xref: /illumos-gate/usr/src/uts/common/fs/nfs/nfs4_vnops.c (revision bea83d026ee1bd1b2a2419e1d0232f107a5d7d9b)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  *	Copyright 1983,1984,1985,1986,1987,1988,1989 AT&T.
28  *	All Rights Reserved
29  */
30 
31 #pragma ident	"%Z%%M%	%I%	%E% SMI"
32 
33 #include <sys/param.h>
34 #include <sys/types.h>
35 #include <sys/systm.h>
36 #include <sys/cred.h>
37 #include <sys/time.h>
38 #include <sys/vnode.h>
39 #include <sys/vfs.h>
40 #include <sys/vfs_opreg.h>
41 #include <sys/file.h>
42 #include <sys/filio.h>
43 #include <sys/uio.h>
44 #include <sys/buf.h>
45 #include <sys/mman.h>
46 #include <sys/pathname.h>
47 #include <sys/dirent.h>
48 #include <sys/debug.h>
49 #include <sys/vmsystm.h>
50 #include <sys/fcntl.h>
51 #include <sys/flock.h>
52 #include <sys/swap.h>
53 #include <sys/errno.h>
54 #include <sys/strsubr.h>
55 #include <sys/sysmacros.h>
56 #include <sys/kmem.h>
57 #include <sys/cmn_err.h>
58 #include <sys/pathconf.h>
59 #include <sys/utsname.h>
60 #include <sys/dnlc.h>
61 #include <sys/acl.h>
62 #include <sys/systeminfo.h>
63 #include <sys/policy.h>
64 #include <sys/sdt.h>
65 #include <sys/list.h>
66 #include <sys/stat.h>
67 
68 #include <rpc/types.h>
69 #include <rpc/auth.h>
70 #include <rpc/clnt.h>
71 
72 #include <nfs/nfs.h>
73 #include <nfs/nfs_clnt.h>
74 #include <nfs/nfs_acl.h>
75 #include <nfs/lm.h>
76 #include <nfs/nfs4.h>
77 #include <nfs/nfs4_kprot.h>
78 #include <nfs/rnode4.h>
79 #include <nfs/nfs4_clnt.h>
80 
81 #include <vm/hat.h>
82 #include <vm/as.h>
83 #include <vm/page.h>
84 #include <vm/pvn.h>
85 #include <vm/seg.h>
86 #include <vm/seg_map.h>
87 #include <vm/seg_kpm.h>
88 #include <vm/seg_vn.h>
89 
90 #include <fs/fs_subr.h>
91 
92 #include <sys/ddi.h>
93 #include <sys/int_fmtio.h>
94 
95 typedef struct {
96 	nfs4_ga_res_t	*di_garp;
97 	cred_t		*di_cred;
98 	hrtime_t	di_time_call;
99 } dirattr_info_t;
100 
101 typedef enum nfs4_acl_op {
102 	NFS4_ACL_GET,
103 	NFS4_ACL_SET
104 } nfs4_acl_op_t;
105 
106 static struct lm_sysid *nfs4_find_sysid(mntinfo4_t *mi);
107 
108 static void	nfs4_update_dircaches(change_info4 *, vnode_t *, vnode_t *,
109 			char *, dirattr_info_t *);
110 
111 static void	nfs4close_otw(rnode4_t *, cred_t *, nfs4_open_owner_t *,
112 		    nfs4_open_stream_t *, int *, int *, nfs4_close_type_t,
113 		    nfs4_error_t *, int *);
114 static int	nfs4_rdwrlbn(vnode_t *, page_t *, u_offset_t, size_t, int,
115 			cred_t *);
116 static int	nfs4write(vnode_t *, caddr_t, u_offset_t, int, cred_t *,
117 			stable_how4 *);
118 static int	nfs4read(vnode_t *, caddr_t, offset_t, int, size_t *,
119 			cred_t *, bool_t, struct uio *);
120 static int	nfs4setattr(vnode_t *, struct vattr *, int, cred_t *,
121 			vsecattr_t *);
122 static int	nfs4openattr(vnode_t *, vnode_t **, int, cred_t *);
123 static int	nfs4lookup(vnode_t *, char *, vnode_t **, cred_t *, int);
124 static int	nfs4lookup_xattr(vnode_t *, char *, vnode_t **, int, cred_t *);
125 static int	nfs4lookupvalidate_otw(vnode_t *, char *, vnode_t **, cred_t *);
126 static int	nfs4lookupnew_otw(vnode_t *, char *, vnode_t **, cred_t *);
127 static int	nfs4mknod(vnode_t *, char *, struct vattr *, enum vcexcl,
128 			int, vnode_t **, cred_t *);
129 static int	nfs4open_otw(vnode_t *, char *, struct vattr *, vnode_t **,
130 			cred_t *, int, int, enum createmode4, int);
131 static int	nfs4rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
132 			caller_context_t *);
133 static int	nfs4rename_persistent_fh(vnode_t *, char *, vnode_t *,
134 			vnode_t *, char *, cred_t *, nfsstat4 *);
135 static int	nfs4rename_volatile_fh(vnode_t *, char *, vnode_t *,
136 			vnode_t *, char *, cred_t *, nfsstat4 *);
137 static int	do_nfs4readdir(vnode_t *, rddir4_cache *, cred_t *);
138 static void	nfs4readdir(vnode_t *, rddir4_cache *, cred_t *);
139 static int	nfs4_bio(struct buf *, stable_how4 *, cred_t *, bool_t);
140 static int	nfs4_getapage(vnode_t *, u_offset_t, size_t, uint_t *,
141 			page_t *[], size_t, struct seg *, caddr_t,
142 			enum seg_rw, cred_t *);
143 static void	nfs4_readahead(vnode_t *, u_offset_t, caddr_t, struct seg *,
144 			cred_t *);
145 static int	nfs4_sync_putapage(vnode_t *, page_t *, u_offset_t, size_t,
146 			int, cred_t *);
147 static int	nfs4_sync_pageio(vnode_t *, page_t *, u_offset_t, size_t,
148 			int, cred_t *);
149 static int	nfs4_commit(vnode_t *, offset4, count4, cred_t *);
150 static void	nfs4_set_mod(vnode_t *);
151 static void	nfs4_get_commit(vnode_t *);
152 static void	nfs4_get_commit_range(vnode_t *, u_offset_t, size_t);
153 static int	nfs4_putpage_commit(vnode_t *, offset_t, size_t, cred_t *);
154 static int	nfs4_commit_vp(vnode_t *, u_offset_t, size_t, cred_t *, int);
155 static int	nfs4_sync_commit(vnode_t *, page_t *, offset3, count3,
156 			cred_t *);
157 static void	do_nfs4_async_commit(vnode_t *, page_t *, offset3, count3,
158 			cred_t *);
159 static int	nfs4_update_attrcache(nfsstat4, nfs4_ga_res_t *,
160 			hrtime_t, vnode_t *, cred_t *);
161 static int	nfs4_open_non_reg_file(vnode_t **, int, cred_t *);
162 static int	nfs4_safelock(vnode_t *, const struct flock64 *, cred_t *);
163 static void	nfs4_register_lock_locally(vnode_t *, struct flock64 *, int,
164 			u_offset_t);
165 static int 	nfs4_lockrelease(vnode_t *, int, offset_t, cred_t *);
166 static int	nfs4_block_and_wait(clock_t *, rnode4_t *);
167 static cred_t  *state_to_cred(nfs4_open_stream_t *);
168 static int	vtoname(vnode_t *, char *, ssize_t);
169 static void	denied_to_flk(LOCK4denied *, flock64_t *, LOCKT4args *);
170 static pid_t	lo_to_pid(lock_owner4 *);
171 static void	nfs4_reinstitute_local_lock_state(vnode_t *, flock64_t *,
172 			cred_t *, nfs4_lock_owner_t *);
173 static void	push_reinstate(vnode_t *, int, flock64_t *, cred_t *,
174 			nfs4_lock_owner_t *);
175 static int 	open_and_get_osp(vnode_t *, cred_t *, nfs4_open_stream_t **);
176 static void	nfs4_delmap_callback(struct as *, void *, uint_t);
177 static void	nfs4_free_delmapcall(nfs4_delmapcall_t *);
178 static nfs4_delmapcall_t	*nfs4_init_delmapcall();
179 static int	nfs4_find_and_delete_delmapcall(rnode4_t *, int *);
180 static int	nfs4_is_acl_mask_valid(uint_t, nfs4_acl_op_t);
181 static int	nfs4_create_getsecattr_return(vsecattr_t *, vsecattr_t *,
182 			uid_t, gid_t, int);
183 
184 /*
185  * Routines that implement the setting of v4 args for the misc. ops
186  */
187 static void	nfs4args_lock_free(nfs_argop4 *);
188 static void	nfs4args_lockt_free(nfs_argop4 *);
189 static void	nfs4args_setattr(nfs_argop4 *, vattr_t *, vsecattr_t *,
190 			int, rnode4_t *, cred_t *, bitmap4, int *,
191 			nfs4_stateid_types_t *);
192 static void	nfs4args_setattr_free(nfs_argop4 *);
193 static int	nfs4args_verify(nfs_argop4 *, vattr_t *, enum nfs_opnum4,
194 			bitmap4);
195 static void	nfs4args_verify_free(nfs_argop4 *);
196 static void	nfs4args_write(nfs_argop4 *, stable_how4, rnode4_t *, cred_t *,
197 			WRITE4args **, nfs4_stateid_types_t *);
198 
199 /*
200  * These are the vnode ops functions that implement the vnode interface to
201  * the networked file system.  See more comments below at nfs4_vnodeops.
202  */
203 static int	nfs4_open(vnode_t **, int, cred_t *, caller_context_t *);
204 static int	nfs4_close(vnode_t *, int, int, offset_t, cred_t *,
205 			caller_context_t *);
206 static int	nfs4_read(vnode_t *, struct uio *, int, cred_t *,
207 			caller_context_t *);
208 static int	nfs4_write(vnode_t *, struct uio *, int, cred_t *,
209 			caller_context_t *);
210 static int	nfs4_ioctl(vnode_t *, int, intptr_t, int, cred_t *, int *,
211 			caller_context_t *);
212 static int	nfs4_setattr(vnode_t *, struct vattr *, int, cred_t *,
213 			caller_context_t *);
214 static int	nfs4_access(vnode_t *, int, int, cred_t *, caller_context_t *);
215 static int	nfs4_readlink(vnode_t *, struct uio *, cred_t *,
216 			caller_context_t *);
217 static int	nfs4_fsync(vnode_t *, int, cred_t *, caller_context_t *);
218 static int	nfs4_create(vnode_t *, char *, struct vattr *, enum vcexcl,
219 			int, vnode_t **, cred_t *, int, caller_context_t *,
220 			vsecattr_t *);
221 static int	nfs4_remove(vnode_t *, char *, cred_t *, caller_context_t *,
222 			int);
223 static int	nfs4_link(vnode_t *, vnode_t *, char *, cred_t *,
224 			caller_context_t *, int);
225 static int	nfs4_rename(vnode_t *, char *, vnode_t *, char *, cred_t *,
226 			caller_context_t *, int);
227 static int	nfs4_mkdir(vnode_t *, char *, struct vattr *, vnode_t **,
228 			cred_t *, caller_context_t *, int, vsecattr_t *);
229 static int	nfs4_rmdir(vnode_t *, char *, vnode_t *, cred_t *,
230 			caller_context_t *, int);
231 static int	nfs4_symlink(vnode_t *, char *, struct vattr *, char *,
232 			cred_t *, caller_context_t *, int);
233 static int	nfs4_readdir(vnode_t *, struct uio *, cred_t *, int *,
234 			caller_context_t *, int);
235 static int	nfs4_seek(vnode_t *, offset_t, offset_t *, caller_context_t *);
236 static int	nfs4_getpage(vnode_t *, offset_t, size_t, uint_t *,
237 			page_t *[], size_t, struct seg *, caddr_t,
238 			enum seg_rw, cred_t *, caller_context_t *);
239 static int	nfs4_putpage(vnode_t *, offset_t, size_t, int, cred_t *,
240 			caller_context_t *);
241 static int	nfs4_map(vnode_t *, offset_t, struct as *, caddr_t *, size_t,
242 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
243 static int	nfs4_addmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
244 			uchar_t, uchar_t, uint_t, cred_t *, caller_context_t *);
245 static int	nfs4_cmp(vnode_t *, vnode_t *, caller_context_t *);
246 static int	nfs4_frlock(vnode_t *, int, struct flock64 *, int, offset_t,
247 			struct flk_callback *, cred_t *, caller_context_t *);
248 static int	nfs4_space(vnode_t *, int, struct flock64 *, int, offset_t,
249 			cred_t *, caller_context_t *);
250 static int	nfs4_delmap(vnode_t *, offset_t, struct as *, caddr_t, size_t,
251 			uint_t, uint_t, uint_t, cred_t *, caller_context_t *);
252 static int	nfs4_pageio(vnode_t *, page_t *, u_offset_t, size_t, int,
253 			cred_t *, caller_context_t *);
254 static void	nfs4_dispose(vnode_t *, page_t *, int, int, cred_t *,
255 			caller_context_t *);
256 static int	nfs4_setsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
257 			caller_context_t *);
258 /*
259  * These vnode ops are required to be called from outside this source file,
260  * e.g. by ephemeral mount stub vnode ops, and so may not be declared
261  * as static.
262  */
263 int	nfs4_getattr(vnode_t *, struct vattr *, int, cred_t *,
264 	    caller_context_t *);
265 void	nfs4_inactive(vnode_t *, cred_t *, caller_context_t *);
266 int	nfs4_lookup(vnode_t *, char *, vnode_t **,
267 	    struct pathname *, int, vnode_t *, cred_t *,
268 	    caller_context_t *, int *, pathname_t *);
269 int	nfs4_fid(vnode_t *, fid_t *, caller_context_t *);
270 int	nfs4_rwlock(vnode_t *, int, caller_context_t *);
271 void	nfs4_rwunlock(vnode_t *, int, caller_context_t *);
272 int	nfs4_realvp(vnode_t *, vnode_t **, caller_context_t *);
273 int	nfs4_pathconf(vnode_t *, int, ulong_t *, cred_t *,
274 	    caller_context_t *);
275 int	nfs4_getsecattr(vnode_t *, vsecattr_t *, int, cred_t *,
276 	    caller_context_t *);
277 int	nfs4_shrlock(vnode_t *, int, struct shrlock *, int, cred_t *,
278 	    caller_context_t *);
279 
280 /*
281  * Used for nfs4_commit_vp() to indicate if we should
282  * wait on pending writes.
283  */
284 #define	NFS4_WRITE_NOWAIT	0
285 #define	NFS4_WRITE_WAIT		1
286 
287 #define	NFS4_BASE_WAIT_TIME 1	/* 1 second */
288 
289 /*
290  * Error flags used to pass information about certain special errors
291  * which need to be handled specially.
292  */
293 #define	NFS_EOF			-98
294 #define	NFS_VERF_MISMATCH	-97
295 
296 /*
297  * Flags used to differentiate between which operation drove the
298  * potential CLOSE OTW. (see nfs4_close_otw_if_necessary)
299  */
300 #define	NFS4_CLOSE_OP		0x1
301 #define	NFS4_DELMAP_OP		0x2
302 #define	NFS4_INACTIVE_OP	0x3
303 
304 #define	ISVDEV(t) ((t == VBLK) || (t == VCHR) || (t == VFIFO))
305 
306 /* ALIGN64 aligns the given buffer and adjust buffer size to 64 bit */
307 #define	ALIGN64(x, ptr, sz)						\
308 	x = ((uintptr_t)(ptr)) & (sizeof (uint64_t) - 1);		\
309 	if (x) {							\
310 		x = sizeof (uint64_t) - (x);				\
311 		sz -= (x);						\
312 		ptr += (x);						\
313 	}
314 
315 #ifdef DEBUG
316 int nfs4_client_attr_debug = 0;
317 int nfs4_client_state_debug = 0;
318 int nfs4_client_shadow_debug = 0;
319 int nfs4_client_lock_debug = 0;
320 int nfs4_seqid_sync = 0;
321 int nfs4_client_map_debug = 0;
322 static int nfs4_pageio_debug = 0;
323 int nfs4_client_inactive_debug = 0;
324 int nfs4_client_recov_debug = 0;
325 int nfs4_client_failover_debug = 0;
326 int nfs4_client_call_debug = 0;
327 int nfs4_client_lookup_debug = 0;
328 int nfs4_client_zone_debug = 0;
329 int nfs4_lost_rqst_debug = 0;
330 int nfs4_rdattrerr_debug = 0;
331 int nfs4_open_stream_debug = 0;
332 
333 int nfs4read_error_inject;
334 
335 static int nfs4_create_misses = 0;
336 
337 static int nfs4_readdir_cache_shorts = 0;
338 static int nfs4_readdir_readahead = 0;
339 
340 static int nfs4_bio_do_stop = 0;
341 
342 static int nfs4_lostpage = 0;	/* number of times we lost original page */
343 
344 int nfs4_mmap_debug = 0;
345 
346 static int nfs4_pathconf_cache_hits = 0;
347 static int nfs4_pathconf_cache_misses = 0;
348 
349 int nfs4close_all_cnt;
350 int nfs4close_one_debug = 0;
351 int nfs4close_notw_debug = 0;
352 
353 int denied_to_flk_debug = 0;
354 void *lockt_denied_debug;
355 
356 #endif
357 
358 /*
359  * How long to wait before trying again if OPEN_CONFIRM gets ETIMEDOUT
360  * or NFS4ERR_RESOURCE.
361  */
362 static int confirm_retry_sec = 30;
363 
364 static int nfs4_lookup_neg_cache = 1;
365 
366 /*
367  * number of pages to read ahead
368  * optimized for 100 base-T.
369  */
370 static int nfs4_nra = 4;
371 
372 static int nfs4_do_symlink_cache = 1;
373 
374 static int nfs4_pathconf_disable_cache = 0;
375 
376 /*
377  * These are the vnode ops routines which implement the vnode interface to
378  * the networked file system.  These routines just take their parameters,
379  * make them look networkish by putting the right info into interface structs,
380  * and then calling the appropriate remote routine(s) to do the work.
381  *
382  * Note on directory name lookup cacheing:  If we detect a stale fhandle,
383  * we purge the directory cache relative to that vnode.  This way, the
384  * user won't get burned by the cache repeatedly.  See <nfs/rnode4.h> for
385  * more details on rnode locking.
386  */
387 
388 struct vnodeops *nfs4_vnodeops;
389 
390 const fs_operation_def_t nfs4_vnodeops_template[] = {
391 	VOPNAME_OPEN,		{ .vop_open = nfs4_open },
392 	VOPNAME_CLOSE,		{ .vop_close = nfs4_close },
393 	VOPNAME_READ,		{ .vop_read = nfs4_read },
394 	VOPNAME_WRITE,		{ .vop_write = nfs4_write },
395 	VOPNAME_IOCTL,		{ .vop_ioctl = nfs4_ioctl },
396 	VOPNAME_GETATTR,	{ .vop_getattr = nfs4_getattr },
397 	VOPNAME_SETATTR,	{ .vop_setattr = nfs4_setattr },
398 	VOPNAME_ACCESS,		{ .vop_access = nfs4_access },
399 	VOPNAME_LOOKUP,		{ .vop_lookup = nfs4_lookup },
400 	VOPNAME_CREATE,		{ .vop_create = nfs4_create },
401 	VOPNAME_REMOVE,		{ .vop_remove = nfs4_remove },
402 	VOPNAME_LINK,		{ .vop_link = nfs4_link },
403 	VOPNAME_RENAME,		{ .vop_rename = nfs4_rename },
404 	VOPNAME_MKDIR,		{ .vop_mkdir = nfs4_mkdir },
405 	VOPNAME_RMDIR,		{ .vop_rmdir = nfs4_rmdir },
406 	VOPNAME_READDIR,	{ .vop_readdir = nfs4_readdir },
407 	VOPNAME_SYMLINK,	{ .vop_symlink = nfs4_symlink },
408 	VOPNAME_READLINK,	{ .vop_readlink = nfs4_readlink },
409 	VOPNAME_FSYNC,		{ .vop_fsync = nfs4_fsync },
410 	VOPNAME_INACTIVE,	{ .vop_inactive = nfs4_inactive },
411 	VOPNAME_FID,		{ .vop_fid = nfs4_fid },
412 	VOPNAME_RWLOCK,		{ .vop_rwlock = nfs4_rwlock },
413 	VOPNAME_RWUNLOCK,	{ .vop_rwunlock = nfs4_rwunlock },
414 	VOPNAME_SEEK,		{ .vop_seek = nfs4_seek },
415 	VOPNAME_FRLOCK,		{ .vop_frlock = nfs4_frlock },
416 	VOPNAME_SPACE,		{ .vop_space = nfs4_space },
417 	VOPNAME_REALVP,		{ .vop_realvp = nfs4_realvp },
418 	VOPNAME_GETPAGE,	{ .vop_getpage = nfs4_getpage },
419 	VOPNAME_PUTPAGE,	{ .vop_putpage = nfs4_putpage },
420 	VOPNAME_MAP,		{ .vop_map = nfs4_map },
421 	VOPNAME_ADDMAP,		{ .vop_addmap = nfs4_addmap },
422 	VOPNAME_DELMAP,		{ .vop_delmap = nfs4_delmap },
423 	/* no separate nfs4_dump */
424 	VOPNAME_DUMP,		{ .vop_dump = nfs_dump },
425 	VOPNAME_PATHCONF,	{ .vop_pathconf = nfs4_pathconf },
426 	VOPNAME_PAGEIO,		{ .vop_pageio = nfs4_pageio },
427 	VOPNAME_DISPOSE,	{ .vop_dispose = nfs4_dispose },
428 	VOPNAME_SETSECATTR,	{ .vop_setsecattr = nfs4_setsecattr },
429 	VOPNAME_GETSECATTR,	{ .vop_getsecattr = nfs4_getsecattr },
430 	VOPNAME_SHRLOCK,	{ .vop_shrlock = nfs4_shrlock },
431 	VOPNAME_VNEVENT, 	{ .vop_vnevent = fs_vnevent_support },
432 	NULL,			NULL
433 };
434 
435 /*
436  * The following are subroutines and definitions to set args or get res
437  * for the different nfsv4 ops
438  */
439 
440 void
441 nfs4args_lookup_free(nfs_argop4 *argop, int arglen)
442 {
443 	int		i;
444 
445 	for (i = 0; i < arglen; i++) {
446 		if (argop[i].argop == OP_LOOKUP) {
447 			kmem_free(
448 			    argop[i].nfs_argop4_u.oplookup.
449 			    objname.utf8string_val,
450 			    argop[i].nfs_argop4_u.oplookup.
451 			    objname.utf8string_len);
452 		}
453 	}
454 }
455 
456 static void
457 nfs4args_lock_free(nfs_argop4 *argop)
458 {
459 	locker4 *locker = &argop->nfs_argop4_u.oplock.locker;
460 
461 	if (locker->new_lock_owner == TRUE) {
462 		open_to_lock_owner4 *open_owner;
463 
464 		open_owner = &locker->locker4_u.open_owner;
465 		if (open_owner->lock_owner.owner_val != NULL) {
466 			kmem_free(open_owner->lock_owner.owner_val,
467 			    open_owner->lock_owner.owner_len);
468 		}
469 	}
470 }
471 
472 static void
473 nfs4args_lockt_free(nfs_argop4 *argop)
474 {
475 	lock_owner4 *lowner = &argop->nfs_argop4_u.oplockt.owner;
476 
477 	if (lowner->owner_val != NULL) {
478 		kmem_free(lowner->owner_val, lowner->owner_len);
479 	}
480 }
481 
482 static void
483 nfs4args_setattr(nfs_argop4 *argop, vattr_t *vap, vsecattr_t *vsap, int flags,
484     rnode4_t *rp, cred_t *cr, bitmap4 supp, int *error,
485     nfs4_stateid_types_t *sid_types)
486 {
487 	fattr4		*attr = &argop->nfs_argop4_u.opsetattr.obj_attributes;
488 	mntinfo4_t	*mi;
489 
490 	argop->argop = OP_SETATTR;
491 	/*
492 	 * The stateid is set to 0 if client is not modifying the size
493 	 * and otherwise to whatever nfs4_get_stateid() returns.
494 	 *
495 	 * XXX Note: nfs4_get_stateid() returns 0 if no lockowner and/or no
496 	 * state struct could be found for the process/file pair.  We may
497 	 * want to change this in the future (by OPENing the file).  See
498 	 * bug # 4474852.
499 	 */
500 	if (vap->va_mask & AT_SIZE) {
501 
502 		ASSERT(rp != NULL);
503 		mi = VTOMI4(RTOV4(rp));
504 
505 		argop->nfs_argop4_u.opsetattr.stateid =
506 		    nfs4_get_stateid(cr, rp, curproc->p_pidp->pid_id, mi,
507 		    OP_SETATTR, sid_types, FALSE);
508 	} else {
509 		bzero(&argop->nfs_argop4_u.opsetattr.stateid,
510 		    sizeof (stateid4));
511 	}
512 
513 	*error = vattr_to_fattr4(vap, vsap, attr, flags, OP_SETATTR, supp);
514 	if (*error)
515 		bzero(attr, sizeof (*attr));
516 }
517 
518 static void
519 nfs4args_setattr_free(nfs_argop4 *argop)
520 {
521 	nfs4_fattr4_free(&argop->nfs_argop4_u.opsetattr.obj_attributes);
522 }
523 
524 static int
525 nfs4args_verify(nfs_argop4 *argop, vattr_t *vap, enum nfs_opnum4 op,
526     bitmap4 supp)
527 {
528 	fattr4 *attr;
529 	int error = 0;
530 
531 	argop->argop = op;
532 	switch (op) {
533 	case OP_VERIFY:
534 		attr = &argop->nfs_argop4_u.opverify.obj_attributes;
535 		break;
536 	case OP_NVERIFY:
537 		attr = &argop->nfs_argop4_u.opnverify.obj_attributes;
538 		break;
539 	default:
540 		return (EINVAL);
541 	}
542 	if (!error)
543 		error = vattr_to_fattr4(vap, NULL, attr, 0, op, supp);
544 	if (error)
545 		bzero(attr, sizeof (*attr));
546 	return (error);
547 }
548 
549 static void
550 nfs4args_verify_free(nfs_argop4 *argop)
551 {
552 	switch (argop->argop) {
553 	case OP_VERIFY:
554 		nfs4_fattr4_free(&argop->nfs_argop4_u.opverify.obj_attributes);
555 		break;
556 	case OP_NVERIFY:
557 		nfs4_fattr4_free(&argop->nfs_argop4_u.opnverify.obj_attributes);
558 		break;
559 	default:
560 		break;
561 	}
562 }
563 
564 static void
565 nfs4args_write(nfs_argop4 *argop, stable_how4 stable, rnode4_t *rp, cred_t *cr,
566     WRITE4args **wargs_pp, nfs4_stateid_types_t *sid_tp)
567 {
568 	WRITE4args *wargs = &argop->nfs_argop4_u.opwrite;
569 	mntinfo4_t *mi = VTOMI4(RTOV4(rp));
570 
571 	argop->argop = OP_WRITE;
572 	wargs->stable = stable;
573 	wargs->stateid = nfs4_get_w_stateid(cr, rp, curproc->p_pidp->pid_id,
574 	    mi, OP_WRITE, sid_tp);
575 	wargs->mblk = NULL;
576 	*wargs_pp = wargs;
577 }
578 
579 void
580 nfs4args_copen_free(OPEN4cargs *open_args)
581 {
582 	if (open_args->owner.owner_val) {
583 		kmem_free(open_args->owner.owner_val,
584 		    open_args->owner.owner_len);
585 	}
586 	if ((open_args->opentype == OPEN4_CREATE) &&
587 	    (open_args->mode != EXCLUSIVE4)) {
588 		nfs4_fattr4_free(&open_args->createhow4_u.createattrs);
589 	}
590 }
591 
592 /*
593  * XXX:  This is referenced in modstubs.s
594  */
595 struct vnodeops *
596 nfs4_getvnodeops(void)
597 {
598 	return (nfs4_vnodeops);
599 }
600 
601 /*
602  * The OPEN operation opens a regular file.
603  */
604 /*ARGSUSED3*/
605 static int
606 nfs4_open(vnode_t **vpp, int flag, cred_t *cr, caller_context_t *ct)
607 {
608 	vnode_t *dvp = NULL;
609 	rnode4_t *rp, *drp;
610 	int error;
611 	int just_been_created;
612 	char fn[MAXNAMELEN];
613 
614 	NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4_open: "));
615 	if (nfs_zone() != VTOMI4(*vpp)->mi_zone)
616 		return (EIO);
617 	rp = VTOR4(*vpp);
618 
619 	/*
620 	 * Check to see if opening something besides a regular file;
621 	 * if so skip the OTW call
622 	 */
623 	if ((*vpp)->v_type != VREG) {
624 		error = nfs4_open_non_reg_file(vpp, flag, cr);
625 		return (error);
626 	}
627 
628 	/*
629 	 * XXX - would like a check right here to know if the file is
630 	 * executable or not, so as to skip OTW
631 	 */
632 
633 	if ((error = vtodv(*vpp, &dvp, cr, TRUE)) != 0)
634 		return (error);
635 
636 	drp = VTOR4(dvp);
637 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp)))
638 		return (EINTR);
639 
640 	if ((error = vtoname(*vpp, fn, MAXNAMELEN)) != 0) {
641 		nfs_rw_exit(&drp->r_rwlock);
642 		return (error);
643 	}
644 
645 	/*
646 	 * See if this file has just been CREATEd.
647 	 * If so, clear the flag and update the dnlc, which was previously
648 	 * skipped in nfs4_create.
649 	 * XXX need better serilization on this.
650 	 * XXX move this into the nf4open_otw call, after we have
651 	 * XXX acquired the open owner seqid sync.
652 	 */
653 	mutex_enter(&rp->r_statev4_lock);
654 	if (rp->created_v4) {
655 		rp->created_v4 = 0;
656 		mutex_exit(&rp->r_statev4_lock);
657 
658 		dnlc_update(dvp, fn, *vpp);
659 		/* This is needed so we don't bump the open ref count */
660 		just_been_created = 1;
661 	} else {
662 		mutex_exit(&rp->r_statev4_lock);
663 		just_been_created = 0;
664 	}
665 
666 	/*
667 	 * If caller specified O_TRUNC/FTRUNC, then be sure to set
668 	 * FWRITE (to drive successful setattr(size=0) after open)
669 	 */
670 	if (flag & FTRUNC)
671 		flag |= FWRITE;
672 
673 	error = nfs4open_otw(dvp, fn, NULL, vpp, cr, 0, flag, 0,
674 	    just_been_created);
675 
676 	if (!error && !((*vpp)->v_flag & VROOT))
677 		dnlc_update(dvp, fn, *vpp);
678 
679 	nfs_rw_exit(&drp->r_rwlock);
680 
681 	/* release the hold from vtodv */
682 	VN_RELE(dvp);
683 
684 	/* exchange the shadow for the master vnode, if needed */
685 
686 	if (error == 0 && IS_SHADOW(*vpp, rp))
687 		sv_exchange(vpp);
688 
689 	return (error);
690 }
691 
692 /*
693  * See if there's a "lost open" request to be saved and recovered.
694  */
695 static void
696 nfs4open_save_lost_rqst(int error, nfs4_lost_rqst_t *lost_rqstp,
697     nfs4_open_owner_t *oop, cred_t *cr, vnode_t *vp,
698     vnode_t *dvp, OPEN4cargs *open_args)
699 {
700 	vfs_t *vfsp;
701 	char *srccfp;
702 
703 	vfsp = (dvp ? dvp->v_vfsp : vp->v_vfsp);
704 
705 	if (error != ETIMEDOUT && error != EINTR &&
706 	    !NFS4_FRC_UNMT_ERR(error, vfsp)) {
707 		lost_rqstp->lr_op = 0;
708 		return;
709 	}
710 
711 	NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
712 	    "nfs4open_save_lost_rqst: error %d", error));
713 
714 	lost_rqstp->lr_op = OP_OPEN;
715 
716 	/*
717 	 * The vp (if it is not NULL) and dvp are held and rele'd via
718 	 * the recovery code.  See nfs4_save_lost_rqst.
719 	 */
720 	lost_rqstp->lr_vp = vp;
721 	lost_rqstp->lr_dvp = dvp;
722 	lost_rqstp->lr_oop = oop;
723 	lost_rqstp->lr_osp = NULL;
724 	lost_rqstp->lr_lop = NULL;
725 	lost_rqstp->lr_cr = cr;
726 	lost_rqstp->lr_flk = NULL;
727 	lost_rqstp->lr_oacc = open_args->share_access;
728 	lost_rqstp->lr_odeny = open_args->share_deny;
729 	lost_rqstp->lr_oclaim = open_args->claim;
730 	if (open_args->claim == CLAIM_DELEGATE_CUR) {
731 		lost_rqstp->lr_ostateid =
732 		    open_args->open_claim4_u.delegate_cur_info.delegate_stateid;
733 		srccfp = open_args->open_claim4_u.delegate_cur_info.cfile;
734 	} else {
735 		srccfp = open_args->open_claim4_u.cfile;
736 	}
737 	lost_rqstp->lr_ofile.utf8string_len = 0;
738 	lost_rqstp->lr_ofile.utf8string_val = NULL;
739 	(void) str_to_utf8(srccfp, &lost_rqstp->lr_ofile);
740 	lost_rqstp->lr_putfirst = FALSE;
741 }
742 
743 struct nfs4_excl_time {
744 	uint32 seconds;
745 	uint32 nseconds;
746 };
747 
748 /*
749  * The OPEN operation creates and/or opens a regular file
750  *
751  * ARGSUSED
752  */
753 static int
754 nfs4open_otw(vnode_t *dvp, char *file_name, struct vattr *in_va,
755     vnode_t **vpp, cred_t *cr, int create_flag, int open_flag,
756     enum createmode4 createmode, int file_just_been_created)
757 {
758 	rnode4_t *rp;
759 	rnode4_t *drp = VTOR4(dvp);
760 	vnode_t *vp = NULL;
761 	vnode_t *vpi = *vpp;
762 	bool_t needrecov = FALSE;
763 
764 	int doqueue = 1;
765 
766 	COMPOUND4args_clnt args;
767 	COMPOUND4res_clnt res;
768 	nfs_argop4 *argop;
769 	nfs_resop4 *resop;
770 	int argoplist_size;
771 	int idx_open, idx_fattr;
772 
773 	GETFH4res *gf_res = NULL;
774 	OPEN4res *op_res = NULL;
775 	nfs4_ga_res_t *garp;
776 	fattr4 *attr = NULL;
777 	struct nfs4_excl_time verf;
778 	bool_t did_excl_setup = FALSE;
779 	int created_osp;
780 
781 	OPEN4cargs *open_args;
782 	nfs4_open_owner_t	*oop = NULL;
783 	nfs4_open_stream_t	*osp = NULL;
784 	seqid4 seqid = 0;
785 	bool_t retry_open = FALSE;
786 	nfs4_recov_state_t recov_state;
787 	nfs4_lost_rqst_t lost_rqst;
788 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
789 	hrtime_t t;
790 	int acc = 0;
791 	cred_t *cred_otw = NULL;	/* cred used to do the RPC call */
792 	cred_t *ncr = NULL;
793 
794 	nfs4_sharedfh_t *otw_sfh;
795 	nfs4_sharedfh_t *orig_sfh;
796 	int fh_differs = 0;
797 	int numops, setgid_flag;
798 	int num_bseqid_retry = NFS4_NUM_RETRY_BAD_SEQID + 1;
799 
800 	/*
801 	 * Make sure we properly deal with setting the right gid on
802 	 * a newly created file to reflect the parent's setgid bit
803 	 */
804 	setgid_flag = 0;
805 	if (create_flag && in_va) {
806 
807 		/*
808 		 * If the parent's directory has the setgid bit set
809 		 * _and_ the client was able to get a valid mapping
810 		 * for the parent dir's owner_group, we want to
811 		 * append NVERIFY(owner_group == dva.va_gid) and
812 		 * SETATTR to the CREATE compound.
813 		 */
814 		mutex_enter(&drp->r_statelock);
815 		if (drp->r_attr.va_mode & VSGID &&
816 		    drp->r_attr.va_gid != GID_NOBODY) {
817 			in_va->va_gid = drp->r_attr.va_gid;
818 			setgid_flag = 1;
819 		}
820 		mutex_exit(&drp->r_statelock);
821 	}
822 
823 	/*
824 	 * Normal/non-create compound:
825 	 * PUTFH(dfh) + OPEN(create) + GETFH + GETATTR(new)
826 	 *
827 	 * Open(create) compound no setgid:
828 	 * PUTFH(dfh) + SAVEFH + OPEN(create) + GETFH + GETATTR(new) +
829 	 * RESTOREFH + GETATTR
830 	 *
831 	 * Open(create) setgid:
832 	 * PUTFH(dfh) + OPEN(create) + GETFH + GETATTR(new) +
833 	 * SAVEFH + PUTFH(dfh) + GETATTR(dvp) + RESTOREFH +
834 	 * NVERIFY(grp) + SETATTR
835 	 */
836 	if (setgid_flag) {
837 		numops = 10;
838 		idx_open = 1;
839 		idx_fattr = 3;
840 	} else if (create_flag) {
841 		numops = 7;
842 		idx_open = 2;
843 		idx_fattr = 4;
844 	} else {
845 		numops = 4;
846 		idx_open = 1;
847 		idx_fattr = 3;
848 	}
849 
850 	args.array_len = numops;
851 	argoplist_size = numops * sizeof (nfs_argop4);
852 	argop = kmem_alloc(argoplist_size, KM_SLEEP);
853 
854 	NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4open_otw: "
855 	    "open %s open flag 0x%x cred %p", file_name, open_flag,
856 	    (void *)cr));
857 
858 	ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
859 	if (create_flag) {
860 		/*
861 		 * We are to create a file.  Initialize the passed in vnode
862 		 * pointer.
863 		 */
864 		vpi = NULL;
865 	} else {
866 		/*
867 		 * Check to see if the client owns a read delegation and is
868 		 * trying to open for write.  If so, then return the delegation
869 		 * to avoid the server doing a cb_recall and returning DELAY.
870 		 * NB - we don't use the statev4_lock here because we'd have
871 		 * to drop the lock anyway and the result would be stale.
872 		 */
873 		if ((open_flag & FWRITE) &&
874 		    VTOR4(vpi)->r_deleg_type == OPEN_DELEGATE_READ)
875 			(void) nfs4delegreturn(VTOR4(vpi), NFS4_DR_REOPEN);
876 
877 		/*
878 		 * If the file has a delegation, then do an access check up
879 		 * front.  This avoids having to an access check later after
880 		 * we've already done start_op, which could deadlock.
881 		 */
882 		if (VTOR4(vpi)->r_deleg_type != OPEN_DELEGATE_NONE) {
883 			if (open_flag & FREAD &&
884 			    nfs4_access(vpi, VREAD, 0, cr, NULL) == 0)
885 				acc |= VREAD;
886 			if (open_flag & FWRITE &&
887 			    nfs4_access(vpi, VWRITE, 0, cr, NULL) == 0)
888 				acc |= VWRITE;
889 		}
890 	}
891 
892 	drp = VTOR4(dvp);
893 
894 	recov_state.rs_flags = 0;
895 	recov_state.rs_num_retry_despite_err = 0;
896 	cred_otw = cr;
897 
898 recov_retry:
899 	fh_differs = 0;
900 	nfs4_error_zinit(&e);
901 
902 	e.error = nfs4_start_op(VTOMI4(dvp), dvp, vpi, &recov_state);
903 	if (e.error) {
904 		if (ncr != NULL)
905 			crfree(ncr);
906 		kmem_free(argop, argoplist_size);
907 		return (e.error);
908 	}
909 
910 	args.ctag = TAG_OPEN;
911 	args.array_len = numops;
912 	args.array = argop;
913 
914 	/* putfh directory fh */
915 	argop[0].argop = OP_CPUTFH;
916 	argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
917 
918 	/* OPEN: either op 1 or op 2 depending upon create/setgid flags */
919 	argop[idx_open].argop = OP_COPEN;
920 	open_args = &argop[idx_open].nfs_argop4_u.opcopen;
921 	open_args->claim = CLAIM_NULL;
922 
923 	/* name of file */
924 	open_args->open_claim4_u.cfile = file_name;
925 	open_args->owner.owner_len = 0;
926 	open_args->owner.owner_val = NULL;
927 
928 	if (create_flag) {
929 		/* CREATE a file */
930 		open_args->opentype = OPEN4_CREATE;
931 		open_args->mode = createmode;
932 		if (createmode == EXCLUSIVE4) {
933 			if (did_excl_setup == FALSE) {
934 				verf.seconds = nfs_atoi(hw_serial);
935 				if (verf.seconds != 0)
936 					verf.nseconds = newnum();
937 				else {
938 					timestruc_t now;
939 
940 					gethrestime(&now);
941 					verf.seconds = now.tv_sec;
942 					verf.nseconds = now.tv_nsec;
943 				}
944 				/*
945 				 * Since the server will use this value for the
946 				 * mtime, make sure that it can't overflow. Zero
947 				 * out the MSB. The actual value does not matter
948 				 * here, only its uniqeness.
949 				 */
950 				verf.seconds &= INT32_MAX;
951 				did_excl_setup = TRUE;
952 			}
953 
954 			/* Now copy over verifier to OPEN4args. */
955 			open_args->createhow4_u.createverf = *(uint64_t *)&verf;
956 		} else {
957 			int v_error;
958 			bitmap4 supp_attrs;
959 			servinfo4_t *svp;
960 
961 			attr = &open_args->createhow4_u.createattrs;
962 
963 			svp = drp->r_server;
964 			(void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
965 			supp_attrs = svp->sv_supp_attrs;
966 			nfs_rw_exit(&svp->sv_lock);
967 
968 			/* GUARDED4 or UNCHECKED4 */
969 			v_error = vattr_to_fattr4(in_va, NULL, attr, 0, OP_OPEN,
970 			    supp_attrs);
971 			if (v_error) {
972 				bzero(attr, sizeof (*attr));
973 				nfs4args_copen_free(open_args);
974 				nfs4_end_op(VTOMI4(dvp), dvp, vpi,
975 				    &recov_state, FALSE);
976 				if (ncr != NULL)
977 					crfree(ncr);
978 				kmem_free(argop, argoplist_size);
979 				return (v_error);
980 			}
981 		}
982 	} else {
983 		/* NO CREATE */
984 		open_args->opentype = OPEN4_NOCREATE;
985 	}
986 
987 	if (recov_state.rs_sp != NULL) {
988 		mutex_enter(&recov_state.rs_sp->s_lock);
989 		open_args->owner.clientid = recov_state.rs_sp->clientid;
990 		mutex_exit(&recov_state.rs_sp->s_lock);
991 	} else {
992 		/* XXX should we just fail here? */
993 		open_args->owner.clientid = 0;
994 	}
995 
996 	/*
997 	 * This increments oop's ref count or creates a temporary 'just_created'
998 	 * open owner that will become valid when this OPEN/OPEN_CONFIRM call
999 	 * completes.
1000 	 */
1001 	mutex_enter(&VTOMI4(dvp)->mi_lock);
1002 
1003 	/* See if a permanent or just created open owner exists */
1004 	oop = find_open_owner_nolock(cr, NFS4_JUST_CREATED, VTOMI4(dvp));
1005 	if (!oop) {
1006 		/*
1007 		 * This open owner does not exist so create a temporary
1008 		 * just created one.
1009 		 */
1010 		oop = create_open_owner(cr, VTOMI4(dvp));
1011 		ASSERT(oop != NULL);
1012 	}
1013 	mutex_exit(&VTOMI4(dvp)->mi_lock);
1014 
1015 	/* this length never changes, do alloc before seqid sync */
1016 	open_args->owner.owner_len = sizeof (oop->oo_name);
1017 	open_args->owner.owner_val =
1018 	    kmem_alloc(open_args->owner.owner_len, KM_SLEEP);
1019 
1020 	e.error = nfs4_start_open_seqid_sync(oop, VTOMI4(dvp));
1021 	if (e.error == EAGAIN) {
1022 		open_owner_rele(oop);
1023 		nfs4args_copen_free(open_args);
1024 		nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, TRUE);
1025 		if (ncr != NULL) {
1026 			crfree(ncr);
1027 			ncr = NULL;
1028 		}
1029 		goto recov_retry;
1030 	}
1031 
1032 	/* Check to see if we need to do the OTW call */
1033 	if (!create_flag) {
1034 		if (!nfs4_is_otw_open_necessary(oop, open_flag, vpi,
1035 		    file_just_been_created, &e.error, acc, &recov_state)) {
1036 
1037 			/*
1038 			 * The OTW open is not necessary.  Either
1039 			 * the open can succeed without it (eg.
1040 			 * delegation, error == 0) or the open
1041 			 * must fail due to an access failure
1042 			 * (error != 0).  In either case, tidy
1043 			 * up and return.
1044 			 */
1045 
1046 			nfs4_end_open_seqid_sync(oop);
1047 			open_owner_rele(oop);
1048 			nfs4args_copen_free(open_args);
1049 			nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, FALSE);
1050 			if (ncr != NULL)
1051 				crfree(ncr);
1052 			kmem_free(argop, argoplist_size);
1053 			return (e.error);
1054 		}
1055 	}
1056 
1057 	bcopy(&oop->oo_name, open_args->owner.owner_val,
1058 	    open_args->owner.owner_len);
1059 
1060 	seqid = nfs4_get_open_seqid(oop) + 1;
1061 	open_args->seqid = seqid;
1062 	open_args->share_access = 0;
1063 	if (open_flag & FREAD)
1064 		open_args->share_access |= OPEN4_SHARE_ACCESS_READ;
1065 	if (open_flag & FWRITE)
1066 		open_args->share_access |= OPEN4_SHARE_ACCESS_WRITE;
1067 	open_args->share_deny = OPEN4_SHARE_DENY_NONE;
1068 
1069 
1070 
1071 	/*
1072 	 * getfh w/sanity check for idx_open/idx_fattr
1073 	 */
1074 	ASSERT((idx_open + 1) == (idx_fattr - 1));
1075 	argop[idx_open + 1].argop = OP_GETFH;
1076 
1077 	/* getattr */
1078 	argop[idx_fattr].argop = OP_GETATTR;
1079 	argop[idx_fattr].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1080 	argop[idx_fattr].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
1081 
1082 	if (setgid_flag) {
1083 		vattr_t	_v;
1084 		servinfo4_t *svp;
1085 		bitmap4	supp_attrs;
1086 
1087 		svp = drp->r_server;
1088 		(void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
1089 		supp_attrs = svp->sv_supp_attrs;
1090 		nfs_rw_exit(&svp->sv_lock);
1091 
1092 		/*
1093 		 * For setgid case, we need to:
1094 		 * 4:savefh(new) 5:putfh(dir) 6:getattr(dir) 7:restorefh(new)
1095 		 */
1096 		argop[4].argop = OP_SAVEFH;
1097 
1098 		argop[5].argop = OP_CPUTFH;
1099 		argop[5].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
1100 
1101 		argop[6].argop = OP_GETATTR;
1102 		argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1103 		argop[6].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
1104 
1105 		argop[7].argop = OP_RESTOREFH;
1106 
1107 		/*
1108 		 * nverify
1109 		 */
1110 		_v.va_mask = AT_GID;
1111 		_v.va_gid = in_va->va_gid;
1112 		if (!(e.error = nfs4args_verify(&argop[8], &_v, OP_NVERIFY,
1113 		    supp_attrs))) {
1114 
1115 			/*
1116 			 * setattr
1117 			 *
1118 			 * We _know_ we're not messing with AT_SIZE or
1119 			 * AT_XTIME, so no need for stateid or flags.
1120 			 * Also we specify NULL rp since we're only
1121 			 * interested in setting owner_group attributes.
1122 			 */
1123 			nfs4args_setattr(&argop[9], &_v, NULL, 0, NULL, cr,
1124 			    supp_attrs, &e.error, 0);
1125 			if (e.error)
1126 				nfs4args_verify_free(&argop[8]);
1127 		}
1128 
1129 		if (e.error) {
1130 			/*
1131 			 * XXX - Revisit the last argument to nfs4_end_op()
1132 			 *	 once 5020486 is fixed.
1133 			 */
1134 			nfs4_end_open_seqid_sync(oop);
1135 			open_owner_rele(oop);
1136 			nfs4args_copen_free(open_args);
1137 			nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, TRUE);
1138 			if (ncr != NULL)
1139 				crfree(ncr);
1140 			kmem_free(argop, argoplist_size);
1141 			return (e.error);
1142 		}
1143 	} else if (create_flag) {
1144 		/*
1145 		 * For setgid case, we need to:
1146 		 * 4:savefh(new) 5:putfh(dir) 6:getattr(dir) 7:restorefh(new)
1147 		 */
1148 		argop[1].argop = OP_SAVEFH;
1149 
1150 		argop[5].argop = OP_RESTOREFH;
1151 
1152 		argop[6].argop = OP_GETATTR;
1153 		argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1154 		argop[6].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
1155 	}
1156 
1157 	NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
1158 	    "nfs4open_otw: %s call, nm %s, rp %s",
1159 	    needrecov ? "recov" : "first", file_name,
1160 	    rnode4info(VTOR4(dvp))));
1161 
1162 	t = gethrtime();
1163 
1164 	rfs4call(VTOMI4(dvp), &args, &res, cred_otw, &doqueue, 0, &e);
1165 
1166 	if (!e.error && nfs4_need_to_bump_seqid(&res))
1167 		nfs4_set_open_seqid(seqid, oop, args.ctag);
1168 
1169 	needrecov = nfs4_needs_recovery(&e, TRUE, dvp->v_vfsp);
1170 
1171 	if (e.error || needrecov) {
1172 		bool_t abort = FALSE;
1173 
1174 		if (needrecov) {
1175 			nfs4_bseqid_entry_t *bsep = NULL;
1176 
1177 			nfs4open_save_lost_rqst(e.error, &lost_rqst, oop,
1178 			    cred_otw, vpi, dvp, open_args);
1179 
1180 			if (!e.error && res.status == NFS4ERR_BAD_SEQID) {
1181 				bsep = nfs4_create_bseqid_entry(oop, NULL,
1182 				    vpi, 0, args.ctag, open_args->seqid);
1183 				num_bseqid_retry--;
1184 			}
1185 
1186 			abort = nfs4_start_recovery(&e, VTOMI4(dvp), dvp, vpi,
1187 			    NULL, lost_rqst.lr_op == OP_OPEN ?
1188 			    &lost_rqst : NULL, OP_OPEN, bsep);
1189 
1190 			if (bsep)
1191 				kmem_free(bsep, sizeof (*bsep));
1192 			/* give up if we keep getting BAD_SEQID */
1193 			if (num_bseqid_retry == 0)
1194 				abort = TRUE;
1195 			if (abort == TRUE && e.error == 0)
1196 				e.error = geterrno4(res.status);
1197 		}
1198 		nfs4_end_open_seqid_sync(oop);
1199 		open_owner_rele(oop);
1200 		nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1201 		nfs4args_copen_free(open_args);
1202 		if (setgid_flag) {
1203 			nfs4args_verify_free(&argop[8]);
1204 			nfs4args_setattr_free(&argop[9]);
1205 		}
1206 		if (!e.error)
1207 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1208 		if (ncr != NULL) {
1209 			crfree(ncr);
1210 			ncr = NULL;
1211 		}
1212 		if (!needrecov || abort == TRUE || e.error == EINTR ||
1213 		    NFS4_FRC_UNMT_ERR(e.error, dvp->v_vfsp)) {
1214 			kmem_free(argop, argoplist_size);
1215 			return (e.error);
1216 		}
1217 		goto recov_retry;
1218 	}
1219 
1220 	/*
1221 	 * Will check and update lease after checking the rflag for
1222 	 * OPEN_CONFIRM in the successful OPEN call.
1223 	 */
1224 	if (res.status != NFS4_OK && res.array_len <= idx_fattr + 1) {
1225 
1226 		/*
1227 		 * XXX what if we're crossing mount points from server1:/drp
1228 		 * to server2:/drp/rp.
1229 		 */
1230 
1231 		/* Signal our end of use of the open seqid */
1232 		nfs4_end_open_seqid_sync(oop);
1233 
1234 		/*
1235 		 * This will destroy the open owner if it was just created,
1236 		 * and no one else has put a reference on it.
1237 		 */
1238 		open_owner_rele(oop);
1239 		if (create_flag && (createmode != EXCLUSIVE4) &&
1240 		    res.status == NFS4ERR_BADOWNER)
1241 			nfs4_log_badowner(VTOMI4(dvp), OP_OPEN);
1242 
1243 		e.error = geterrno4(res.status);
1244 		nfs4args_copen_free(open_args);
1245 		if (setgid_flag) {
1246 			nfs4args_verify_free(&argop[8]);
1247 			nfs4args_setattr_free(&argop[9]);
1248 		}
1249 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1250 		nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1251 		/*
1252 		 * If the reply is NFS4ERR_ACCESS, it may be because
1253 		 * we are root (no root net access).  If the real uid
1254 		 * is not root, then retry with the real uid instead.
1255 		 */
1256 		if (ncr != NULL) {
1257 			crfree(ncr);
1258 			ncr = NULL;
1259 		}
1260 		if (res.status == NFS4ERR_ACCESS &&
1261 		    (ncr = crnetadjust(cred_otw)) != NULL) {
1262 			cred_otw = ncr;
1263 			goto recov_retry;
1264 		}
1265 		kmem_free(argop, argoplist_size);
1266 		return (e.error);
1267 	}
1268 
1269 	resop = &res.array[idx_open];  /* open res */
1270 	op_res = &resop->nfs_resop4_u.opopen;
1271 
1272 #ifdef DEBUG
1273 	/*
1274 	 * verify attrset bitmap
1275 	 */
1276 	if (create_flag &&
1277 	    (createmode == UNCHECKED4 || createmode == GUARDED4)) {
1278 		/* make sure attrset returned is what we asked for */
1279 		/* XXX Ignore this 'error' for now */
1280 		if (attr->attrmask != op_res->attrset)
1281 			/* EMPTY */;
1282 	}
1283 #endif
1284 
1285 	if (op_res->rflags & OPEN4_RESULT_LOCKTYPE_POSIX) {
1286 		mutex_enter(&VTOMI4(dvp)->mi_lock);
1287 		VTOMI4(dvp)->mi_flags |= MI4_POSIX_LOCK;
1288 		mutex_exit(&VTOMI4(dvp)->mi_lock);
1289 	}
1290 
1291 	resop = &res.array[idx_open + 1];  /* getfh res */
1292 	gf_res = &resop->nfs_resop4_u.opgetfh;
1293 
1294 	otw_sfh = sfh4_get(&gf_res->object, VTOMI4(dvp));
1295 
1296 	/*
1297 	 * The open stateid has been updated on the server but not
1298 	 * on the client yet.  There is a path: makenfs4node->nfs4_attr_cache->
1299 	 * flush_pages->VOP_PUTPAGE->...->nfs4write where we will issue an OTW
1300 	 * WRITE call.  That, however, will use the old stateid, so go ahead
1301 	 * and upate the open stateid now, before any call to makenfs4node.
1302 	 */
1303 	if (vpi) {
1304 		nfs4_open_stream_t	*tmp_osp;
1305 		rnode4_t		*tmp_rp = VTOR4(vpi);
1306 
1307 		tmp_osp = find_open_stream(oop, tmp_rp);
1308 		if (tmp_osp) {
1309 			tmp_osp->open_stateid = op_res->stateid;
1310 			mutex_exit(&tmp_osp->os_sync_lock);
1311 			open_stream_rele(tmp_osp, tmp_rp);
1312 		}
1313 
1314 		/*
1315 		 * We must determine if the file handle given by the otw open
1316 		 * is the same as the file handle which was passed in with
1317 		 * *vpp.  This case can be reached if the file we are trying
1318 		 * to open has been removed and another file has been created
1319 		 * having the same file name.  The passed in vnode is released
1320 		 * later.
1321 		 */
1322 		orig_sfh = VTOR4(vpi)->r_fh;
1323 		fh_differs = nfs4cmpfh(&orig_sfh->sfh_fh, &otw_sfh->sfh_fh);
1324 	}
1325 
1326 	garp = &res.array[idx_fattr].nfs_resop4_u.opgetattr.ga_res;
1327 
1328 	if (create_flag || fh_differs) {
1329 		int rnode_err = 0;
1330 
1331 		vp = makenfs4node(otw_sfh, garp, dvp->v_vfsp, t, cr,
1332 		    dvp, fn_get(VTOSV(dvp)->sv_name, file_name));
1333 
1334 		if (e.error)
1335 			PURGE_ATTRCACHE4(vp);
1336 		/*
1337 		 * For the newly created vp case, make sure the rnode
1338 		 * isn't bad before using it.
1339 		 */
1340 		mutex_enter(&(VTOR4(vp))->r_statelock);
1341 		if (VTOR4(vp)->r_flags & R4RECOVERR)
1342 			rnode_err = EIO;
1343 		mutex_exit(&(VTOR4(vp))->r_statelock);
1344 
1345 		if (rnode_err) {
1346 			nfs4_end_open_seqid_sync(oop);
1347 			nfs4args_copen_free(open_args);
1348 			if (setgid_flag) {
1349 				nfs4args_verify_free(&argop[8]);
1350 				nfs4args_setattr_free(&argop[9]);
1351 			}
1352 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1353 			nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state,
1354 			    needrecov);
1355 			open_owner_rele(oop);
1356 			VN_RELE(vp);
1357 			if (ncr != NULL)
1358 				crfree(ncr);
1359 			sfh4_rele(&otw_sfh);
1360 			kmem_free(argop, argoplist_size);
1361 			return (EIO);
1362 		}
1363 	} else {
1364 		vp = vpi;
1365 	}
1366 	sfh4_rele(&otw_sfh);
1367 
1368 	/*
1369 	 * It seems odd to get a full set of attrs and then not update
1370 	 * the object's attrcache in the non-create case.  Create case uses
1371 	 * the attrs since makenfs4node checks to see if the attrs need to
1372 	 * be updated (and then updates them).  The non-create case should
1373 	 * update attrs also.
1374 	 */
1375 	if (! create_flag && ! fh_differs && !e.error) {
1376 		nfs4_attr_cache(vp, garp, t, cr, TRUE, NULL);
1377 	}
1378 
1379 	nfs4_error_zinit(&e);
1380 	if (op_res->rflags & OPEN4_RESULT_CONFIRM) {
1381 		/* This does not do recovery for vp explicitly. */
1382 		nfs4open_confirm(vp, &seqid, &op_res->stateid, cred_otw, FALSE,
1383 		    &retry_open, oop, FALSE, &e, &num_bseqid_retry);
1384 
1385 		if (e.error || e.stat) {
1386 			nfs4_end_open_seqid_sync(oop);
1387 			nfs4args_copen_free(open_args);
1388 			if (setgid_flag) {
1389 				nfs4args_verify_free(&argop[8]);
1390 				nfs4args_setattr_free(&argop[9]);
1391 			}
1392 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1393 			nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state,
1394 			    needrecov);
1395 			open_owner_rele(oop);
1396 			if (create_flag || fh_differs) {
1397 				/* rele the makenfs4node */
1398 				VN_RELE(vp);
1399 			}
1400 			if (ncr != NULL) {
1401 				crfree(ncr);
1402 				ncr = NULL;
1403 			}
1404 			if (retry_open == TRUE) {
1405 				NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
1406 				    "nfs4open_otw: retry the open since OPEN "
1407 				    "CONFIRM failed with error %d stat %d",
1408 				    e.error, e.stat));
1409 				if (create_flag && createmode == GUARDED4) {
1410 					NFS4_DEBUG(nfs4_client_recov_debug,
1411 					    (CE_NOTE, "nfs4open_otw: switch "
1412 					    "createmode from GUARDED4 to "
1413 					    "UNCHECKED4"));
1414 					createmode = UNCHECKED4;
1415 				}
1416 				goto recov_retry;
1417 			}
1418 			if (!e.error) {
1419 				if (create_flag && (createmode != EXCLUSIVE4) &&
1420 				    e.stat == NFS4ERR_BADOWNER)
1421 					nfs4_log_badowner(VTOMI4(dvp), OP_OPEN);
1422 
1423 				e.error = geterrno4(e.stat);
1424 			}
1425 			kmem_free(argop, argoplist_size);
1426 			return (e.error);
1427 		}
1428 	}
1429 
1430 	rp = VTOR4(vp);
1431 
1432 	mutex_enter(&rp->r_statev4_lock);
1433 	if (create_flag)
1434 		rp->created_v4 = 1;
1435 	mutex_exit(&rp->r_statev4_lock);
1436 
1437 	mutex_enter(&oop->oo_lock);
1438 	/* Doesn't matter if 'oo_just_created' already was set as this */
1439 	oop->oo_just_created = NFS4_PERM_CREATED;
1440 	if (oop->oo_cred_otw)
1441 		crfree(oop->oo_cred_otw);
1442 	oop->oo_cred_otw = cred_otw;
1443 	crhold(oop->oo_cred_otw);
1444 	mutex_exit(&oop->oo_lock);
1445 
1446 	/* returns with 'os_sync_lock' held */
1447 	osp = find_or_create_open_stream(oop, rp, &created_osp);
1448 	if (!osp) {
1449 		NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE,
1450 		    "nfs4open_otw: failed to create an open stream"));
1451 		NFS4_DEBUG(nfs4_seqid_sync, (CE_NOTE, "nfs4open_otw: "
1452 		    "signal our end of use of the open seqid"));
1453 
1454 		nfs4_end_open_seqid_sync(oop);
1455 		open_owner_rele(oop);
1456 		nfs4args_copen_free(open_args);
1457 		if (setgid_flag) {
1458 			nfs4args_verify_free(&argop[8]);
1459 			nfs4args_setattr_free(&argop[9]);
1460 		}
1461 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1462 		nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1463 		if (create_flag || fh_differs)
1464 			VN_RELE(vp);
1465 		if (ncr != NULL)
1466 			crfree(ncr);
1467 
1468 		kmem_free(argop, argoplist_size);
1469 		return (EINVAL);
1470 
1471 	}
1472 
1473 	osp->open_stateid = op_res->stateid;
1474 
1475 	if (open_flag & FREAD)
1476 		osp->os_share_acc_read++;
1477 	if (open_flag & FWRITE)
1478 		osp->os_share_acc_write++;
1479 	osp->os_share_deny_none++;
1480 
1481 	/*
1482 	 * Need to reset this bitfield for the possible case where we were
1483 	 * going to OTW CLOSE the file, got a non-recoverable error, and before
1484 	 * we could retry the CLOSE, OPENed the file again.
1485 	 */
1486 	ASSERT(osp->os_open_owner->oo_seqid_inuse);
1487 	osp->os_final_close = 0;
1488 	osp->os_force_close = 0;
1489 #ifdef DEBUG
1490 	if (osp->os_failed_reopen)
1491 		NFS4_DEBUG(nfs4_open_stream_debug, (CE_NOTE, "nfs4open_otw:"
1492 		    " clearing os_failed_reopen for osp %p, cr %p, rp %s",
1493 		    (void *)osp, (void *)cr, rnode4info(rp)));
1494 #endif
1495 	osp->os_failed_reopen = 0;
1496 
1497 	mutex_exit(&osp->os_sync_lock);
1498 
1499 	nfs4_end_open_seqid_sync(oop);
1500 
1501 	if (created_osp && recov_state.rs_sp != NULL) {
1502 		mutex_enter(&recov_state.rs_sp->s_lock);
1503 		nfs4_inc_state_ref_count_nolock(recov_state.rs_sp, VTOMI4(dvp));
1504 		mutex_exit(&recov_state.rs_sp->s_lock);
1505 	}
1506 
1507 	/* get rid of our reference to find oop */
1508 	open_owner_rele(oop);
1509 
1510 	open_stream_rele(osp, rp);
1511 
1512 	/* accept delegation, if any */
1513 	nfs4_delegation_accept(rp, CLAIM_NULL, op_res, garp, cred_otw);
1514 
1515 	nfs4_end_op(VTOMI4(dvp), dvp, vpi, &recov_state, needrecov);
1516 
1517 	if (createmode == EXCLUSIVE4 &&
1518 	    (in_va->va_mask & ~(AT_GID | AT_SIZE))) {
1519 		NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4open_otw:"
1520 		    " EXCLUSIVE4: sending a SETATTR"));
1521 		/*
1522 		 * If doing an exclusive create, then generate
1523 		 * a SETATTR to set the initial attributes.
1524 		 * Try to set the mtime and the atime to the
1525 		 * server's current time.  It is somewhat
1526 		 * expected that these fields will be used to
1527 		 * store the exclusive create cookie.  If not,
1528 		 * server implementors will need to know that
1529 		 * a SETATTR will follow an exclusive create
1530 		 * and the cookie should be destroyed if
1531 		 * appropriate.
1532 		 *
1533 		 * The AT_GID and AT_SIZE bits are turned off
1534 		 * so that the SETATTR request will not attempt
1535 		 * to process these.  The gid will be set
1536 		 * separately if appropriate.  The size is turned
1537 		 * off because it is assumed that a new file will
1538 		 * be created empty and if the file wasn't empty,
1539 		 * then the exclusive create will have failed
1540 		 * because the file must have existed already.
1541 		 * Therefore, no truncate operation is needed.
1542 		 */
1543 		in_va->va_mask &= ~(AT_GID | AT_SIZE);
1544 		in_va->va_mask |= (AT_MTIME | AT_ATIME);
1545 
1546 		e.error = nfs4setattr(vp, in_va, 0, cr, NULL);
1547 		if (e.error) {
1548 			/*
1549 			 * Couldn't correct the attributes of
1550 			 * the newly created file and the
1551 			 * attributes are wrong.  Remove the
1552 			 * file and return an error to the
1553 			 * application.
1554 			 */
1555 			/* XXX will this take care of client state ? */
1556 			NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE,
1557 			    "nfs4open_otw: EXCLUSIVE4: error %d on SETATTR:"
1558 			    " remove file", e.error));
1559 			VN_RELE(vp);
1560 			(void) nfs4_remove(dvp, file_name, cr, NULL, 0);
1561 			/*
1562 			 * Since we've reled the vnode and removed
1563 			 * the file we now need to return the error.
1564 			 * At this point we don't want to update the
1565 			 * dircaches, call nfs4_waitfor_purge_complete
1566 			 * or set vpp to vp so we need to skip these
1567 			 * as well.
1568 			 */
1569 			goto skip_update_dircaches;
1570 		}
1571 	}
1572 
1573 	/*
1574 	 * If we created or found the correct vnode, due to create_flag or
1575 	 * fh_differs being set, then update directory cache attribute, readdir
1576 	 * and dnlc caches.
1577 	 */
1578 	if (create_flag || fh_differs) {
1579 		dirattr_info_t dinfo, *dinfop;
1580 
1581 		/*
1582 		 * Make sure getattr succeeded before using results.
1583 		 * note: op 7 is getattr(dir) for both flavors of
1584 		 * open(create).
1585 		 */
1586 		if (create_flag && res.status == NFS4_OK) {
1587 			dinfo.di_time_call = t;
1588 			dinfo.di_cred = cr;
1589 			dinfo.di_garp =
1590 			    &res.array[6].nfs_resop4_u.opgetattr.ga_res;
1591 			dinfop = &dinfo;
1592 		} else {
1593 			dinfop = NULL;
1594 		}
1595 
1596 		nfs4_update_dircaches(&op_res->cinfo, dvp, vp, file_name,
1597 		    dinfop);
1598 	}
1599 
1600 	/*
1601 	 * If the page cache for this file was flushed from actions
1602 	 * above, it was done asynchronously and if that is true,
1603 	 * there is a need to wait here for it to complete.  This must
1604 	 * be done outside of start_fop/end_fop.
1605 	 */
1606 	(void) nfs4_waitfor_purge_complete(vp);
1607 
1608 	/*
1609 	 * It is implicit that we are in the open case (create_flag == 0) since
1610 	 * fh_differs can only be set to a non-zero value in the open case.
1611 	 */
1612 	if (fh_differs != 0 && vpi != NULL)
1613 		VN_RELE(vpi);
1614 
1615 	/*
1616 	 * Be sure to set *vpp to the correct value before returning.
1617 	 */
1618 	*vpp = vp;
1619 
1620 skip_update_dircaches:
1621 
1622 	nfs4args_copen_free(open_args);
1623 	if (setgid_flag) {
1624 		nfs4args_verify_free(&argop[8]);
1625 		nfs4args_setattr_free(&argop[9]);
1626 	}
1627 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1628 
1629 	if (ncr)
1630 		crfree(ncr);
1631 	kmem_free(argop, argoplist_size);
1632 	return (e.error);
1633 }
1634 
1635 /*
1636  * Reopen an open instance.  cf. nfs4open_otw().
1637  *
1638  * Errors are returned by the nfs4_error_t parameter.
1639  * - ep->error contains an errno value or zero.
1640  * - if it is zero, ep->stat is set to an NFS status code, if any.
1641  *   If the file could not be reopened, but the caller should continue, the
1642  *   file is marked dead and no error values are returned.  If the caller
1643  *   should stop recovering open files and start over, either the ep->error
1644  *   value or ep->stat will indicate an error (either something that requires
1645  *   recovery or EAGAIN).  Note that some recovery (e.g., expired volatile
1646  *   filehandles) may be handled silently by this routine.
1647  * - if it is EINTR, ETIMEDOUT, or NFS4_FRC_UNMT_ERR, recovery for lost state
1648  *   will be started, so the caller should not do it.
1649  *
1650  * Gotos:
1651  * - kill_file : reopen failed in such a fashion to constitute marking the
1652  *    file dead and setting the open stream's 'os_failed_reopen' as 1.  This
1653  *   is for cases where recovery is not possible.
1654  * - failed_reopen : same as above, except that the file has already been
1655  *   marked dead, so no need to do it again.
1656  * - bailout : reopen failed but we are able to recover and retry the reopen -
1657  *   either within this function immediately or via the calling function.
1658  */
1659 
1660 void
1661 nfs4_reopen(vnode_t *vp, nfs4_open_stream_t *osp, nfs4_error_t *ep,
1662     open_claim_type4 claim, bool_t frc_use_claim_previous,
1663     bool_t is_recov)
1664 {
1665 	COMPOUND4args_clnt args;
1666 	COMPOUND4res_clnt res;
1667 	nfs_argop4 argop[4];
1668 	nfs_resop4 *resop;
1669 	OPEN4res *op_res = NULL;
1670 	OPEN4cargs *open_args;
1671 	GETFH4res *gf_res;
1672 	rnode4_t *rp = VTOR4(vp);
1673 	int doqueue = 1;
1674 	cred_t *cr = NULL, *cred_otw = NULL;
1675 	nfs4_open_owner_t *oop = NULL;
1676 	seqid4 seqid;
1677 	nfs4_ga_res_t *garp;
1678 	char fn[MAXNAMELEN];
1679 	nfs4_recov_state_t recov = {NULL, 0};
1680 	nfs4_lost_rqst_t lost_rqst;
1681 	mntinfo4_t *mi = VTOMI4(vp);
1682 	bool_t abort;
1683 	char *failed_msg = "";
1684 	int fh_different;
1685 	hrtime_t t;
1686 	nfs4_bseqid_entry_t *bsep = NULL;
1687 
1688 	ASSERT(nfs4_consistent_type(vp));
1689 	ASSERT(nfs_zone() == mi->mi_zone);
1690 
1691 	nfs4_error_zinit(ep);
1692 
1693 	/* this is the cred used to find the open owner */
1694 	cr = state_to_cred(osp);
1695 	if (cr == NULL) {
1696 		failed_msg = "Couldn't reopen: no cred";
1697 		goto kill_file;
1698 	}
1699 	/* use this cred for OTW operations */
1700 	cred_otw = nfs4_get_otw_cred(cr, mi, osp->os_open_owner);
1701 
1702 top:
1703 	nfs4_error_zinit(ep);
1704 
1705 	if (mi->mi_vfsp->vfs_flag & VFS_UNMOUNTED) {
1706 		/* File system has been unmounted, quit */
1707 		ep->error = EIO;
1708 		failed_msg = "Couldn't reopen: file system has been unmounted";
1709 		goto kill_file;
1710 	}
1711 
1712 	oop = osp->os_open_owner;
1713 
1714 	ASSERT(oop != NULL);
1715 	if (oop == NULL) {	/* be defensive in non-DEBUG */
1716 		failed_msg = "can't reopen: no open owner";
1717 		goto kill_file;
1718 	}
1719 	open_owner_hold(oop);
1720 
1721 	ep->error = nfs4_start_open_seqid_sync(oop, mi);
1722 	if (ep->error) {
1723 		open_owner_rele(oop);
1724 		oop = NULL;
1725 		goto bailout;
1726 	}
1727 
1728 	/*
1729 	 * If the rnode has a delegation and the delegation has been
1730 	 * recovered and the server didn't request a recall and the caller
1731 	 * didn't specifically ask for CLAIM_PREVIOUS (nfs4frlock during
1732 	 * recovery) and the rnode hasn't been marked dead, then install
1733 	 * the delegation stateid in the open stream.  Otherwise, proceed
1734 	 * with a CLAIM_PREVIOUS or CLAIM_NULL OPEN.
1735 	 */
1736 	mutex_enter(&rp->r_statev4_lock);
1737 	if (rp->r_deleg_type != OPEN_DELEGATE_NONE &&
1738 	    !rp->r_deleg_return_pending &&
1739 	    (rp->r_deleg_needs_recovery == OPEN_DELEGATE_NONE) &&
1740 	    !rp->r_deleg_needs_recall &&
1741 	    claim != CLAIM_DELEGATE_CUR && !frc_use_claim_previous &&
1742 	    !(rp->r_flags & R4RECOVERR)) {
1743 		mutex_enter(&osp->os_sync_lock);
1744 		osp->os_delegation = 1;
1745 		osp->open_stateid = rp->r_deleg_stateid;
1746 		mutex_exit(&osp->os_sync_lock);
1747 		mutex_exit(&rp->r_statev4_lock);
1748 		goto bailout;
1749 	}
1750 	mutex_exit(&rp->r_statev4_lock);
1751 
1752 	/*
1753 	 * If the file failed recovery, just quit.  This failure need not
1754 	 * affect other reopens, so don't return an error.
1755 	 */
1756 	mutex_enter(&rp->r_statelock);
1757 	if (rp->r_flags & R4RECOVERR) {
1758 		mutex_exit(&rp->r_statelock);
1759 		ep->error = 0;
1760 		goto failed_reopen;
1761 	}
1762 	mutex_exit(&rp->r_statelock);
1763 
1764 	/*
1765 	 * argop is empty here
1766 	 *
1767 	 * PUTFH, OPEN, GETATTR
1768 	 */
1769 	args.ctag = TAG_REOPEN;
1770 	args.array_len = 4;
1771 	args.array = argop;
1772 
1773 	NFS4_DEBUG(nfs4_client_failover_debug, (CE_NOTE,
1774 	    "nfs4_reopen: file is type %d, id %s",
1775 	    vp->v_type, rnode4info(VTOR4(vp))));
1776 
1777 	argop[0].argop = OP_CPUTFH;
1778 
1779 	if (claim != CLAIM_PREVIOUS) {
1780 		/*
1781 		 * if this is a file mount then
1782 		 * use the mntinfo parentfh
1783 		 */
1784 		argop[0].nfs_argop4_u.opcputfh.sfh =
1785 		    (vp->v_flag & VROOT) ? mi->mi_srvparentfh :
1786 		    VTOSV(vp)->sv_dfh;
1787 	} else {
1788 		/* putfh fh to reopen */
1789 		argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
1790 	}
1791 
1792 	argop[1].argop = OP_COPEN;
1793 	open_args = &argop[1].nfs_argop4_u.opcopen;
1794 	open_args->claim = claim;
1795 
1796 	if (claim == CLAIM_NULL) {
1797 
1798 		if ((ep->error = vtoname(vp, fn, MAXNAMELEN)) != 0) {
1799 			nfs_cmn_err(ep->error, CE_WARN, "nfs4_reopen: vtoname "
1800 			    "failed for vp 0x%p for CLAIM_NULL with %m",
1801 			    (void *)vp);
1802 			failed_msg = "Couldn't reopen: vtoname failed for "
1803 			    "CLAIM_NULL";
1804 			/* nothing allocated yet */
1805 			goto kill_file;
1806 		}
1807 
1808 		open_args->open_claim4_u.cfile = fn;
1809 	} else if (claim == CLAIM_PREVIOUS) {
1810 
1811 		/*
1812 		 * We have two cases to deal with here:
1813 		 * 1) We're being called to reopen files in order to satisfy
1814 		 *    a lock operation request which requires us to explicitly
1815 		 *    reopen files which were opened under a delegation.  If
1816 		 *    we're in recovery, we *must* use CLAIM_PREVIOUS.  In
1817 		 *    that case, frc_use_claim_previous is TRUE and we must
1818 		 *    use the rnode's current delegation type (r_deleg_type).
1819 		 * 2) We're reopening files during some form of recovery.
1820 		 *    In this case, frc_use_claim_previous is FALSE and we
1821 		 *    use the delegation type appropriate for recovery
1822 		 *    (r_deleg_needs_recovery).
1823 		 */
1824 		mutex_enter(&rp->r_statev4_lock);
1825 		open_args->open_claim4_u.delegate_type =
1826 		    frc_use_claim_previous ?
1827 		    rp->r_deleg_type :
1828 		    rp->r_deleg_needs_recovery;
1829 		mutex_exit(&rp->r_statev4_lock);
1830 
1831 	} else if (claim == CLAIM_DELEGATE_CUR) {
1832 
1833 		if ((ep->error = vtoname(vp, fn, MAXNAMELEN)) != 0) {
1834 			nfs_cmn_err(ep->error, CE_WARN, "nfs4_reopen: vtoname "
1835 			    "failed for vp 0x%p for CLAIM_DELEGATE_CUR "
1836 			    "with %m", (void *)vp);
1837 			failed_msg = "Couldn't reopen: vtoname failed for "
1838 			    "CLAIM_DELEGATE_CUR";
1839 			/* nothing allocated yet */
1840 			goto kill_file;
1841 		}
1842 
1843 		mutex_enter(&rp->r_statev4_lock);
1844 		open_args->open_claim4_u.delegate_cur_info.delegate_stateid =
1845 		    rp->r_deleg_stateid;
1846 		mutex_exit(&rp->r_statev4_lock);
1847 
1848 		open_args->open_claim4_u.delegate_cur_info.cfile = fn;
1849 	}
1850 	open_args->opentype = OPEN4_NOCREATE;
1851 	open_args->owner.clientid = mi2clientid(mi);
1852 	open_args->owner.owner_len = sizeof (oop->oo_name);
1853 	open_args->owner.owner_val =
1854 	    kmem_alloc(open_args->owner.owner_len, KM_SLEEP);
1855 	bcopy(&oop->oo_name, open_args->owner.owner_val,
1856 	    open_args->owner.owner_len);
1857 	open_args->share_access = 0;
1858 	open_args->share_deny = 0;
1859 
1860 	mutex_enter(&osp->os_sync_lock);
1861 	NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE, "nfs4_reopen: osp %p rp "
1862 	    "%p: read acc %"PRIu64" write acc %"PRIu64": open ref count %d: "
1863 	    "mmap read %"PRIu64" mmap write %"PRIu64" claim %d ",
1864 	    (void *)osp, (void *)rp, osp->os_share_acc_read,
1865 	    osp->os_share_acc_write, osp->os_open_ref_count,
1866 	    osp->os_mmap_read, osp->os_mmap_write, claim));
1867 
1868 	if (osp->os_share_acc_read || osp->os_mmap_read)
1869 		open_args->share_access |= OPEN4_SHARE_ACCESS_READ;
1870 	if (osp->os_share_acc_write || osp->os_mmap_write)
1871 		open_args->share_access |= OPEN4_SHARE_ACCESS_WRITE;
1872 	if (osp->os_share_deny_read)
1873 		open_args->share_deny |= OPEN4_SHARE_DENY_READ;
1874 	if (osp->os_share_deny_write)
1875 		open_args->share_deny |= OPEN4_SHARE_DENY_WRITE;
1876 	mutex_exit(&osp->os_sync_lock);
1877 
1878 	seqid = nfs4_get_open_seqid(oop) + 1;
1879 	open_args->seqid = seqid;
1880 
1881 	/* Construct the getfh part of the compound */
1882 	argop[2].argop = OP_GETFH;
1883 
1884 	/* Construct the getattr part of the compound */
1885 	argop[3].argop = OP_GETATTR;
1886 	argop[3].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
1887 	argop[3].nfs_argop4_u.opgetattr.mi = mi;
1888 
1889 	t = gethrtime();
1890 
1891 	rfs4call(mi, &args, &res, cred_otw, &doqueue, 0, ep);
1892 
1893 	if (ep->error) {
1894 		if (!is_recov && !frc_use_claim_previous &&
1895 		    (ep->error == EINTR || ep->error == ETIMEDOUT ||
1896 		    NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp))) {
1897 			nfs4open_save_lost_rqst(ep->error, &lost_rqst, oop,
1898 			    cred_otw, vp, NULL, open_args);
1899 			abort = nfs4_start_recovery(ep,
1900 			    VTOMI4(vp), vp, NULL, NULL,
1901 			    lost_rqst.lr_op == OP_OPEN ?
1902 			    &lost_rqst : NULL, OP_OPEN, NULL);
1903 			nfs4args_copen_free(open_args);
1904 			goto bailout;
1905 		}
1906 
1907 		nfs4args_copen_free(open_args);
1908 
1909 		if (ep->error == EACCES && cred_otw != cr) {
1910 			crfree(cred_otw);
1911 			cred_otw = cr;
1912 			crhold(cred_otw);
1913 			nfs4_end_open_seqid_sync(oop);
1914 			open_owner_rele(oop);
1915 			oop = NULL;
1916 			goto top;
1917 		}
1918 		if (ep->error == ETIMEDOUT)
1919 			goto bailout;
1920 		failed_msg = "Couldn't reopen: rpc error";
1921 		goto kill_file;
1922 	}
1923 
1924 	if (nfs4_need_to_bump_seqid(&res))
1925 		nfs4_set_open_seqid(seqid, oop, args.ctag);
1926 
1927 	switch (res.status) {
1928 	case NFS4_OK:
1929 		if (recov.rs_flags & NFS4_RS_DELAY_MSG) {
1930 			mutex_enter(&rp->r_statelock);
1931 			rp->r_delay_interval = 0;
1932 			mutex_exit(&rp->r_statelock);
1933 		}
1934 		break;
1935 	case NFS4ERR_BAD_SEQID:
1936 		bsep = nfs4_create_bseqid_entry(oop, NULL, vp, 0,
1937 		    args.ctag, open_args->seqid);
1938 
1939 		abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL,
1940 		    NULL, lost_rqst.lr_op == OP_OPEN ? &lost_rqst :
1941 		    NULL, OP_OPEN, bsep);
1942 
1943 		nfs4args_copen_free(open_args);
1944 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1945 		nfs4_end_open_seqid_sync(oop);
1946 		open_owner_rele(oop);
1947 		oop = NULL;
1948 		kmem_free(bsep, sizeof (*bsep));
1949 
1950 		goto kill_file;
1951 	case NFS4ERR_NO_GRACE:
1952 		nfs4args_copen_free(open_args);
1953 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1954 		nfs4_end_open_seqid_sync(oop);
1955 		open_owner_rele(oop);
1956 		oop = NULL;
1957 		if (claim == CLAIM_PREVIOUS) {
1958 			/*
1959 			 * Retry as a plain open. We don't need to worry about
1960 			 * checking the changeinfo: it is acceptable for a
1961 			 * client to re-open a file and continue processing
1962 			 * (in the absence of locks).
1963 			 */
1964 			NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
1965 			    "nfs4_reopen: CLAIM_PREVIOUS: NFS4ERR_NO_GRACE; "
1966 			    "will retry as CLAIM_NULL"));
1967 			claim = CLAIM_NULL;
1968 			nfs4_mi_kstat_inc_no_grace(mi);
1969 			goto top;
1970 		}
1971 		failed_msg =
1972 		    "Couldn't reopen: tried reclaim outside grace period. ";
1973 		goto kill_file;
1974 	case NFS4ERR_GRACE:
1975 		nfs4_set_grace_wait(mi);
1976 		nfs4args_copen_free(open_args);
1977 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1978 		nfs4_end_open_seqid_sync(oop);
1979 		open_owner_rele(oop);
1980 		oop = NULL;
1981 		ep->error = nfs4_wait_for_grace(mi, &recov);
1982 		if (ep->error != 0)
1983 			goto bailout;
1984 		goto top;
1985 	case NFS4ERR_DELAY:
1986 		nfs4_set_delay_wait(vp);
1987 		nfs4args_copen_free(open_args);
1988 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
1989 		nfs4_end_open_seqid_sync(oop);
1990 		open_owner_rele(oop);
1991 		oop = NULL;
1992 		ep->error = nfs4_wait_for_delay(vp, &recov);
1993 		nfs4_mi_kstat_inc_delay(mi);
1994 		if (ep->error != 0)
1995 			goto bailout;
1996 		goto top;
1997 	case NFS4ERR_FHEXPIRED:
1998 		/* recover filehandle and retry */
1999 		abort = nfs4_start_recovery(ep,
2000 		    mi, vp, NULL, NULL, NULL, OP_OPEN, NULL);
2001 		nfs4args_copen_free(open_args);
2002 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2003 		nfs4_end_open_seqid_sync(oop);
2004 		open_owner_rele(oop);
2005 		oop = NULL;
2006 		if (abort == FALSE)
2007 			goto top;
2008 		failed_msg = "Couldn't reopen: recovery aborted";
2009 		goto kill_file;
2010 	case NFS4ERR_RESOURCE:
2011 	case NFS4ERR_STALE_CLIENTID:
2012 	case NFS4ERR_WRONGSEC:
2013 	case NFS4ERR_EXPIRED:
2014 		/*
2015 		 * Do not mark the file dead and let the calling
2016 		 * function initiate recovery.
2017 		 */
2018 		nfs4args_copen_free(open_args);
2019 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2020 		nfs4_end_open_seqid_sync(oop);
2021 		open_owner_rele(oop);
2022 		oop = NULL;
2023 		goto bailout;
2024 	case NFS4ERR_ACCESS:
2025 		if (cred_otw != cr) {
2026 			crfree(cred_otw);
2027 			cred_otw = cr;
2028 			crhold(cred_otw);
2029 			nfs4args_copen_free(open_args);
2030 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2031 			nfs4_end_open_seqid_sync(oop);
2032 			open_owner_rele(oop);
2033 			oop = NULL;
2034 			goto top;
2035 		}
2036 		/* fall through */
2037 	default:
2038 		NFS4_DEBUG(nfs4_client_failover_debug, (CE_NOTE,
2039 		    "nfs4_reopen: r_server 0x%p, mi_curr_serv 0x%p, rnode %s",
2040 		    (void*)VTOR4(vp)->r_server, (void*)mi->mi_curr_serv,
2041 		    rnode4info(VTOR4(vp))));
2042 		failed_msg = "Couldn't reopen: NFSv4 error";
2043 		nfs4args_copen_free(open_args);
2044 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2045 		goto kill_file;
2046 	}
2047 
2048 	resop = &res.array[1];  /* open res */
2049 	op_res = &resop->nfs_resop4_u.opopen;
2050 
2051 	garp = &res.array[3].nfs_resop4_u.opgetattr.ga_res;
2052 
2053 	/*
2054 	 * Check if the path we reopened really is the same
2055 	 * file. We could end up in a situation where the file
2056 	 * was removed and a new file created with the same name.
2057 	 */
2058 	resop = &res.array[2];
2059 	gf_res = &resop->nfs_resop4_u.opgetfh;
2060 	(void) nfs_rw_enter_sig(&mi->mi_fh_lock, RW_READER, 0);
2061 	fh_different = (nfs4cmpfh(&rp->r_fh->sfh_fh, &gf_res->object) != 0);
2062 	if (fh_different) {
2063 		if (mi->mi_fh_expire_type == FH4_PERSISTENT ||
2064 		    mi->mi_fh_expire_type & FH4_NOEXPIRE_WITH_OPEN) {
2065 			/* Oops, we don't have the same file */
2066 			if (mi->mi_fh_expire_type == FH4_PERSISTENT)
2067 				failed_msg = "Couldn't reopen: Persistent "
2068 				    "file handle changed";
2069 			else
2070 				failed_msg = "Couldn't reopen: Volatile "
2071 				    "(no expire on open) file handle changed";
2072 
2073 			nfs4args_copen_free(open_args);
2074 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2075 			nfs_rw_exit(&mi->mi_fh_lock);
2076 			goto kill_file;
2077 
2078 		} else {
2079 			/*
2080 			 * We have volatile file handles that don't compare.
2081 			 * If the fids are the same then we assume that the
2082 			 * file handle expired but the rnode still refers to
2083 			 * the same file object.
2084 			 *
2085 			 * First check that we have fids or not.
2086 			 * If we don't we have a dumb server so we will
2087 			 * just assume every thing is ok for now.
2088 			 */
2089 			if (!ep->error && garp->n4g_va.va_mask & AT_NODEID &&
2090 			    rp->r_attr.va_mask & AT_NODEID &&
2091 			    rp->r_attr.va_nodeid != garp->n4g_va.va_nodeid) {
2092 				/*
2093 				 * We have fids, but they don't
2094 				 * compare. So kill the file.
2095 				 */
2096 				failed_msg =
2097 				    "Couldn't reopen: file handle changed"
2098 				    " due to mismatched fids";
2099 				nfs4args_copen_free(open_args);
2100 				(void) xdr_free(xdr_COMPOUND4res_clnt,
2101 				    (caddr_t)&res);
2102 				nfs_rw_exit(&mi->mi_fh_lock);
2103 				goto kill_file;
2104 			} else {
2105 				/*
2106 				 * We have volatile file handles that refers
2107 				 * to the same file (at least they have the
2108 				 * same fid) or we don't have fids so we
2109 				 * can't tell. :(. We'll be a kind and accepting
2110 				 * client so we'll update the rnode's file
2111 				 * handle with the otw handle.
2112 				 *
2113 				 * We need to drop mi->mi_fh_lock since
2114 				 * sh4_update acquires it. Since there is
2115 				 * only one recovery thread there is no
2116 				 * race.
2117 				 */
2118 				nfs_rw_exit(&mi->mi_fh_lock);
2119 				sfh4_update(rp->r_fh, &gf_res->object);
2120 			}
2121 		}
2122 	} else {
2123 		nfs_rw_exit(&mi->mi_fh_lock);
2124 	}
2125 
2126 	ASSERT(nfs4_consistent_type(vp));
2127 
2128 	/*
2129 	 * If the server wanted an OPEN_CONFIRM but that fails, just start
2130 	 * over.  Presumably if there is a persistent error it will show up
2131 	 * when we resend the OPEN.
2132 	 */
2133 	if (op_res->rflags & OPEN4_RESULT_CONFIRM) {
2134 		bool_t retry_open = FALSE;
2135 
2136 		nfs4open_confirm(vp, &seqid, &op_res->stateid,
2137 		    cred_otw, is_recov, &retry_open,
2138 		    oop, FALSE, ep, NULL);
2139 		if (ep->error || ep->stat) {
2140 			nfs4args_copen_free(open_args);
2141 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2142 			nfs4_end_open_seqid_sync(oop);
2143 			open_owner_rele(oop);
2144 			oop = NULL;
2145 			goto top;
2146 		}
2147 	}
2148 
2149 	mutex_enter(&osp->os_sync_lock);
2150 	osp->open_stateid = op_res->stateid;
2151 	osp->os_delegation = 0;
2152 	/*
2153 	 * Need to reset this bitfield for the possible case where we were
2154 	 * going to OTW CLOSE the file, got a non-recoverable error, and before
2155 	 * we could retry the CLOSE, OPENed the file again.
2156 	 */
2157 	ASSERT(osp->os_open_owner->oo_seqid_inuse);
2158 	osp->os_final_close = 0;
2159 	osp->os_force_close = 0;
2160 	if (claim == CLAIM_DELEGATE_CUR || claim == CLAIM_PREVIOUS)
2161 		osp->os_dc_openacc = open_args->share_access;
2162 	mutex_exit(&osp->os_sync_lock);
2163 
2164 	nfs4_end_open_seqid_sync(oop);
2165 
2166 	/* accept delegation, if any */
2167 	nfs4_delegation_accept(rp, claim, op_res, garp, cred_otw);
2168 
2169 	nfs4args_copen_free(open_args);
2170 
2171 	nfs4_attr_cache(vp, garp, t, cr, TRUE, NULL);
2172 
2173 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2174 
2175 	ASSERT(nfs4_consistent_type(vp));
2176 
2177 	open_owner_rele(oop);
2178 	crfree(cr);
2179 	crfree(cred_otw);
2180 	return;
2181 
2182 kill_file:
2183 	nfs4_fail_recov(vp, failed_msg, ep->error, ep->stat);
2184 failed_reopen:
2185 	NFS4_DEBUG(nfs4_open_stream_debug, (CE_NOTE,
2186 	    "nfs4_reopen: setting os_failed_reopen for osp %p, cr %p, rp %s",
2187 	    (void *)osp, (void *)cr, rnode4info(rp)));
2188 	mutex_enter(&osp->os_sync_lock);
2189 	osp->os_failed_reopen = 1;
2190 	mutex_exit(&osp->os_sync_lock);
2191 bailout:
2192 	if (oop != NULL) {
2193 		nfs4_end_open_seqid_sync(oop);
2194 		open_owner_rele(oop);
2195 	}
2196 	if (cr != NULL)
2197 		crfree(cr);
2198 	if (cred_otw != NULL)
2199 		crfree(cred_otw);
2200 }
2201 
2202 /* for . and .. OPENs */
2203 /* ARGSUSED */
2204 static int
2205 nfs4_open_non_reg_file(vnode_t **vpp, int flag, cred_t *cr)
2206 {
2207 	rnode4_t *rp;
2208 	nfs4_ga_res_t gar;
2209 
2210 	ASSERT(nfs_zone() == VTOMI4(*vpp)->mi_zone);
2211 
2212 	/*
2213 	 * If close-to-open consistency checking is turned off or
2214 	 * if there is no cached data, we can avoid
2215 	 * the over the wire getattr.  Otherwise, force a
2216 	 * call to the server to get fresh attributes and to
2217 	 * check caches. This is required for close-to-open
2218 	 * consistency.
2219 	 */
2220 	rp = VTOR4(*vpp);
2221 	if (VTOMI4(*vpp)->mi_flags & MI4_NOCTO ||
2222 	    (rp->r_dir == NULL && !nfs4_has_pages(*vpp)))
2223 		return (0);
2224 
2225 	gar.n4g_va.va_mask = AT_ALL;
2226 	return (nfs4_getattr_otw(*vpp, &gar, cr, 0));
2227 }
2228 
2229 /*
2230  * CLOSE a file
2231  */
2232 /* ARGSUSED */
2233 static int
2234 nfs4_close(vnode_t *vp, int flag, int count, offset_t offset, cred_t *cr,
2235 	caller_context_t *ct)
2236 {
2237 	rnode4_t	*rp;
2238 	int		 error = 0;
2239 	int		 r_error = 0;
2240 	int		 n4error = 0;
2241 	nfs4_error_t	 e = { 0, NFS4_OK, RPC_SUCCESS };
2242 
2243 	/*
2244 	 * Remove client state for this (lockowner, file) pair.
2245 	 * Issue otw v4 call to have the server do the same.
2246 	 */
2247 
2248 	rp = VTOR4(vp);
2249 
2250 	/*
2251 	 * zone_enter(2) prevents processes from changing zones with NFS files
2252 	 * open; if we happen to get here from the wrong zone we can't do
2253 	 * anything over the wire.
2254 	 */
2255 	if (VTOMI4(vp)->mi_zone != nfs_zone()) {
2256 		/*
2257 		 * We could attempt to clean up locks, except we're sure
2258 		 * that the current process didn't acquire any locks on
2259 		 * the file: any attempt to lock a file belong to another zone
2260 		 * will fail, and one can't lock an NFS file and then change
2261 		 * zones, as that fails too.
2262 		 *
2263 		 * Returning an error here is the sane thing to do.  A
2264 		 * subsequent call to VN_RELE() which translates to a
2265 		 * nfs4_inactive() will clean up state: if the zone of the
2266 		 * vnode's origin is still alive and kicking, the inactive
2267 		 * thread will handle the request (from the correct zone), and
2268 		 * everything (minus the OTW close call) should be OK.  If the
2269 		 * zone is going away nfs4_async_inactive() will throw away
2270 		 * delegations, open streams and cached pages inline.
2271 		 */
2272 		return (EIO);
2273 	}
2274 
2275 	/*
2276 	 * If we are using local locking for this filesystem, then
2277 	 * release all of the SYSV style record locks.  Otherwise,
2278 	 * we are doing network locking and we need to release all
2279 	 * of the network locks.  All of the locks held by this
2280 	 * process on this file are released no matter what the
2281 	 * incoming reference count is.
2282 	 */
2283 	if (VTOMI4(vp)->mi_flags & MI4_LLOCK) {
2284 		cleanlocks(vp, ttoproc(curthread)->p_pid, 0);
2285 		cleanshares(vp, ttoproc(curthread)->p_pid);
2286 	} else
2287 		e.error = nfs4_lockrelease(vp, flag, offset, cr);
2288 
2289 	if (e.error) {
2290 		struct lm_sysid *lmsid;
2291 		lmsid = nfs4_find_sysid(VTOMI4(vp));
2292 		if (lmsid == NULL) {
2293 			DTRACE_PROBE2(unknown__sysid, int, e.error,
2294 			    vnode_t *, vp);
2295 		} else {
2296 			cleanlocks(vp, ttoproc(curthread)->p_pid,
2297 			    (lm_sysidt(lmsid) | LM_SYSID_CLIENT));
2298 		}
2299 		return (e.error);
2300 	}
2301 
2302 	if (count > 1)
2303 		return (0);
2304 
2305 	/*
2306 	 * If the file has been `unlinked', then purge the
2307 	 * DNLC so that this vnode will get reycled quicker
2308 	 * and the .nfs* file on the server will get removed.
2309 	 */
2310 	if (rp->r_unldvp != NULL)
2311 		dnlc_purge_vp(vp);
2312 
2313 	/*
2314 	 * If the file was open for write and there are pages,
2315 	 * do a synchronous flush and commit of all of the
2316 	 * dirty and uncommitted pages.
2317 	 */
2318 	ASSERT(!e.error);
2319 	if ((flag & FWRITE) && nfs4_has_pages(vp))
2320 		error = nfs4_putpage_commit(vp, 0, 0, cr);
2321 
2322 	mutex_enter(&rp->r_statelock);
2323 	r_error = rp->r_error;
2324 	rp->r_error = 0;
2325 	mutex_exit(&rp->r_statelock);
2326 
2327 	/*
2328 	 * If this file type is one for which no explicit 'open' was
2329 	 * done, then bail now (ie. no need for protocol 'close'). If
2330 	 * there was an error w/the vm subsystem, return _that_ error,
2331 	 * otherwise, return any errors that may've been reported via
2332 	 * the rnode.
2333 	 */
2334 	if (vp->v_type != VREG)
2335 		return (error ? error : r_error);
2336 
2337 	/*
2338 	 * The sync putpage commit may have failed above, but since
2339 	 * we're working w/a regular file, we need to do the protocol
2340 	 * 'close' (nfs4close_one will figure out if an otw close is
2341 	 * needed or not). Report any errors _after_ doing the protocol
2342 	 * 'close'.
2343 	 */
2344 	nfs4close_one(vp, NULL, cr, flag, NULL, &e, CLOSE_NORM, 0, 0, 0);
2345 	n4error = e.error ? e.error : geterrno4(e.stat);
2346 
2347 	/*
2348 	 * Error reporting prio (Hi -> Lo)
2349 	 *
2350 	 *   i) nfs4_putpage_commit (error)
2351 	 *  ii) rnode's (r_error)
2352 	 * iii) nfs4close_one (n4error)
2353 	 */
2354 	return (error ? error : (r_error ? r_error : n4error));
2355 }
2356 
2357 /*
2358  * Initialize *lost_rqstp.
2359  */
2360 
2361 static void
2362 nfs4close_save_lost_rqst(int error, nfs4_lost_rqst_t *lost_rqstp,
2363     nfs4_open_owner_t *oop, nfs4_open_stream_t *osp, cred_t *cr,
2364     vnode_t *vp)
2365 {
2366 	if (error != ETIMEDOUT && error != EINTR &&
2367 	    !NFS4_FRC_UNMT_ERR(error, vp->v_vfsp)) {
2368 		lost_rqstp->lr_op = 0;
2369 		return;
2370 	}
2371 
2372 	NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
2373 	    "nfs4close_save_lost_rqst: error %d", error));
2374 
2375 	lost_rqstp->lr_op = OP_CLOSE;
2376 	/*
2377 	 * The vp is held and rele'd via the recovery code.
2378 	 * See nfs4_save_lost_rqst.
2379 	 */
2380 	lost_rqstp->lr_vp = vp;
2381 	lost_rqstp->lr_dvp = NULL;
2382 	lost_rqstp->lr_oop = oop;
2383 	lost_rqstp->lr_osp = osp;
2384 	ASSERT(osp != NULL);
2385 	ASSERT(mutex_owned(&osp->os_sync_lock));
2386 	osp->os_pending_close = 1;
2387 	lost_rqstp->lr_lop = NULL;
2388 	lost_rqstp->lr_cr = cr;
2389 	lost_rqstp->lr_flk = NULL;
2390 	lost_rqstp->lr_putfirst = FALSE;
2391 }
2392 
2393 /*
2394  * Assumes you already have the open seqid sync grabbed as well as the
2395  * 'os_sync_lock'.  Note: this will release the open seqid sync and
2396  * 'os_sync_lock' if client recovery starts.  Calling functions have to
2397  * be prepared to handle this.
2398  *
2399  * 'recov' is returned as 1 if the CLOSE operation detected client recovery
2400  * was needed and was started, and that the calling function should retry
2401  * this function; otherwise it is returned as 0.
2402  *
2403  * Errors are returned via the nfs4_error_t parameter.
2404  */
2405 static void
2406 nfs4close_otw(rnode4_t *rp, cred_t *cred_otw, nfs4_open_owner_t *oop,
2407     nfs4_open_stream_t *osp, int *recov, int *did_start_seqid_syncp,
2408     nfs4_close_type_t close_type, nfs4_error_t *ep, int *have_sync_lockp)
2409 {
2410 	COMPOUND4args_clnt args;
2411 	COMPOUND4res_clnt res;
2412 	CLOSE4args *close_args;
2413 	nfs_resop4 *resop;
2414 	nfs_argop4 argop[3];
2415 	int doqueue = 1;
2416 	mntinfo4_t *mi;
2417 	seqid4 seqid;
2418 	vnode_t *vp;
2419 	bool_t needrecov = FALSE;
2420 	nfs4_lost_rqst_t lost_rqst;
2421 	hrtime_t t;
2422 
2423 	ASSERT(nfs_zone() == VTOMI4(RTOV4(rp))->mi_zone);
2424 
2425 	ASSERT(MUTEX_HELD(&osp->os_sync_lock));
2426 
2427 	NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4close_otw"));
2428 
2429 	/* Only set this to 1 if recovery is started */
2430 	*recov = 0;
2431 
2432 	/* do the OTW call to close the file */
2433 
2434 	if (close_type == CLOSE_RESEND)
2435 		args.ctag = TAG_CLOSE_LOST;
2436 	else if (close_type == CLOSE_AFTER_RESEND)
2437 		args.ctag = TAG_CLOSE_UNDO;
2438 	else
2439 		args.ctag = TAG_CLOSE;
2440 
2441 	args.array_len = 3;
2442 	args.array = argop;
2443 
2444 	vp = RTOV4(rp);
2445 
2446 	mi = VTOMI4(vp);
2447 
2448 	/* putfh target fh */
2449 	argop[0].argop = OP_CPUTFH;
2450 	argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
2451 
2452 	argop[1].argop = OP_GETATTR;
2453 	argop[1].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
2454 	argop[1].nfs_argop4_u.opgetattr.mi = mi;
2455 
2456 	argop[2].argop = OP_CLOSE;
2457 	close_args = &argop[2].nfs_argop4_u.opclose;
2458 
2459 	seqid = nfs4_get_open_seqid(oop) + 1;
2460 
2461 	close_args->seqid = seqid;
2462 	close_args->open_stateid = osp->open_stateid;
2463 
2464 	NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
2465 	    "nfs4close_otw: %s call, rp %s", needrecov ? "recov" : "first",
2466 	    rnode4info(rp)));
2467 
2468 	t = gethrtime();
2469 
2470 	rfs4call(mi, &args, &res, cred_otw, &doqueue, 0, ep);
2471 
2472 	if (!ep->error && nfs4_need_to_bump_seqid(&res)) {
2473 		nfs4_set_open_seqid(seqid, oop, args.ctag);
2474 	}
2475 
2476 	needrecov = nfs4_needs_recovery(ep, TRUE, mi->mi_vfsp);
2477 	if (ep->error && !needrecov) {
2478 		/*
2479 		 * if there was an error and no recovery is to be done
2480 		 * then then set up the file to flush its cache if
2481 		 * needed for the next caller.
2482 		 */
2483 		mutex_enter(&rp->r_statelock);
2484 		PURGE_ATTRCACHE4_LOCKED(rp);
2485 		rp->r_flags &= ~R4WRITEMODIFIED;
2486 		mutex_exit(&rp->r_statelock);
2487 		return;
2488 	}
2489 
2490 	if (needrecov) {
2491 		bool_t abort;
2492 		nfs4_bseqid_entry_t *bsep = NULL;
2493 
2494 		if (close_type != CLOSE_RESEND)
2495 			nfs4close_save_lost_rqst(ep->error, &lost_rqst, oop,
2496 			    osp, cred_otw, vp);
2497 
2498 		if (!ep->error && res.status == NFS4ERR_BAD_SEQID)
2499 			bsep = nfs4_create_bseqid_entry(oop, NULL, vp,
2500 			    0, args.ctag, close_args->seqid);
2501 
2502 		NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
2503 		    "nfs4close_otw: initiating recovery. error %d "
2504 		    "res.status %d", ep->error, res.status));
2505 
2506 		/*
2507 		 * Drop the 'os_sync_lock' here so we don't hit
2508 		 * a potential recursive mutex_enter via an
2509 		 * 'open_stream_hold()'.
2510 		 */
2511 		mutex_exit(&osp->os_sync_lock);
2512 		*have_sync_lockp = 0;
2513 		abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL, NULL,
2514 		    (close_type != CLOSE_RESEND &&
2515 		    lost_rqst.lr_op == OP_CLOSE) ? &lost_rqst : NULL,
2516 		    OP_CLOSE, bsep);
2517 
2518 		/* drop open seq sync, and let the calling function regrab it */
2519 		nfs4_end_open_seqid_sync(oop);
2520 		*did_start_seqid_syncp = 0;
2521 
2522 		if (bsep)
2523 			kmem_free(bsep, sizeof (*bsep));
2524 		/*
2525 		 * For signals, the caller wants to quit, so don't say to
2526 		 * retry.  For forced unmount, if it's a user thread, it
2527 		 * wants to quit.  If it's a recovery thread, the retry
2528 		 * will happen higher-up on the call stack.  Either way,
2529 		 * don't say to retry.
2530 		 */
2531 		if (abort == FALSE && ep->error != EINTR &&
2532 		    !NFS4_FRC_UNMT_ERR(ep->error, mi->mi_vfsp) &&
2533 		    close_type != CLOSE_RESEND &&
2534 		    close_type != CLOSE_AFTER_RESEND)
2535 			*recov = 1;
2536 		else
2537 			*recov = 0;
2538 
2539 		if (!ep->error)
2540 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2541 		return;
2542 	}
2543 
2544 	if (res.status) {
2545 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2546 		return;
2547 	}
2548 
2549 	mutex_enter(&rp->r_statev4_lock);
2550 	rp->created_v4 = 0;
2551 	mutex_exit(&rp->r_statev4_lock);
2552 
2553 	resop = &res.array[2];
2554 	osp->open_stateid = resop->nfs_resop4_u.opclose.open_stateid;
2555 	osp->os_valid = 0;
2556 
2557 	/*
2558 	 * This removes the reference obtained at OPEN; ie, when the
2559 	 * open stream structure was created.
2560 	 *
2561 	 * We don't have to worry about calling 'open_stream_rele'
2562 	 * since we our currently holding a reference to the open
2563 	 * stream which means the count cannot go to 0 with this
2564 	 * decrement.
2565 	 */
2566 	ASSERT(osp->os_ref_count >= 2);
2567 	osp->os_ref_count--;
2568 
2569 	if (!ep->error)
2570 		nfs4_attr_cache(vp,
2571 		    &res.array[1].nfs_resop4_u.opgetattr.ga_res,
2572 		    t, cred_otw, TRUE, NULL);
2573 
2574 	NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE, "nfs4close_otw:"
2575 	    " returning %d", ep->error));
2576 
2577 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
2578 }
2579 
2580 /* ARGSUSED */
2581 static int
2582 nfs4_read(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
2583     caller_context_t *ct)
2584 {
2585 	rnode4_t *rp;
2586 	u_offset_t off;
2587 	offset_t diff;
2588 	uint_t on;
2589 	uint_t n;
2590 	caddr_t base;
2591 	uint_t flags;
2592 	int error;
2593 	mntinfo4_t *mi;
2594 
2595 	rp = VTOR4(vp);
2596 
2597 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
2598 
2599 	if (IS_SHADOW(vp, rp))
2600 		vp = RTOV4(rp);
2601 
2602 	if (vp->v_type != VREG)
2603 		return (EISDIR);
2604 
2605 	mi = VTOMI4(vp);
2606 
2607 	if (nfs_zone() != mi->mi_zone)
2608 		return (EIO);
2609 
2610 	if (uiop->uio_resid == 0)
2611 		return (0);
2612 
2613 	if (uiop->uio_loffset < 0 || uiop->uio_loffset + uiop->uio_resid < 0)
2614 		return (EINVAL);
2615 
2616 	mutex_enter(&rp->r_statelock);
2617 	if (rp->r_flags & R4RECOVERRP)
2618 		error = (rp->r_error ? rp->r_error : EIO);
2619 	else
2620 		error = 0;
2621 	mutex_exit(&rp->r_statelock);
2622 	if (error)
2623 		return (error);
2624 
2625 	/*
2626 	 * Bypass VM if caching has been disabled (e.g., locking) or if
2627 	 * using client-side direct I/O and the file is not mmap'd and
2628 	 * there are no cached pages.
2629 	 */
2630 	if ((vp->v_flag & VNOCACHE) ||
2631 	    (((rp->r_flags & R4DIRECTIO) || (mi->mi_flags & MI4_DIRECTIO)) &&
2632 	    rp->r_mapcnt == 0 && !nfs4_has_pages(vp))) {
2633 		size_t resid = 0;
2634 
2635 		return (nfs4read(vp, NULL, uiop->uio_loffset,
2636 		    uiop->uio_resid, &resid, cr, FALSE, uiop));
2637 	}
2638 
2639 	error = 0;
2640 
2641 	do {
2642 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
2643 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
2644 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
2645 
2646 		if (error = nfs4_validate_caches(vp, cr))
2647 			break;
2648 
2649 		mutex_enter(&rp->r_statelock);
2650 		while (rp->r_flags & R4INCACHEPURGE) {
2651 			if (!cv_wait_sig(&rp->r_cv, &rp->r_statelock)) {
2652 				mutex_exit(&rp->r_statelock);
2653 				return (EINTR);
2654 			}
2655 		}
2656 		diff = rp->r_size - uiop->uio_loffset;
2657 		mutex_exit(&rp->r_statelock);
2658 		if (diff <= 0)
2659 			break;
2660 		if (diff < n)
2661 			n = (uint_t)diff;
2662 
2663 		if (vpm_enable) {
2664 			/*
2665 			 * Copy data.
2666 			 */
2667 			error = vpm_data_copy(vp, off + on, n, uiop,
2668 			    1, NULL, 0, S_READ);
2669 		} else {
2670 			base = segmap_getmapflt(segkmap, vp, off + on, n, 1,
2671 			    S_READ);
2672 
2673 			error = uiomove(base + on, n, UIO_READ, uiop);
2674 		}
2675 
2676 		if (!error) {
2677 			/*
2678 			 * If read a whole block or read to eof,
2679 			 * won't need this buffer again soon.
2680 			 */
2681 			mutex_enter(&rp->r_statelock);
2682 			if (n + on == MAXBSIZE ||
2683 			    uiop->uio_loffset == rp->r_size)
2684 				flags = SM_DONTNEED;
2685 			else
2686 				flags = 0;
2687 			mutex_exit(&rp->r_statelock);
2688 			if (vpm_enable) {
2689 				error = vpm_sync_pages(vp, off, n, flags);
2690 			} else {
2691 				error = segmap_release(segkmap, base, flags);
2692 			}
2693 		} else {
2694 			if (vpm_enable) {
2695 				(void) vpm_sync_pages(vp, off, n, 0);
2696 			} else {
2697 				(void) segmap_release(segkmap, base, 0);
2698 			}
2699 		}
2700 	} while (!error && uiop->uio_resid > 0);
2701 
2702 	return (error);
2703 }
2704 
2705 /* ARGSUSED */
2706 static int
2707 nfs4_write(vnode_t *vp, struct uio *uiop, int ioflag, cred_t *cr,
2708     caller_context_t *ct)
2709 {
2710 	rlim64_t limit = uiop->uio_llimit;
2711 	rnode4_t *rp;
2712 	u_offset_t off;
2713 	caddr_t base;
2714 	uint_t flags;
2715 	int remainder;
2716 	size_t n;
2717 	int on;
2718 	int error;
2719 	int resid;
2720 	u_offset_t offset;
2721 	mntinfo4_t *mi;
2722 	uint_t bsize;
2723 
2724 	rp = VTOR4(vp);
2725 
2726 	if (IS_SHADOW(vp, rp))
2727 		vp = RTOV4(rp);
2728 
2729 	if (vp->v_type != VREG)
2730 		return (EISDIR);
2731 
2732 	mi = VTOMI4(vp);
2733 
2734 	if (nfs_zone() != mi->mi_zone)
2735 		return (EIO);
2736 
2737 	if (uiop->uio_resid == 0)
2738 		return (0);
2739 
2740 	mutex_enter(&rp->r_statelock);
2741 	if (rp->r_flags & R4RECOVERRP)
2742 		error = (rp->r_error ? rp->r_error : EIO);
2743 	else
2744 		error = 0;
2745 	mutex_exit(&rp->r_statelock);
2746 	if (error)
2747 		return (error);
2748 
2749 	if (ioflag & FAPPEND) {
2750 		struct vattr va;
2751 
2752 		/*
2753 		 * Must serialize if appending.
2754 		 */
2755 		if (nfs_rw_lock_held(&rp->r_rwlock, RW_READER)) {
2756 			nfs_rw_exit(&rp->r_rwlock);
2757 			if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER,
2758 			    INTR(vp)))
2759 				return (EINTR);
2760 		}
2761 
2762 		va.va_mask = AT_SIZE;
2763 		error = nfs4getattr(vp, &va, cr);
2764 		if (error)
2765 			return (error);
2766 		uiop->uio_loffset = va.va_size;
2767 	}
2768 
2769 	offset = uiop->uio_loffset + uiop->uio_resid;
2770 
2771 	if (uiop->uio_loffset < (offset_t)0 || offset < 0)
2772 		return (EINVAL);
2773 
2774 	if (limit == RLIM64_INFINITY || limit > MAXOFFSET_T)
2775 		limit = MAXOFFSET_T;
2776 
2777 	/*
2778 	 * Check to make sure that the process will not exceed
2779 	 * its limit on file size.  It is okay to write up to
2780 	 * the limit, but not beyond.  Thus, the write which
2781 	 * reaches the limit will be short and the next write
2782 	 * will return an error.
2783 	 */
2784 	remainder = 0;
2785 	if (offset > uiop->uio_llimit) {
2786 		remainder = offset - uiop->uio_llimit;
2787 		uiop->uio_resid = uiop->uio_llimit - uiop->uio_loffset;
2788 		if (uiop->uio_resid <= 0) {
2789 			proc_t *p = ttoproc(curthread);
2790 
2791 			uiop->uio_resid += remainder;
2792 			mutex_enter(&p->p_lock);
2793 			(void) rctl_action(rctlproc_legacy[RLIMIT_FSIZE],
2794 			    p->p_rctls, p, RCA_UNSAFE_SIGINFO);
2795 			mutex_exit(&p->p_lock);
2796 			return (EFBIG);
2797 		}
2798 	}
2799 
2800 	/* update the change attribute, if we have a write delegation */
2801 
2802 	mutex_enter(&rp->r_statev4_lock);
2803 	if (rp->r_deleg_type == OPEN_DELEGATE_WRITE)
2804 		rp->r_deleg_change++;
2805 
2806 	mutex_exit(&rp->r_statev4_lock);
2807 
2808 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR4(vp)))
2809 		return (EINTR);
2810 
2811 	/*
2812 	 * Bypass VM if caching has been disabled (e.g., locking) or if
2813 	 * using client-side direct I/O and the file is not mmap'd and
2814 	 * there are no cached pages.
2815 	 */
2816 	if ((vp->v_flag & VNOCACHE) ||
2817 	    (((rp->r_flags & R4DIRECTIO) || (mi->mi_flags & MI4_DIRECTIO)) &&
2818 	    rp->r_mapcnt == 0 && !nfs4_has_pages(vp))) {
2819 		size_t bufsize;
2820 		int count;
2821 		u_offset_t org_offset;
2822 		stable_how4 stab_comm;
2823 nfs4_fwrite:
2824 		if (rp->r_flags & R4STALE) {
2825 			resid = uiop->uio_resid;
2826 			offset = uiop->uio_loffset;
2827 			error = rp->r_error;
2828 			goto bottom;
2829 		}
2830 
2831 		bufsize = MIN(uiop->uio_resid, mi->mi_stsize);
2832 		base = kmem_alloc(bufsize, KM_SLEEP);
2833 		do {
2834 			if (ioflag & FDSYNC)
2835 				stab_comm = DATA_SYNC4;
2836 			else
2837 				stab_comm = FILE_SYNC4;
2838 			resid = uiop->uio_resid;
2839 			offset = uiop->uio_loffset;
2840 			count = MIN(uiop->uio_resid, bufsize);
2841 			org_offset = uiop->uio_loffset;
2842 			error = uiomove(base, count, UIO_WRITE, uiop);
2843 			if (!error) {
2844 				error = nfs4write(vp, base, org_offset,
2845 				    count, cr, &stab_comm);
2846 				if (!error) {
2847 					mutex_enter(&rp->r_statelock);
2848 					if (rp->r_size < uiop->uio_loffset)
2849 						rp->r_size = uiop->uio_loffset;
2850 					mutex_exit(&rp->r_statelock);
2851 				}
2852 			}
2853 		} while (!error && uiop->uio_resid > 0);
2854 		kmem_free(base, bufsize);
2855 		goto bottom;
2856 	}
2857 
2858 	bsize = vp->v_vfsp->vfs_bsize;
2859 
2860 	do {
2861 		off = uiop->uio_loffset & MAXBMASK; /* mapping offset */
2862 		on = uiop->uio_loffset & MAXBOFFSET; /* Relative offset */
2863 		n = MIN(MAXBSIZE - on, uiop->uio_resid);
2864 
2865 		resid = uiop->uio_resid;
2866 		offset = uiop->uio_loffset;
2867 
2868 		if (rp->r_flags & R4STALE) {
2869 			error = rp->r_error;
2870 			break;
2871 		}
2872 
2873 		/*
2874 		 * Don't create dirty pages faster than they
2875 		 * can be cleaned so that the system doesn't
2876 		 * get imbalanced.  If the async queue is
2877 		 * maxed out, then wait for it to drain before
2878 		 * creating more dirty pages.  Also, wait for
2879 		 * any threads doing pagewalks in the vop_getattr
2880 		 * entry points so that they don't block for
2881 		 * long periods.
2882 		 */
2883 		mutex_enter(&rp->r_statelock);
2884 		while ((mi->mi_max_threads != 0 &&
2885 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
2886 		    rp->r_gcount > 0)
2887 			cv_wait(&rp->r_cv, &rp->r_statelock);
2888 		mutex_exit(&rp->r_statelock);
2889 
2890 		if (vpm_enable) {
2891 			/*
2892 			 * It will use kpm mappings, so no need to
2893 			 * pass an address.
2894 			 */
2895 			error = writerp4(rp, NULL, n, uiop, 0);
2896 		} else  {
2897 			if (segmap_kpm) {
2898 				int pon = uiop->uio_loffset & PAGEOFFSET;
2899 				size_t pn = MIN(PAGESIZE - pon,
2900 				    uiop->uio_resid);
2901 				int pagecreate;
2902 
2903 				mutex_enter(&rp->r_statelock);
2904 				pagecreate = (pon == 0) && (pn == PAGESIZE ||
2905 				    uiop->uio_loffset + pn >= rp->r_size);
2906 				mutex_exit(&rp->r_statelock);
2907 
2908 				base = segmap_getmapflt(segkmap, vp, off + on,
2909 				    pn, !pagecreate, S_WRITE);
2910 
2911 				error = writerp4(rp, base + pon, n, uiop,
2912 				    pagecreate);
2913 
2914 			} else {
2915 				base = segmap_getmapflt(segkmap, vp, off + on,
2916 				    n, 0, S_READ);
2917 				error = writerp4(rp, base + on, n, uiop, 0);
2918 			}
2919 		}
2920 
2921 		if (!error) {
2922 			if (mi->mi_flags & MI4_NOAC)
2923 				flags = SM_WRITE;
2924 			else if ((uiop->uio_loffset % bsize) == 0 ||
2925 			    IS_SWAPVP(vp)) {
2926 				/*
2927 				 * Have written a whole block.
2928 				 * Start an asynchronous write
2929 				 * and mark the buffer to
2930 				 * indicate that it won't be
2931 				 * needed again soon.
2932 				 */
2933 				flags = SM_WRITE | SM_ASYNC | SM_DONTNEED;
2934 			} else
2935 				flags = 0;
2936 			if ((ioflag & (FSYNC|FDSYNC)) ||
2937 			    (rp->r_flags & R4OUTOFSPACE)) {
2938 				flags &= ~SM_ASYNC;
2939 				flags |= SM_WRITE;
2940 			}
2941 			if (vpm_enable) {
2942 				error = vpm_sync_pages(vp, off, n, flags);
2943 			} else {
2944 				error = segmap_release(segkmap, base, flags);
2945 			}
2946 		} else {
2947 			if (vpm_enable) {
2948 				(void) vpm_sync_pages(vp, off, n, 0);
2949 			} else {
2950 				(void) segmap_release(segkmap, base, 0);
2951 			}
2952 			/*
2953 			 * In the event that we got an access error while
2954 			 * faulting in a page for a write-only file just
2955 			 * force a write.
2956 			 */
2957 			if (error == EACCES)
2958 				goto nfs4_fwrite;
2959 		}
2960 	} while (!error && uiop->uio_resid > 0);
2961 
2962 bottom:
2963 	if (error) {
2964 		uiop->uio_resid = resid + remainder;
2965 		uiop->uio_loffset = offset;
2966 	} else {
2967 		uiop->uio_resid += remainder;
2968 
2969 		mutex_enter(&rp->r_statev4_lock);
2970 		if (rp->r_deleg_type == OPEN_DELEGATE_WRITE) {
2971 			gethrestime(&rp->r_attr.va_mtime);
2972 			rp->r_attr.va_ctime = rp->r_attr.va_mtime;
2973 		}
2974 		mutex_exit(&rp->r_statev4_lock);
2975 	}
2976 
2977 	nfs_rw_exit(&rp->r_lkserlock);
2978 
2979 	return (error);
2980 }
2981 
2982 /*
2983  * Flags are composed of {B_ASYNC, B_INVAL, B_FREE, B_DONTNEED}
2984  */
2985 static int
2986 nfs4_rdwrlbn(vnode_t *vp, page_t *pp, u_offset_t off, size_t len,
2987     int flags, cred_t *cr)
2988 {
2989 	struct buf *bp;
2990 	int error;
2991 	page_t *savepp;
2992 	uchar_t fsdata;
2993 	stable_how4 stab_comm;
2994 
2995 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
2996 	bp = pageio_setup(pp, len, vp, flags);
2997 	ASSERT(bp != NULL);
2998 
2999 	/*
3000 	 * pageio_setup should have set b_addr to 0.  This
3001 	 * is correct since we want to do I/O on a page
3002 	 * boundary.  bp_mapin will use this addr to calculate
3003 	 * an offset, and then set b_addr to the kernel virtual
3004 	 * address it allocated for us.
3005 	 */
3006 	ASSERT(bp->b_un.b_addr == 0);
3007 
3008 	bp->b_edev = 0;
3009 	bp->b_dev = 0;
3010 	bp->b_lblkno = lbtodb(off);
3011 	bp->b_file = vp;
3012 	bp->b_offset = (offset_t)off;
3013 	bp_mapin(bp);
3014 
3015 	if ((flags & (B_WRITE|B_ASYNC)) == (B_WRITE|B_ASYNC) &&
3016 	    freemem > desfree)
3017 		stab_comm = UNSTABLE4;
3018 	else
3019 		stab_comm = FILE_SYNC4;
3020 
3021 	error = nfs4_bio(bp, &stab_comm, cr, FALSE);
3022 
3023 	bp_mapout(bp);
3024 	pageio_done(bp);
3025 
3026 	if (stab_comm == UNSTABLE4)
3027 		fsdata = C_DELAYCOMMIT;
3028 	else
3029 		fsdata = C_NOCOMMIT;
3030 
3031 	savepp = pp;
3032 	do {
3033 		pp->p_fsdata = fsdata;
3034 	} while ((pp = pp->p_next) != savepp);
3035 
3036 	return (error);
3037 }
3038 
3039 /*
3040  */
3041 static int
3042 nfs4rdwr_check_osid(vnode_t *vp, nfs4_error_t *ep, cred_t *cr)
3043 {
3044 	nfs4_open_owner_t	*oop;
3045 	nfs4_open_stream_t	*osp;
3046 	rnode4_t		*rp = VTOR4(vp);
3047 	mntinfo4_t 		*mi = VTOMI4(vp);
3048 	int 			reopen_needed;
3049 
3050 	ASSERT(nfs_zone() == mi->mi_zone);
3051 
3052 
3053 	oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
3054 	if (!oop)
3055 		return (EIO);
3056 
3057 	/* returns with 'os_sync_lock' held */
3058 	osp = find_open_stream(oop, rp);
3059 	if (!osp) {
3060 		open_owner_rele(oop);
3061 		return (EIO);
3062 	}
3063 
3064 	if (osp->os_failed_reopen) {
3065 		mutex_exit(&osp->os_sync_lock);
3066 		open_stream_rele(osp, rp);
3067 		open_owner_rele(oop);
3068 		return (EIO);
3069 	}
3070 
3071 	/*
3072 	 * Determine whether a reopen is needed.  If this
3073 	 * is a delegation open stream, then the os_delegation bit
3074 	 * should be set.
3075 	 */
3076 
3077 	reopen_needed = osp->os_delegation;
3078 
3079 	mutex_exit(&osp->os_sync_lock);
3080 	open_owner_rele(oop);
3081 
3082 	if (reopen_needed) {
3083 		nfs4_error_zinit(ep);
3084 		nfs4_reopen(vp, osp, ep, CLAIM_NULL, FALSE, FALSE);
3085 		mutex_enter(&osp->os_sync_lock);
3086 		if (ep->error || ep->stat || osp->os_failed_reopen) {
3087 			mutex_exit(&osp->os_sync_lock);
3088 			open_stream_rele(osp, rp);
3089 			return (EIO);
3090 		}
3091 		mutex_exit(&osp->os_sync_lock);
3092 	}
3093 	open_stream_rele(osp, rp);
3094 
3095 	return (0);
3096 }
3097 
3098 /*
3099  * Write to file.  Writes to remote server in largest size
3100  * chunks that the server can handle.  Write is synchronous.
3101  */
3102 static int
3103 nfs4write(vnode_t *vp, caddr_t base, u_offset_t offset, int count, cred_t *cr,
3104     stable_how4 *stab_comm)
3105 {
3106 	mntinfo4_t *mi;
3107 	COMPOUND4args_clnt args;
3108 	COMPOUND4res_clnt res;
3109 	WRITE4args *wargs;
3110 	WRITE4res *wres;
3111 	nfs_argop4 argop[2];
3112 	nfs_resop4 *resop;
3113 	int tsize;
3114 	stable_how4 stable;
3115 	rnode4_t *rp;
3116 	int doqueue = 1;
3117 	bool_t needrecov;
3118 	nfs4_recov_state_t recov_state;
3119 	nfs4_stateid_types_t sid_types;
3120 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
3121 	int recov;
3122 
3123 	rp = VTOR4(vp);
3124 	mi = VTOMI4(vp);
3125 
3126 	ASSERT(nfs_zone() == mi->mi_zone);
3127 
3128 	stable = *stab_comm;
3129 	*stab_comm = FILE_SYNC4;
3130 
3131 	needrecov = FALSE;
3132 	recov_state.rs_flags = 0;
3133 	recov_state.rs_num_retry_despite_err = 0;
3134 	nfs4_init_stateid_types(&sid_types);
3135 
3136 	/* Is curthread the recovery thread? */
3137 	mutex_enter(&mi->mi_lock);
3138 	recov = (mi->mi_recovthread == curthread);
3139 	mutex_exit(&mi->mi_lock);
3140 
3141 recov_retry:
3142 	args.ctag = TAG_WRITE;
3143 	args.array_len = 2;
3144 	args.array = argop;
3145 
3146 	if (!recov) {
3147 		e.error = nfs4_start_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3148 		    &recov_state, NULL);
3149 		if (e.error)
3150 			return (e.error);
3151 	}
3152 
3153 	/* 0. putfh target fh */
3154 	argop[0].argop = OP_CPUTFH;
3155 	argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
3156 
3157 	/* 1. write */
3158 	nfs4args_write(&argop[1], stable, rp, cr, &wargs, &sid_types);
3159 
3160 	do {
3161 
3162 		wargs->offset = (offset4)offset;
3163 		wargs->data_val = base;
3164 
3165 		if (mi->mi_io_kstats) {
3166 			mutex_enter(&mi->mi_lock);
3167 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
3168 			mutex_exit(&mi->mi_lock);
3169 		}
3170 
3171 		if ((vp->v_flag & VNOCACHE) ||
3172 		    (rp->r_flags & R4DIRECTIO) ||
3173 		    (mi->mi_flags & MI4_DIRECTIO))
3174 			tsize = MIN(mi->mi_stsize, count);
3175 		else
3176 			tsize = MIN(mi->mi_curwrite, count);
3177 		wargs->data_len = (uint_t)tsize;
3178 		rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
3179 
3180 		if (mi->mi_io_kstats) {
3181 			mutex_enter(&mi->mi_lock);
3182 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
3183 			mutex_exit(&mi->mi_lock);
3184 		}
3185 
3186 		if (!recov) {
3187 			needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
3188 			if (e.error && !needrecov) {
3189 				nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3190 				    &recov_state, needrecov);
3191 				return (e.error);
3192 			}
3193 
3194 
3195 			/*
3196 			 * Do handling of OLD_STATEID outside
3197 			 * of the normal recovery framework.
3198 			 *
3199 			 * If write receives a BAD stateid error while using a
3200 			 * delegation stateid, retry using the open stateid
3201 			 * (if it exists).  If it doesn't have an open stateid,
3202 			 * reopen the * file first, then retry.
3203 			 */
3204 			if (!e.error && res.status == NFS4ERR_OLD_STATEID &&
3205 			    sid_types.cur_sid_type != SPEC_SID) {
3206 				nfs4_save_stateid(&wargs->stateid, &sid_types);
3207 				nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3208 				    &recov_state, needrecov);
3209 				(void) xdr_free(xdr_COMPOUND4res_clnt,
3210 				    (caddr_t)&res);
3211 				goto recov_retry;
3212 			} else if (e.error == 0 &&
3213 			    res.status == NFS4ERR_BAD_STATEID &&
3214 			    sid_types.cur_sid_type == DEL_SID) {
3215 				nfs4_save_stateid(&wargs->stateid, &sid_types);
3216 				mutex_enter(&rp->r_statev4_lock);
3217 				rp->r_deleg_return_pending = TRUE;
3218 				mutex_exit(&rp->r_statev4_lock);
3219 				if (nfs4rdwr_check_osid(vp, &e, cr)) {
3220 					nfs4_end_fop(mi, vp, NULL, OH_WRITE,
3221 					    &recov_state, needrecov);
3222 					(void) xdr_free(xdr_COMPOUND4res_clnt,
3223 					    (caddr_t)&res);
3224 					return (EIO);
3225 				}
3226 				nfs4_end_fop(mi, vp, NULL, OH_WRITE,
3227 				    &recov_state, needrecov);
3228 				/* hold needed for nfs4delegreturn_thread */
3229 				VN_HOLD(vp);
3230 				nfs4delegreturn_async(rp,
3231 				    (NFS4_DR_PUSH|NFS4_DR_REOPEN|
3232 				    NFS4_DR_DISCARD), FALSE);
3233 				(void) xdr_free(xdr_COMPOUND4res_clnt,
3234 				    (caddr_t)&res);
3235 				goto recov_retry;
3236 			}
3237 
3238 			if (needrecov) {
3239 				bool_t abort;
3240 
3241 				NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
3242 				    "nfs4write: client got error %d, "
3243 				    "res.status %d, so start recovery",
3244 				    e.error, res.status));
3245 
3246 				abort = nfs4_start_recovery(&e,
3247 				    VTOMI4(vp), vp, NULL, &wargs->stateid,
3248 				    NULL, OP_WRITE, NULL);
3249 				if (!e.error) {
3250 					e.error = geterrno4(res.status);
3251 					(void) xdr_free(xdr_COMPOUND4res_clnt,
3252 					    (caddr_t)&res);
3253 				}
3254 				nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3255 				    &recov_state, needrecov);
3256 				if (abort == FALSE)
3257 					goto recov_retry;
3258 				return (e.error);
3259 			}
3260 
3261 			if (res.status) {
3262 				e.error = geterrno4(res.status);
3263 				(void) xdr_free(xdr_COMPOUND4res_clnt,
3264 				    (caddr_t)&res);
3265 				nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3266 				    &recov_state, needrecov);
3267 				return (e.error);
3268 			}
3269 
3270 			resop = &res.array[1];	/* write res */
3271 			wres = &resop->nfs_resop4_u.opwrite;
3272 
3273 			if ((int)wres->count > tsize) {
3274 				(void) xdr_free(xdr_COMPOUND4res_clnt,
3275 				    (caddr_t)&res);
3276 
3277 				zcmn_err(getzoneid(), CE_WARN,
3278 				    "nfs4write: server wrote %u, requested "
3279 				    "was %u", (int)wres->count, tsize);
3280 				nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE,
3281 				    &recov_state, needrecov);
3282 				return (EIO);
3283 			}
3284 			if (wres->committed == UNSTABLE4) {
3285 				*stab_comm = UNSTABLE4;
3286 				if (wargs->stable == DATA_SYNC4 ||
3287 				    wargs->stable == FILE_SYNC4) {
3288 					(void) xdr_free(xdr_COMPOUND4res_clnt,
3289 					    (caddr_t)&res);
3290 					zcmn_err(getzoneid(), CE_WARN,
3291 					    "nfs4write: server %s did not "
3292 					    "commit to stable storage",
3293 					    rp->r_server->sv_hostname);
3294 					nfs4_end_fop(VTOMI4(vp), vp, NULL,
3295 					    OH_WRITE, &recov_state, needrecov);
3296 					return (EIO);
3297 				}
3298 			}
3299 		}
3300 
3301 		tsize = (int)wres->count;
3302 		count -= tsize;
3303 		base += tsize;
3304 		offset += tsize;
3305 		if (mi->mi_io_kstats) {
3306 			mutex_enter(&mi->mi_lock);
3307 			KSTAT_IO_PTR(mi->mi_io_kstats)->writes++;
3308 			KSTAT_IO_PTR(mi->mi_io_kstats)->nwritten +=
3309 			    tsize;
3310 			mutex_exit(&mi->mi_lock);
3311 		}
3312 		lwp_stat_update(LWP_STAT_OUBLK, 1);
3313 		mutex_enter(&rp->r_statelock);
3314 		if (rp->r_flags & R4HAVEVERF) {
3315 			if (rp->r_writeverf != wres->writeverf) {
3316 				nfs4_set_mod(vp);
3317 				rp->r_writeverf = wres->writeverf;
3318 			}
3319 		} else {
3320 			rp->r_writeverf = wres->writeverf;
3321 			rp->r_flags |= R4HAVEVERF;
3322 		}
3323 		PURGE_ATTRCACHE4_LOCKED(rp);
3324 		rp->r_flags |= R4WRITEMODIFIED;
3325 		gethrestime(&rp->r_attr.va_mtime);
3326 		rp->r_attr.va_ctime = rp->r_attr.va_mtime;
3327 		mutex_exit(&rp->r_statelock);
3328 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3329 	} while (count);
3330 
3331 	if (!recov)
3332 		nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_WRITE, &recov_state,
3333 		    needrecov);
3334 
3335 	return (e.error);
3336 }
3337 
3338 /*
3339  * Read from a file.  Reads data in largest chunks our interface can handle.
3340  */
3341 static int
3342 nfs4read(vnode_t *vp, caddr_t base, offset_t offset, int count,
3343     size_t *residp, cred_t *cr, bool_t async, struct uio *uiop)
3344 {
3345 	mntinfo4_t *mi;
3346 	COMPOUND4args_clnt args;
3347 	COMPOUND4res_clnt res;
3348 	READ4args *rargs;
3349 	nfs_argop4 argop[2];
3350 	int tsize;
3351 	int doqueue;
3352 	rnode4_t *rp;
3353 	int data_len;
3354 	bool_t is_eof;
3355 	bool_t needrecov = FALSE;
3356 	nfs4_recov_state_t recov_state;
3357 	nfs4_stateid_types_t sid_types;
3358 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
3359 
3360 	rp = VTOR4(vp);
3361 	mi = VTOMI4(vp);
3362 	doqueue = 1;
3363 
3364 	ASSERT(nfs_zone() == mi->mi_zone);
3365 
3366 	args.ctag = async ? TAG_READAHEAD : TAG_READ;
3367 
3368 	args.array_len = 2;
3369 	args.array = argop;
3370 
3371 	nfs4_init_stateid_types(&sid_types);
3372 
3373 	recov_state.rs_flags = 0;
3374 	recov_state.rs_num_retry_despite_err = 0;
3375 
3376 recov_retry:
3377 	e.error = nfs4_start_fop(mi, vp, NULL, OH_READ,
3378 	    &recov_state, NULL);
3379 	if (e.error)
3380 		return (e.error);
3381 
3382 	/* putfh target fh */
3383 	argop[0].argop = OP_CPUTFH;
3384 	argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
3385 
3386 	/* read */
3387 	argop[1].argop = OP_READ;
3388 	rargs = &argop[1].nfs_argop4_u.opread;
3389 	rargs->stateid = nfs4_get_stateid(cr, rp, curproc->p_pidp->pid_id, mi,
3390 	    OP_READ, &sid_types, async);
3391 
3392 	do {
3393 		if (mi->mi_io_kstats) {
3394 			mutex_enter(&mi->mi_lock);
3395 			kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
3396 			mutex_exit(&mi->mi_lock);
3397 		}
3398 
3399 		NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
3400 		    "nfs4read: %s call, rp %s",
3401 		    needrecov ? "recov" : "first",
3402 		    rnode4info(rp)));
3403 
3404 		if ((vp->v_flag & VNOCACHE) ||
3405 		    (rp->r_flags & R4DIRECTIO) ||
3406 		    (mi->mi_flags & MI4_DIRECTIO))
3407 			tsize = MIN(mi->mi_tsize, count);
3408 		else
3409 			tsize = MIN(mi->mi_curread, count);
3410 		rargs->offset = (offset4)offset;
3411 		rargs->count = (count4)tsize;
3412 		rargs->res_data_val_alt = NULL;
3413 		rargs->res_mblk = NULL;
3414 		rargs->res_uiop = NULL;
3415 		rargs->res_maxsize = 0;
3416 		if (uiop)
3417 			rargs->res_uiop = uiop;
3418 		else
3419 			rargs->res_data_val_alt = base;
3420 		rargs->res_maxsize = tsize;
3421 
3422 		rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
3423 #ifdef	DEBUG
3424 		if (nfs4read_error_inject) {
3425 			res.status = nfs4read_error_inject;
3426 			nfs4read_error_inject = 0;
3427 		}
3428 #endif
3429 
3430 		if (mi->mi_io_kstats) {
3431 			mutex_enter(&mi->mi_lock);
3432 			kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
3433 			mutex_exit(&mi->mi_lock);
3434 		}
3435 
3436 		needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
3437 		if (e.error != 0 && !needrecov) {
3438 			nfs4_end_fop(mi, vp, NULL, OH_READ,
3439 			    &recov_state, needrecov);
3440 			return (e.error);
3441 		}
3442 
3443 		/*
3444 		 * Do proper retry for OLD and BAD stateid errors outside
3445 		 * of the normal recovery framework.  There are two differences
3446 		 * between async and sync reads.  The first is that we allow
3447 		 * retry on BAD_STATEID for async reads, but not sync reads.
3448 		 * The second is that we mark the file dead for a failed
3449 		 * attempt with a special stateid for sync reads, but just
3450 		 * return EIO for async reads.
3451 		 *
3452 		 * If a sync read receives a BAD stateid error while using a
3453 		 * delegation stateid, retry using the open stateid (if it
3454 		 * exists).  If it doesn't have an open stateid, reopen the
3455 		 * file first, then retry.
3456 		 */
3457 		if (e.error == 0 && (res.status == NFS4ERR_OLD_STATEID ||
3458 		    res.status == NFS4ERR_BAD_STATEID) && async) {
3459 			nfs4_end_fop(mi, vp, NULL, OH_READ,
3460 			    &recov_state, needrecov);
3461 			if (sid_types.cur_sid_type == SPEC_SID) {
3462 				(void) xdr_free(xdr_COMPOUND4res_clnt,
3463 				    (caddr_t)&res);
3464 				return (EIO);
3465 			}
3466 			nfs4_save_stateid(&rargs->stateid, &sid_types);
3467 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3468 			goto recov_retry;
3469 		} else if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3470 		    !async && sid_types.cur_sid_type != SPEC_SID) {
3471 			nfs4_save_stateid(&rargs->stateid, &sid_types);
3472 			nfs4_end_fop(mi, vp, NULL, OH_READ,
3473 			    &recov_state, needrecov);
3474 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3475 			goto recov_retry;
3476 		} else if (e.error == 0 && res.status == NFS4ERR_BAD_STATEID &&
3477 		    sid_types.cur_sid_type == DEL_SID) {
3478 			nfs4_save_stateid(&rargs->stateid, &sid_types);
3479 			mutex_enter(&rp->r_statev4_lock);
3480 			rp->r_deleg_return_pending = TRUE;
3481 			mutex_exit(&rp->r_statev4_lock);
3482 			if (nfs4rdwr_check_osid(vp, &e, cr)) {
3483 				nfs4_end_fop(mi, vp, NULL, OH_READ,
3484 				    &recov_state, needrecov);
3485 				(void) xdr_free(xdr_COMPOUND4res_clnt,
3486 				    (caddr_t)&res);
3487 				return (EIO);
3488 			}
3489 			nfs4_end_fop(mi, vp, NULL, OH_READ,
3490 			    &recov_state, needrecov);
3491 			/* hold needed for nfs4delegreturn_thread */
3492 			VN_HOLD(vp);
3493 			nfs4delegreturn_async(rp, (NFS4_DR_PUSH|NFS4_DR_REOPEN|
3494 			    NFS4_DR_DISCARD), FALSE);
3495 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3496 			goto recov_retry;
3497 		}
3498 		if (needrecov) {
3499 			bool_t abort;
3500 
3501 			NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
3502 			    "nfs4read: initiating recovery\n"));
3503 
3504 			abort = nfs4_start_recovery(&e,
3505 			    mi, vp, NULL, &rargs->stateid,
3506 			    NULL, OP_READ, NULL);
3507 			nfs4_end_fop(mi, vp, NULL, OH_READ,
3508 			    &recov_state, needrecov);
3509 			/*
3510 			 * Do not retry if we got OLD_STATEID using a special
3511 			 * stateid.  This avoids looping with a broken server.
3512 			 */
3513 			if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3514 			    sid_types.cur_sid_type == SPEC_SID)
3515 				abort = TRUE;
3516 
3517 			if (abort == FALSE) {
3518 				/*
3519 				 * Need to retry all possible stateids in
3520 				 * case the recovery error wasn't stateid
3521 				 * related or the stateids have become
3522 				 * stale (server reboot).
3523 				 */
3524 				nfs4_init_stateid_types(&sid_types);
3525 				(void) xdr_free(xdr_COMPOUND4res_clnt,
3526 				    (caddr_t)&res);
3527 				goto recov_retry;
3528 			}
3529 
3530 			if (!e.error) {
3531 				e.error = geterrno4(res.status);
3532 				(void) xdr_free(xdr_COMPOUND4res_clnt,
3533 				    (caddr_t)&res);
3534 			}
3535 			return (e.error);
3536 		}
3537 
3538 		if (res.status) {
3539 			e.error = geterrno4(res.status);
3540 			nfs4_end_fop(mi, vp, NULL, OH_READ,
3541 			    &recov_state, needrecov);
3542 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3543 			return (e.error);
3544 		}
3545 
3546 		data_len = res.array[1].nfs_resop4_u.opread.data_len;
3547 		count -= data_len;
3548 		if (base)
3549 			base += data_len;
3550 		offset += data_len;
3551 		if (mi->mi_io_kstats) {
3552 			mutex_enter(&mi->mi_lock);
3553 			KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
3554 			KSTAT_IO_PTR(mi->mi_io_kstats)->nread += data_len;
3555 			mutex_exit(&mi->mi_lock);
3556 		}
3557 		lwp_stat_update(LWP_STAT_INBLK, 1);
3558 		is_eof = res.array[1].nfs_resop4_u.opread.eof;
3559 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3560 
3561 	} while (count && !is_eof);
3562 
3563 	*residp = count;
3564 
3565 	nfs4_end_fop(mi, vp, NULL, OH_READ, &recov_state, needrecov);
3566 
3567 	return (e.error);
3568 }
3569 
3570 /* ARGSUSED */
3571 static int
3572 nfs4_ioctl(vnode_t *vp, int cmd, intptr_t arg, int flag, cred_t *cr, int *rvalp,
3573 	caller_context_t *ct)
3574 {
3575 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
3576 		return (EIO);
3577 	switch (cmd) {
3578 		case _FIODIRECTIO:
3579 			return (nfs4_directio(vp, (int)arg, cr));
3580 		default:
3581 			return (ENOTTY);
3582 	}
3583 }
3584 
3585 /* ARGSUSED */
3586 int
3587 nfs4_getattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
3588     caller_context_t *ct)
3589 {
3590 	int error;
3591 	rnode4_t *rp = VTOR4(vp);
3592 
3593 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
3594 		return (EIO);
3595 	/*
3596 	 * If it has been specified that the return value will
3597 	 * just be used as a hint, and we are only being asked
3598 	 * for size, fsid or rdevid, then return the client's
3599 	 * notion of these values without checking to make sure
3600 	 * that the attribute cache is up to date.
3601 	 * The whole point is to avoid an over the wire GETATTR
3602 	 * call.
3603 	 */
3604 	if (flags & ATTR_HINT) {
3605 		if (vap->va_mask ==
3606 		    (vap->va_mask & (AT_SIZE | AT_FSID | AT_RDEV))) {
3607 			mutex_enter(&rp->r_statelock);
3608 			if (vap->va_mask | AT_SIZE)
3609 				vap->va_size = rp->r_size;
3610 			if (vap->va_mask | AT_FSID)
3611 				vap->va_fsid = rp->r_attr.va_fsid;
3612 			if (vap->va_mask | AT_RDEV)
3613 				vap->va_rdev = rp->r_attr.va_rdev;
3614 			mutex_exit(&rp->r_statelock);
3615 			return (0);
3616 		}
3617 	}
3618 
3619 	/*
3620 	 * Only need to flush pages if asking for the mtime
3621 	 * and if there any dirty pages or any outstanding
3622 	 * asynchronous (write) requests for this file.
3623 	 */
3624 	if (vap->va_mask & AT_MTIME) {
3625 		rp = VTOR4(vp);
3626 		if (nfs4_has_pages(vp)) {
3627 			mutex_enter(&rp->r_statev4_lock);
3628 			if (rp->r_deleg_type != OPEN_DELEGATE_WRITE) {
3629 				mutex_exit(&rp->r_statev4_lock);
3630 				if (rp->r_flags & R4DIRTY ||
3631 				    rp->r_awcount > 0) {
3632 					mutex_enter(&rp->r_statelock);
3633 					rp->r_gcount++;
3634 					mutex_exit(&rp->r_statelock);
3635 					error =
3636 					    nfs4_putpage(vp, (u_offset_t)0,
3637 					    0, 0, cr, NULL);
3638 					mutex_enter(&rp->r_statelock);
3639 					if (error && (error == ENOSPC ||
3640 					    error == EDQUOT)) {
3641 						if (!rp->r_error)
3642 							rp->r_error = error;
3643 					}
3644 					if (--rp->r_gcount == 0)
3645 						cv_broadcast(&rp->r_cv);
3646 					mutex_exit(&rp->r_statelock);
3647 				}
3648 			} else {
3649 				mutex_exit(&rp->r_statev4_lock);
3650 			}
3651 		}
3652 	}
3653 	return (nfs4getattr(vp, vap, cr));
3654 }
3655 
3656 int
3657 nfs4_compare_modes(mode_t from_server, mode_t on_client)
3658 {
3659 	/*
3660 	 * If these are the only two bits cleared
3661 	 * on the server then return 0 (OK) else
3662 	 * return 1 (BAD).
3663 	 */
3664 	on_client &= ~(S_ISUID|S_ISGID);
3665 	if (on_client == from_server)
3666 		return (0);
3667 	else
3668 		return (1);
3669 }
3670 
3671 /*ARGSUSED4*/
3672 static int
3673 nfs4_setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
3674     caller_context_t *ct)
3675 {
3676 	if (vap->va_mask & AT_NOSET)
3677 		return (EINVAL);
3678 
3679 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
3680 		return (EIO);
3681 
3682 	/*
3683 	 * Don't call secpolicy_vnode_setattr, the client cannot
3684 	 * use its cached attributes to make security decisions
3685 	 * as the server may be faking mode bits or mapping uid/gid.
3686 	 * Always just let the server to the checking.
3687 	 * If we provide the ability to remove basic priviledges
3688 	 * to setattr (e.g. basic without chmod) then we will
3689 	 * need to add a check here before calling the server.
3690 	 */
3691 
3692 	return (nfs4setattr(vp, vap, flags, cr, NULL));
3693 }
3694 
3695 /*
3696  * To replace the "guarded" version 3 setattr, we use two types of compound
3697  * setattr requests:
3698  * 1. The "normal" setattr, used when the size of the file isn't being
3699  *    changed - { Putfh <fh>; Setattr; Getattr }/
3700  * 2. If the size is changed, precede Setattr with: Getattr; Verify
3701  *    with only ctime as the argument. If the server ctime differs from
3702  *    what is cached on the client, the verify will fail, but we would
3703  *    already have the ctime from the preceding getattr, so just set it
3704  *    and retry. Thus the compound here is - { Putfh <fh>; Getattr; Verify;
3705  *	Setattr; Getattr }.
3706  *
3707  * The vsecattr_t * input parameter will be non-NULL if ACLs are being set in
3708  * this setattr and NULL if they are not.
3709  */
3710 static int
3711 nfs4setattr(vnode_t *vp, struct vattr *vap, int flags, cred_t *cr,
3712     vsecattr_t *vsap)
3713 {
3714 	COMPOUND4args_clnt args;
3715 	COMPOUND4res_clnt res, *resp = NULL;
3716 	nfs4_ga_res_t *garp = NULL;
3717 	int numops = 3;			/* { Putfh; Setattr; Getattr } */
3718 	nfs_argop4 argop[5];
3719 	int verify_argop = -1;
3720 	int setattr_argop = 1;
3721 	nfs_resop4 *resop;
3722 	vattr_t va;
3723 	rnode4_t *rp;
3724 	int doqueue = 1;
3725 	uint_t mask = vap->va_mask;
3726 	mode_t omode;
3727 	vsecattr_t *vsp;
3728 	timestruc_t ctime;
3729 	bool_t needrecov = FALSE;
3730 	nfs4_recov_state_t recov_state;
3731 	nfs4_stateid_types_t sid_types;
3732 	stateid4 stateid;
3733 	hrtime_t t;
3734 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
3735 	servinfo4_t *svp;
3736 	bitmap4 supp_attrs;
3737 
3738 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
3739 	rp = VTOR4(vp);
3740 	nfs4_init_stateid_types(&sid_types);
3741 
3742 	/*
3743 	 * Only need to flush pages if there are any pages and
3744 	 * if the file is marked as dirty in some fashion.  The
3745 	 * file must be flushed so that we can accurately
3746 	 * determine the size of the file and the cached data
3747 	 * after the SETATTR returns.  A file is considered to
3748 	 * be dirty if it is either marked with R4DIRTY, has
3749 	 * outstanding i/o's active, or is mmap'd.  In this
3750 	 * last case, we can't tell whether there are dirty
3751 	 * pages, so we flush just to be sure.
3752 	 */
3753 	if (nfs4_has_pages(vp) &&
3754 	    ((rp->r_flags & R4DIRTY) ||
3755 	    rp->r_count > 0 ||
3756 	    rp->r_mapcnt > 0)) {
3757 		ASSERT(vp->v_type != VCHR);
3758 		e.error = nfs4_putpage(vp, (offset_t)0, 0, 0, cr, NULL);
3759 		if (e.error && (e.error == ENOSPC || e.error == EDQUOT)) {
3760 			mutex_enter(&rp->r_statelock);
3761 			if (!rp->r_error)
3762 				rp->r_error = e.error;
3763 			mutex_exit(&rp->r_statelock);
3764 		}
3765 	}
3766 
3767 	if (mask & AT_SIZE) {
3768 		/*
3769 		 * Verification setattr compound for non-deleg AT_SIZE:
3770 		 *	{ Putfh; Getattr; Verify; Setattr; Getattr }
3771 		 * Set ctime local here (outside the do_again label)
3772 		 * so that subsequent retries (after failed VERIFY)
3773 		 * will use ctime from GETATTR results (from failed
3774 		 * verify compound) as VERIFY arg.
3775 		 * If file has delegation, then VERIFY(time_metadata)
3776 		 * is of little added value, so don't bother.
3777 		 */
3778 		mutex_enter(&rp->r_statev4_lock);
3779 		if (rp->r_deleg_type == OPEN_DELEGATE_NONE ||
3780 		    rp->r_deleg_return_pending) {
3781 			numops = 5;
3782 			ctime = rp->r_attr.va_ctime;
3783 		}
3784 		mutex_exit(&rp->r_statev4_lock);
3785 	}
3786 
3787 	recov_state.rs_flags = 0;
3788 	recov_state.rs_num_retry_despite_err = 0;
3789 
3790 	args.ctag = TAG_SETATTR;
3791 do_again:
3792 recov_retry:
3793 	setattr_argop = numops - 2;
3794 
3795 	args.array = argop;
3796 	args.array_len = numops;
3797 
3798 	e.error = nfs4_start_op(VTOMI4(vp), vp, NULL, &recov_state);
3799 	if (e.error)
3800 		return (e.error);
3801 
3802 
3803 	/* putfh target fh */
3804 	argop[0].argop = OP_CPUTFH;
3805 	argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
3806 
3807 	if (numops == 5) {
3808 		/*
3809 		 * We only care about the ctime, but need to get mtime
3810 		 * and size for proper cache update.
3811 		 */
3812 		/* getattr */
3813 		argop[1].argop = OP_GETATTR;
3814 		argop[1].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
3815 		argop[1].nfs_argop4_u.opgetattr.mi = VTOMI4(vp);
3816 
3817 		/* verify - set later in loop */
3818 		verify_argop = 2;
3819 	}
3820 
3821 	/* setattr */
3822 	svp = rp->r_server;
3823 	(void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
3824 	supp_attrs = svp->sv_supp_attrs;
3825 	nfs_rw_exit(&svp->sv_lock);
3826 
3827 	nfs4args_setattr(&argop[setattr_argop], vap, vsap, flags, rp, cr,
3828 	    supp_attrs, &e.error, &sid_types);
3829 	stateid = argop[setattr_argop].nfs_argop4_u.opsetattr.stateid;
3830 	if (e.error) {
3831 		/* req time field(s) overflow - return immediately */
3832 		nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state, needrecov);
3833 		nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
3834 		    opsetattr.obj_attributes);
3835 		return (e.error);
3836 	}
3837 	omode = rp->r_attr.va_mode;
3838 
3839 	/* getattr */
3840 	argop[numops-1].argop = OP_GETATTR;
3841 	argop[numops-1].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
3842 	/*
3843 	 * If we are setting the ACL (indicated only by vsap != NULL), request
3844 	 * the ACL in this getattr.  The ACL returned from this getattr will be
3845 	 * used in updating the ACL cache.
3846 	 */
3847 	if (vsap != NULL)
3848 		argop[numops-1].nfs_argop4_u.opgetattr.attr_request |=
3849 		    FATTR4_ACL_MASK;
3850 	argop[numops-1].nfs_argop4_u.opgetattr.mi = VTOMI4(vp);
3851 
3852 	/*
3853 	 * setattr iterates if the object size is set and the cached ctime
3854 	 * does not match the file ctime. In that case, verify the ctime first.
3855 	 */
3856 
3857 	do {
3858 		if (verify_argop != -1) {
3859 			/*
3860 			 * Verify that the ctime match before doing setattr.
3861 			 */
3862 			va.va_mask = AT_CTIME;
3863 			va.va_ctime = ctime;
3864 			svp = rp->r_server;
3865 			(void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
3866 			supp_attrs = svp->sv_supp_attrs;
3867 			nfs_rw_exit(&svp->sv_lock);
3868 			e.error = nfs4args_verify(&argop[verify_argop], &va,
3869 			    OP_VERIFY, supp_attrs);
3870 			if (e.error) {
3871 				/* req time field(s) overflow - return */
3872 				nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3873 				    needrecov);
3874 				break;
3875 			}
3876 		}
3877 
3878 		doqueue = 1;
3879 
3880 		t = gethrtime();
3881 
3882 		rfs4call(VTOMI4(vp), &args, &res, cr, &doqueue, 0, &e);
3883 
3884 		/*
3885 		 * Purge the access cache and ACL cache if changing either the
3886 		 * owner of the file, the group owner, or the mode.  These may
3887 		 * change the access permissions of the file, so purge old
3888 		 * information and start over again.
3889 		 */
3890 		if (mask & (AT_UID | AT_GID | AT_MODE)) {
3891 			(void) nfs4_access_purge_rp(rp);
3892 			if (rp->r_secattr != NULL) {
3893 				mutex_enter(&rp->r_statelock);
3894 				vsp = rp->r_secattr;
3895 				rp->r_secattr = NULL;
3896 				mutex_exit(&rp->r_statelock);
3897 				if (vsp != NULL)
3898 					nfs4_acl_free_cache(vsp);
3899 			}
3900 		}
3901 
3902 		/*
3903 		 * If res.array_len == numops, then everything succeeded,
3904 		 * except for possibly the final getattr.  If only the
3905 		 * last getattr failed, give up, and don't try recovery.
3906 		 */
3907 		if (res.array_len == numops) {
3908 			nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3909 			    needrecov);
3910 			if (! e.error)
3911 				resp = &res;
3912 			break;
3913 		}
3914 
3915 		/*
3916 		 * if either rpc call failed or completely succeeded - done
3917 		 */
3918 		needrecov = nfs4_needs_recovery(&e, FALSE, vp->v_vfsp);
3919 		if (e.error) {
3920 			PURGE_ATTRCACHE4(vp);
3921 			if (!needrecov) {
3922 				nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3923 				    needrecov);
3924 				break;
3925 			}
3926 		}
3927 
3928 		/*
3929 		 * Do proper retry for OLD_STATEID outside of the normal
3930 		 * recovery framework.
3931 		 */
3932 		if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3933 		    sid_types.cur_sid_type != SPEC_SID &&
3934 		    sid_types.cur_sid_type != NO_SID) {
3935 			nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3936 			    needrecov);
3937 			nfs4_save_stateid(&stateid, &sid_types);
3938 			nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
3939 			    opsetattr.obj_attributes);
3940 			if (verify_argop != -1) {
3941 				nfs4args_verify_free(&argop[verify_argop]);
3942 				verify_argop = -1;
3943 			}
3944 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
3945 			goto recov_retry;
3946 		}
3947 
3948 		if (needrecov) {
3949 			bool_t abort;
3950 
3951 			abort = nfs4_start_recovery(&e,
3952 			    VTOMI4(vp), vp, NULL, NULL, NULL,
3953 			    OP_SETATTR, NULL);
3954 			nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
3955 			    needrecov);
3956 			/*
3957 			 * Do not retry if we failed with OLD_STATEID using
3958 			 * a special stateid.  This is done to avoid looping
3959 			 * with a broken server.
3960 			 */
3961 			if (e.error == 0 && res.status == NFS4ERR_OLD_STATEID &&
3962 			    (sid_types.cur_sid_type == SPEC_SID ||
3963 			    sid_types.cur_sid_type == NO_SID))
3964 				abort = TRUE;
3965 			if (!e.error) {
3966 				if (res.status == NFS4ERR_BADOWNER)
3967 					nfs4_log_badowner(VTOMI4(vp),
3968 					    OP_SETATTR);
3969 
3970 				e.error = geterrno4(res.status);
3971 				(void) xdr_free(xdr_COMPOUND4res_clnt,
3972 				    (caddr_t)&res);
3973 			}
3974 			nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
3975 			    opsetattr.obj_attributes);
3976 			if (verify_argop != -1) {
3977 				nfs4args_verify_free(&argop[verify_argop]);
3978 				verify_argop = -1;
3979 			}
3980 			if (abort == FALSE) {
3981 				/*
3982 				 * Need to retry all possible stateids in
3983 				 * case the recovery error wasn't stateid
3984 				 * related or the stateids have become
3985 				 * stale (server reboot).
3986 				 */
3987 				nfs4_init_stateid_types(&sid_types);
3988 				goto recov_retry;
3989 			}
3990 			return (e.error);
3991 		}
3992 
3993 		/*
3994 		 * Need to call nfs4_end_op before nfs4getattr to
3995 		 * avoid potential nfs4_start_op deadlock. See RFE
3996 		 * 4777612.  Calls to nfs4_invalidate_pages() and
3997 		 * nfs4_purge_stale_fh() might also generate over the
3998 		 * wire calls which my cause nfs4_start_op() deadlock.
3999 		 */
4000 		nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state, needrecov);
4001 
4002 		/*
4003 		 * Check to update lease.
4004 		 */
4005 		resp = &res;
4006 		if (res.status == NFS4_OK) {
4007 			break;
4008 		}
4009 
4010 		/*
4011 		 * Check if verify failed to see if try again
4012 		 */
4013 		if ((verify_argop == -1) || (res.array_len != 3)) {
4014 			/*
4015 			 * can't continue...
4016 			 */
4017 			if (res.status == NFS4ERR_BADOWNER)
4018 				nfs4_log_badowner(VTOMI4(vp), OP_SETATTR);
4019 
4020 			e.error = geterrno4(res.status);
4021 		} else {
4022 			/*
4023 			 * When the verify request fails, the client ctime is
4024 			 * not in sync with the server. This is the same as
4025 			 * the version 3 "not synchronized" error, and we
4026 			 * handle it in a similar manner (XXX do we need to???).
4027 			 * Use the ctime returned in the first getattr for
4028 			 * the input to the next verify.
4029 			 * If we couldn't get the attributes, then we give up
4030 			 * because we can't complete the operation as required.
4031 			 */
4032 			garp = &res.array[1].nfs_resop4_u.opgetattr.ga_res;
4033 		}
4034 		if (e.error) {
4035 			PURGE_ATTRCACHE4(vp);
4036 			nfs4_purge_stale_fh(e.error, vp, cr);
4037 		} else {
4038 			/*
4039 			 * retry with a new verify value
4040 			 */
4041 			ctime = garp->n4g_va.va_ctime;
4042 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4043 			resp = NULL;
4044 		}
4045 		if (!e.error) {
4046 			nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4047 			    opsetattr.obj_attributes);
4048 			if (verify_argop != -1) {
4049 				nfs4args_verify_free(&argop[verify_argop]);
4050 				verify_argop = -1;
4051 			}
4052 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4053 			goto do_again;
4054 		}
4055 	} while (!e.error);
4056 
4057 	if (e.error) {
4058 		/*
4059 		 * If we are here, rfs4call has an irrecoverable error - return
4060 		 */
4061 		nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4062 		    opsetattr.obj_attributes);
4063 		if (verify_argop != -1) {
4064 			nfs4args_verify_free(&argop[verify_argop]);
4065 			verify_argop = -1;
4066 		}
4067 		if (resp)
4068 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
4069 		return (e.error);
4070 	}
4071 
4072 
4073 
4074 	/*
4075 	 * If changing the size of the file, invalidate
4076 	 * any local cached data which is no longer part
4077 	 * of the file.  We also possibly invalidate the
4078 	 * last page in the file.  We could use
4079 	 * pvn_vpzero(), but this would mark the page as
4080 	 * modified and require it to be written back to
4081 	 * the server for no particularly good reason.
4082 	 * This way, if we access it, then we bring it
4083 	 * back in.  A read should be cheaper than a
4084 	 * write.
4085 	 */
4086 	if (mask & AT_SIZE) {
4087 		nfs4_invalidate_pages(vp, (vap->va_size & PAGEMASK), cr);
4088 	}
4089 
4090 	/* either no error or one of the postop getattr failed */
4091 
4092 	/*
4093 	 * XXX Perform a simplified version of wcc checking. Instead of
4094 	 * have another getattr to get pre-op, just purge cache if
4095 	 * any of the ops prior to and including the getattr failed.
4096 	 * If the getattr succeeded then update the attrcache accordingly.
4097 	 */
4098 
4099 	garp = NULL;
4100 	if (res.status == NFS4_OK) {
4101 		/*
4102 		 * Last getattr
4103 		 */
4104 		resop = &res.array[numops - 1];
4105 		garp = &resop->nfs_resop4_u.opgetattr.ga_res;
4106 	}
4107 	/*
4108 	 * In certain cases, nfs4_update_attrcache() will purge the attrcache,
4109 	 * rather than filling it.  See the function itself for details.
4110 	 */
4111 	e.error = nfs4_update_attrcache(res.status, garp, t, vp, cr);
4112 	if (garp != NULL) {
4113 		if (garp->n4g_resbmap & FATTR4_ACL_MASK) {
4114 			nfs4_acl_fill_cache(rp, &garp->n4g_vsa);
4115 			vs_ace4_destroy(&garp->n4g_vsa);
4116 		} else {
4117 			if (vsap != NULL) {
4118 				/*
4119 				 * The ACL was supposed to be set and to be
4120 				 * returned in the last getattr of this
4121 				 * compound, but for some reason the getattr
4122 				 * result doesn't contain the ACL.  In this
4123 				 * case, purge the ACL cache.
4124 				 */
4125 				if (rp->r_secattr != NULL) {
4126 					mutex_enter(&rp->r_statelock);
4127 					vsp = rp->r_secattr;
4128 					rp->r_secattr = NULL;
4129 					mutex_exit(&rp->r_statelock);
4130 					if (vsp != NULL)
4131 						nfs4_acl_free_cache(vsp);
4132 				}
4133 			}
4134 		}
4135 	}
4136 
4137 	if (res.status == NFS4_OK && (mask & AT_SIZE)) {
4138 		/*
4139 		 * Set the size, rather than relying on getting it updated
4140 		 * via a GETATTR.  With delegations the client tries to
4141 		 * suppress GETATTR calls.
4142 		 */
4143 		mutex_enter(&rp->r_statelock);
4144 		rp->r_size = vap->va_size;
4145 		mutex_exit(&rp->r_statelock);
4146 	}
4147 
4148 	/*
4149 	 * Can free up request args and res
4150 	 */
4151 	nfs4_fattr4_free(&argop[setattr_argop].nfs_argop4_u.
4152 	    opsetattr.obj_attributes);
4153 	if (verify_argop != -1) {
4154 		nfs4args_verify_free(&argop[verify_argop]);
4155 		verify_argop = -1;
4156 	}
4157 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4158 
4159 	/*
4160 	 * Some servers will change the mode to clear the setuid
4161 	 * and setgid bits when changing the uid or gid.  The
4162 	 * client needs to compensate appropriately.
4163 	 */
4164 	if (mask & (AT_UID | AT_GID)) {
4165 		int terror, do_setattr;
4166 
4167 		do_setattr = 0;
4168 		va.va_mask = AT_MODE;
4169 		terror = nfs4getattr(vp, &va, cr);
4170 		if (!terror &&
4171 		    (((mask & AT_MODE) && va.va_mode != vap->va_mode) ||
4172 		    (!(mask & AT_MODE) && va.va_mode != omode))) {
4173 			va.va_mask = AT_MODE;
4174 			if (mask & AT_MODE) {
4175 				/*
4176 				 * We asked the mode to be changed and what
4177 				 * we just got from the server in getattr is
4178 				 * not what we wanted it to be, so set it now.
4179 				 */
4180 				va.va_mode = vap->va_mode;
4181 				do_setattr = 1;
4182 			} else {
4183 				/*
4184 				 * We did not ask the mode to be changed,
4185 				 * Check to see that the server just cleared
4186 				 * I_SUID and I_GUID from it. If not then
4187 				 * set mode to omode with UID/GID cleared.
4188 				 */
4189 				if (nfs4_compare_modes(va.va_mode, omode)) {
4190 					omode &= ~(S_ISUID|S_ISGID);
4191 					va.va_mode = omode;
4192 					do_setattr = 1;
4193 				}
4194 			}
4195 
4196 			if (do_setattr)
4197 				(void) nfs4setattr(vp, &va, 0, cr, NULL);
4198 		}
4199 	}
4200 
4201 	return (e.error);
4202 }
4203 
4204 /* ARGSUSED */
4205 static int
4206 nfs4_access(vnode_t *vp, int mode, int flags, cred_t *cr, caller_context_t *ct)
4207 {
4208 	COMPOUND4args_clnt args;
4209 	COMPOUND4res_clnt res;
4210 	int doqueue;
4211 	uint32_t acc, resacc, argacc;
4212 	rnode4_t *rp;
4213 	cred_t *cred, *ncr, *ncrfree = NULL;
4214 	nfs4_access_type_t cacc;
4215 	int num_ops;
4216 	nfs_argop4 argop[3];
4217 	nfs_resop4 *resop;
4218 	bool_t needrecov = FALSE, do_getattr;
4219 	nfs4_recov_state_t recov_state;
4220 	int rpc_error;
4221 	hrtime_t t;
4222 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
4223 	mntinfo4_t *mi = VTOMI4(vp);
4224 
4225 	if (nfs_zone() != mi->mi_zone)
4226 		return (EIO);
4227 
4228 	acc = 0;
4229 	if (mode & VREAD)
4230 		acc |= ACCESS4_READ;
4231 	if (mode & VWRITE) {
4232 		if ((vp->v_vfsp->vfs_flag & VFS_RDONLY) && !ISVDEV(vp->v_type))
4233 			return (EROFS);
4234 		if (vp->v_type == VDIR)
4235 			acc |= ACCESS4_DELETE;
4236 		acc |= ACCESS4_MODIFY | ACCESS4_EXTEND;
4237 	}
4238 	if (mode & VEXEC) {
4239 		if (vp->v_type == VDIR)
4240 			acc |= ACCESS4_LOOKUP;
4241 		else
4242 			acc |= ACCESS4_EXECUTE;
4243 	}
4244 
4245 	if (VTOR4(vp)->r_acache != NULL) {
4246 		e.error = nfs4_validate_caches(vp, cr);
4247 		if (e.error)
4248 			return (e.error);
4249 	}
4250 
4251 	rp = VTOR4(vp);
4252 	if (vp->v_type == VDIR)
4253 		argacc = ACCESS4_READ | ACCESS4_DELETE | ACCESS4_MODIFY |
4254 		    ACCESS4_EXTEND | ACCESS4_LOOKUP;
4255 	else
4256 		argacc = ACCESS4_READ | ACCESS4_MODIFY | ACCESS4_EXTEND |
4257 		    ACCESS4_EXECUTE;
4258 	recov_state.rs_flags = 0;
4259 	recov_state.rs_num_retry_despite_err = 0;
4260 
4261 	cred = cr;
4262 	/*
4263 	 * ncr and ncrfree both initially
4264 	 * point to the memory area returned
4265 	 * by crnetadjust();
4266 	 * ncrfree not NULL when exiting means
4267 	 * that we need to release it
4268 	 */
4269 	ncr = crnetadjust(cred);
4270 	ncrfree = ncr;
4271 
4272 tryagain:
4273 	cacc = nfs4_access_check(rp, acc, cred);
4274 	if (cacc == NFS4_ACCESS_ALLOWED) {
4275 		if (ncrfree != NULL)
4276 			crfree(ncrfree);
4277 		return (0);
4278 	}
4279 	if (cacc == NFS4_ACCESS_DENIED) {
4280 		/*
4281 		 * If the cred can be adjusted, try again
4282 		 * with the new cred.
4283 		 */
4284 		if (ncr != NULL) {
4285 			cred = ncr;
4286 			ncr = NULL;
4287 			goto tryagain;
4288 		}
4289 		if (ncrfree != NULL)
4290 			crfree(ncrfree);
4291 		return (EACCES);
4292 	}
4293 
4294 recov_retry:
4295 	/*
4296 	 * Don't take with r_statev4_lock here. r_deleg_type could
4297 	 * change as soon as lock is released.  Since it is an int,
4298 	 * there is no atomicity issue.
4299 	 */
4300 	do_getattr = (rp->r_deleg_type == OPEN_DELEGATE_NONE);
4301 	num_ops = do_getattr ? 3 : 2;
4302 
4303 	args.ctag = TAG_ACCESS;
4304 
4305 	args.array_len = num_ops;
4306 	args.array = argop;
4307 
4308 	if (e.error = nfs4_start_fop(mi, vp, NULL, OH_ACCESS,
4309 	    &recov_state, NULL)) {
4310 		if (ncrfree != NULL)
4311 			crfree(ncrfree);
4312 		return (e.error);
4313 	}
4314 
4315 	/* putfh target fh */
4316 	argop[0].argop = OP_CPUTFH;
4317 	argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(vp)->r_fh;
4318 
4319 	/* access */
4320 	argop[1].argop = OP_ACCESS;
4321 	argop[1].nfs_argop4_u.opaccess.access = argacc;
4322 
4323 	/* getattr */
4324 	if (do_getattr) {
4325 		argop[2].argop = OP_GETATTR;
4326 		argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
4327 		argop[2].nfs_argop4_u.opgetattr.mi = mi;
4328 	}
4329 
4330 	NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
4331 	    "nfs4_access: %s call, rp %s", needrecov ? "recov" : "first",
4332 	    rnode4info(VTOR4(vp))));
4333 
4334 	doqueue = 1;
4335 	t = gethrtime();
4336 	rfs4call(VTOMI4(vp), &args, &res, cred, &doqueue, 0, &e);
4337 	rpc_error = e.error;
4338 
4339 	needrecov = nfs4_needs_recovery(&e, FALSE, vp->v_vfsp);
4340 	if (needrecov) {
4341 		NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
4342 		    "nfs4_access: initiating recovery\n"));
4343 
4344 		if (nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
4345 		    NULL, OP_ACCESS, NULL) == FALSE) {
4346 			nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_ACCESS,
4347 			    &recov_state, needrecov);
4348 			if (!e.error)
4349 				(void) xdr_free(xdr_COMPOUND4res_clnt,
4350 				    (caddr_t)&res);
4351 			goto recov_retry;
4352 		}
4353 	}
4354 	nfs4_end_fop(mi, vp, NULL, OH_ACCESS, &recov_state, needrecov);
4355 
4356 	if (e.error)
4357 		goto out;
4358 
4359 	if (res.status) {
4360 		e.error = geterrno4(res.status);
4361 		/*
4362 		 * This might generate over the wire calls throught
4363 		 * nfs4_invalidate_pages. Hence we need to call nfs4_end_op()
4364 		 * here to avoid a deadlock.
4365 		 */
4366 		nfs4_purge_stale_fh(e.error, vp, cr);
4367 		goto out;
4368 	}
4369 	resop = &res.array[1];	/* access res */
4370 
4371 	resacc = resop->nfs_resop4_u.opaccess.access;
4372 
4373 	if (do_getattr) {
4374 		resop++;	/* getattr res */
4375 		nfs4_attr_cache(vp, &resop->nfs_resop4_u.opgetattr.ga_res,
4376 		    t, cr, FALSE, NULL);
4377 	}
4378 
4379 	if (!e.error) {
4380 		nfs4_access_cache(rp, argacc, resacc, cred);
4381 		/*
4382 		 * we just cached results with cred; if cred is the
4383 		 * adjusted credentials from crnetadjust, we do not want
4384 		 * to release them before exiting: hence setting ncrfree
4385 		 * to NULL
4386 		 */
4387 		if (cred != cr)
4388 			ncrfree = NULL;
4389 		/* XXX check the supported bits too? */
4390 		if ((acc & resacc) != acc) {
4391 			/*
4392 			 * The following code implements the semantic
4393 			 * that a setuid root program has *at least* the
4394 			 * permissions of the user that is running the
4395 			 * program.  See rfs3call() for more portions
4396 			 * of the implementation of this functionality.
4397 			 */
4398 			/* XXX-LP */
4399 			if (ncr != NULL) {
4400 				(void) xdr_free(xdr_COMPOUND4res_clnt,
4401 				    (caddr_t)&res);
4402 				cred = ncr;
4403 				ncr = NULL;
4404 				goto tryagain;
4405 			}
4406 			e.error = EACCES;
4407 		}
4408 	}
4409 
4410 out:
4411 	if (!rpc_error)
4412 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4413 
4414 	if (ncrfree != NULL)
4415 		crfree(ncrfree);
4416 
4417 	return (e.error);
4418 }
4419 
4420 /* ARGSUSED */
4421 static int
4422 nfs4_readlink(vnode_t *vp, struct uio *uiop, cred_t *cr, caller_context_t *ct)
4423 {
4424 	COMPOUND4args_clnt args;
4425 	COMPOUND4res_clnt res;
4426 	int doqueue;
4427 	rnode4_t *rp;
4428 	nfs_argop4 argop[3];
4429 	nfs_resop4 *resop;
4430 	READLINK4res *lr_res;
4431 	nfs4_ga_res_t *garp;
4432 	uint_t len;
4433 	char *linkdata;
4434 	bool_t needrecov = FALSE;
4435 	nfs4_recov_state_t recov_state;
4436 	hrtime_t t;
4437 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
4438 
4439 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
4440 		return (EIO);
4441 	/*
4442 	 * Can't readlink anything other than a symbolic link.
4443 	 */
4444 	if (vp->v_type != VLNK)
4445 		return (EINVAL);
4446 
4447 	rp = VTOR4(vp);
4448 	if (nfs4_do_symlink_cache && rp->r_symlink.contents != NULL) {
4449 		e.error = nfs4_validate_caches(vp, cr);
4450 		if (e.error)
4451 			return (e.error);
4452 		mutex_enter(&rp->r_statelock);
4453 		if (rp->r_symlink.contents != NULL) {
4454 			e.error = uiomove(rp->r_symlink.contents,
4455 			    rp->r_symlink.len, UIO_READ, uiop);
4456 			mutex_exit(&rp->r_statelock);
4457 			return (e.error);
4458 		}
4459 		mutex_exit(&rp->r_statelock);
4460 	}
4461 	recov_state.rs_flags = 0;
4462 	recov_state.rs_num_retry_despite_err = 0;
4463 
4464 recov_retry:
4465 	args.array_len = 3;
4466 	args.array = argop;
4467 	args.ctag = TAG_READLINK;
4468 
4469 	e.error = nfs4_start_op(VTOMI4(vp), vp, NULL, &recov_state);
4470 	if (e.error) {
4471 		return (e.error);
4472 	}
4473 
4474 	/* 0. putfh symlink fh */
4475 	argop[0].argop = OP_CPUTFH;
4476 	argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(vp)->r_fh;
4477 
4478 	/* 1. readlink */
4479 	argop[1].argop = OP_READLINK;
4480 
4481 	/* 2. getattr */
4482 	argop[2].argop = OP_GETATTR;
4483 	argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
4484 	argop[2].nfs_argop4_u.opgetattr.mi = VTOMI4(vp);
4485 
4486 	doqueue = 1;
4487 
4488 	NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
4489 	    "nfs4_readlink: %s call, rp %s", needrecov ? "recov" : "first",
4490 	    rnode4info(VTOR4(vp))));
4491 
4492 	t = gethrtime();
4493 
4494 	rfs4call(VTOMI4(vp), &args, &res, cr, &doqueue, 0, &e);
4495 
4496 	needrecov = nfs4_needs_recovery(&e, FALSE, vp->v_vfsp);
4497 	if (needrecov) {
4498 		NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
4499 		    "nfs4_readlink: initiating recovery\n"));
4500 
4501 		if (nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
4502 		    NULL, OP_READLINK, NULL) == FALSE) {
4503 			if (!e.error)
4504 				(void) xdr_free(xdr_COMPOUND4res_clnt,
4505 				    (caddr_t)&res);
4506 
4507 			nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state,
4508 			    needrecov);
4509 			goto recov_retry;
4510 		}
4511 	}
4512 
4513 	nfs4_end_op(VTOMI4(vp), vp, NULL, &recov_state, needrecov);
4514 
4515 	if (e.error)
4516 		return (e.error);
4517 
4518 	/*
4519 	 * There is an path in the code below which calls
4520 	 * nfs4_purge_stale_fh(), which may generate otw calls through
4521 	 * nfs4_invalidate_pages. Hence we need to call nfs4_end_op()
4522 	 * here to avoid nfs4_start_op() deadlock.
4523 	 */
4524 
4525 	if (res.status && (res.array_len < args.array_len)) {
4526 		/*
4527 		 * either Putfh or Link failed
4528 		 */
4529 		e.error = geterrno4(res.status);
4530 		nfs4_purge_stale_fh(e.error, vp, cr);
4531 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4532 		return (e.error);
4533 	}
4534 
4535 	resop = &res.array[1];	/* readlink res */
4536 	lr_res = &resop->nfs_resop4_u.opreadlink;
4537 
4538 	/*
4539 	 * treat symlink names as data
4540 	 */
4541 	linkdata = utf8_to_str(&lr_res->link, &len, NULL);
4542 	if (linkdata != NULL) {
4543 		int uio_len = len - 1;
4544 		/* len includes null byte, which we won't uiomove */
4545 		e.error = uiomove(linkdata, uio_len, UIO_READ, uiop);
4546 		if (nfs4_do_symlink_cache && rp->r_symlink.contents == NULL) {
4547 			mutex_enter(&rp->r_statelock);
4548 			if (rp->r_symlink.contents == NULL) {
4549 				rp->r_symlink.contents = linkdata;
4550 				rp->r_symlink.len = uio_len;
4551 				rp->r_symlink.size = len;
4552 				mutex_exit(&rp->r_statelock);
4553 			} else {
4554 				mutex_exit(&rp->r_statelock);
4555 				kmem_free(linkdata, len);
4556 			}
4557 		} else {
4558 			kmem_free(linkdata, len);
4559 		}
4560 	}
4561 	if (res.status == NFS4_OK) {
4562 		resop++;	/* getattr res */
4563 		garp = &resop->nfs_resop4_u.opgetattr.ga_res;
4564 	}
4565 	e.error = nfs4_update_attrcache(res.status, garp, t, vp, cr);
4566 
4567 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
4568 
4569 	/*
4570 	 * The over the wire error for attempting to readlink something
4571 	 * other than a symbolic link is ENXIO.  However, we need to
4572 	 * return EINVAL instead of ENXIO, so we map it here.
4573 	 */
4574 	return (e.error == ENXIO ? EINVAL : e.error);
4575 }
4576 
4577 /*
4578  * Flush local dirty pages to stable storage on the server.
4579  *
4580  * If FNODSYNC is specified, then there is nothing to do because
4581  * metadata changes are not cached on the client before being
4582  * sent to the server.
4583  */
4584 /* ARGSUSED */
4585 static int
4586 nfs4_fsync(vnode_t *vp, int syncflag, cred_t *cr, caller_context_t *ct)
4587 {
4588 	int error;
4589 
4590 	if ((syncflag & FNODSYNC) || IS_SWAPVP(vp))
4591 		return (0);
4592 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
4593 		return (EIO);
4594 	error = nfs4_putpage_commit(vp, (offset_t)0, 0, cr);
4595 	if (!error)
4596 		error = VTOR4(vp)->r_error;
4597 	return (error);
4598 }
4599 
4600 /*
4601  * Weirdness: if the file was removed or the target of a rename
4602  * operation while it was open, it got renamed instead.  Here we
4603  * remove the renamed file.
4604  */
4605 /* ARGSUSED */
4606 void
4607 nfs4_inactive(vnode_t *vp, cred_t *cr, caller_context_t *ct)
4608 {
4609 	rnode4_t *rp;
4610 
4611 	ASSERT(vp != DNLC_NO_VNODE);
4612 
4613 	rp = VTOR4(vp);
4614 
4615 	if (IS_SHADOW(vp, rp)) {
4616 		sv_inactive(vp);
4617 		return;
4618 	}
4619 
4620 	/*
4621 	 * If this is coming from the wrong zone, we let someone in the right
4622 	 * zone take care of it asynchronously.  We can get here due to
4623 	 * VN_RELE() being called from pageout() or fsflush().  This call may
4624 	 * potentially turn into an expensive no-op if, for instance, v_count
4625 	 * gets incremented in the meantime, but it's still correct.
4626 	 */
4627 	if (nfs_zone() != VTOMI4(vp)->mi_zone) {
4628 		nfs4_async_inactive(vp, cr);
4629 		return;
4630 	}
4631 
4632 	/*
4633 	 * Some of the cleanup steps might require over-the-wire
4634 	 * operations.  Since VOP_INACTIVE can get called as a result of
4635 	 * other over-the-wire operations (e.g., an attribute cache update
4636 	 * can lead to a DNLC purge), doing those steps now would lead to a
4637 	 * nested call to the recovery framework, which can deadlock.  So
4638 	 * do any over-the-wire cleanups asynchronously, in a separate
4639 	 * thread.
4640 	 */
4641 
4642 	mutex_enter(&rp->r_os_lock);
4643 	mutex_enter(&rp->r_statelock);
4644 	mutex_enter(&rp->r_statev4_lock);
4645 
4646 	if (vp->v_type == VREG && list_head(&rp->r_open_streams) != NULL) {
4647 		mutex_exit(&rp->r_statev4_lock);
4648 		mutex_exit(&rp->r_statelock);
4649 		mutex_exit(&rp->r_os_lock);
4650 		nfs4_async_inactive(vp, cr);
4651 		return;
4652 	}
4653 
4654 	if (rp->r_deleg_type == OPEN_DELEGATE_READ ||
4655 	    rp->r_deleg_type == OPEN_DELEGATE_WRITE) {
4656 		mutex_exit(&rp->r_statev4_lock);
4657 		mutex_exit(&rp->r_statelock);
4658 		mutex_exit(&rp->r_os_lock);
4659 		nfs4_async_inactive(vp, cr);
4660 		return;
4661 	}
4662 
4663 	if (rp->r_unldvp != NULL) {
4664 		mutex_exit(&rp->r_statev4_lock);
4665 		mutex_exit(&rp->r_statelock);
4666 		mutex_exit(&rp->r_os_lock);
4667 		nfs4_async_inactive(vp, cr);
4668 		return;
4669 	}
4670 	mutex_exit(&rp->r_statev4_lock);
4671 	mutex_exit(&rp->r_statelock);
4672 	mutex_exit(&rp->r_os_lock);
4673 
4674 	rp4_addfree(rp, cr);
4675 }
4676 
4677 /*
4678  * nfs4_inactive_otw - nfs4_inactive, plus over-the-wire calls to free up
4679  * various bits of state.  The caller must not refer to vp after this call.
4680  */
4681 
4682 void
4683 nfs4_inactive_otw(vnode_t *vp, cred_t *cr)
4684 {
4685 	rnode4_t *rp = VTOR4(vp);
4686 	nfs4_recov_state_t recov_state;
4687 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
4688 	vnode_t *unldvp;
4689 	char *unlname;
4690 	cred_t *unlcred;
4691 	COMPOUND4args_clnt args;
4692 	COMPOUND4res_clnt res, *resp;
4693 	nfs_argop4 argop[2];
4694 	int doqueue;
4695 #ifdef DEBUG
4696 	char *name;
4697 #endif
4698 
4699 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
4700 	ASSERT(!IS_SHADOW(vp, rp));
4701 
4702 #ifdef DEBUG
4703 	name = fn_name(VTOSV(vp)->sv_name);
4704 	NFS4_DEBUG(nfs4_client_inactive_debug, (CE_NOTE, "nfs4_inactive_otw: "
4705 	    "release vnode %s", name));
4706 	kmem_free(name, MAXNAMELEN);
4707 #endif
4708 
4709 	if (vp->v_type == VREG) {
4710 		bool_t recov_failed = FALSE;
4711 
4712 		e.error = nfs4close_all(vp, cr);
4713 		if (e.error) {
4714 			/* Check to see if recovery failed */
4715 			mutex_enter(&(VTOMI4(vp)->mi_lock));
4716 			if (VTOMI4(vp)->mi_flags & MI4_RECOV_FAIL)
4717 				recov_failed = TRUE;
4718 			mutex_exit(&(VTOMI4(vp)->mi_lock));
4719 			if (!recov_failed) {
4720 				mutex_enter(&rp->r_statelock);
4721 				if (rp->r_flags & R4RECOVERR)
4722 					recov_failed = TRUE;
4723 				mutex_exit(&rp->r_statelock);
4724 			}
4725 			if (recov_failed) {
4726 				NFS4_DEBUG(nfs4_client_recov_debug,
4727 				    (CE_NOTE, "nfs4_inactive_otw: "
4728 				    "close failed (recovery failure)"));
4729 			}
4730 		}
4731 	}
4732 
4733 redo:
4734 	if (rp->r_unldvp == NULL) {
4735 		rp4_addfree(rp, cr);
4736 		return;
4737 	}
4738 
4739 	/*
4740 	 * Save the vnode pointer for the directory where the
4741 	 * unlinked-open file got renamed, then set it to NULL
4742 	 * to prevent another thread from getting here before
4743 	 * we're done with the remove.  While we have the
4744 	 * statelock, make local copies of the pertinent rnode
4745 	 * fields.  If we weren't to do this in an atomic way, the
4746 	 * the unl* fields could become inconsistent with respect
4747 	 * to each other due to a race condition between this
4748 	 * code and nfs_remove().  See bug report 1034328.
4749 	 */
4750 	mutex_enter(&rp->r_statelock);
4751 	if (rp->r_unldvp == NULL) {
4752 		mutex_exit(&rp->r_statelock);
4753 		rp4_addfree(rp, cr);
4754 		return;
4755 	}
4756 
4757 	unldvp = rp->r_unldvp;
4758 	rp->r_unldvp = NULL;
4759 	unlname = rp->r_unlname;
4760 	rp->r_unlname = NULL;
4761 	unlcred = rp->r_unlcred;
4762 	rp->r_unlcred = NULL;
4763 	mutex_exit(&rp->r_statelock);
4764 
4765 	/*
4766 	 * If there are any dirty pages left, then flush
4767 	 * them.  This is unfortunate because they just
4768 	 * may get thrown away during the remove operation,
4769 	 * but we have to do this for correctness.
4770 	 */
4771 	if (nfs4_has_pages(vp) &&
4772 	    ((rp->r_flags & R4DIRTY) || rp->r_count > 0)) {
4773 		ASSERT(vp->v_type != VCHR);
4774 		e.error = nfs4_putpage(vp, (u_offset_t)0, 0, 0, cr, NULL);
4775 		if (e.error) {
4776 			mutex_enter(&rp->r_statelock);
4777 			if (!rp->r_error)
4778 				rp->r_error = e.error;
4779 			mutex_exit(&rp->r_statelock);
4780 		}
4781 	}
4782 
4783 	recov_state.rs_flags = 0;
4784 	recov_state.rs_num_retry_despite_err = 0;
4785 recov_retry_remove:
4786 	/*
4787 	 * Do the remove operation on the renamed file
4788 	 */
4789 	args.ctag = TAG_INACTIVE;
4790 
4791 	/*
4792 	 * Remove ops: putfh dir; remove
4793 	 */
4794 	args.array_len = 2;
4795 	args.array = argop;
4796 
4797 	e.error = nfs4_start_op(VTOMI4(unldvp), unldvp, NULL, &recov_state);
4798 	if (e.error) {
4799 		kmem_free(unlname, MAXNAMELEN);
4800 		crfree(unlcred);
4801 		VN_RELE(unldvp);
4802 		/*
4803 		 * Try again; this time around r_unldvp will be NULL, so we'll
4804 		 * just call rp4_addfree() and return.
4805 		 */
4806 		goto redo;
4807 	}
4808 
4809 	/* putfh directory */
4810 	argop[0].argop = OP_CPUTFH;
4811 	argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(unldvp)->r_fh;
4812 
4813 	/* remove */
4814 	argop[1].argop = OP_CREMOVE;
4815 	argop[1].nfs_argop4_u.opcremove.ctarget = unlname;
4816 
4817 	doqueue = 1;
4818 	resp = &res;
4819 
4820 #if 0 /* notyet */
4821 	/*
4822 	 * Can't do this yet.  We may be being called from
4823 	 * dnlc_purge_XXX while that routine is holding a
4824 	 * mutex lock to the nc_rele list.  The calls to
4825 	 * nfs3_cache_wcc_data may result in calls to
4826 	 * dnlc_purge_XXX.  This will result in a deadlock.
4827 	 */
4828 	rfs4call(VTOMI4(unldvp), &args, &res, unlcred, &doqueue, 0, &e);
4829 	if (e.error) {
4830 		PURGE_ATTRCACHE4(unldvp);
4831 		resp = NULL;
4832 	} else if (res.status) {
4833 		e.error = geterrno4(res.status);
4834 		PURGE_ATTRCACHE4(unldvp);
4835 		/*
4836 		 * This code is inactive right now
4837 		 * but if made active there should
4838 		 * be a nfs4_end_op() call before
4839 		 * nfs4_purge_stale_fh to avoid start_op()
4840 		 * deadlock. See BugId: 4948726
4841 		 */
4842 		nfs4_purge_stale_fh(error, unldvp, cr);
4843 	} else {
4844 		nfs_resop4 *resop;
4845 		REMOVE4res *rm_res;
4846 
4847 		resop = &res.array[1];
4848 		rm_res = &resop->nfs_resop4_u.opremove;
4849 		/*
4850 		 * Update directory cache attribute,
4851 		 * readdir and dnlc caches.
4852 		 */
4853 		nfs4_update_dircaches(&rm_res->cinfo, unldvp, NULL, NULL, NULL);
4854 	}
4855 #else
4856 	rfs4call(VTOMI4(unldvp), &args, &res, unlcred, &doqueue, 0, &e);
4857 
4858 	PURGE_ATTRCACHE4(unldvp);
4859 #endif
4860 
4861 	if (nfs4_needs_recovery(&e, FALSE, unldvp->v_vfsp)) {
4862 		if (nfs4_start_recovery(&e, VTOMI4(unldvp), unldvp, NULL,
4863 		    NULL, NULL, OP_REMOVE, NULL) == FALSE) {
4864 			if (!e.error)
4865 				(void) xdr_free(xdr_COMPOUND4res_clnt,
4866 				    (caddr_t)&res);
4867 			nfs4_end_op(VTOMI4(unldvp), unldvp, NULL,
4868 			    &recov_state, TRUE);
4869 			goto recov_retry_remove;
4870 		}
4871 	}
4872 	nfs4_end_op(VTOMI4(unldvp), unldvp, NULL, &recov_state, FALSE);
4873 
4874 	/*
4875 	 * Release stuff held for the remove
4876 	 */
4877 	VN_RELE(unldvp);
4878 	if (!e.error && resp)
4879 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
4880 
4881 	kmem_free(unlname, MAXNAMELEN);
4882 	crfree(unlcred);
4883 	goto redo;
4884 }
4885 
4886 /*
4887  * Remote file system operations having to do with directory manipulation.
4888  */
4889 /* ARGSUSED3 */
4890 int
4891 nfs4_lookup(vnode_t *dvp, char *nm, vnode_t **vpp, struct pathname *pnp,
4892     int flags, vnode_t *rdir, cred_t *cr, caller_context_t *ct,
4893     int *direntflags, pathname_t *realpnp)
4894 {
4895 	int error;
4896 	vnode_t *vp, *avp = NULL;
4897 	rnode4_t *drp;
4898 
4899 	*vpp = NULL;
4900 	if (nfs_zone() != VTOMI4(dvp)->mi_zone)
4901 		return (EPERM);
4902 	/*
4903 	 * if LOOKUP_XATTR, must replace dvp (object) with
4904 	 * object's attrdir before continuing with lookup
4905 	 */
4906 	if (flags & LOOKUP_XATTR) {
4907 		error = nfs4lookup_xattr(dvp, nm, &avp, flags, cr);
4908 		if (error)
4909 			return (error);
4910 
4911 		dvp = avp;
4912 
4913 		/*
4914 		 * If lookup is for "", just return dvp now.  The attrdir
4915 		 * has already been activated (from nfs4lookup_xattr), and
4916 		 * the caller will RELE the original dvp -- not
4917 		 * the attrdir.  So, set vpp and return.
4918 		 * Currently, when the LOOKUP_XATTR flag is
4919 		 * passed to VOP_LOOKUP, the name is always empty, and
4920 		 * shortcircuiting here avoids 3 unneeded lock/unlock
4921 		 * pairs.
4922 		 *
4923 		 * If a non-empty name was provided, then it is the
4924 		 * attribute name, and it will be looked up below.
4925 		 */
4926 		if (*nm == '\0') {
4927 			*vpp = dvp;
4928 			return (0);
4929 		}
4930 
4931 		/*
4932 		 * The vfs layer never sends a name when asking for the
4933 		 * attrdir, so we should never get here (unless of course
4934 		 * name is passed at some time in future -- at which time
4935 		 * we'll blow up here).
4936 		 */
4937 		ASSERT(0);
4938 	}
4939 
4940 	drp = VTOR4(dvp);
4941 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp)))
4942 		return (EINTR);
4943 
4944 	error = nfs4lookup(dvp, nm, vpp, cr, 0);
4945 	nfs_rw_exit(&drp->r_rwlock);
4946 
4947 	/*
4948 	 * If vnode is a device, create special vnode.
4949 	 */
4950 	if (!error && ISVDEV((*vpp)->v_type)) {
4951 		vp = *vpp;
4952 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
4953 		VN_RELE(vp);
4954 	}
4955 
4956 	return (error);
4957 }
4958 
4959 /* ARGSUSED */
4960 static int
4961 nfs4lookup_xattr(vnode_t *dvp, char *nm, vnode_t **vpp, int flags, cred_t *cr)
4962 {
4963 	int error;
4964 	rnode4_t *drp;
4965 	int cflag = ((flags & CREATE_XATTR_DIR) != 0);
4966 	mntinfo4_t *mi;
4967 
4968 	mi = VTOMI4(dvp);
4969 	if (!(mi->mi_vfsp->vfs_flag & VFS_XATTR) &&
4970 	    !vfs_has_feature(mi->mi_vfsp, VFSFT_XVATTR))
4971 		return (EINVAL);
4972 
4973 	drp = VTOR4(dvp);
4974 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp)))
4975 		return (EINTR);
4976 
4977 	mutex_enter(&drp->r_statelock);
4978 	/*
4979 	 * If the server doesn't support xattrs just return EINVAL
4980 	 */
4981 	if (drp->r_xattr_dir == NFS4_XATTR_DIR_NOTSUPP) {
4982 		mutex_exit(&drp->r_statelock);
4983 		nfs_rw_exit(&drp->r_rwlock);
4984 		return (EINVAL);
4985 	}
4986 
4987 	/*
4988 	 * If there is a cached xattr directory entry,
4989 	 * use it as long as the attributes are valid. If the
4990 	 * attributes are not valid, take the simple approach and
4991 	 * free the cached value and re-fetch a new value.
4992 	 *
4993 	 * We don't negative entry cache for now, if we did we
4994 	 * would need to check if the file has changed on every
4995 	 * lookup. But xattrs don't exist very often and failing
4996 	 * an openattr is not much more expensive than and NVERIFY or GETATTR
4997 	 * so do an openattr over the wire for now.
4998 	 */
4999 	if (drp->r_xattr_dir != NULL) {
5000 		if (ATTRCACHE4_VALID(dvp)) {
5001 			VN_HOLD(drp->r_xattr_dir);
5002 			*vpp = drp->r_xattr_dir;
5003 			mutex_exit(&drp->r_statelock);
5004 			nfs_rw_exit(&drp->r_rwlock);
5005 			return (0);
5006 		}
5007 		VN_RELE(drp->r_xattr_dir);
5008 		drp->r_xattr_dir = NULL;
5009 	}
5010 	mutex_exit(&drp->r_statelock);
5011 
5012 	error = nfs4openattr(dvp, vpp, cflag, cr);
5013 
5014 	nfs_rw_exit(&drp->r_rwlock);
5015 
5016 	return (error);
5017 }
5018 
5019 static int
5020 nfs4lookup(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr, int skipdnlc)
5021 {
5022 	int error;
5023 	rnode4_t *drp;
5024 
5025 	ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
5026 
5027 	/*
5028 	 * If lookup is for "", just return dvp.  Don't need
5029 	 * to send it over the wire, look it up in the dnlc,
5030 	 * or perform any access checks.
5031 	 */
5032 	if (*nm == '\0') {
5033 		VN_HOLD(dvp);
5034 		*vpp = dvp;
5035 		return (0);
5036 	}
5037 
5038 	/*
5039 	 * Can't do lookups in non-directories.
5040 	 */
5041 	if (dvp->v_type != VDIR)
5042 		return (ENOTDIR);
5043 
5044 	/*
5045 	 * If lookup is for ".", just return dvp.  Don't need
5046 	 * to send it over the wire or look it up in the dnlc,
5047 	 * just need to check access.
5048 	 */
5049 	if (nm[0] == '.' && nm[1] == '\0') {
5050 		error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5051 		if (error)
5052 			return (error);
5053 		VN_HOLD(dvp);
5054 		*vpp = dvp;
5055 		return (0);
5056 	}
5057 
5058 	drp = VTOR4(dvp);
5059 	if (!(drp->r_flags & R4LOOKUP)) {
5060 		mutex_enter(&drp->r_statelock);
5061 		drp->r_flags |= R4LOOKUP;
5062 		mutex_exit(&drp->r_statelock);
5063 	}
5064 
5065 	*vpp = NULL;
5066 	/*
5067 	 * Lookup this name in the DNLC.  If there is no entry
5068 	 * lookup over the wire.
5069 	 */
5070 	if (!skipdnlc)
5071 		*vpp = dnlc_lookup(dvp, nm);
5072 	if (*vpp == NULL) {
5073 		/*
5074 		 * We need to go over the wire to lookup the name.
5075 		 */
5076 		return (nfs4lookupnew_otw(dvp, nm, vpp, cr));
5077 	}
5078 
5079 	/*
5080 	 * We hit on the dnlc
5081 	 */
5082 	if (*vpp != DNLC_NO_VNODE ||
5083 	    (dvp->v_vfsp->vfs_flag & VFS_RDONLY)) {
5084 		/*
5085 		 * But our attrs may not be valid.
5086 		 */
5087 		if (ATTRCACHE4_VALID(dvp)) {
5088 			error = nfs4_waitfor_purge_complete(dvp);
5089 			if (error) {
5090 				VN_RELE(*vpp);
5091 				*vpp = NULL;
5092 				return (error);
5093 			}
5094 
5095 			/*
5096 			 * If after the purge completes, check to make sure
5097 			 * our attrs are still valid.
5098 			 */
5099 			if (ATTRCACHE4_VALID(dvp)) {
5100 				/*
5101 				 * If we waited for a purge we may have
5102 				 * lost our vnode so look it up again.
5103 				 */
5104 				VN_RELE(*vpp);
5105 				*vpp = dnlc_lookup(dvp, nm);
5106 				if (*vpp == NULL)
5107 					return (nfs4lookupnew_otw(dvp,
5108 					    nm, vpp, cr));
5109 
5110 				/*
5111 				 * The access cache should almost always hit
5112 				 */
5113 				error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5114 
5115 				if (error) {
5116 					VN_RELE(*vpp);
5117 					*vpp = NULL;
5118 					return (error);
5119 				}
5120 				if (*vpp == DNLC_NO_VNODE) {
5121 					VN_RELE(*vpp);
5122 					*vpp = NULL;
5123 					return (ENOENT);
5124 				}
5125 				return (0);
5126 			}
5127 		}
5128 	}
5129 
5130 	ASSERT(*vpp != NULL);
5131 
5132 	/*
5133 	 * We may have gotten here we have one of the following cases:
5134 	 *	1) vpp != DNLC_NO_VNODE, our attrs have timed out so we
5135 	 *		need to validate them.
5136 	 *	2) vpp == DNLC_NO_VNODE, a negative entry that we always
5137 	 *		must validate.
5138 	 *
5139 	 * Go to the server and check if the directory has changed, if
5140 	 * it hasn't we are done and can use the dnlc entry.
5141 	 */
5142 	return (nfs4lookupvalidate_otw(dvp, nm, vpp, cr));
5143 }
5144 
5145 /*
5146  * Go to the server and check if the directory has changed, if
5147  * it hasn't we are done and can use the dnlc entry.  If it
5148  * has changed we get a new copy of its attributes and check
5149  * the access for VEXEC, then relookup the filename and
5150  * get its filehandle and attributes.
5151  *
5152  * PUTFH dfh NVERIFY GETATTR ACCESS LOOKUP GETFH GETATTR
5153  *	if the NVERIFY failed we must
5154  *		purge the caches
5155  *		cache new attributes (will set r_time_attr_inval)
5156  *		cache new access
5157  *		recheck VEXEC access
5158  *		add name to dnlc, possibly negative
5159  *		if LOOKUP succeeded
5160  *			cache new attributes
5161  *	else
5162  *		set a new r_time_attr_inval for dvp
5163  *		check to make sure we have access
5164  *
5165  * The vpp returned is the vnode passed in if the directory is valid,
5166  * a new vnode if successful lookup, or NULL on error.
5167  */
5168 static int
5169 nfs4lookupvalidate_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
5170 {
5171 	COMPOUND4args_clnt args;
5172 	COMPOUND4res_clnt res;
5173 	fattr4 *ver_fattr;
5174 	fattr4_change dchange;
5175 	int32_t *ptr;
5176 	int argoplist_size  = 7 * sizeof (nfs_argop4);
5177 	nfs_argop4 *argop;
5178 	int doqueue;
5179 	mntinfo4_t *mi;
5180 	nfs4_recov_state_t recov_state;
5181 	hrtime_t t;
5182 	int isdotdot;
5183 	vnode_t *nvp;
5184 	nfs_fh4 *fhp;
5185 	nfs4_sharedfh_t *sfhp;
5186 	nfs4_access_type_t cacc;
5187 	rnode4_t *nrp;
5188 	rnode4_t *drp = VTOR4(dvp);
5189 	nfs4_ga_res_t *garp = NULL;
5190 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
5191 
5192 	ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
5193 	ASSERT(nm != NULL);
5194 	ASSERT(nm[0] != '\0');
5195 	ASSERT(dvp->v_type == VDIR);
5196 	ASSERT(nm[0] != '.' || nm[1] != '\0');
5197 	ASSERT(*vpp != NULL);
5198 
5199 	if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0') {
5200 		isdotdot = 1;
5201 		args.ctag = TAG_LOOKUP_VPARENT;
5202 	} else {
5203 		/*
5204 		 * If dvp were a stub, it should have triggered and caused
5205 		 * a mount for us to get this far.
5206 		 */
5207 		ASSERT(!RP_ISSTUB(VTOR4(dvp)));
5208 
5209 		isdotdot = 0;
5210 		args.ctag = TAG_LOOKUP_VALID;
5211 	}
5212 
5213 	mi = VTOMI4(dvp);
5214 	recov_state.rs_flags = 0;
5215 	recov_state.rs_num_retry_despite_err = 0;
5216 
5217 	nvp = NULL;
5218 
5219 	/* Save the original mount point security information */
5220 	(void) save_mnt_secinfo(mi->mi_curr_serv);
5221 
5222 recov_retry:
5223 	e.error = nfs4_start_fop(mi, dvp, NULL, OH_LOOKUP,
5224 	    &recov_state, NULL);
5225 	if (e.error) {
5226 		(void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5227 		VN_RELE(*vpp);
5228 		*vpp = NULL;
5229 		return (e.error);
5230 	}
5231 
5232 	argop = kmem_alloc(argoplist_size, KM_SLEEP);
5233 
5234 	/* PUTFH dfh NVERIFY GETATTR ACCESS LOOKUP GETFH GETATTR */
5235 	args.array_len = 7;
5236 	args.array = argop;
5237 
5238 	/* 0. putfh file */
5239 	argop[0].argop = OP_CPUTFH;
5240 	argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(dvp)->r_fh;
5241 
5242 	/* 1. nverify the change info */
5243 	argop[1].argop = OP_NVERIFY;
5244 	ver_fattr = &argop[1].nfs_argop4_u.opnverify.obj_attributes;
5245 	ver_fattr->attrmask = FATTR4_CHANGE_MASK;
5246 	ver_fattr->attrlist4 = (char *)&dchange;
5247 	ptr = (int32_t *)&dchange;
5248 	IXDR_PUT_HYPER(ptr, VTOR4(dvp)->r_change);
5249 	ver_fattr->attrlist4_len = sizeof (fattr4_change);
5250 
5251 	/* 2. getattr directory */
5252 	argop[2].argop = OP_GETATTR;
5253 	argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5254 	argop[2].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5255 
5256 	/* 3. access directory */
5257 	argop[3].argop = OP_ACCESS;
5258 	argop[3].nfs_argop4_u.opaccess.access = ACCESS4_READ | ACCESS4_DELETE |
5259 	    ACCESS4_MODIFY | ACCESS4_EXTEND | ACCESS4_LOOKUP;
5260 
5261 	/* 4. lookup name */
5262 	if (isdotdot) {
5263 		argop[4].argop = OP_LOOKUPP;
5264 	} else {
5265 		argop[4].argop = OP_CLOOKUP;
5266 		argop[4].nfs_argop4_u.opclookup.cname = nm;
5267 	}
5268 
5269 	/* 5. resulting file handle */
5270 	argop[5].argop = OP_GETFH;
5271 
5272 	/* 6. resulting file attributes */
5273 	argop[6].argop = OP_GETATTR;
5274 	argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5275 	argop[6].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5276 
5277 	doqueue = 1;
5278 	t = gethrtime();
5279 
5280 	rfs4call(VTOMI4(dvp), &args, &res, cr, &doqueue, 0, &e);
5281 
5282 	if (nfs4_needs_recovery(&e, FALSE, dvp->v_vfsp)) {
5283 		/*
5284 		 * For WRONGSEC of a non-dotdot case, send secinfo directly
5285 		 * from this thread, do not go thru the recovery thread since
5286 		 * we need the nm information.
5287 		 *
5288 		 * Not doing dotdot case because there is no specification
5289 		 * for (PUTFH, SECINFO "..") yet.
5290 		 */
5291 		if (!isdotdot && res.status == NFS4ERR_WRONGSEC) {
5292 			if ((e.error = nfs4_secinfo_vnode_otw(dvp, nm, cr)))
5293 				nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5294 				    &recov_state, FALSE);
5295 			else
5296 				nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5297 				    &recov_state, TRUE);
5298 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5299 			kmem_free(argop, argoplist_size);
5300 			if (!e.error)
5301 				goto recov_retry;
5302 			(void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5303 			VN_RELE(*vpp);
5304 			*vpp = NULL;
5305 			return (e.error);
5306 		}
5307 
5308 		if (nfs4_start_recovery(&e, mi, dvp, NULL, NULL, NULL,
5309 		    OP_LOOKUP, NULL) == FALSE) {
5310 			nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5311 			    &recov_state, TRUE);
5312 
5313 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5314 			kmem_free(argop, argoplist_size);
5315 			goto recov_retry;
5316 		}
5317 	}
5318 
5319 	nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP, &recov_state, FALSE);
5320 
5321 	if (e.error || res.array_len == 0) {
5322 		/*
5323 		 * If e.error isn't set, then reply has no ops (or we couldn't
5324 		 * be here).  The only legal way to reply without an op array
5325 		 * is via NFS4ERR_MINOR_VERS_MISMATCH.  An ops array should
5326 		 * be in the reply for all other status values.
5327 		 *
5328 		 * For valid replies without an ops array, return ENOTSUP
5329 		 * (geterrno4 xlation of VERS_MISMATCH).  For illegal replies,
5330 		 * return EIO -- don't trust status.
5331 		 */
5332 		if (e.error == 0)
5333 			e.error = (res.status == NFS4ERR_MINOR_VERS_MISMATCH) ?
5334 			    ENOTSUP : EIO;
5335 		VN_RELE(*vpp);
5336 		*vpp = NULL;
5337 		kmem_free(argop, argoplist_size);
5338 		(void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5339 		return (e.error);
5340 	}
5341 
5342 	if (res.status != NFS4ERR_SAME) {
5343 		e.error = geterrno4(res.status);
5344 
5345 		/*
5346 		 * The NVERIFY "failed" so the directory has changed
5347 		 * First make sure PUTFH succeeded and NVERIFY "failed"
5348 		 * cleanly.
5349 		 */
5350 		if ((res.array[0].nfs_resop4_u.opputfh.status != NFS4_OK) ||
5351 		    (res.array[1].nfs_resop4_u.opnverify.status != NFS4_OK)) {
5352 			nfs4_purge_stale_fh(e.error, dvp, cr);
5353 			VN_RELE(*vpp);
5354 			*vpp = NULL;
5355 			goto exit;
5356 		}
5357 
5358 		/*
5359 		 * We know the NVERIFY "failed" so we must:
5360 		 *	purge the caches (access and indirectly dnlc if needed)
5361 		 */
5362 		nfs4_purge_caches(dvp, NFS4_NOPURGE_DNLC, cr, TRUE);
5363 
5364 		if (res.array[2].nfs_resop4_u.opgetattr.status != NFS4_OK) {
5365 			nfs4_purge_stale_fh(e.error, dvp, cr);
5366 			VN_RELE(*vpp);
5367 			*vpp = NULL;
5368 			goto exit;
5369 		}
5370 
5371 		/*
5372 		 * Install new cached attributes for the directory
5373 		 */
5374 		nfs4_attr_cache(dvp,
5375 		    &res.array[2].nfs_resop4_u.opgetattr.ga_res,
5376 		    t, cr, FALSE, NULL);
5377 
5378 		if (res.array[3].nfs_resop4_u.opaccess.status != NFS4_OK) {
5379 			nfs4_purge_stale_fh(e.error, dvp, cr);
5380 			VN_RELE(*vpp);
5381 			*vpp = NULL;
5382 			e.error = geterrno4(res.status);
5383 			goto exit;
5384 		}
5385 
5386 		/*
5387 		 * Now we know the directory is valid,
5388 		 * cache new directory access
5389 		 */
5390 		nfs4_access_cache(drp,
5391 		    args.array[3].nfs_argop4_u.opaccess.access,
5392 		    res.array[3].nfs_resop4_u.opaccess.access, cr);
5393 
5394 		/*
5395 		 * recheck VEXEC access
5396 		 */
5397 		cacc = nfs4_access_check(drp, ACCESS4_LOOKUP, cr);
5398 		if (cacc != NFS4_ACCESS_ALLOWED) {
5399 			/*
5400 			 * Directory permissions might have been revoked
5401 			 */
5402 			if (cacc == NFS4_ACCESS_DENIED) {
5403 				e.error = EACCES;
5404 				VN_RELE(*vpp);
5405 				*vpp = NULL;
5406 				goto exit;
5407 			}
5408 
5409 			/*
5410 			 * Somehow we must not have asked for enough
5411 			 * so try a singleton ACCESS, should never happen.
5412 			 */
5413 			e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5414 			if (e.error) {
5415 				VN_RELE(*vpp);
5416 				*vpp = NULL;
5417 				goto exit;
5418 			}
5419 		}
5420 
5421 		e.error = geterrno4(res.status);
5422 		if (res.array[4].nfs_resop4_u.oplookup.status != NFS4_OK) {
5423 			/*
5424 			 * The lookup failed, probably no entry
5425 			 */
5426 			if (e.error == ENOENT && nfs4_lookup_neg_cache) {
5427 				dnlc_update(dvp, nm, DNLC_NO_VNODE);
5428 			} else {
5429 				/*
5430 				 * Might be some other error, so remove
5431 				 * the dnlc entry to make sure we start all
5432 				 * over again, next time.
5433 				 */
5434 				dnlc_remove(dvp, nm);
5435 			}
5436 			VN_RELE(*vpp);
5437 			*vpp = NULL;
5438 			goto exit;
5439 		}
5440 
5441 		if (res.array[5].nfs_resop4_u.opgetfh.status != NFS4_OK) {
5442 			/*
5443 			 * The file exists but we can't get its fh for
5444 			 * some unknown reason.  Remove it from the dnlc
5445 			 * and error out to be safe.
5446 			 */
5447 			dnlc_remove(dvp, nm);
5448 			VN_RELE(*vpp);
5449 			*vpp = NULL;
5450 			goto exit;
5451 		}
5452 		fhp = &res.array[5].nfs_resop4_u.opgetfh.object;
5453 		if (fhp->nfs_fh4_len == 0) {
5454 			/*
5455 			 * The file exists but a bogus fh
5456 			 * some unknown reason.  Remove it from the dnlc
5457 			 * and error out to be safe.
5458 			 */
5459 			e.error = ENOENT;
5460 			dnlc_remove(dvp, nm);
5461 			VN_RELE(*vpp);
5462 			*vpp = NULL;
5463 			goto exit;
5464 		}
5465 		sfhp = sfh4_get(fhp, mi);
5466 
5467 		if (res.array[6].nfs_resop4_u.opgetattr.status == NFS4_OK)
5468 			garp = &res.array[6].nfs_resop4_u.opgetattr.ga_res;
5469 
5470 		/*
5471 		 * Make the new rnode
5472 		 */
5473 		if (isdotdot) {
5474 			e.error = nfs4_make_dotdot(sfhp, t, dvp, cr, &nvp, 1);
5475 			if (e.error) {
5476 				sfh4_rele(&sfhp);
5477 				VN_RELE(*vpp);
5478 				*vpp = NULL;
5479 				goto exit;
5480 			}
5481 			/*
5482 			 * XXX if nfs4_make_dotdot uses an existing rnode
5483 			 * XXX it doesn't update the attributes.
5484 			 * XXX for now just save them again to save an OTW
5485 			 */
5486 			nfs4_attr_cache(nvp, garp, t, cr, FALSE, NULL);
5487 		} else {
5488 			nvp = makenfs4node(sfhp, garp, dvp->v_vfsp, t, cr,
5489 			    dvp, fn_get(VTOSV(dvp)->sv_name, nm));
5490 			/*
5491 			 * If v_type == VNON, then garp was NULL because
5492 			 * the last op in the compound failed and makenfs4node
5493 			 * could not find the vnode for sfhp. It created
5494 			 * a new vnode, so we have nothing to purge here.
5495 			 */
5496 			if (nvp->v_type == VNON) {
5497 				vattr_t vattr;
5498 
5499 				vattr.va_mask = AT_TYPE;
5500 				/*
5501 				 * N.B. We've already called nfs4_end_fop above.
5502 				 */
5503 				e.error = nfs4getattr(nvp, &vattr, cr);
5504 				if (e.error) {
5505 					sfh4_rele(&sfhp);
5506 					VN_RELE(*vpp);
5507 					*vpp = NULL;
5508 					VN_RELE(nvp);
5509 					goto exit;
5510 				}
5511 				nvp->v_type = vattr.va_type;
5512 			}
5513 		}
5514 		sfh4_rele(&sfhp);
5515 
5516 		nrp = VTOR4(nvp);
5517 		mutex_enter(&nrp->r_statev4_lock);
5518 		if (!nrp->created_v4) {
5519 			mutex_exit(&nrp->r_statev4_lock);
5520 			dnlc_update(dvp, nm, nvp);
5521 		} else
5522 			mutex_exit(&nrp->r_statev4_lock);
5523 
5524 		VN_RELE(*vpp);
5525 		*vpp = nvp;
5526 	} else {
5527 		hrtime_t now;
5528 		hrtime_t delta = 0;
5529 
5530 		e.error = 0;
5531 
5532 		/*
5533 		 * Because the NVERIFY "succeeded" we know that the
5534 		 * directory attributes are still valid
5535 		 * so update r_time_attr_inval
5536 		 */
5537 		now = gethrtime();
5538 		mutex_enter(&drp->r_statelock);
5539 		if (!(mi->mi_flags & MI4_NOAC) && !(dvp->v_flag & VNOCACHE)) {
5540 			delta = now - drp->r_time_attr_saved;
5541 			if (delta < mi->mi_acdirmin)
5542 				delta = mi->mi_acdirmin;
5543 			else if (delta > mi->mi_acdirmax)
5544 				delta = mi->mi_acdirmax;
5545 		}
5546 		drp->r_time_attr_inval = now + delta;
5547 		mutex_exit(&drp->r_statelock);
5548 		dnlc_update(dvp, nm, *vpp);
5549 
5550 		/*
5551 		 * Even though we have a valid directory attr cache
5552 		 * and dnlc entry, we may not have access.
5553 		 * This should almost always hit the cache.
5554 		 */
5555 		e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5556 		if (e.error) {
5557 			VN_RELE(*vpp);
5558 			*vpp = NULL;
5559 		}
5560 
5561 		if (*vpp == DNLC_NO_VNODE) {
5562 			VN_RELE(*vpp);
5563 			*vpp = NULL;
5564 			e.error = ENOENT;
5565 		}
5566 	}
5567 
5568 exit:
5569 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5570 	kmem_free(argop, argoplist_size);
5571 	(void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5572 	return (e.error);
5573 }
5574 
5575 /*
5576  * We need to go over the wire to lookup the name, but
5577  * while we are there verify the directory has not
5578  * changed but if it has, get new attributes and check access
5579  *
5580  * PUTFH dfh SAVEFH LOOKUP nm GETFH GETATTR RESTOREFH
5581  *					NVERIFY GETATTR ACCESS
5582  *
5583  * With the results:
5584  *	if the NVERIFY failed we must purge the caches, add new attributes,
5585  *		and cache new access.
5586  *	set a new r_time_attr_inval
5587  *	add name to dnlc, possibly negative
5588  *	if LOOKUP succeeded
5589  *		cache new attributes
5590  */
5591 static int
5592 nfs4lookupnew_otw(vnode_t *dvp, char *nm, vnode_t **vpp, cred_t *cr)
5593 {
5594 	COMPOUND4args_clnt args;
5595 	COMPOUND4res_clnt res;
5596 	fattr4 *ver_fattr;
5597 	fattr4_change dchange;
5598 	int32_t *ptr;
5599 	nfs4_ga_res_t *garp = NULL;
5600 	int argoplist_size  = 9 * sizeof (nfs_argop4);
5601 	nfs_argop4 *argop;
5602 	int doqueue;
5603 	mntinfo4_t *mi;
5604 	nfs4_recov_state_t recov_state;
5605 	hrtime_t t;
5606 	int isdotdot;
5607 	vnode_t *nvp;
5608 	nfs_fh4 *fhp;
5609 	nfs4_sharedfh_t *sfhp;
5610 	nfs4_access_type_t cacc;
5611 	rnode4_t *nrp;
5612 	rnode4_t *drp = VTOR4(dvp);
5613 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
5614 
5615 	ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
5616 	ASSERT(nm != NULL);
5617 	ASSERT(nm[0] != '\0');
5618 	ASSERT(dvp->v_type == VDIR);
5619 	ASSERT(nm[0] != '.' || nm[1] != '\0');
5620 	ASSERT(*vpp == NULL);
5621 
5622 	if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0') {
5623 		isdotdot = 1;
5624 		args.ctag = TAG_LOOKUP_PARENT;
5625 	} else {
5626 		/*
5627 		 * If dvp were a stub, it should have triggered and caused
5628 		 * a mount for us to get this far.
5629 		 */
5630 		ASSERT(!RP_ISSTUB(VTOR4(dvp)));
5631 
5632 		isdotdot = 0;
5633 		args.ctag = TAG_LOOKUP;
5634 	}
5635 
5636 	mi = VTOMI4(dvp);
5637 	recov_state.rs_flags = 0;
5638 	recov_state.rs_num_retry_despite_err = 0;
5639 
5640 	nvp = NULL;
5641 
5642 	/* Save the original mount point security information */
5643 	(void) save_mnt_secinfo(mi->mi_curr_serv);
5644 
5645 recov_retry:
5646 	e.error = nfs4_start_fop(mi, dvp, NULL, OH_LOOKUP,
5647 	    &recov_state, NULL);
5648 	if (e.error) {
5649 		(void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5650 		return (e.error);
5651 	}
5652 
5653 	argop = kmem_alloc(argoplist_size, KM_SLEEP);
5654 
5655 	/* PUTFH SAVEFH LOOKUP GETFH GETATTR RESTOREFH NVERIFY GETATTR ACCESS */
5656 	args.array_len = 9;
5657 	args.array = argop;
5658 
5659 	/* 0. putfh file */
5660 	argop[0].argop = OP_CPUTFH;
5661 	argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(dvp)->r_fh;
5662 
5663 	/* 1. savefh for the nverify */
5664 	argop[1].argop = OP_SAVEFH;
5665 
5666 	/* 2. lookup name */
5667 	if (isdotdot) {
5668 		argop[2].argop = OP_LOOKUPP;
5669 	} else {
5670 		argop[2].argop = OP_CLOOKUP;
5671 		argop[2].nfs_argop4_u.opclookup.cname = nm;
5672 	}
5673 
5674 	/* 3. resulting file handle */
5675 	argop[3].argop = OP_GETFH;
5676 
5677 	/* 4. resulting file attributes */
5678 	argop[4].argop = OP_GETATTR;
5679 	argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5680 	argop[4].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5681 
5682 	/* 5. restorefh back the directory for the nverify */
5683 	argop[5].argop = OP_RESTOREFH;
5684 
5685 	/* 6. nverify the change info */
5686 	argop[6].argop = OP_NVERIFY;
5687 	ver_fattr = &argop[6].nfs_argop4_u.opnverify.obj_attributes;
5688 	ver_fattr->attrmask = FATTR4_CHANGE_MASK;
5689 	ver_fattr->attrlist4 = (char *)&dchange;
5690 	ptr = (int32_t *)&dchange;
5691 	IXDR_PUT_HYPER(ptr, VTOR4(dvp)->r_change);
5692 	ver_fattr->attrlist4_len = sizeof (fattr4_change);
5693 
5694 	/* 7. getattr directory */
5695 	argop[7].argop = OP_GETATTR;
5696 	argop[7].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
5697 	argop[7].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
5698 
5699 	/* 8. access directory */
5700 	argop[8].argop = OP_ACCESS;
5701 	argop[8].nfs_argop4_u.opaccess.access = ACCESS4_READ | ACCESS4_DELETE |
5702 	    ACCESS4_MODIFY | ACCESS4_EXTEND | ACCESS4_LOOKUP;
5703 
5704 	doqueue = 1;
5705 	t = gethrtime();
5706 
5707 	rfs4call(VTOMI4(dvp), &args, &res, cr, &doqueue, 0, &e);
5708 
5709 	if (nfs4_needs_recovery(&e, FALSE, dvp->v_vfsp)) {
5710 		/*
5711 		 * For WRONGSEC of a non-dotdot case, send secinfo directly
5712 		 * from this thread, do not go thru the recovery thread since
5713 		 * we need the nm information.
5714 		 *
5715 		 * Not doing dotdot case because there is no specification
5716 		 * for (PUTFH, SECINFO "..") yet.
5717 		 */
5718 		if (!isdotdot && res.status == NFS4ERR_WRONGSEC) {
5719 			if ((e.error = nfs4_secinfo_vnode_otw(dvp, nm, cr)))
5720 				nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5721 				    &recov_state, FALSE);
5722 			else
5723 				nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5724 				    &recov_state, TRUE);
5725 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5726 			kmem_free(argop, argoplist_size);
5727 			if (!e.error)
5728 				goto recov_retry;
5729 			(void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5730 			return (e.error);
5731 		}
5732 
5733 		if (nfs4_start_recovery(&e, mi, dvp, NULL, NULL, NULL,
5734 		    OP_LOOKUP, NULL) == FALSE) {
5735 			nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP,
5736 			    &recov_state, TRUE);
5737 
5738 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5739 			kmem_free(argop, argoplist_size);
5740 			goto recov_retry;
5741 		}
5742 	}
5743 
5744 	nfs4_end_fop(mi, dvp, NULL, OH_LOOKUP, &recov_state, FALSE);
5745 
5746 	if (e.error || res.array_len == 0) {
5747 		/*
5748 		 * If e.error isn't set, then reply has no ops (or we couldn't
5749 		 * be here).  The only legal way to reply without an op array
5750 		 * is via NFS4ERR_MINOR_VERS_MISMATCH.  An ops array should
5751 		 * be in the reply for all other status values.
5752 		 *
5753 		 * For valid replies without an ops array, return ENOTSUP
5754 		 * (geterrno4 xlation of VERS_MISMATCH).  For illegal replies,
5755 		 * return EIO -- don't trust status.
5756 		 */
5757 		if (e.error == 0)
5758 			e.error = (res.status == NFS4ERR_MINOR_VERS_MISMATCH) ?
5759 			    ENOTSUP : EIO;
5760 
5761 		kmem_free(argop, argoplist_size);
5762 		(void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5763 		return (e.error);
5764 	}
5765 
5766 	e.error = geterrno4(res.status);
5767 
5768 	/*
5769 	 * The PUTFH and SAVEFH may have failed.
5770 	 */
5771 	if ((res.array[0].nfs_resop4_u.opputfh.status != NFS4_OK) ||
5772 	    (res.array[1].nfs_resop4_u.opsavefh.status != NFS4_OK)) {
5773 		nfs4_purge_stale_fh(e.error, dvp, cr);
5774 		goto exit;
5775 	}
5776 
5777 	/*
5778 	 * Check if the file exists, if it does delay entering
5779 	 * into the dnlc until after we update the directory
5780 	 * attributes so we don't cause it to get purged immediately.
5781 	 */
5782 	if (res.array[2].nfs_resop4_u.oplookup.status != NFS4_OK) {
5783 		/*
5784 		 * The lookup failed, probably no entry
5785 		 */
5786 		if (e.error == ENOENT && nfs4_lookup_neg_cache)
5787 			dnlc_update(dvp, nm, DNLC_NO_VNODE);
5788 		goto exit;
5789 	}
5790 
5791 	if (res.array[3].nfs_resop4_u.opgetfh.status != NFS4_OK) {
5792 		/*
5793 		 * The file exists but we can't get its fh for
5794 		 * some unknown reason. Error out to be safe.
5795 		 */
5796 		goto exit;
5797 	}
5798 
5799 	fhp = &res.array[3].nfs_resop4_u.opgetfh.object;
5800 	if (fhp->nfs_fh4_len == 0) {
5801 		/*
5802 		 * The file exists but a bogus fh
5803 		 * some unknown reason.  Error out to be safe.
5804 		 */
5805 		e.error = EIO;
5806 		goto exit;
5807 	}
5808 	sfhp = sfh4_get(fhp, mi);
5809 
5810 	if (res.array[4].nfs_resop4_u.opgetattr.status != NFS4_OK) {
5811 		sfh4_rele(&sfhp);
5812 		goto exit;
5813 	}
5814 	garp = &res.array[4].nfs_resop4_u.opgetattr.ga_res;
5815 
5816 	/*
5817 	 * The RESTOREFH may have failed
5818 	 */
5819 	if (res.array[5].nfs_resop4_u.oprestorefh.status != NFS4_OK) {
5820 		sfh4_rele(&sfhp);
5821 		e.error = EIO;
5822 		goto exit;
5823 	}
5824 
5825 	if (res.array[6].nfs_resop4_u.opnverify.status != NFS4ERR_SAME) {
5826 		/*
5827 		 * First make sure the NVERIFY failed as we expected,
5828 		 * if it didn't then be conservative and error out
5829 		 * as we can't trust the directory.
5830 		 */
5831 		if (res.array[6].nfs_resop4_u.opnverify.status != NFS4_OK) {
5832 			sfh4_rele(&sfhp);
5833 			e.error = EIO;
5834 			goto exit;
5835 		}
5836 
5837 		/*
5838 		 * We know the NVERIFY "failed" so the directory has changed,
5839 		 * so we must:
5840 		 *	purge the caches (access and indirectly dnlc if needed)
5841 		 */
5842 		nfs4_purge_caches(dvp, NFS4_NOPURGE_DNLC, cr, TRUE);
5843 
5844 		if (res.array[7].nfs_resop4_u.opgetattr.status != NFS4_OK) {
5845 			sfh4_rele(&sfhp);
5846 			goto exit;
5847 		}
5848 		nfs4_attr_cache(dvp,
5849 		    &res.array[7].nfs_resop4_u.opgetattr.ga_res,
5850 		    t, cr, FALSE, NULL);
5851 
5852 		if (res.array[8].nfs_resop4_u.opaccess.status != NFS4_OK) {
5853 			nfs4_purge_stale_fh(e.error, dvp, cr);
5854 			sfh4_rele(&sfhp);
5855 			e.error = geterrno4(res.status);
5856 			goto exit;
5857 		}
5858 
5859 		/*
5860 		 * Now we know the directory is valid,
5861 		 * cache new directory access
5862 		 */
5863 		nfs4_access_cache(drp,
5864 		    args.array[8].nfs_argop4_u.opaccess.access,
5865 		    res.array[8].nfs_resop4_u.opaccess.access, cr);
5866 
5867 		/*
5868 		 * recheck VEXEC access
5869 		 */
5870 		cacc = nfs4_access_check(drp, ACCESS4_LOOKUP, cr);
5871 		if (cacc != NFS4_ACCESS_ALLOWED) {
5872 			/*
5873 			 * Directory permissions might have been revoked
5874 			 */
5875 			if (cacc == NFS4_ACCESS_DENIED) {
5876 				sfh4_rele(&sfhp);
5877 				e.error = EACCES;
5878 				goto exit;
5879 			}
5880 
5881 			/*
5882 			 * Somehow we must not have asked for enough
5883 			 * so try a singleton ACCESS should never happen
5884 			 */
5885 			e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5886 			if (e.error) {
5887 				sfh4_rele(&sfhp);
5888 				goto exit;
5889 			}
5890 		}
5891 
5892 		e.error = geterrno4(res.status);
5893 	} else {
5894 		hrtime_t now;
5895 		hrtime_t delta = 0;
5896 
5897 		e.error = 0;
5898 
5899 		/*
5900 		 * Because the NVERIFY "succeeded" we know that the
5901 		 * directory attributes are still valid
5902 		 * so update r_time_attr_inval
5903 		 */
5904 		now = gethrtime();
5905 		mutex_enter(&drp->r_statelock);
5906 		if (!(mi->mi_flags & MI4_NOAC) && !(dvp->v_flag & VNOCACHE)) {
5907 			delta = now - drp->r_time_attr_saved;
5908 			if (delta < mi->mi_acdirmin)
5909 				delta = mi->mi_acdirmin;
5910 			else if (delta > mi->mi_acdirmax)
5911 				delta = mi->mi_acdirmax;
5912 		}
5913 		drp->r_time_attr_inval = now + delta;
5914 		mutex_exit(&drp->r_statelock);
5915 
5916 		/*
5917 		 * Even though we have a valid directory attr cache,
5918 		 * we may not have access.
5919 		 * This should almost always hit the cache.
5920 		 */
5921 		e.error = nfs4_access(dvp, VEXEC, 0, cr, NULL);
5922 		if (e.error) {
5923 			sfh4_rele(&sfhp);
5924 			goto exit;
5925 		}
5926 	}
5927 
5928 	/*
5929 	 * Now we have successfully completed the lookup, if the
5930 	 * directory has changed we now have the valid attributes.
5931 	 * We also know we have directory access.
5932 	 * Create the new rnode and insert it in the dnlc.
5933 	 */
5934 	if (isdotdot) {
5935 		e.error = nfs4_make_dotdot(sfhp, t, dvp, cr, &nvp, 1);
5936 		if (e.error) {
5937 			sfh4_rele(&sfhp);
5938 			goto exit;
5939 		}
5940 		/*
5941 		 * XXX if nfs4_make_dotdot uses an existing rnode
5942 		 * XXX it doesn't update the attributes.
5943 		 * XXX for now just save them again to save an OTW
5944 		 */
5945 		nfs4_attr_cache(nvp, garp, t, cr, FALSE, NULL);
5946 	} else {
5947 		nvp = makenfs4node(sfhp, garp, dvp->v_vfsp, t, cr,
5948 		    dvp, fn_get(VTOSV(dvp)->sv_name, nm));
5949 	}
5950 	sfh4_rele(&sfhp);
5951 
5952 	nrp = VTOR4(nvp);
5953 	mutex_enter(&nrp->r_statev4_lock);
5954 	if (!nrp->created_v4) {
5955 		mutex_exit(&nrp->r_statev4_lock);
5956 		dnlc_update(dvp, nm, nvp);
5957 	} else
5958 		mutex_exit(&nrp->r_statev4_lock);
5959 
5960 	*vpp = nvp;
5961 
5962 exit:
5963 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
5964 	kmem_free(argop, argoplist_size);
5965 	(void) check_mnt_secinfo(mi->mi_curr_serv, nvp);
5966 	return (e.error);
5967 }
5968 
5969 #ifdef DEBUG
5970 void
5971 nfs4lookup_dump_compound(char *where, nfs_argop4 *argbase, int argcnt)
5972 {
5973 	uint_t i, len;
5974 	zoneid_t zoneid = getzoneid();
5975 	char *s;
5976 
5977 	zcmn_err(zoneid, CE_NOTE, "%s: dumping cmpd", where);
5978 	for (i = 0; i < argcnt; i++) {
5979 		nfs_argop4 *op = &argbase[i];
5980 		switch (op->argop) {
5981 		case OP_CPUTFH:
5982 		case OP_PUTFH:
5983 			zcmn_err(zoneid, CE_NOTE, "\t op %d, putfh", i);
5984 			break;
5985 		case OP_PUTROOTFH:
5986 			zcmn_err(zoneid, CE_NOTE, "\t op %d, putrootfh", i);
5987 			break;
5988 		case OP_CLOOKUP:
5989 			s = op->nfs_argop4_u.opclookup.cname;
5990 			zcmn_err(zoneid, CE_NOTE, "\t op %d, lookup %s", i, s);
5991 			break;
5992 		case OP_LOOKUP:
5993 			s = utf8_to_str(&op->nfs_argop4_u.oplookup.objname,
5994 			    &len, NULL);
5995 			zcmn_err(zoneid, CE_NOTE, "\t op %d, lookup %s", i, s);
5996 			kmem_free(s, len);
5997 			break;
5998 		case OP_LOOKUPP:
5999 			zcmn_err(zoneid, CE_NOTE, "\t op %d, lookupp ..", i);
6000 			break;
6001 		case OP_GETFH:
6002 			zcmn_err(zoneid, CE_NOTE, "\t op %d, getfh", i);
6003 			break;
6004 		case OP_GETATTR:
6005 			zcmn_err(zoneid, CE_NOTE, "\t op %d, getattr", i);
6006 			break;
6007 		case OP_OPENATTR:
6008 			zcmn_err(zoneid, CE_NOTE, "\t op %d, openattr", i);
6009 			break;
6010 		default:
6011 			zcmn_err(zoneid, CE_NOTE, "\t op %d, opcode %d", i,
6012 			    op->argop);
6013 			break;
6014 		}
6015 	}
6016 }
6017 #endif
6018 
6019 /*
6020  * nfs4lookup_setup - constructs a multi-lookup compound request.
6021  *
6022  * Given the path "nm1/nm2/.../nmn", the following compound requests
6023  * may be created:
6024  *
6025  * Note: Getfh is not be needed because filehandle attr is mandatory, but it
6026  * is faster, for now.
6027  *
6028  * l4_getattrs indicates the type of compound requested.
6029  *
6030  * LKP4_NO_ATTRIBUTE - no attributes (used by secinfo):
6031  *
6032  *	compound { Put*fh; Lookup {nm1}; Lookup {nm2}; ...  Lookup {nmn} }
6033  *
6034  *   total number of ops is n + 1.
6035  *
6036  * LKP4_LAST_NAMED_ATTR - multi-component path for a named
6037  *      attribute: create lookups plus one OPENATTR/GETFH/GETATTR
6038  *      before the last component, and only get attributes
6039  *      for the last component.  Note that the second-to-last
6040  *	pathname component is XATTR_RPATH, which does NOT go
6041  *	over-the-wire as a lookup.
6042  *
6043  *      compound { Put*fh; Lookup {nm1}; Lookup {nm2}; ... Lookup {nmn-2};
6044  *		Openattr; Getfh; Getattr; Lookup {nmn}; Getfh; Getattr }
6045  *
6046  *   and total number of ops is n + 5.
6047  *
6048  * LKP4_LAST_ATTRDIR - multi-component path for the hidden named
6049  *      attribute directory: create lookups plus an OPENATTR
6050  *	replacing the last lookup.  Note that the last pathname
6051  *	component is XATTR_RPATH, which does NOT go over-the-wire
6052  *	as a lookup.
6053  *
6054  *      compound { Put*fh; Lookup {nm1}; Lookup {nm2}; ... Getfh; Getattr;
6055  *		Openattr; Getfh; Getattr }
6056  *
6057  *   and total number of ops is n + 5.
6058  *
6059  * LKP4_ALL_ATTRIBUTES - create lookups and get attributes for intermediate
6060  *	nodes too.
6061  *
6062  *	compound { Put*fh; Lookup {nm1}; Getfh; Getattr;
6063  *		Lookup {nm2}; ...  Lookup {nmn}; Getfh; Getattr }
6064  *
6065  *   and total number of ops is 3*n + 1.
6066  *
6067  * All cases: returns the index in the arg array of the final LOOKUP op, or
6068  * -1 if no LOOKUPs were used.
6069  */
6070 int
6071 nfs4lookup_setup(char *nm, lookup4_param_t *lookupargp, int needgetfh)
6072 {
6073 	enum lkp4_attr_setup l4_getattrs = lookupargp->l4_getattrs;
6074 	nfs_argop4 *argbase, *argop;
6075 	int arglen, argcnt;
6076 	int n = 1;	/* number of components */
6077 	int nga = 1;	/* number of Getattr's in request */
6078 	char c = '\0', *s, *p;
6079 	int lookup_idx = -1;
6080 	int argoplist_size;
6081 
6082 	/* set lookuparg response result to 0 */
6083 	lookupargp->resp->status = NFS4_OK;
6084 
6085 	/* skip leading "/" or "." e.g. ".//./" if there is */
6086 	for (; ; nm++) {
6087 		if (*nm != '/' && *nm != '.')
6088 			break;
6089 
6090 		/* ".." is counted as 1 component */
6091 		if (*nm == '.' && *(nm + 1) == '.')
6092 			break;
6093 	}
6094 
6095 	/*
6096 	 * Find n = number of components - nm must be null terminated
6097 	 * Skip "." components.
6098 	 */
6099 	if (*nm != '\0')
6100 		for (n = 1, s = nm; *s != '\0'; s++) {
6101 			if ((*s == '/') && (*(s + 1) != '/') &&
6102 			    (*(s + 1) != '\0') &&
6103 			    !(*(s + 1) == '.' && (*(s + 2) == '/' ||
6104 			    *(s + 2) == '\0')))
6105 				n++;
6106 		}
6107 	else
6108 		n = 0;
6109 
6110 	/*
6111 	 * nga is number of components that need Getfh+Getattr
6112 	 */
6113 	switch (l4_getattrs) {
6114 	case LKP4_NO_ATTRIBUTES:
6115 		nga = 0;
6116 		break;
6117 	case LKP4_ALL_ATTRIBUTES:
6118 		nga = n;
6119 		/*
6120 		 * Always have at least 1 getfh, getattr pair
6121 		 */
6122 		if (nga == 0)
6123 			nga++;
6124 		break;
6125 	case LKP4_LAST_ATTRDIR:
6126 	case LKP4_LAST_NAMED_ATTR:
6127 		nga = n+1;
6128 		break;
6129 	}
6130 
6131 	/*
6132 	 * If change to use the filehandle attr instead of getfh
6133 	 * the following line can be deleted.
6134 	 */
6135 	nga *= 2;
6136 
6137 	/*
6138 	 * calculate number of ops in request as
6139 	 * header + trailer + lookups + getattrs
6140 	 */
6141 	arglen = lookupargp->header_len + lookupargp->trailer_len + n + nga;
6142 
6143 	argoplist_size = arglen * sizeof (nfs_argop4);
6144 	argop = argbase = kmem_alloc(argoplist_size, KM_SLEEP);
6145 	lookupargp->argsp->array = argop;
6146 
6147 	argcnt = lookupargp->header_len;
6148 	argop += argcnt;
6149 
6150 	/*
6151 	 * loop and create a lookup op and possibly getattr/getfh for
6152 	 * each component. Skip "." components.
6153 	 */
6154 	for (s = nm; *s != '\0'; s = p) {
6155 		/*
6156 		 * Set up a pathname struct for each component if needed
6157 		 */
6158 		while (*s == '/')
6159 			s++;
6160 		if (*s == '\0')
6161 			break;
6162 
6163 		for (p = s; (*p != '/') && (*p != '\0'); p++)
6164 			;
6165 		c = *p;
6166 		*p = '\0';
6167 
6168 		if (s[0] == '.' && s[1] == '\0') {
6169 			*p = c;
6170 			continue;
6171 		}
6172 		if (l4_getattrs == LKP4_LAST_ATTRDIR &&
6173 		    strcmp(s, XATTR_RPATH) == 0) {
6174 			/* getfh XXX may not be needed in future */
6175 			argop->argop = OP_GETFH;
6176 			argop++;
6177 			argcnt++;
6178 
6179 			/* getattr */
6180 			argop->argop = OP_GETATTR;
6181 			argop->nfs_argop4_u.opgetattr.attr_request =
6182 			    lookupargp->ga_bits;
6183 			argop->nfs_argop4_u.opgetattr.mi =
6184 			    lookupargp->mi;
6185 			argop++;
6186 			argcnt++;
6187 
6188 			/* openattr */
6189 			argop->argop = OP_OPENATTR;
6190 		} else if (l4_getattrs == LKP4_LAST_NAMED_ATTR &&
6191 		    strcmp(s, XATTR_RPATH) == 0) {
6192 			/* openattr */
6193 			argop->argop = OP_OPENATTR;
6194 			argop++;
6195 			argcnt++;
6196 
6197 			/* getfh XXX may not be needed in future */
6198 			argop->argop = OP_GETFH;
6199 			argop++;
6200 			argcnt++;
6201 
6202 			/* getattr */
6203 			argop->argop = OP_GETATTR;
6204 			argop->nfs_argop4_u.opgetattr.attr_request =
6205 			    lookupargp->ga_bits;
6206 			argop->nfs_argop4_u.opgetattr.mi =
6207 			    lookupargp->mi;
6208 			argop++;
6209 			argcnt++;
6210 			*p = c;
6211 			continue;
6212 		} else if (s[0] == '.' && s[1] == '.' && s[2] == '\0') {
6213 			/* lookupp */
6214 			argop->argop = OP_LOOKUPP;
6215 		} else {
6216 			/* lookup */
6217 			argop->argop = OP_LOOKUP;
6218 			(void) str_to_utf8(s,
6219 			    &argop->nfs_argop4_u.oplookup.objname);
6220 		}
6221 		lookup_idx = argcnt;
6222 		argop++;
6223 		argcnt++;
6224 
6225 		*p = c;
6226 
6227 		if (l4_getattrs == LKP4_ALL_ATTRIBUTES) {
6228 			/* getfh XXX may not be needed in future */
6229 			argop->argop = OP_GETFH;
6230 			argop++;
6231 			argcnt++;
6232 
6233 			/* getattr */
6234 			argop->argop = OP_GETATTR;
6235 			argop->nfs_argop4_u.opgetattr.attr_request =
6236 			    lookupargp->ga_bits;
6237 			argop->nfs_argop4_u.opgetattr.mi =
6238 			    lookupargp->mi;
6239 			argop++;
6240 			argcnt++;
6241 		}
6242 	}
6243 
6244 	if ((l4_getattrs != LKP4_NO_ATTRIBUTES) &&
6245 	    ((l4_getattrs != LKP4_ALL_ATTRIBUTES) || (lookup_idx < 0))) {
6246 		if (needgetfh) {
6247 			/* stick in a post-lookup getfh */
6248 			argop->argop = OP_GETFH;
6249 			argcnt++;
6250 			argop++;
6251 		}
6252 		/* post-lookup getattr */
6253 		argop->argop = OP_GETATTR;
6254 		argop->nfs_argop4_u.opgetattr.attr_request =
6255 		    lookupargp->ga_bits;
6256 		argop->nfs_argop4_u.opgetattr.mi = lookupargp->mi;
6257 		argcnt++;
6258 	}
6259 	argcnt += lookupargp->trailer_len;	/* actual op count */
6260 	lookupargp->argsp->array_len = argcnt;
6261 	lookupargp->arglen = arglen;
6262 
6263 #ifdef DEBUG
6264 	if (nfs4_client_lookup_debug)
6265 		nfs4lookup_dump_compound("nfs4lookup_setup", argbase, argcnt);
6266 #endif
6267 
6268 	return (lookup_idx);
6269 }
6270 
6271 static int
6272 nfs4openattr(vnode_t *dvp, vnode_t **avp, int cflag, cred_t *cr)
6273 {
6274 	COMPOUND4args_clnt	args;
6275 	COMPOUND4res_clnt	res;
6276 	GETFH4res	*gf_res = NULL;
6277 	nfs_argop4	argop[4];
6278 	nfs_resop4	*resop = NULL;
6279 	nfs4_sharedfh_t *sfhp;
6280 	hrtime_t t;
6281 	nfs4_error_t	e;
6282 
6283 	rnode4_t	*drp;
6284 	int		doqueue = 1;
6285 	vnode_t		*vp;
6286 	int		needrecov = 0;
6287 	nfs4_recov_state_t recov_state;
6288 
6289 	ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
6290 
6291 	*avp = NULL;
6292 	recov_state.rs_flags = 0;
6293 	recov_state.rs_num_retry_despite_err = 0;
6294 
6295 recov_retry:
6296 	/* COMPOUND: putfh, openattr, getfh, getattr */
6297 	args.array_len = 4;
6298 	args.array = argop;
6299 	args.ctag = TAG_OPENATTR;
6300 
6301 	e.error = nfs4_start_op(VTOMI4(dvp), dvp, NULL, &recov_state);
6302 	if (e.error)
6303 		return (e.error);
6304 
6305 	drp = VTOR4(dvp);
6306 
6307 	/* putfh */
6308 	argop[0].argop = OP_CPUTFH;
6309 	argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
6310 
6311 	/* openattr */
6312 	argop[1].argop = OP_OPENATTR;
6313 	argop[1].nfs_argop4_u.opopenattr.createdir = (cflag ? TRUE : FALSE);
6314 
6315 	/* getfh */
6316 	argop[2].argop = OP_GETFH;
6317 
6318 	/* getattr */
6319 	argop[3].argop = OP_GETATTR;
6320 	argop[3].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6321 	argop[3].nfs_argop4_u.opgetattr.mi = VTOMI4(dvp);
6322 
6323 	NFS4_DEBUG(nfs4_client_call_debug, (CE_NOTE,
6324 	    "nfs4openattr: %s call, drp %s", needrecov ? "recov" : "first",
6325 	    rnode4info(drp)));
6326 
6327 	t = gethrtime();
6328 
6329 	rfs4call(VTOMI4(dvp), &args, &res, cr, &doqueue, 0, &e);
6330 
6331 	needrecov = nfs4_needs_recovery(&e, FALSE, dvp->v_vfsp);
6332 	if (needrecov) {
6333 		bool_t abort;
6334 
6335 		NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
6336 		    "nfs4openattr: initiating recovery\n"));
6337 
6338 		abort = nfs4_start_recovery(&e,
6339 		    VTOMI4(dvp), dvp, NULL, NULL, NULL,
6340 		    OP_OPENATTR, NULL);
6341 		nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6342 		if (!e.error) {
6343 			e.error = geterrno4(res.status);
6344 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6345 		}
6346 		if (abort == FALSE)
6347 			goto recov_retry;
6348 		return (e.error);
6349 	}
6350 
6351 	if (e.error) {
6352 		nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6353 		return (e.error);
6354 	}
6355 
6356 	if (res.status) {
6357 		/*
6358 		 * If OTW errro is NOTSUPP, then it should be
6359 		 * translated to EINVAL.  All Solaris file system
6360 		 * implementations return EINVAL to the syscall layer
6361 		 * when the attrdir cannot be created due to an
6362 		 * implementation restriction or noxattr mount option.
6363 		 */
6364 		if (res.status == NFS4ERR_NOTSUPP) {
6365 			mutex_enter(&drp->r_statelock);
6366 			if (drp->r_xattr_dir)
6367 				VN_RELE(drp->r_xattr_dir);
6368 			VN_HOLD(NFS4_XATTR_DIR_NOTSUPP);
6369 			drp->r_xattr_dir = NFS4_XATTR_DIR_NOTSUPP;
6370 			mutex_exit(&drp->r_statelock);
6371 
6372 			e.error = EINVAL;
6373 		} else {
6374 			e.error = geterrno4(res.status);
6375 		}
6376 
6377 		if (e.error) {
6378 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6379 			nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state,
6380 			    needrecov);
6381 			return (e.error);
6382 		}
6383 	}
6384 
6385 	resop = &res.array[0];  /* putfh res */
6386 	ASSERT(resop->nfs_resop4_u.opgetfh.status == NFS4_OK);
6387 
6388 	resop = &res.array[1];  /* openattr res */
6389 	ASSERT(resop->nfs_resop4_u.opopenattr.status == NFS4_OK);
6390 
6391 	resop = &res.array[2];  /* getfh res */
6392 	gf_res = &resop->nfs_resop4_u.opgetfh;
6393 	if (gf_res->object.nfs_fh4_len == 0) {
6394 		*avp = NULL;
6395 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6396 		nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6397 		return (ENOENT);
6398 	}
6399 
6400 	sfhp = sfh4_get(&gf_res->object, VTOMI4(dvp));
6401 	vp = makenfs4node(sfhp, &res.array[3].nfs_resop4_u.opgetattr.ga_res,
6402 	    dvp->v_vfsp, t, cr, dvp,
6403 	    fn_get(VTOSV(dvp)->sv_name, XATTR_RPATH));
6404 	sfh4_rele(&sfhp);
6405 
6406 	if (e.error)
6407 		PURGE_ATTRCACHE4(vp);
6408 
6409 	mutex_enter(&vp->v_lock);
6410 	vp->v_flag |= V_XATTRDIR;
6411 	mutex_exit(&vp->v_lock);
6412 
6413 	*avp = vp;
6414 
6415 	mutex_enter(&drp->r_statelock);
6416 	if (drp->r_xattr_dir)
6417 		VN_RELE(drp->r_xattr_dir);
6418 	VN_HOLD(vp);
6419 	drp->r_xattr_dir = vp;
6420 
6421 	/*
6422 	 * Invalidate pathconf4 cache because r_xattr_dir is no longer
6423 	 * NULL.  xattrs could be created at any time, and we have no
6424 	 * way to update pc4_xattr_exists in the base object if/when
6425 	 * it happens.
6426 	 */
6427 	drp->r_pathconf.pc4_xattr_valid = 0;
6428 
6429 	mutex_exit(&drp->r_statelock);
6430 
6431 	nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
6432 
6433 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6434 
6435 	return (0);
6436 }
6437 
6438 /* ARGSUSED */
6439 static int
6440 nfs4_create(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
6441 	int mode, vnode_t **vpp, cred_t *cr, int flags, caller_context_t *ct,
6442 	vsecattr_t *vsecp)
6443 {
6444 	int error;
6445 	vnode_t *vp = NULL;
6446 	rnode4_t *rp;
6447 	struct vattr vattr;
6448 	rnode4_t *drp;
6449 	vnode_t *tempvp;
6450 	enum createmode4 createmode;
6451 	bool_t must_trunc = FALSE;
6452 	int	truncating = 0;
6453 
6454 	if (nfs_zone() != VTOMI4(dvp)->mi_zone)
6455 		return (EPERM);
6456 	if (exclusive == EXCL && (dvp->v_flag & V_XATTRDIR)) {
6457 		return (EINVAL);
6458 	}
6459 
6460 	/* . and .. have special meaning in the protocol, reject them. */
6461 
6462 	if (nm[0] == '.' && (nm[1] == '\0' || (nm[1] == '.' && nm[2] == '\0')))
6463 		return (EISDIR);
6464 
6465 	drp = VTOR4(dvp);
6466 
6467 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp)))
6468 		return (EINTR);
6469 
6470 top:
6471 	/*
6472 	 * We make a copy of the attributes because the caller does not
6473 	 * expect us to change what va points to.
6474 	 */
6475 	vattr = *va;
6476 
6477 	/*
6478 	 * If the pathname is "", then dvp is the root vnode of
6479 	 * a remote file mounted over a local directory.
6480 	 * All that needs to be done is access
6481 	 * checking and truncation.  Note that we avoid doing
6482 	 * open w/ create because the parent directory might
6483 	 * be in pseudo-fs and the open would fail.
6484 	 */
6485 	if (*nm == '\0') {
6486 		error = 0;
6487 		VN_HOLD(dvp);
6488 		vp = dvp;
6489 		must_trunc = TRUE;
6490 	} else {
6491 		/*
6492 		 * We need to go over the wire, just to be sure whether the
6493 		 * file exists or not.  Using the DNLC can be dangerous in
6494 		 * this case when making a decision regarding existence.
6495 		 */
6496 		error = nfs4lookup(dvp, nm, &vp, cr, 1);
6497 	}
6498 
6499 	if (exclusive)
6500 		createmode = EXCLUSIVE4;
6501 	else
6502 		createmode = GUARDED4;
6503 
6504 	/*
6505 	 * error would be set if the file does not exist on the
6506 	 * server, so lets go create it.
6507 	 */
6508 	if (error) {
6509 		goto create_otw;
6510 	}
6511 
6512 	/*
6513 	 * File does exist on the server
6514 	 */
6515 	if (exclusive == EXCL)
6516 		error = EEXIST;
6517 	else if (vp->v_type == VDIR && (mode & VWRITE))
6518 		error = EISDIR;
6519 	else {
6520 		/*
6521 		 * If vnode is a device, create special vnode.
6522 		 */
6523 		if (ISVDEV(vp->v_type)) {
6524 			tempvp = vp;
6525 			vp = specvp(vp, vp->v_rdev, vp->v_type, cr);
6526 			VN_RELE(tempvp);
6527 		}
6528 		if (!(error = VOP_ACCESS(vp, mode, 0, cr, ct))) {
6529 			if ((vattr.va_mask & AT_SIZE) &&
6530 			    vp->v_type == VREG) {
6531 				rp = VTOR4(vp);
6532 				/*
6533 				 * Check here for large file handled
6534 				 * by LF-unaware process (as
6535 				 * ufs_create() does)
6536 				 */
6537 				if (!(flags & FOFFMAX)) {
6538 					mutex_enter(&rp->r_statelock);
6539 					if (rp->r_size > MAXOFF32_T)
6540 						error = EOVERFLOW;
6541 					mutex_exit(&rp->r_statelock);
6542 				}
6543 
6544 				/* if error is set then we need to return */
6545 				if (error) {
6546 					nfs_rw_exit(&drp->r_rwlock);
6547 					VN_RELE(vp);
6548 					return (error);
6549 				}
6550 
6551 				if (must_trunc) {
6552 					vattr.va_mask = AT_SIZE;
6553 					error = nfs4setattr(vp, &vattr, 0, cr,
6554 					    NULL);
6555 				} else {
6556 				/*
6557 				 * we know we have a regular file that already
6558 				 * exists and we may end up truncating the file
6559 				 * as a result of the open_otw, so flush out
6560 				 * any dirty pages for this file first.
6561 				 */
6562 					if (nfs4_has_pages(vp) &&
6563 					    ((rp->r_flags & R4DIRTY) ||
6564 					    rp->r_count > 0 ||
6565 					    rp->r_mapcnt > 0)) {
6566 						error = nfs4_putpage(vp,
6567 						    (offset_t)0, 0, 0, cr, ct);
6568 						if (error && (error == ENOSPC ||
6569 						    error == EDQUOT)) {
6570 							mutex_enter(
6571 							    &rp->r_statelock);
6572 							if (!rp->r_error)
6573 								rp->r_error =
6574 								    error;
6575 							mutex_exit(
6576 							    &rp->r_statelock);
6577 						}
6578 					}
6579 					vattr.va_mask = (AT_SIZE |
6580 					    AT_TYPE | AT_MODE);
6581 					vattr.va_type = VREG;
6582 					createmode = UNCHECKED4;
6583 					truncating = 1;
6584 					goto create_otw;
6585 				}
6586 			}
6587 		}
6588 	}
6589 	nfs_rw_exit(&drp->r_rwlock);
6590 	if (error) {
6591 		VN_RELE(vp);
6592 	} else {
6593 		vnode_t *tvp;
6594 		rnode4_t *trp;
6595 		/*
6596 		 * existing file got truncated, notify.
6597 		 */
6598 		tvp = vp;
6599 		if (vp->v_type == VREG) {
6600 			trp = VTOR4(vp);
6601 			if (IS_SHADOW(vp, trp))
6602 				tvp = RTOV4(trp);
6603 		}
6604 		vnevent_create(tvp, ct);
6605 		*vpp = vp;
6606 	}
6607 	return (error);
6608 
6609 create_otw:
6610 	dnlc_remove(dvp, nm);
6611 
6612 	ASSERT(vattr.va_mask & AT_TYPE);
6613 
6614 	/*
6615 	 * If not a regular file let nfs4mknod() handle it.
6616 	 */
6617 	if (vattr.va_type != VREG) {
6618 		error = nfs4mknod(dvp, nm, &vattr, exclusive, mode, vpp, cr);
6619 		nfs_rw_exit(&drp->r_rwlock);
6620 		return (error);
6621 	}
6622 
6623 	/*
6624 	 * It _is_ a regular file.
6625 	 */
6626 	ASSERT(vattr.va_mask & AT_MODE);
6627 	if (MANDMODE(vattr.va_mode)) {
6628 		nfs_rw_exit(&drp->r_rwlock);
6629 		return (EACCES);
6630 	}
6631 
6632 	/*
6633 	 * If this happens to be a mknod of a regular file, then flags will
6634 	 * have neither FREAD or FWRITE.  However, we must set at least one
6635 	 * for the call to nfs4open_otw.  If it's open(O_CREAT) driving
6636 	 * nfs4_create, then either FREAD, FWRITE, or FRDWR has already been
6637 	 * set (based on openmode specified by app).
6638 	 */
6639 	if ((flags & (FREAD|FWRITE)) == 0)
6640 		flags |= (FREAD|FWRITE);
6641 
6642 	error = nfs4open_otw(dvp, nm, &vattr, vpp, cr, 1, flags, createmode, 0);
6643 
6644 	if (vp != NULL) {
6645 		/* if create was successful, throw away the file's pages */
6646 		if (!error && (vattr.va_mask & AT_SIZE))
6647 			nfs4_invalidate_pages(vp, (vattr.va_size & PAGEMASK),
6648 			    cr);
6649 		/* release the lookup hold */
6650 		VN_RELE(vp);
6651 		vp = NULL;
6652 	}
6653 
6654 	/*
6655 	 * validate that we opened a regular file. This handles a misbehaving
6656 	 * server that returns an incorrect FH.
6657 	 */
6658 	if ((error == 0) && *vpp && (*vpp)->v_type != VREG) {
6659 		error = EISDIR;
6660 		VN_RELE(*vpp);
6661 	}
6662 
6663 	/*
6664 	 * If this is not an exclusive create, then the CREATE
6665 	 * request will be made with the GUARDED mode set.  This
6666 	 * means that the server will return EEXIST if the file
6667 	 * exists.  The file could exist because of a retransmitted
6668 	 * request.  In this case, we recover by starting over and
6669 	 * checking to see whether the file exists.  This second
6670 	 * time through it should and a CREATE request will not be
6671 	 * sent.
6672 	 *
6673 	 * This handles the problem of a dangling CREATE request
6674 	 * which contains attributes which indicate that the file
6675 	 * should be truncated.  This retransmitted request could
6676 	 * possibly truncate valid data in the file if not caught
6677 	 * by the duplicate request mechanism on the server or if
6678 	 * not caught by other means.  The scenario is:
6679 	 *
6680 	 * Client transmits CREATE request with size = 0
6681 	 * Client times out, retransmits request.
6682 	 * Response to the first request arrives from the server
6683 	 *  and the client proceeds on.
6684 	 * Client writes data to the file.
6685 	 * The server now processes retransmitted CREATE request
6686 	 *  and truncates file.
6687 	 *
6688 	 * The use of the GUARDED CREATE request prevents this from
6689 	 * happening because the retransmitted CREATE would fail
6690 	 * with EEXIST and would not truncate the file.
6691 	 */
6692 	if (error == EEXIST && exclusive == NONEXCL) {
6693 #ifdef DEBUG
6694 		nfs4_create_misses++;
6695 #endif
6696 		goto top;
6697 	}
6698 	nfs_rw_exit(&drp->r_rwlock);
6699 	if (truncating && !error && *vpp) {
6700 		vnode_t *tvp;
6701 		rnode4_t *trp;
6702 		/*
6703 		 * existing file got truncated, notify.
6704 		 */
6705 		tvp = *vpp;
6706 		trp = VTOR4(tvp);
6707 		if (IS_SHADOW(tvp, trp))
6708 			tvp = RTOV4(trp);
6709 		vnevent_create(tvp, ct);
6710 	}
6711 	return (error);
6712 }
6713 
6714 /*
6715  * Create compound (for mkdir, mknod, symlink):
6716  * { Putfh <dfh>; Create; Getfh; Getattr }
6717  * It's okay if setattr failed to set gid - this is not considered
6718  * an error, but purge attrs in that case.
6719  */
6720 static int
6721 call_nfs4_create_req(vnode_t *dvp, char *nm, void *data, struct vattr *va,
6722     vnode_t **vpp, cred_t *cr, nfs_ftype4 type)
6723 {
6724 	int need_end_op = FALSE;
6725 	COMPOUND4args_clnt args;
6726 	COMPOUND4res_clnt res, *resp = NULL;
6727 	nfs_argop4 *argop;
6728 	nfs_resop4 *resop;
6729 	int doqueue;
6730 	mntinfo4_t *mi;
6731 	rnode4_t *drp = VTOR4(dvp);
6732 	change_info4 *cinfo;
6733 	GETFH4res *gf_res;
6734 	struct vattr vattr;
6735 	vnode_t *vp;
6736 	fattr4 *crattr;
6737 	bool_t needrecov = FALSE;
6738 	nfs4_recov_state_t recov_state;
6739 	nfs4_sharedfh_t *sfhp = NULL;
6740 	hrtime_t t;
6741 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
6742 	int numops, argoplist_size, setgid_flag, idx_create, idx_fattr;
6743 	dirattr_info_t dinfo, *dinfop;
6744 	servinfo4_t *svp;
6745 	bitmap4 supp_attrs;
6746 
6747 	ASSERT(type == NF4DIR || type == NF4LNK || type == NF4BLK ||
6748 	    type == NF4CHR || type == NF4SOCK || type == NF4FIFO);
6749 
6750 	mi = VTOMI4(dvp);
6751 
6752 	/*
6753 	 * Make sure we properly deal with setting the right gid
6754 	 * on a new directory to reflect the parent's setgid bit
6755 	 */
6756 	setgid_flag = 0;
6757 	if (type == NF4DIR) {
6758 		struct vattr dva;
6759 
6760 		va->va_mode &= ~VSGID;
6761 		dva.va_mask = AT_MODE | AT_GID;
6762 		if (VOP_GETATTR(dvp, &dva, 0, cr, NULL) == 0) {
6763 
6764 			/*
6765 			 * If the parent's directory has the setgid bit set
6766 			 * _and_ the client was able to get a valid mapping
6767 			 * for the parent dir's owner_group, we want to
6768 			 * append NVERIFY(owner_group == dva.va_gid) and
6769 			 * SETTATTR to the CREATE compound.
6770 			 */
6771 			if (mi->mi_flags & MI4_GRPID || dva.va_mode & VSGID) {
6772 				setgid_flag = 1;
6773 				va->va_mode |= VSGID;
6774 				if (dva.va_gid != GID_NOBODY) {
6775 					va->va_mask |= AT_GID;
6776 					va->va_gid = dva.va_gid;
6777 				}
6778 			}
6779 		}
6780 	}
6781 
6782 	/*
6783 	 * Create ops:
6784 	 *	0:putfh(dir) 1:savefh(dir) 2:create 3:getfh(new) 4:getattr(new)
6785 	 *	5:restorefh(dir) 6:getattr(dir)
6786 	 *
6787 	 * if (setgid)
6788 	 *	0:putfh(dir) 1:create 2:getfh(new) 3:getattr(new)
6789 	 *	4:savefh(new) 5:putfh(dir) 6:getattr(dir) 7:restorefh(new)
6790 	 *	8:nverify 9:setattr
6791 	 */
6792 	if (setgid_flag) {
6793 		numops = 10;
6794 		idx_create = 1;
6795 		idx_fattr = 3;
6796 	} else {
6797 		numops = 7;
6798 		idx_create = 2;
6799 		idx_fattr = 4;
6800 	}
6801 
6802 	ASSERT(nfs_zone() == mi->mi_zone);
6803 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp))) {
6804 		return (EINTR);
6805 	}
6806 	recov_state.rs_flags = 0;
6807 	recov_state.rs_num_retry_despite_err = 0;
6808 
6809 	argoplist_size = numops * sizeof (nfs_argop4);
6810 	argop = kmem_alloc(argoplist_size, KM_SLEEP);
6811 
6812 recov_retry:
6813 	if (type == NF4LNK)
6814 		args.ctag = TAG_SYMLINK;
6815 	else if (type == NF4DIR)
6816 		args.ctag = TAG_MKDIR;
6817 	else
6818 		args.ctag = TAG_MKNOD;
6819 
6820 	args.array_len = numops;
6821 	args.array = argop;
6822 
6823 	if (e.error = nfs4_start_op(mi, dvp, NULL, &recov_state)) {
6824 		nfs_rw_exit(&drp->r_rwlock);
6825 		kmem_free(argop, argoplist_size);
6826 		return (e.error);
6827 	}
6828 	need_end_op = TRUE;
6829 
6830 
6831 	/* 0: putfh directory */
6832 	argop[0].argop = OP_CPUTFH;
6833 	argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
6834 
6835 	/* 1/2: Create object */
6836 	argop[idx_create].argop = OP_CCREATE;
6837 	argop[idx_create].nfs_argop4_u.opccreate.cname = nm;
6838 	argop[idx_create].nfs_argop4_u.opccreate.type = type;
6839 	if (type == NF4LNK) {
6840 		/*
6841 		 * symlink, treat name as data
6842 		 */
6843 		ASSERT(data != NULL);
6844 		argop[idx_create].nfs_argop4_u.opccreate.ftype4_u.clinkdata =
6845 		    (char *)data;
6846 	}
6847 	if (type == NF4BLK || type == NF4CHR) {
6848 		ASSERT(data != NULL);
6849 		argop[idx_create].nfs_argop4_u.opccreate.ftype4_u.devdata =
6850 		    *((specdata4 *)data);
6851 	}
6852 
6853 	crattr = &argop[idx_create].nfs_argop4_u.opccreate.createattrs;
6854 
6855 	svp = drp->r_server;
6856 	(void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
6857 	supp_attrs = svp->sv_supp_attrs;
6858 	nfs_rw_exit(&svp->sv_lock);
6859 
6860 	if (vattr_to_fattr4(va, NULL, crattr, 0, OP_CREATE, supp_attrs)) {
6861 		nfs_rw_exit(&drp->r_rwlock);
6862 		nfs4_end_op(mi, dvp, NULL, &recov_state, needrecov);
6863 		e.error = EINVAL;
6864 		kmem_free(argop, argoplist_size);
6865 		return (e.error);
6866 	}
6867 
6868 	/* 2/3: getfh fh of created object */
6869 	ASSERT(idx_create + 1 == idx_fattr - 1);
6870 	argop[idx_create + 1].argop = OP_GETFH;
6871 
6872 	/* 3/4: getattr of new object */
6873 	argop[idx_fattr].argop = OP_GETATTR;
6874 	argop[idx_fattr].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6875 	argop[idx_fattr].nfs_argop4_u.opgetattr.mi = mi;
6876 
6877 	if (setgid_flag) {
6878 		vattr_t	_v;
6879 
6880 		argop[4].argop = OP_SAVEFH;
6881 
6882 		argop[5].argop = OP_CPUTFH;
6883 		argop[5].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
6884 
6885 		argop[6].argop = OP_GETATTR;
6886 		argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6887 		argop[6].nfs_argop4_u.opgetattr.mi = mi;
6888 
6889 		argop[7].argop = OP_RESTOREFH;
6890 
6891 		/*
6892 		 * nverify
6893 		 *
6894 		 * XXX - Revisit the last argument to nfs4_end_op()
6895 		 *	 once 5020486 is fixed.
6896 		 */
6897 		_v.va_mask = AT_GID;
6898 		_v.va_gid = va->va_gid;
6899 		if (e.error = nfs4args_verify(&argop[8], &_v, OP_NVERIFY,
6900 		    supp_attrs)) {
6901 			nfs4_end_op(mi, dvp, *vpp, &recov_state, TRUE);
6902 			nfs_rw_exit(&drp->r_rwlock);
6903 			nfs4_fattr4_free(crattr);
6904 			kmem_free(argop, argoplist_size);
6905 			return (e.error);
6906 		}
6907 
6908 		/*
6909 		 * setattr
6910 		 *
6911 		 * We _know_ we're not messing with AT_SIZE or AT_XTIME,
6912 		 * so no need for stateid or flags. Also we specify NULL
6913 		 * rp since we're only interested in setting owner_group
6914 		 * attributes.
6915 		 */
6916 		nfs4args_setattr(&argop[9], &_v, NULL, 0, NULL, cr, supp_attrs,
6917 		    &e.error, 0);
6918 
6919 		if (e.error) {
6920 			nfs4_end_op(mi, dvp, *vpp, &recov_state, TRUE);
6921 			nfs_rw_exit(&drp->r_rwlock);
6922 			nfs4_fattr4_free(crattr);
6923 			nfs4args_verify_free(&argop[8]);
6924 			kmem_free(argop, argoplist_size);
6925 			return (e.error);
6926 		}
6927 	} else {
6928 		argop[1].argop = OP_SAVEFH;
6929 
6930 		argop[5].argop = OP_RESTOREFH;
6931 
6932 		argop[6].argop = OP_GETATTR;
6933 		argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
6934 		argop[6].nfs_argop4_u.opgetattr.mi = mi;
6935 	}
6936 
6937 	dnlc_remove(dvp, nm);
6938 
6939 	doqueue = 1;
6940 	t = gethrtime();
6941 	rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
6942 
6943 	needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
6944 	if (e.error) {
6945 		PURGE_ATTRCACHE4(dvp);
6946 		if (!needrecov)
6947 			goto out;
6948 	}
6949 
6950 	if (needrecov) {
6951 		if (nfs4_start_recovery(&e, mi, dvp, NULL, NULL, NULL,
6952 		    OP_CREATE, NULL) == FALSE) {
6953 			nfs4_end_op(mi, dvp, NULL, &recov_state,
6954 			    needrecov);
6955 			need_end_op = FALSE;
6956 			nfs4_fattr4_free(crattr);
6957 			if (setgid_flag) {
6958 				nfs4args_verify_free(&argop[8]);
6959 				nfs4args_setattr_free(&argop[9]);
6960 			}
6961 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
6962 			goto recov_retry;
6963 		}
6964 	}
6965 
6966 	resp = &res;
6967 
6968 	if (res.status != NFS4_OK && res.array_len <= idx_fattr + 1) {
6969 
6970 		if (res.status == NFS4ERR_BADOWNER)
6971 			nfs4_log_badowner(mi, OP_CREATE);
6972 
6973 		e.error = geterrno4(res.status);
6974 
6975 		/*
6976 		 * This check is left over from when create was implemented
6977 		 * using a setattr op (instead of createattrs).  If the
6978 		 * putfh/create/getfh failed, the error was returned.  If
6979 		 * setattr/getattr failed, we keep going.
6980 		 *
6981 		 * It might be better to get rid of the GETFH also, and just
6982 		 * do PUTFH/CREATE/GETATTR since the FH attr is mandatory.
6983 		 * Then if any of the operations failed, we could return the
6984 		 * error now, and remove much of the error code below.
6985 		 */
6986 		if (res.array_len <= idx_fattr) {
6987 			/*
6988 			 * Either Putfh, Create or Getfh failed.
6989 			 */
6990 			PURGE_ATTRCACHE4(dvp);
6991 			/*
6992 			 * nfs4_purge_stale_fh() may generate otw calls through
6993 			 * nfs4_invalidate_pages. Hence the need to call
6994 			 * nfs4_end_op() here to avoid nfs4_start_op() deadlock.
6995 			 */
6996 			nfs4_end_op(mi, dvp, NULL, &recov_state,
6997 			    needrecov);
6998 			need_end_op = FALSE;
6999 			nfs4_purge_stale_fh(e.error, dvp, cr);
7000 			goto out;
7001 		}
7002 	}
7003 
7004 	resop = &res.array[idx_create];	/* create res */
7005 	cinfo = &resop->nfs_resop4_u.opcreate.cinfo;
7006 
7007 	resop = &res.array[idx_create + 1]; /* getfh res */
7008 	gf_res = &resop->nfs_resop4_u.opgetfh;
7009 
7010 	sfhp = sfh4_get(&gf_res->object, mi);
7011 	if (e.error) {
7012 		*vpp = vp = makenfs4node(sfhp, NULL, dvp->v_vfsp, t, cr, dvp,
7013 		    fn_get(VTOSV(dvp)->sv_name, nm));
7014 		if (vp->v_type == VNON) {
7015 			vattr.va_mask = AT_TYPE;
7016 			/*
7017 			 * Need to call nfs4_end_op before nfs4getattr to avoid
7018 			 * potential nfs4_start_op deadlock. See RFE 4777612.
7019 			 */
7020 			nfs4_end_op(mi, dvp, NULL, &recov_state,
7021 			    needrecov);
7022 			need_end_op = FALSE;
7023 			e.error = nfs4getattr(vp, &vattr, cr);
7024 			if (e.error) {
7025 				VN_RELE(vp);
7026 				*vpp = NULL;
7027 				goto out;
7028 			}
7029 			vp->v_type = vattr.va_type;
7030 		}
7031 		e.error = 0;
7032 	} else {
7033 		*vpp = vp = makenfs4node(sfhp,
7034 		    &res.array[idx_fattr].nfs_resop4_u.opgetattr.ga_res,
7035 		    dvp->v_vfsp, t, cr,
7036 		    dvp, fn_get(VTOSV(dvp)->sv_name, nm));
7037 	}
7038 
7039 	/*
7040 	 * If compound succeeded, then update dir attrs
7041 	 */
7042 	if (res.status == NFS4_OK) {
7043 		dinfo.di_garp = &res.array[6].nfs_resop4_u.opgetattr.ga_res;
7044 		dinfo.di_cred = cr;
7045 		dinfo.di_time_call = t;
7046 		dinfop = &dinfo;
7047 	} else
7048 		dinfop = NULL;
7049 
7050 	/* Update directory cache attribute, readdir and dnlc caches */
7051 	nfs4_update_dircaches(cinfo, dvp, vp, nm, dinfop);
7052 
7053 out:
7054 	if (sfhp != NULL)
7055 		sfh4_rele(&sfhp);
7056 	nfs_rw_exit(&drp->r_rwlock);
7057 	nfs4_fattr4_free(crattr);
7058 	if (setgid_flag) {
7059 		nfs4args_verify_free(&argop[8]);
7060 		nfs4args_setattr_free(&argop[9]);
7061 	}
7062 	if (resp)
7063 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
7064 	if (need_end_op)
7065 		nfs4_end_op(mi, dvp, NULL, &recov_state, needrecov);
7066 
7067 	kmem_free(argop, argoplist_size);
7068 	return (e.error);
7069 }
7070 
7071 /* ARGSUSED */
7072 static int
7073 nfs4mknod(vnode_t *dvp, char *nm, struct vattr *va, enum vcexcl exclusive,
7074     int mode, vnode_t **vpp, cred_t *cr)
7075 {
7076 	int error;
7077 	vnode_t *vp;
7078 	nfs_ftype4 type;
7079 	specdata4 spec, *specp = NULL;
7080 
7081 	ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
7082 
7083 	switch (va->va_type) {
7084 	case VCHR:
7085 	case VBLK:
7086 		type = (va->va_type == VCHR) ? NF4CHR : NF4BLK;
7087 		spec.specdata1 = getmajor(va->va_rdev);
7088 		spec.specdata2 = getminor(va->va_rdev);
7089 		specp = &spec;
7090 		break;
7091 
7092 	case VFIFO:
7093 		type = NF4FIFO;
7094 		break;
7095 	case VSOCK:
7096 		type = NF4SOCK;
7097 		break;
7098 
7099 	default:
7100 		return (EINVAL);
7101 	}
7102 
7103 	error = call_nfs4_create_req(dvp, nm, specp, va, &vp, cr, type);
7104 	if (error) {
7105 		return (error);
7106 	}
7107 
7108 	/*
7109 	 * This might not be needed any more; special case to deal
7110 	 * with problematic v2/v3 servers.  Since create was unable
7111 	 * to set group correctly, not sure what hope setattr has.
7112 	 */
7113 	if (va->va_gid != VTOR4(vp)->r_attr.va_gid) {
7114 		va->va_mask = AT_GID;
7115 		(void) nfs4setattr(vp, va, 0, cr, NULL);
7116 	}
7117 
7118 	/*
7119 	 * If vnode is a device create special vnode
7120 	 */
7121 	if (ISVDEV(vp->v_type)) {
7122 		*vpp = specvp(vp, vp->v_rdev, vp->v_type, cr);
7123 		VN_RELE(vp);
7124 	} else {
7125 		*vpp = vp;
7126 	}
7127 	return (error);
7128 }
7129 
7130 /*
7131  * Remove requires that the current fh be the target directory.
7132  * After the operation, the current fh is unchanged.
7133  * The compound op structure is:
7134  *      PUTFH(targetdir), REMOVE
7135  *
7136  * Weirdness: if the vnode to be removed is open
7137  * we rename it instead of removing it and nfs_inactive
7138  * will remove the new name.
7139  */
7140 /* ARGSUSED */
7141 static int
7142 nfs4_remove(vnode_t *dvp, char *nm, cred_t *cr, caller_context_t *ct, int flags)
7143 {
7144 	COMPOUND4args_clnt args;
7145 	COMPOUND4res_clnt res, *resp = NULL;
7146 	REMOVE4res *rm_res;
7147 	nfs_argop4 argop[3];
7148 	nfs_resop4 *resop;
7149 	vnode_t *vp;
7150 	char *tmpname;
7151 	int doqueue;
7152 	mntinfo4_t *mi;
7153 	rnode4_t *rp;
7154 	rnode4_t *drp;
7155 	int needrecov = 0;
7156 	nfs4_recov_state_t recov_state;
7157 	int isopen;
7158 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
7159 	dirattr_info_t dinfo;
7160 
7161 	if (nfs_zone() != VTOMI4(dvp)->mi_zone)
7162 		return (EPERM);
7163 	drp = VTOR4(dvp);
7164 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp)))
7165 		return (EINTR);
7166 
7167 	e.error = nfs4lookup(dvp, nm, &vp, cr, 0);
7168 	if (e.error) {
7169 		nfs_rw_exit(&drp->r_rwlock);
7170 		return (e.error);
7171 	}
7172 
7173 	if (vp->v_type == VDIR) {
7174 		VN_RELE(vp);
7175 		nfs_rw_exit(&drp->r_rwlock);
7176 		return (EISDIR);
7177 	}
7178 
7179 	/*
7180 	 * First just remove the entry from the name cache, as it
7181 	 * is most likely the only entry for this vp.
7182 	 */
7183 	dnlc_remove(dvp, nm);
7184 
7185 	rp = VTOR4(vp);
7186 
7187 	/*
7188 	 * For regular file types, check to see if the file is open by looking
7189 	 * at the open streams.
7190 	 * For all other types, check the reference count on the vnode.  Since
7191 	 * they are not opened OTW they never have an open stream.
7192 	 *
7193 	 * If the file is open, rename it to .nfsXXXX.
7194 	 */
7195 	if (vp->v_type != VREG) {
7196 		/*
7197 		 * If the file has a v_count > 1 then there may be more than one
7198 		 * entry in the name cache due multiple links or an open file,
7199 		 * but we don't have the real reference count so flush all
7200 		 * possible entries.
7201 		 */
7202 		if (vp->v_count > 1)
7203 			dnlc_purge_vp(vp);
7204 
7205 		/*
7206 		 * Now we have the real reference count.
7207 		 */
7208 		isopen = vp->v_count > 1;
7209 	} else {
7210 		mutex_enter(&rp->r_os_lock);
7211 		isopen = list_head(&rp->r_open_streams) != NULL;
7212 		mutex_exit(&rp->r_os_lock);
7213 	}
7214 
7215 	mutex_enter(&rp->r_statelock);
7216 	if (isopen &&
7217 	    (rp->r_unldvp == NULL || strcmp(nm, rp->r_unlname) == 0)) {
7218 		mutex_exit(&rp->r_statelock);
7219 		tmpname = newname();
7220 		e.error = nfs4rename(dvp, nm, dvp, tmpname, cr, ct);
7221 		if (e.error)
7222 			kmem_free(tmpname, MAXNAMELEN);
7223 		else {
7224 			mutex_enter(&rp->r_statelock);
7225 			if (rp->r_unldvp == NULL) {
7226 				VN_HOLD(dvp);
7227 				rp->r_unldvp = dvp;
7228 				if (rp->r_unlcred != NULL)
7229 					crfree(rp->r_unlcred);
7230 				crhold(cr);
7231 				rp->r_unlcred = cr;
7232 				rp->r_unlname = tmpname;
7233 			} else {
7234 				kmem_free(rp->r_unlname, MAXNAMELEN);
7235 				rp->r_unlname = tmpname;
7236 			}
7237 			mutex_exit(&rp->r_statelock);
7238 		}
7239 		VN_RELE(vp);
7240 		nfs_rw_exit(&drp->r_rwlock);
7241 		return (e.error);
7242 	}
7243 	/*
7244 	 * Actually remove the file/dir
7245 	 */
7246 	mutex_exit(&rp->r_statelock);
7247 
7248 	/*
7249 	 * We need to flush any dirty pages which happen to
7250 	 * be hanging around before removing the file.
7251 	 * This shouldn't happen very often since in NFSv4
7252 	 * we should be close to open consistent.
7253 	 */
7254 	if (nfs4_has_pages(vp) &&
7255 	    ((rp->r_flags & R4DIRTY) || rp->r_count > 0)) {
7256 		e.error = nfs4_putpage(vp, (u_offset_t)0, 0, 0, cr, ct);
7257 		if (e.error && (e.error == ENOSPC || e.error == EDQUOT)) {
7258 			mutex_enter(&rp->r_statelock);
7259 			if (!rp->r_error)
7260 				rp->r_error = e.error;
7261 			mutex_exit(&rp->r_statelock);
7262 		}
7263 	}
7264 
7265 	mi = VTOMI4(dvp);
7266 
7267 	(void) nfs4delegreturn(rp, NFS4_DR_REOPEN);
7268 	recov_state.rs_flags = 0;
7269 	recov_state.rs_num_retry_despite_err = 0;
7270 
7271 recov_retry:
7272 	/*
7273 	 * Remove ops: putfh dir; remove
7274 	 */
7275 	args.ctag = TAG_REMOVE;
7276 	args.array_len = 3;
7277 	args.array = argop;
7278 
7279 	e.error = nfs4_start_op(VTOMI4(dvp), dvp, NULL, &recov_state);
7280 	if (e.error) {
7281 		nfs_rw_exit(&drp->r_rwlock);
7282 		VN_RELE(vp);
7283 		return (e.error);
7284 	}
7285 
7286 	/* putfh directory */
7287 	argop[0].argop = OP_CPUTFH;
7288 	argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
7289 
7290 	/* remove */
7291 	argop[1].argop = OP_CREMOVE;
7292 	argop[1].nfs_argop4_u.opcremove.ctarget = nm;
7293 
7294 	/* getattr dir */
7295 	argop[2].argop = OP_GETATTR;
7296 	argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7297 	argop[2].nfs_argop4_u.opgetattr.mi = mi;
7298 
7299 	doqueue = 1;
7300 	dinfo.di_time_call = gethrtime();
7301 	rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
7302 
7303 	PURGE_ATTRCACHE4(vp);
7304 
7305 	needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
7306 	if (e.error)
7307 		PURGE_ATTRCACHE4(dvp);
7308 
7309 	if (needrecov) {
7310 		if (nfs4_start_recovery(&e, VTOMI4(dvp), dvp,
7311 		    NULL, NULL, NULL, OP_REMOVE, NULL) == FALSE) {
7312 			if (!e.error)
7313 				(void) xdr_free(xdr_COMPOUND4res_clnt,
7314 				    (caddr_t)&res);
7315 			nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state,
7316 			    needrecov);
7317 			goto recov_retry;
7318 		}
7319 	}
7320 
7321 	/*
7322 	 * Matching nfs4_end_op() for start_op() above.
7323 	 * There is a path in the code below which calls
7324 	 * nfs4_purge_stale_fh(), which may generate otw calls through
7325 	 * nfs4_invalidate_pages. Hence we need to call nfs4_end_op()
7326 	 * here to avoid nfs4_start_op() deadlock.
7327 	 */
7328 	nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
7329 
7330 	if (!e.error) {
7331 		resp = &res;
7332 
7333 		if (res.status) {
7334 			e.error = geterrno4(res.status);
7335 			PURGE_ATTRCACHE4(dvp);
7336 			nfs4_purge_stale_fh(e.error, dvp, cr);
7337 		} else {
7338 			resop = &res.array[1];	/* remove res */
7339 			rm_res = &resop->nfs_resop4_u.opremove;
7340 
7341 			dinfo.di_garp =
7342 			    &res.array[2].nfs_resop4_u.opgetattr.ga_res;
7343 			dinfo.di_cred = cr;
7344 
7345 			/* Update directory attr, readdir and dnlc caches */
7346 			nfs4_update_dircaches(&rm_res->cinfo, dvp, NULL, NULL,
7347 			    &dinfo);
7348 		}
7349 	}
7350 	nfs_rw_exit(&drp->r_rwlock);
7351 	if (resp)
7352 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
7353 
7354 	if (e.error == 0) {
7355 		vnode_t *tvp;
7356 		rnode4_t *trp;
7357 		trp = VTOR4(vp);
7358 		tvp = vp;
7359 		if (IS_SHADOW(vp, trp))
7360 			tvp = RTOV4(trp);
7361 		vnevent_remove(tvp, dvp, nm, ct);
7362 	}
7363 	VN_RELE(vp);
7364 	return (e.error);
7365 }
7366 
7367 /*
7368  * Link requires that the current fh be the target directory and the
7369  * saved fh be the source fh. After the operation, the current fh is unchanged.
7370  * Thus the compound op structure is:
7371  *	PUTFH(file), SAVEFH, PUTFH(targetdir), LINK, RESTOREFH,
7372  *	GETATTR(file)
7373  */
7374 /* ARGSUSED */
7375 static int
7376 nfs4_link(vnode_t *tdvp, vnode_t *svp, char *tnm, cred_t *cr,
7377     caller_context_t *ct, int flags)
7378 {
7379 	COMPOUND4args_clnt args;
7380 	COMPOUND4res_clnt res, *resp = NULL;
7381 	LINK4res *ln_res;
7382 	int argoplist_size  = 7 * sizeof (nfs_argop4);
7383 	nfs_argop4 *argop;
7384 	nfs_resop4 *resop;
7385 	vnode_t *realvp, *nvp;
7386 	int doqueue;
7387 	mntinfo4_t *mi;
7388 	rnode4_t *tdrp;
7389 	bool_t needrecov = FALSE;
7390 	nfs4_recov_state_t recov_state;
7391 	hrtime_t t;
7392 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
7393 	dirattr_info_t dinfo;
7394 
7395 	ASSERT(*tnm != '\0');
7396 	ASSERT(tdvp->v_type == VDIR);
7397 	ASSERT(nfs4_consistent_type(tdvp));
7398 	ASSERT(nfs4_consistent_type(svp));
7399 
7400 	if (nfs_zone() != VTOMI4(tdvp)->mi_zone)
7401 		return (EPERM);
7402 	if (VOP_REALVP(svp, &realvp, ct) == 0) {
7403 		svp = realvp;
7404 		ASSERT(nfs4_consistent_type(svp));
7405 	}
7406 
7407 	tdrp = VTOR4(tdvp);
7408 	mi = VTOMI4(svp);
7409 
7410 	if (!(mi->mi_flags & MI4_LINK)) {
7411 		return (EOPNOTSUPP);
7412 	}
7413 	recov_state.rs_flags = 0;
7414 	recov_state.rs_num_retry_despite_err = 0;
7415 
7416 	if (nfs_rw_enter_sig(&tdrp->r_rwlock, RW_WRITER, INTR4(tdvp)))
7417 		return (EINTR);
7418 
7419 recov_retry:
7420 	argop = kmem_alloc(argoplist_size, KM_SLEEP);
7421 
7422 	args.ctag = TAG_LINK;
7423 
7424 	/*
7425 	 * Link ops: putfh fl; savefh; putfh tdir; link; getattr(dir);
7426 	 * restorefh; getattr(fl)
7427 	 */
7428 	args.array_len = 7;
7429 	args.array = argop;
7430 
7431 	e.error = nfs4_start_op(VTOMI4(svp), svp, tdvp, &recov_state);
7432 	if (e.error) {
7433 		kmem_free(argop, argoplist_size);
7434 		nfs_rw_exit(&tdrp->r_rwlock);
7435 		return (e.error);
7436 	}
7437 
7438 	/* 0. putfh file */
7439 	argop[0].argop = OP_CPUTFH;
7440 	argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(svp)->r_fh;
7441 
7442 	/* 1. save current fh to free up the space for the dir */
7443 	argop[1].argop = OP_SAVEFH;
7444 
7445 	/* 2. putfh targetdir */
7446 	argop[2].argop = OP_CPUTFH;
7447 	argop[2].nfs_argop4_u.opcputfh.sfh = tdrp->r_fh;
7448 
7449 	/* 3. link: current_fh is targetdir, saved_fh is source */
7450 	argop[3].argop = OP_CLINK;
7451 	argop[3].nfs_argop4_u.opclink.cnewname = tnm;
7452 
7453 	/* 4. Get attributes of dir */
7454 	argop[4].argop = OP_GETATTR;
7455 	argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7456 	argop[4].nfs_argop4_u.opgetattr.mi = mi;
7457 
7458 	/* 5. If link was successful, restore current vp to file */
7459 	argop[5].argop = OP_RESTOREFH;
7460 
7461 	/* 6. Get attributes of linked object */
7462 	argop[6].argop = OP_GETATTR;
7463 	argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
7464 	argop[6].nfs_argop4_u.opgetattr.mi = mi;
7465 
7466 	dnlc_remove(tdvp, tnm);
7467 
7468 	doqueue = 1;
7469 	t = gethrtime();
7470 
7471 	rfs4call(VTOMI4(svp), &args, &res, cr, &doqueue, 0, &e);
7472 
7473 	needrecov = nfs4_needs_recovery(&e, FALSE, svp->v_vfsp);
7474 	if (e.error != 0 && !needrecov) {
7475 		PURGE_ATTRCACHE4(tdvp);
7476 		PURGE_ATTRCACHE4(svp);
7477 		nfs4_end_op(VTOMI4(svp), svp, tdvp, &recov_state, needrecov);
7478 		goto out;
7479 	}
7480 
7481 	if (needrecov) {
7482 		bool_t abort;
7483 
7484 		abort = nfs4_start_recovery(&e, VTOMI4(svp), svp, tdvp,
7485 		    NULL, NULL, OP_LINK, NULL);
7486 		if (abort == FALSE) {
7487 			nfs4_end_op(VTOMI4(svp), svp, tdvp, &recov_state,
7488 			    needrecov);
7489 			kmem_free(argop, argoplist_size);
7490 			if (!e.error)
7491 				(void) xdr_free(xdr_COMPOUND4res_clnt,
7492 				    (caddr_t)&res);
7493 			goto recov_retry;
7494 		} else {
7495 			if (e.error != 0) {
7496 				PURGE_ATTRCACHE4(tdvp);
7497 				PURGE_ATTRCACHE4(svp);
7498 				nfs4_end_op(VTOMI4(svp), svp, tdvp,
7499 				    &recov_state, needrecov);
7500 				goto out;
7501 			}
7502 			/* fall through for res.status case */
7503 		}
7504 	}
7505 
7506 	nfs4_end_op(VTOMI4(svp), svp, tdvp, &recov_state, needrecov);
7507 
7508 	resp = &res;
7509 	if (res.status) {
7510 		/* If link succeeded, then don't return error */
7511 		e.error = geterrno4(res.status);
7512 		if (res.array_len <= 4) {
7513 			/*
7514 			 * Either Putfh, Savefh, Putfh dir, or Link failed
7515 			 */
7516 			PURGE_ATTRCACHE4(svp);
7517 			PURGE_ATTRCACHE4(tdvp);
7518 			if (e.error == EOPNOTSUPP) {
7519 				mutex_enter(&mi->mi_lock);
7520 				mi->mi_flags &= ~MI4_LINK;
7521 				mutex_exit(&mi->mi_lock);
7522 			}
7523 			/* Remap EISDIR to EPERM for non-root user for SVVS */
7524 			/* XXX-LP */
7525 			if (e.error == EISDIR && crgetuid(cr) != 0)
7526 				e.error = EPERM;
7527 			goto out;
7528 		}
7529 	}
7530 
7531 	/* either no error or one of the postop getattr failed */
7532 
7533 	/*
7534 	 * XXX - if LINK succeeded, but no attrs were returned for link
7535 	 * file, purge its cache.
7536 	 *
7537 	 * XXX Perform a simplified version of wcc checking. Instead of
7538 	 * have another getattr to get pre-op, just purge cache if
7539 	 * any of the ops prior to and including the getattr failed.
7540 	 * If the getattr succeeded then update the attrcache accordingly.
7541 	 */
7542 
7543 	/*
7544 	 * update cache with link file postattrs.
7545 	 * Note: at this point resop points to link res.
7546 	 */
7547 	resop = &res.array[3];	/* link res */
7548 	ln_res = &resop->nfs_resop4_u.oplink;
7549 	if (res.status == NFS4_OK)
7550 		e.error = nfs4_update_attrcache(res.status,
7551 		    &res.array[6].nfs_resop4_u.opgetattr.ga_res,
7552 		    t, svp, cr);
7553 
7554 	/*
7555 	 * Call makenfs4node to create the new shadow vp for tnm.
7556 	 * We pass NULL attrs because we just cached attrs for
7557 	 * the src object.  All we're trying to accomplish is to
7558 	 * to create the new shadow vnode.
7559 	 */
7560 	nvp = makenfs4node(VTOR4(svp)->r_fh, NULL, tdvp->v_vfsp, t, cr,
7561 	    tdvp, fn_get(VTOSV(tdvp)->sv_name, tnm));
7562 
7563 	/* Update target cache attribute, readdir and dnlc caches */
7564 	dinfo.di_garp = &res.array[4].nfs_resop4_u.opgetattr.ga_res;
7565 	dinfo.di_time_call = t;
7566 	dinfo.di_cred = cr;
7567 
7568 	nfs4_update_dircaches(&ln_res->cinfo, tdvp, nvp, tnm, &dinfo);
7569 	ASSERT(nfs4_consistent_type(tdvp));
7570 	ASSERT(nfs4_consistent_type(svp));
7571 	ASSERT(nfs4_consistent_type(nvp));
7572 	VN_RELE(nvp);
7573 
7574 	if (!e.error) {
7575 		vnode_t *tvp;
7576 		rnode4_t *trp;
7577 		/*
7578 		 * Notify the source file of this link operation.
7579 		 */
7580 		trp = VTOR4(svp);
7581 		tvp = svp;
7582 		if (IS_SHADOW(svp, trp))
7583 			tvp = RTOV4(trp);
7584 		vnevent_link(tvp, ct);
7585 	}
7586 out:
7587 	kmem_free(argop, argoplist_size);
7588 	if (resp)
7589 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
7590 
7591 	nfs_rw_exit(&tdrp->r_rwlock);
7592 
7593 	return (e.error);
7594 }
7595 
7596 /* ARGSUSED */
7597 static int
7598 nfs4_rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
7599     caller_context_t *ct, int flags)
7600 {
7601 	vnode_t *realvp;
7602 
7603 	if (nfs_zone() != VTOMI4(odvp)->mi_zone)
7604 		return (EPERM);
7605 	if (VOP_REALVP(ndvp, &realvp, ct) == 0)
7606 		ndvp = realvp;
7607 
7608 	return (nfs4rename(odvp, onm, ndvp, nnm, cr, ct));
7609 }
7610 
7611 /*
7612  * nfs4rename does the real work of renaming in NFS Version 4.
7613  *
7614  * A file handle is considered volatile for renaming purposes if either
7615  * of the volatile bits are turned on. However, the compound may differ
7616  * based on the likelihood of the filehandle to change during rename.
7617  */
7618 static int
7619 nfs4rename(vnode_t *odvp, char *onm, vnode_t *ndvp, char *nnm, cred_t *cr,
7620     caller_context_t *ct)
7621 {
7622 	int error;
7623 	mntinfo4_t *mi;
7624 	vnode_t *nvp = NULL;
7625 	vnode_t *ovp = NULL;
7626 	char *tmpname = NULL;
7627 	rnode4_t *rp;
7628 	rnode4_t *odrp;
7629 	rnode4_t *ndrp;
7630 	int did_link = 0;
7631 	int do_link = 1;
7632 	nfsstat4 stat = NFS4_OK;
7633 
7634 	ASSERT(nfs_zone() == VTOMI4(odvp)->mi_zone);
7635 	ASSERT(nfs4_consistent_type(odvp));
7636 	ASSERT(nfs4_consistent_type(ndvp));
7637 
7638 	if (onm[0] == '.' && (onm[1] == '\0' ||
7639 	    (onm[1] == '.' && onm[2] == '\0')))
7640 		return (EINVAL);
7641 
7642 	if (nnm[0] == '.' && (nnm[1] == '\0' ||
7643 	    (nnm[1] == '.' && nnm[2] == '\0')))
7644 		return (EINVAL);
7645 
7646 	odrp = VTOR4(odvp);
7647 	ndrp = VTOR4(ndvp);
7648 	if ((intptr_t)odrp < (intptr_t)ndrp) {
7649 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR4(odvp)))
7650 			return (EINTR);
7651 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR4(ndvp))) {
7652 			nfs_rw_exit(&odrp->r_rwlock);
7653 			return (EINTR);
7654 		}
7655 	} else {
7656 		if (nfs_rw_enter_sig(&ndrp->r_rwlock, RW_WRITER, INTR4(ndvp)))
7657 			return (EINTR);
7658 		if (nfs_rw_enter_sig(&odrp->r_rwlock, RW_WRITER, INTR4(odvp))) {
7659 			nfs_rw_exit(&ndrp->r_rwlock);
7660 			return (EINTR);
7661 		}
7662 	}
7663 
7664 	/*
7665 	 * Lookup the target file.  If it exists, it needs to be
7666 	 * checked to see whether it is a mount point and whether
7667 	 * it is active (open).
7668 	 */
7669 	error = nfs4lookup(ndvp, nnm, &nvp, cr, 0);
7670 	if (!error) {
7671 		int	isactive;
7672 
7673 		ASSERT(nfs4_consistent_type(nvp));
7674 		/*
7675 		 * If this file has been mounted on, then just
7676 		 * return busy because renaming to it would remove
7677 		 * the mounted file system from the name space.
7678 		 */
7679 		if (vn_ismntpt(nvp)) {
7680 			VN_RELE(nvp);
7681 			nfs_rw_exit(&odrp->r_rwlock);
7682 			nfs_rw_exit(&ndrp->r_rwlock);
7683 			return (EBUSY);
7684 		}
7685 
7686 		/*
7687 		 * First just remove the entry from the name cache, as it
7688 		 * is most likely the only entry for this vp.
7689 		 */
7690 		dnlc_remove(ndvp, nnm);
7691 
7692 		rp = VTOR4(nvp);
7693 
7694 		if (nvp->v_type != VREG) {
7695 			/*
7696 			 * Purge the name cache of all references to this vnode
7697 			 * so that we can check the reference count to infer
7698 			 * whether it is active or not.
7699 			 */
7700 			if (nvp->v_count > 1)
7701 				dnlc_purge_vp(nvp);
7702 
7703 			isactive = nvp->v_count > 1;
7704 		} else {
7705 			mutex_enter(&rp->r_os_lock);
7706 			isactive = list_head(&rp->r_open_streams) != NULL;
7707 			mutex_exit(&rp->r_os_lock);
7708 		}
7709 
7710 		/*
7711 		 * If the vnode is active and is not a directory,
7712 		 * arrange to rename it to a
7713 		 * temporary file so that it will continue to be
7714 		 * accessible.  This implements the "unlink-open-file"
7715 		 * semantics for the target of a rename operation.
7716 		 * Before doing this though, make sure that the
7717 		 * source and target files are not already the same.
7718 		 */
7719 		if (isactive && nvp->v_type != VDIR) {
7720 			/*
7721 			 * Lookup the source name.
7722 			 */
7723 			error = nfs4lookup(odvp, onm, &ovp, cr, 0);
7724 
7725 			/*
7726 			 * The source name *should* already exist.
7727 			 */
7728 			if (error) {
7729 				VN_RELE(nvp);
7730 				nfs_rw_exit(&odrp->r_rwlock);
7731 				nfs_rw_exit(&ndrp->r_rwlock);
7732 				return (error);
7733 			}
7734 
7735 			ASSERT(nfs4_consistent_type(ovp));
7736 
7737 			/*
7738 			 * Compare the two vnodes.  If they are the same,
7739 			 * just release all held vnodes and return success.
7740 			 */
7741 			if (VN_CMP(ovp, nvp)) {
7742 				VN_RELE(ovp);
7743 				VN_RELE(nvp);
7744 				nfs_rw_exit(&odrp->r_rwlock);
7745 				nfs_rw_exit(&ndrp->r_rwlock);
7746 				return (0);
7747 			}
7748 
7749 			/*
7750 			 * Can't mix and match directories and non-
7751 			 * directories in rename operations.  We already
7752 			 * know that the target is not a directory.  If
7753 			 * the source is a directory, return an error.
7754 			 */
7755 			if (ovp->v_type == VDIR) {
7756 				VN_RELE(ovp);
7757 				VN_RELE(nvp);
7758 				nfs_rw_exit(&odrp->r_rwlock);
7759 				nfs_rw_exit(&ndrp->r_rwlock);
7760 				return (ENOTDIR);
7761 			}
7762 link_call:
7763 			/*
7764 			 * The target file exists, is not the same as
7765 			 * the source file, and is active.  We first
7766 			 * try to Link it to a temporary filename to
7767 			 * avoid having the server removing the file
7768 			 * completely (which could cause data loss to
7769 			 * the user's POV in the event the Rename fails
7770 			 * -- see bug 1165874).
7771 			 */
7772 			/*
7773 			 * The do_link and did_link booleans are
7774 			 * introduced in the event we get NFS4ERR_FILE_OPEN
7775 			 * returned for the Rename.  Some servers can
7776 			 * not Rename over an Open file, so they return
7777 			 * this error.  The client needs to Remove the
7778 			 * newly created Link and do two Renames, just
7779 			 * as if the server didn't support LINK.
7780 			 */
7781 			tmpname = newname();
7782 			error = 0;
7783 
7784 			if (do_link) {
7785 				error = nfs4_link(ndvp, nvp, tmpname, cr,
7786 				    NULL, 0);
7787 			}
7788 			if (error == EOPNOTSUPP || !do_link) {
7789 				error = nfs4_rename(ndvp, nnm, ndvp, tmpname,
7790 				    cr, NULL, 0);
7791 				did_link = 0;
7792 			} else {
7793 				did_link = 1;
7794 			}
7795 			if (error) {
7796 				kmem_free(tmpname, MAXNAMELEN);
7797 				VN_RELE(ovp);
7798 				VN_RELE(nvp);
7799 				nfs_rw_exit(&odrp->r_rwlock);
7800 				nfs_rw_exit(&ndrp->r_rwlock);
7801 				return (error);
7802 			}
7803 
7804 			mutex_enter(&rp->r_statelock);
7805 			if (rp->r_unldvp == NULL) {
7806 				VN_HOLD(ndvp);
7807 				rp->r_unldvp = ndvp;
7808 				if (rp->r_unlcred != NULL)
7809 					crfree(rp->r_unlcred);
7810 				crhold(cr);
7811 				rp->r_unlcred = cr;
7812 				rp->r_unlname = tmpname;
7813 			} else {
7814 				if (rp->r_unlname)
7815 					kmem_free(rp->r_unlname, MAXNAMELEN);
7816 				rp->r_unlname = tmpname;
7817 			}
7818 			mutex_exit(&rp->r_statelock);
7819 		}
7820 
7821 		(void) nfs4delegreturn(VTOR4(nvp), NFS4_DR_PUSH|NFS4_DR_REOPEN);
7822 
7823 		ASSERT(nfs4_consistent_type(nvp));
7824 	}
7825 
7826 	if (ovp == NULL) {
7827 		/*
7828 		 * When renaming directories to be a subdirectory of a
7829 		 * different parent, the dnlc entry for ".." will no
7830 		 * longer be valid, so it must be removed.
7831 		 *
7832 		 * We do a lookup here to determine whether we are renaming
7833 		 * a directory and we need to check if we are renaming
7834 		 * an unlinked file.  This might have already been done
7835 		 * in previous code, so we check ovp == NULL to avoid
7836 		 * doing it twice.
7837 		 */
7838 		error = nfs4lookup(odvp, onm, &ovp, cr, 0);
7839 		/*
7840 		 * The source name *should* already exist.
7841 		 */
7842 		if (error) {
7843 			nfs_rw_exit(&odrp->r_rwlock);
7844 			nfs_rw_exit(&ndrp->r_rwlock);
7845 			if (nvp) {
7846 				VN_RELE(nvp);
7847 			}
7848 			return (error);
7849 		}
7850 		ASSERT(ovp != NULL);
7851 		ASSERT(nfs4_consistent_type(ovp));
7852 	}
7853 
7854 	/*
7855 	 * Is the object being renamed a dir, and if so, is
7856 	 * it being renamed to a child of itself?  The underlying
7857 	 * fs should ultimately return EINVAL for this case;
7858 	 * however, buggy beta non-Solaris NFSv4 servers at
7859 	 * interop testing events have allowed this behavior,
7860 	 * and it caused our client to panic due to a recursive
7861 	 * mutex_enter in fn_move.
7862 	 *
7863 	 * The tedious locking in fn_move could be changed to
7864 	 * deal with this case, and the client could avoid the
7865 	 * panic; however, the client would just confuse itself
7866 	 * later and misbehave.  A better way to handle the broken
7867 	 * server is to detect this condition and return EINVAL
7868 	 * without ever sending the the bogus rename to the server.
7869 	 * We know the rename is invalid -- just fail it now.
7870 	 */
7871 	if (ovp->v_type == VDIR && VN_CMP(ndvp, ovp)) {
7872 		VN_RELE(ovp);
7873 		nfs_rw_exit(&odrp->r_rwlock);
7874 		nfs_rw_exit(&ndrp->r_rwlock);
7875 		if (nvp) {
7876 			VN_RELE(nvp);
7877 		}
7878 		return (EINVAL);
7879 	}
7880 
7881 	(void) nfs4delegreturn(VTOR4(ovp), NFS4_DR_PUSH|NFS4_DR_REOPEN);
7882 
7883 	/*
7884 	 * If FH4_VOL_RENAME or FH4_VOLATILE_ANY bits are set, it is
7885 	 * possible for the filehandle to change due to the rename.
7886 	 * If neither of these bits is set, but FH4_VOL_MIGRATION is set,
7887 	 * the fh will not change because of the rename, but we still need
7888 	 * to update its rnode entry with the new name for
7889 	 * an eventual fh change due to migration. The FH4_NOEXPIRE_ON_OPEN
7890 	 * has no effect on these for now, but for future improvements,
7891 	 * we might want to use it too to simplify handling of files
7892 	 * that are open with that flag on. (XXX)
7893 	 */
7894 	mi = VTOMI4(odvp);
7895 	if (NFS4_VOLATILE_FH(mi))
7896 		error = nfs4rename_volatile_fh(odvp, onm, ovp, ndvp, nnm, cr,
7897 		    &stat);
7898 	else
7899 		error = nfs4rename_persistent_fh(odvp, onm, ovp, ndvp, nnm, cr,
7900 		    &stat);
7901 
7902 	ASSERT(nfs4_consistent_type(odvp));
7903 	ASSERT(nfs4_consistent_type(ndvp));
7904 	ASSERT(nfs4_consistent_type(ovp));
7905 
7906 	if (stat == NFS4ERR_FILE_OPEN && did_link) {
7907 		do_link = 0;
7908 		/*
7909 		 * Before the 'link_call' code, we did a nfs4_lookup
7910 		 * that puts a VN_HOLD on nvp.  After the nfs4_link
7911 		 * call we call VN_RELE to match that hold.  We need
7912 		 * to place an additional VN_HOLD here since we will
7913 		 * be hitting that VN_RELE again.
7914 		 */
7915 		VN_HOLD(nvp);
7916 
7917 		(void) nfs4_remove(ndvp, tmpname, cr, NULL, 0);
7918 
7919 		/* Undo the unlinked file naming stuff we just did */
7920 		mutex_enter(&rp->r_statelock);
7921 		if (rp->r_unldvp) {
7922 			VN_RELE(ndvp);
7923 			rp->r_unldvp = NULL;
7924 			if (rp->r_unlcred != NULL)
7925 				crfree(rp->r_unlcred);
7926 			rp->r_unlcred = NULL;
7927 			/* rp->r_unlanme points to tmpname */
7928 			if (rp->r_unlname)
7929 				kmem_free(rp->r_unlname, MAXNAMELEN);
7930 			rp->r_unlname = NULL;
7931 		}
7932 		mutex_exit(&rp->r_statelock);
7933 
7934 		if (nvp) {
7935 			VN_RELE(nvp);
7936 		}
7937 		goto link_call;
7938 	}
7939 
7940 	if (error) {
7941 		VN_RELE(ovp);
7942 		nfs_rw_exit(&odrp->r_rwlock);
7943 		nfs_rw_exit(&ndrp->r_rwlock);
7944 		if (nvp) {
7945 			VN_RELE(nvp);
7946 		}
7947 		return (error);
7948 	}
7949 
7950 	/*
7951 	 * when renaming directories to be a subdirectory of a
7952 	 * different parent, the dnlc entry for ".." will no
7953 	 * longer be valid, so it must be removed
7954 	 */
7955 	rp = VTOR4(ovp);
7956 	if (ndvp != odvp) {
7957 		if (ovp->v_type == VDIR) {
7958 			dnlc_remove(ovp, "..");
7959 			if (rp->r_dir != NULL)
7960 				nfs4_purge_rddir_cache(ovp);
7961 		}
7962 	}
7963 
7964 	/*
7965 	 * If we are renaming the unlinked file, update the
7966 	 * r_unldvp and r_unlname as needed.
7967 	 */
7968 	mutex_enter(&rp->r_statelock);
7969 	if (rp->r_unldvp != NULL) {
7970 		if (strcmp(rp->r_unlname, onm) == 0) {
7971 			(void) strncpy(rp->r_unlname, nnm, MAXNAMELEN);
7972 			rp->r_unlname[MAXNAMELEN - 1] = '\0';
7973 			if (ndvp != rp->r_unldvp) {
7974 				VN_RELE(rp->r_unldvp);
7975 				rp->r_unldvp = ndvp;
7976 				VN_HOLD(ndvp);
7977 			}
7978 		}
7979 	}
7980 	mutex_exit(&rp->r_statelock);
7981 
7982 	/*
7983 	 * Notify the rename vnevents to source vnode, and to the target
7984 	 * vnode if it already existed.
7985 	 */
7986 	if (error == 0) {
7987 		vnode_t *tvp;
7988 		rnode4_t *trp;
7989 		/*
7990 		 * Notify the vnode. Each links is represented by
7991 		 * a different vnode, in nfsv4.
7992 		 */
7993 		if (nvp) {
7994 			trp = VTOR4(nvp);
7995 			tvp = nvp;
7996 			if (IS_SHADOW(nvp, trp))
7997 				tvp = RTOV4(trp);
7998 			vnevent_rename_dest(tvp, ndvp, nnm, ct);
7999 		}
8000 
8001 		/*
8002 		 * if the source and destination directory are not the
8003 		 * same notify the destination directory.
8004 		 */
8005 		if (VTOR4(odvp) != VTOR4(ndvp)) {
8006 			trp = VTOR4(ndvp);
8007 			tvp = ndvp;
8008 			if (IS_SHADOW(ndvp, trp))
8009 				tvp = RTOV4(trp);
8010 			vnevent_rename_dest_dir(tvp, ct);
8011 		}
8012 
8013 		trp = VTOR4(ovp);
8014 		tvp = ovp;
8015 		if (IS_SHADOW(ovp, trp))
8016 			tvp = RTOV4(trp);
8017 		vnevent_rename_src(tvp, odvp, onm, ct);
8018 	}
8019 
8020 	if (nvp) {
8021 		VN_RELE(nvp);
8022 	}
8023 	VN_RELE(ovp);
8024 
8025 	nfs_rw_exit(&odrp->r_rwlock);
8026 	nfs_rw_exit(&ndrp->r_rwlock);
8027 
8028 	return (error);
8029 }
8030 
8031 /*
8032  * nfs4rename_persistent does the otw portion of renaming in NFS Version 4,
8033  * when it is known that the filehandle is persistent through rename.
8034  *
8035  * Rename requires that the current fh be the target directory and the
8036  * saved fh be the source directory. After the operation, the current fh
8037  * is unchanged.
8038  * The compound op structure for persistent fh rename is:
8039  *      PUTFH(sourcdir), SAVEFH, PUTFH(targetdir), RENAME
8040  * Rather than bother with the directory postop args, we'll simply
8041  * update that a change occurred in the cache, so no post-op getattrs.
8042  */
8043 static int
8044 nfs4rename_persistent_fh(vnode_t *odvp, char *onm, vnode_t *renvp,
8045     vnode_t *ndvp, char *nnm, cred_t *cr, nfsstat4 *statp)
8046 {
8047 	COMPOUND4args_clnt args;
8048 	COMPOUND4res_clnt res, *resp = NULL;
8049 	nfs_argop4 *argop;
8050 	nfs_resop4 *resop;
8051 	int doqueue, argoplist_size;
8052 	mntinfo4_t *mi;
8053 	rnode4_t *odrp = VTOR4(odvp);
8054 	rnode4_t *ndrp = VTOR4(ndvp);
8055 	RENAME4res *rn_res;
8056 	bool_t needrecov;
8057 	nfs4_recov_state_t recov_state;
8058 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
8059 	dirattr_info_t dinfo, *dinfop;
8060 
8061 	ASSERT(nfs_zone() == VTOMI4(odvp)->mi_zone);
8062 
8063 	recov_state.rs_flags = 0;
8064 	recov_state.rs_num_retry_despite_err = 0;
8065 
8066 	/*
8067 	 * Rename ops: putfh sdir; savefh; putfh tdir; rename; getattr tdir
8068 	 *
8069 	 * If source/target are different dirs, then append putfh(src); getattr
8070 	 */
8071 	args.array_len = (odvp == ndvp) ? 5 : 7;
8072 	argoplist_size = args.array_len * sizeof (nfs_argop4);
8073 	args.array = argop = kmem_alloc(argoplist_size, KM_SLEEP);
8074 
8075 recov_retry:
8076 	*statp = NFS4_OK;
8077 
8078 	/* No need to Lookup the file, persistent fh */
8079 	args.ctag = TAG_RENAME;
8080 
8081 	mi = VTOMI4(odvp);
8082 	e.error = nfs4_start_op(mi, odvp, ndvp, &recov_state);
8083 	if (e.error) {
8084 		kmem_free(argop, argoplist_size);
8085 		return (e.error);
8086 	}
8087 
8088 	/* 0: putfh source directory */
8089 	argop[0].argop = OP_CPUTFH;
8090 	argop[0].nfs_argop4_u.opcputfh.sfh = odrp->r_fh;
8091 
8092 	/* 1: Save source fh to free up current for target */
8093 	argop[1].argop = OP_SAVEFH;
8094 
8095 	/* 2: putfh targetdir */
8096 	argop[2].argop = OP_CPUTFH;
8097 	argop[2].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8098 
8099 	/* 3: current_fh is targetdir, saved_fh is sourcedir */
8100 	argop[3].argop = OP_CRENAME;
8101 	argop[3].nfs_argop4_u.opcrename.coldname = onm;
8102 	argop[3].nfs_argop4_u.opcrename.cnewname = nnm;
8103 
8104 	/* 4: getattr (targetdir) */
8105 	argop[4].argop = OP_GETATTR;
8106 	argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8107 	argop[4].nfs_argop4_u.opgetattr.mi = mi;
8108 
8109 	if (ndvp != odvp) {
8110 
8111 		/* 5: putfh (sourcedir) */
8112 		argop[5].argop = OP_CPUTFH;
8113 		argop[5].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8114 
8115 		/* 6: getattr (sourcedir) */
8116 		argop[6].argop = OP_GETATTR;
8117 		argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8118 		argop[6].nfs_argop4_u.opgetattr.mi = mi;
8119 	}
8120 
8121 	dnlc_remove(odvp, onm);
8122 	dnlc_remove(ndvp, nnm);
8123 
8124 	doqueue = 1;
8125 	dinfo.di_time_call = gethrtime();
8126 	rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
8127 
8128 	needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
8129 	if (e.error) {
8130 		PURGE_ATTRCACHE4(odvp);
8131 		PURGE_ATTRCACHE4(ndvp);
8132 	} else {
8133 		*statp = res.status;
8134 	}
8135 
8136 	if (needrecov) {
8137 		if (nfs4_start_recovery(&e, mi, odvp, ndvp, NULL, NULL,
8138 		    OP_RENAME, NULL) == FALSE) {
8139 			nfs4_end_op(mi, odvp, ndvp, &recov_state, needrecov);
8140 			if (!e.error)
8141 				(void) xdr_free(xdr_COMPOUND4res_clnt,
8142 				    (caddr_t)&res);
8143 			goto recov_retry;
8144 		}
8145 	}
8146 
8147 	if (!e.error) {
8148 		resp = &res;
8149 		/*
8150 		 * as long as OP_RENAME
8151 		 */
8152 		if (res.status != NFS4_OK && res.array_len <= 4) {
8153 			e.error = geterrno4(res.status);
8154 			PURGE_ATTRCACHE4(odvp);
8155 			PURGE_ATTRCACHE4(ndvp);
8156 			/*
8157 			 * System V defines rename to return EEXIST, not
8158 			 * ENOTEMPTY if the target directory is not empty.
8159 			 * Over the wire, the error is NFSERR_ENOTEMPTY
8160 			 * which geterrno4 maps to ENOTEMPTY.
8161 			 */
8162 			if (e.error == ENOTEMPTY)
8163 				e.error = EEXIST;
8164 		} else {
8165 
8166 			resop = &res.array[3];	/* rename res */
8167 			rn_res = &resop->nfs_resop4_u.oprename;
8168 
8169 			if (res.status == NFS4_OK) {
8170 				/*
8171 				 * Update target attribute, readdir and dnlc
8172 				 * caches.
8173 				 */
8174 				dinfo.di_garp =
8175 				    &res.array[4].nfs_resop4_u.opgetattr.ga_res;
8176 				dinfo.di_cred = cr;
8177 				dinfop = &dinfo;
8178 			} else
8179 				dinfop = NULL;
8180 
8181 			nfs4_update_dircaches(&rn_res->target_cinfo,
8182 			    ndvp, NULL, NULL, dinfop);
8183 
8184 			/*
8185 			 * Update source attribute, readdir and dnlc caches
8186 			 *
8187 			 */
8188 			if (ndvp != odvp) {
8189 				if (dinfop)
8190 					dinfo.di_garp =
8191 					    &(res.array[6].nfs_resop4_u.
8192 					    opgetattr.ga_res);
8193 
8194 				nfs4_update_dircaches(&rn_res->source_cinfo,
8195 				    odvp, NULL, NULL, dinfop);
8196 			}
8197 
8198 			fn_move(VTOSV(renvp)->sv_name, VTOSV(ndvp)->sv_name,
8199 			    nnm);
8200 		}
8201 	}
8202 
8203 	if (resp)
8204 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
8205 	nfs4_end_op(mi, odvp, ndvp, &recov_state, needrecov);
8206 	kmem_free(argop, argoplist_size);
8207 
8208 	return (e.error);
8209 }
8210 
8211 /*
8212  * nfs4rename_volatile_fh does the otw part of renaming in NFS Version 4, when
8213  * it is possible for the filehandle to change due to the rename.
8214  *
8215  * The compound req in this case includes a post-rename lookup and getattr
8216  * to ensure that we have the correct fh and attributes for the object.
8217  *
8218  * Rename requires that the current fh be the target directory and the
8219  * saved fh be the source directory. After the operation, the current fh
8220  * is unchanged.
8221  *
8222  * We need the new filehandle (hence a LOOKUP and GETFH) so that we can
8223  * update the filehandle for the renamed object.  We also get the old
8224  * filehandle for historical reasons; this should be taken out sometime.
8225  * This results in a rather cumbersome compound...
8226  *
8227  *    PUTFH(sourcdir), SAVEFH, LOOKUP(src), GETFH(old),
8228  *    PUTFH(targetdir), RENAME, LOOKUP(trgt), GETFH(new), GETATTR
8229  *
8230  */
8231 static int
8232 nfs4rename_volatile_fh(vnode_t *odvp, char *onm, vnode_t *ovp,
8233     vnode_t *ndvp, char *nnm, cred_t *cr, nfsstat4 *statp)
8234 {
8235 	COMPOUND4args_clnt args;
8236 	COMPOUND4res_clnt res, *resp = NULL;
8237 	int argoplist_size;
8238 	nfs_argop4 *argop;
8239 	nfs_resop4 *resop;
8240 	int doqueue;
8241 	mntinfo4_t *mi;
8242 	rnode4_t *odrp = VTOR4(odvp);	/* old directory */
8243 	rnode4_t *ndrp = VTOR4(ndvp);	/* new directory */
8244 	rnode4_t *orp = VTOR4(ovp);	/* object being renamed */
8245 	RENAME4res *rn_res;
8246 	GETFH4res *ngf_res;
8247 	bool_t needrecov;
8248 	nfs4_recov_state_t recov_state;
8249 	hrtime_t t;
8250 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
8251 	dirattr_info_t dinfo, *dinfop = &dinfo;
8252 
8253 	ASSERT(nfs_zone() == VTOMI4(odvp)->mi_zone);
8254 
8255 	recov_state.rs_flags = 0;
8256 	recov_state.rs_num_retry_despite_err = 0;
8257 
8258 recov_retry:
8259 	*statp = NFS4_OK;
8260 
8261 	/*
8262 	 * There is a window between the RPC and updating the path and
8263 	 * filehandle stored in the rnode.  Lock out the FHEXPIRED recovery
8264 	 * code, so that it doesn't try to use the old path during that
8265 	 * window.
8266 	 */
8267 	mutex_enter(&orp->r_statelock);
8268 	while (orp->r_flags & R4RECEXPFH) {
8269 		klwp_t *lwp = ttolwp(curthread);
8270 
8271 		if (lwp != NULL)
8272 			lwp->lwp_nostop++;
8273 		if (cv_wait_sig(&orp->r_cv, &orp->r_statelock) == 0) {
8274 			mutex_exit(&orp->r_statelock);
8275 			if (lwp != NULL)
8276 				lwp->lwp_nostop--;
8277 			return (EINTR);
8278 		}
8279 		if (lwp != NULL)
8280 			lwp->lwp_nostop--;
8281 	}
8282 	orp->r_flags |= R4RECEXPFH;
8283 	mutex_exit(&orp->r_statelock);
8284 
8285 	mi = VTOMI4(odvp);
8286 
8287 	args.ctag = TAG_RENAME_VFH;
8288 	args.array_len = (odvp == ndvp) ? 10 : 12;
8289 	argoplist_size  = args.array_len * sizeof (nfs_argop4);
8290 	argop = kmem_alloc(argoplist_size, KM_SLEEP);
8291 
8292 	/*
8293 	 * Rename ops:
8294 	 *    PUTFH(sourcdir), SAVEFH, LOOKUP(src), GETFH(old),
8295 	 *    PUTFH(targetdir), RENAME, GETATTR(targetdir)
8296 	 *    LOOKUP(trgt), GETFH(new), GETATTR,
8297 	 *
8298 	 *    if (odvp != ndvp)
8299 	 *	add putfh(sourcedir), getattr(sourcedir) }
8300 	 */
8301 	args.array = argop;
8302 
8303 	e.error = nfs4_start_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8304 	    &recov_state, NULL);
8305 	if (e.error) {
8306 		kmem_free(argop, argoplist_size);
8307 		mutex_enter(&orp->r_statelock);
8308 		orp->r_flags &= ~R4RECEXPFH;
8309 		cv_broadcast(&orp->r_cv);
8310 		mutex_exit(&orp->r_statelock);
8311 		return (e.error);
8312 	}
8313 
8314 	/* 0: putfh source directory */
8315 	argop[0].argop = OP_CPUTFH;
8316 	argop[0].nfs_argop4_u.opcputfh.sfh = odrp->r_fh;
8317 
8318 	/* 1: Save source fh to free up current for target */
8319 	argop[1].argop = OP_SAVEFH;
8320 
8321 	/* 2: Lookup pre-rename fh of renamed object */
8322 	argop[2].argop = OP_CLOOKUP;
8323 	argop[2].nfs_argop4_u.opclookup.cname = onm;
8324 
8325 	/* 3: getfh fh of renamed object (before rename) */
8326 	argop[3].argop = OP_GETFH;
8327 
8328 	/* 4: putfh targetdir */
8329 	argop[4].argop = OP_CPUTFH;
8330 	argop[4].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8331 
8332 	/* 5: current_fh is targetdir, saved_fh is sourcedir */
8333 	argop[5].argop = OP_CRENAME;
8334 	argop[5].nfs_argop4_u.opcrename.coldname = onm;
8335 	argop[5].nfs_argop4_u.opcrename.cnewname = nnm;
8336 
8337 	/* 6: getattr of target dir (post op attrs) */
8338 	argop[6].argop = OP_GETATTR;
8339 	argop[6].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8340 	argop[6].nfs_argop4_u.opgetattr.mi = mi;
8341 
8342 	/* 7: Lookup post-rename fh of renamed object */
8343 	argop[7].argop = OP_CLOOKUP;
8344 	argop[7].nfs_argop4_u.opclookup.cname = nnm;
8345 
8346 	/* 8: getfh fh of renamed object (after rename) */
8347 	argop[8].argop = OP_GETFH;
8348 
8349 	/* 9: getattr of renamed object */
8350 	argop[9].argop = OP_GETATTR;
8351 	argop[9].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8352 	argop[9].nfs_argop4_u.opgetattr.mi = mi;
8353 
8354 	/*
8355 	 * If source/target dirs are different, then get new post-op
8356 	 * attrs for source dir also.
8357 	 */
8358 	if (ndvp != odvp) {
8359 		/* 10: putfh (sourcedir) */
8360 		argop[10].argop = OP_CPUTFH;
8361 		argop[10].nfs_argop4_u.opcputfh.sfh = ndrp->r_fh;
8362 
8363 		/* 11: getattr (sourcedir) */
8364 		argop[11].argop = OP_GETATTR;
8365 		argop[11].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8366 		argop[11].nfs_argop4_u.opgetattr.mi = mi;
8367 	}
8368 
8369 	dnlc_remove(odvp, onm);
8370 	dnlc_remove(ndvp, nnm);
8371 
8372 	doqueue = 1;
8373 	t = gethrtime();
8374 	rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
8375 
8376 	needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
8377 	if (e.error) {
8378 		PURGE_ATTRCACHE4(odvp);
8379 		PURGE_ATTRCACHE4(ndvp);
8380 		if (!needrecov) {
8381 			nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8382 			    &recov_state, needrecov);
8383 			goto out;
8384 		}
8385 	} else {
8386 		*statp = res.status;
8387 	}
8388 
8389 	if (needrecov) {
8390 		bool_t abort;
8391 
8392 		abort = nfs4_start_recovery(&e, mi, odvp, ndvp, NULL, NULL,
8393 		    OP_RENAME, NULL);
8394 		if (abort == FALSE) {
8395 			nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8396 			    &recov_state, needrecov);
8397 			kmem_free(argop, argoplist_size);
8398 			if (!e.error)
8399 				(void) xdr_free(xdr_COMPOUND4res_clnt,
8400 				    (caddr_t)&res);
8401 			mutex_enter(&orp->r_statelock);
8402 			orp->r_flags &= ~R4RECEXPFH;
8403 			cv_broadcast(&orp->r_cv);
8404 			mutex_exit(&orp->r_statelock);
8405 			goto recov_retry;
8406 		} else {
8407 			if (e.error != 0) {
8408 				nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME,
8409 				    &recov_state, needrecov);
8410 				goto out;
8411 			}
8412 			/* fall through for res.status case */
8413 		}
8414 	}
8415 
8416 	resp = &res;
8417 	/*
8418 	 * If OP_RENAME (or any prev op) failed, then return an error.
8419 	 * OP_RENAME is index 5, so if array len <= 6 we return an error.
8420 	 */
8421 	if ((res.status != NFS4_OK) && (res.array_len <= 6)) {
8422 		/*
8423 		 * Error in an op other than last Getattr
8424 		 */
8425 		e.error = geterrno4(res.status);
8426 		PURGE_ATTRCACHE4(odvp);
8427 		PURGE_ATTRCACHE4(ndvp);
8428 		/*
8429 		 * System V defines rename to return EEXIST, not
8430 		 * ENOTEMPTY if the target directory is not empty.
8431 		 * Over the wire, the error is NFSERR_ENOTEMPTY
8432 		 * which geterrno4 maps to ENOTEMPTY.
8433 		 */
8434 		if (e.error == ENOTEMPTY)
8435 			e.error = EEXIST;
8436 		nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME, &recov_state,
8437 		    needrecov);
8438 		goto out;
8439 	}
8440 
8441 	/* rename results */
8442 	rn_res = &res.array[5].nfs_resop4_u.oprename;
8443 
8444 	if (res.status == NFS4_OK) {
8445 		/* Update target attribute, readdir and dnlc caches */
8446 		dinfo.di_garp =
8447 		    &res.array[6].nfs_resop4_u.opgetattr.ga_res;
8448 		dinfo.di_cred = cr;
8449 		dinfo.di_time_call = t;
8450 	} else
8451 		dinfop = NULL;
8452 
8453 	/* Update source cache attribute, readdir and dnlc caches */
8454 	nfs4_update_dircaches(&rn_res->target_cinfo, ndvp, NULL, NULL, dinfop);
8455 
8456 	/* Update source cache attribute, readdir and dnlc caches */
8457 	if (ndvp != odvp) {
8458 
8459 		/*
8460 		 * If dinfop is non-NULL, then compound succeded, so
8461 		 * set di_garp to attrs for source dir.  dinfop is only
8462 		 * set to NULL when compound fails.
8463 		 */
8464 		if (dinfop)
8465 			dinfo.di_garp =
8466 			    &res.array[11].nfs_resop4_u.opgetattr.ga_res;
8467 		nfs4_update_dircaches(&rn_res->source_cinfo, odvp, NULL, NULL,
8468 		    dinfop);
8469 	}
8470 
8471 	/*
8472 	 * Update the rnode with the new component name and args,
8473 	 * and if the file handle changed, also update it with the new fh.
8474 	 * This is only necessary if the target object has an rnode
8475 	 * entry and there is no need to create one for it.
8476 	 */
8477 	resop = &res.array[8];	/* getfh new res */
8478 	ngf_res = &resop->nfs_resop4_u.opgetfh;
8479 
8480 	/*
8481 	 * Update the path and filehandle for the renamed object.
8482 	 */
8483 	nfs4rename_update(ovp, ndvp, &ngf_res->object, nnm);
8484 
8485 	nfs4_end_fop(mi, odvp, ndvp, OH_VFH_RENAME, &recov_state, needrecov);
8486 
8487 	if (res.status == NFS4_OK) {
8488 		resop++;	/* getattr res */
8489 		e.error = nfs4_update_attrcache(res.status,
8490 		    &resop->nfs_resop4_u.opgetattr.ga_res,
8491 		    t, ovp, cr);
8492 	}
8493 
8494 out:
8495 	kmem_free(argop, argoplist_size);
8496 	if (resp)
8497 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
8498 	mutex_enter(&orp->r_statelock);
8499 	orp->r_flags &= ~R4RECEXPFH;
8500 	cv_broadcast(&orp->r_cv);
8501 	mutex_exit(&orp->r_statelock);
8502 
8503 	return (e.error);
8504 }
8505 
8506 /* ARGSUSED */
8507 static int
8508 nfs4_mkdir(vnode_t *dvp, char *nm, struct vattr *va, vnode_t **vpp, cred_t *cr,
8509     caller_context_t *ct, int flags, vsecattr_t *vsecp)
8510 {
8511 	int error;
8512 	vnode_t *vp;
8513 
8514 	if (nfs_zone() != VTOMI4(dvp)->mi_zone)
8515 		return (EPERM);
8516 	/*
8517 	 * As ".." has special meaning and rather than send a mkdir
8518 	 * over the wire to just let the server freak out, we just
8519 	 * short circuit it here and return EEXIST
8520 	 */
8521 	if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0')
8522 		return (EEXIST);
8523 
8524 	/*
8525 	 * Decision to get the right gid and setgid bit of the
8526 	 * new directory is now made in call_nfs4_create_req.
8527 	 */
8528 	va->va_mask |= AT_MODE;
8529 	error = call_nfs4_create_req(dvp, nm, NULL, va, &vp, cr, NF4DIR);
8530 	if (error)
8531 		return (error);
8532 
8533 	*vpp = vp;
8534 	return (0);
8535 }
8536 
8537 
8538 /*
8539  * rmdir is using the same remove v4 op as does remove.
8540  * Remove requires that the current fh be the target directory.
8541  * After the operation, the current fh is unchanged.
8542  * The compound op structure is:
8543  *      PUTFH(targetdir), REMOVE
8544  */
8545 /*ARGSUSED4*/
8546 static int
8547 nfs4_rmdir(vnode_t *dvp, char *nm, vnode_t *cdir, cred_t *cr,
8548     caller_context_t *ct, int flags)
8549 {
8550 	int need_end_op = FALSE;
8551 	COMPOUND4args_clnt args;
8552 	COMPOUND4res_clnt res, *resp = NULL;
8553 	REMOVE4res *rm_res;
8554 	nfs_argop4 argop[3];
8555 	nfs_resop4 *resop;
8556 	vnode_t *vp;
8557 	int doqueue;
8558 	mntinfo4_t *mi;
8559 	rnode4_t *drp;
8560 	bool_t needrecov = FALSE;
8561 	nfs4_recov_state_t recov_state;
8562 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
8563 	dirattr_info_t dinfo, *dinfop;
8564 
8565 	if (nfs_zone() != VTOMI4(dvp)->mi_zone)
8566 		return (EPERM);
8567 	/*
8568 	 * As ".." has special meaning and rather than send a rmdir
8569 	 * over the wire to just let the server freak out, we just
8570 	 * short circuit it here and return EEXIST
8571 	 */
8572 	if (nm[0] == '.' && nm[1] == '.' && nm[2] == '\0')
8573 		return (EEXIST);
8574 
8575 	drp = VTOR4(dvp);
8576 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_WRITER, INTR4(dvp)))
8577 		return (EINTR);
8578 
8579 	/*
8580 	 * Attempt to prevent a rmdir(".") from succeeding.
8581 	 */
8582 	e.error = nfs4lookup(dvp, nm, &vp, cr, 0);
8583 	if (e.error) {
8584 		nfs_rw_exit(&drp->r_rwlock);
8585 		return (e.error);
8586 	}
8587 	if (vp == cdir) {
8588 		VN_RELE(vp);
8589 		nfs_rw_exit(&drp->r_rwlock);
8590 		return (EINVAL);
8591 	}
8592 
8593 	/*
8594 	 * Since nfsv4 remove op works on both files and directories,
8595 	 * check that the removed object is indeed a directory.
8596 	 */
8597 	if (vp->v_type != VDIR) {
8598 		VN_RELE(vp);
8599 		nfs_rw_exit(&drp->r_rwlock);
8600 		return (ENOTDIR);
8601 	}
8602 
8603 	/*
8604 	 * First just remove the entry from the name cache, as it
8605 	 * is most likely an entry for this vp.
8606 	 */
8607 	dnlc_remove(dvp, nm);
8608 
8609 	/*
8610 	 * If there vnode reference count is greater than one, then
8611 	 * there may be additional references in the DNLC which will
8612 	 * need to be purged.  First, trying removing the entry for
8613 	 * the parent directory and see if that removes the additional
8614 	 * reference(s).  If that doesn't do it, then use dnlc_purge_vp
8615 	 * to completely remove any references to the directory which
8616 	 * might still exist in the DNLC.
8617 	 */
8618 	if (vp->v_count > 1) {
8619 		dnlc_remove(vp, "..");
8620 		if (vp->v_count > 1)
8621 			dnlc_purge_vp(vp);
8622 	}
8623 
8624 	mi = VTOMI4(dvp);
8625 	recov_state.rs_flags = 0;
8626 	recov_state.rs_num_retry_despite_err = 0;
8627 
8628 recov_retry:
8629 	args.ctag = TAG_RMDIR;
8630 
8631 	/*
8632 	 * Rmdir ops: putfh dir; remove
8633 	 */
8634 	args.array_len = 3;
8635 	args.array = argop;
8636 
8637 	e.error = nfs4_start_op(VTOMI4(dvp), dvp, NULL, &recov_state);
8638 	if (e.error) {
8639 		nfs_rw_exit(&drp->r_rwlock);
8640 		return (e.error);
8641 	}
8642 	need_end_op = TRUE;
8643 
8644 	/* putfh directory */
8645 	argop[0].argop = OP_CPUTFH;
8646 	argop[0].nfs_argop4_u.opcputfh.sfh = drp->r_fh;
8647 
8648 	/* remove */
8649 	argop[1].argop = OP_CREMOVE;
8650 	argop[1].nfs_argop4_u.opcremove.ctarget = nm;
8651 
8652 	/* getattr (postop attrs for dir that contained removed dir) */
8653 	argop[2].argop = OP_GETATTR;
8654 	argop[2].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
8655 	argop[2].nfs_argop4_u.opgetattr.mi = mi;
8656 
8657 	dinfo.di_time_call = gethrtime();
8658 	doqueue = 1;
8659 	rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
8660 
8661 	PURGE_ATTRCACHE4(vp);
8662 
8663 	needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
8664 	if (e.error) {
8665 		PURGE_ATTRCACHE4(dvp);
8666 	}
8667 
8668 	if (needrecov) {
8669 		if (nfs4_start_recovery(&e, VTOMI4(dvp), dvp, NULL, NULL,
8670 		    NULL, OP_REMOVE, NULL) == FALSE) {
8671 			if (!e.error)
8672 				(void) xdr_free(xdr_COMPOUND4res_clnt,
8673 				    (caddr_t)&res);
8674 
8675 			nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state,
8676 			    needrecov);
8677 			need_end_op = FALSE;
8678 			goto recov_retry;
8679 		}
8680 	}
8681 
8682 	if (!e.error) {
8683 		resp = &res;
8684 
8685 		/*
8686 		 * Only return error if first 2 ops (OP_REMOVE or earlier)
8687 		 * failed.
8688 		 */
8689 		if (res.status != NFS4_OK && res.array_len <= 2) {
8690 			e.error = geterrno4(res.status);
8691 			PURGE_ATTRCACHE4(dvp);
8692 			nfs4_end_op(VTOMI4(dvp), dvp, NULL,
8693 			    &recov_state, needrecov);
8694 			need_end_op = FALSE;
8695 			nfs4_purge_stale_fh(e.error, dvp, cr);
8696 			/*
8697 			 * System V defines rmdir to return EEXIST, not
8698 			 * ENOTEMPTY if the directory is not empty.  Over
8699 			 * the wire, the error is NFSERR_ENOTEMPTY which
8700 			 * geterrno4 maps to ENOTEMPTY.
8701 			 */
8702 			if (e.error == ENOTEMPTY)
8703 				e.error = EEXIST;
8704 		} else {
8705 			resop = &res.array[1];	/* remove res */
8706 			rm_res = &resop->nfs_resop4_u.opremove;
8707 
8708 			if (res.status == NFS4_OK) {
8709 				resop = &res.array[2];	/* dir attrs */
8710 				dinfo.di_garp =
8711 				    &resop->nfs_resop4_u.opgetattr.ga_res;
8712 				dinfo.di_cred = cr;
8713 				dinfop = &dinfo;
8714 			} else
8715 				dinfop = NULL;
8716 
8717 			/* Update dir attribute, readdir and dnlc caches */
8718 			nfs4_update_dircaches(&rm_res->cinfo, dvp, NULL, NULL,
8719 			    dinfop);
8720 
8721 			/* destroy rddir cache for dir that was removed */
8722 			if (VTOR4(vp)->r_dir != NULL)
8723 				nfs4_purge_rddir_cache(vp);
8724 		}
8725 	}
8726 
8727 	if (need_end_op)
8728 		nfs4_end_op(VTOMI4(dvp), dvp, NULL, &recov_state, needrecov);
8729 
8730 	nfs_rw_exit(&drp->r_rwlock);
8731 
8732 	if (resp)
8733 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
8734 
8735 	if (e.error == 0) {
8736 		vnode_t *tvp;
8737 		rnode4_t *trp;
8738 		trp = VTOR4(vp);
8739 		tvp = vp;
8740 		if (IS_SHADOW(vp, trp))
8741 			tvp = RTOV4(trp);
8742 		vnevent_rmdir(tvp, dvp, nm, ct);
8743 	}
8744 
8745 	VN_RELE(vp);
8746 
8747 	return (e.error);
8748 }
8749 
8750 /* ARGSUSED */
8751 static int
8752 nfs4_symlink(vnode_t *dvp, char *lnm, struct vattr *tva, char *tnm, cred_t *cr,
8753     caller_context_t *ct, int flags)
8754 {
8755 	int error;
8756 	vnode_t *vp;
8757 	rnode4_t *rp;
8758 	char *contents;
8759 	mntinfo4_t *mi = VTOMI4(dvp);
8760 
8761 	if (nfs_zone() != mi->mi_zone)
8762 		return (EPERM);
8763 	if (!(mi->mi_flags & MI4_SYMLINK))
8764 		return (EOPNOTSUPP);
8765 
8766 	error = call_nfs4_create_req(dvp, lnm, tnm, tva, &vp, cr, NF4LNK);
8767 	if (error)
8768 		return (error);
8769 
8770 	ASSERT(nfs4_consistent_type(vp));
8771 	rp = VTOR4(vp);
8772 	if (nfs4_do_symlink_cache && rp->r_symlink.contents == NULL) {
8773 
8774 		contents = kmem_alloc(MAXPATHLEN, KM_SLEEP);
8775 
8776 		if (contents != NULL) {
8777 			mutex_enter(&rp->r_statelock);
8778 			if (rp->r_symlink.contents == NULL) {
8779 				rp->r_symlink.len = strlen(tnm);
8780 				bcopy(tnm, contents, rp->r_symlink.len);
8781 				rp->r_symlink.contents = contents;
8782 				rp->r_symlink.size = MAXPATHLEN;
8783 				mutex_exit(&rp->r_statelock);
8784 			} else {
8785 				mutex_exit(&rp->r_statelock);
8786 				kmem_free((void *)contents, MAXPATHLEN);
8787 			}
8788 		}
8789 	}
8790 	VN_RELE(vp);
8791 
8792 	return (error);
8793 }
8794 
8795 
8796 /*
8797  * Read directory entries.
8798  * There are some weird things to look out for here.  The uio_loffset
8799  * field is either 0 or it is the offset returned from a previous
8800  * readdir.  It is an opaque value used by the server to find the
8801  * correct directory block to read. The count field is the number
8802  * of blocks to read on the server.  This is advisory only, the server
8803  * may return only one block's worth of entries.  Entries may be compressed
8804  * on the server.
8805  */
8806 /* ARGSUSED */
8807 static int
8808 nfs4_readdir(vnode_t *vp, struct uio *uiop, cred_t *cr, int *eofp,
8809 	caller_context_t *ct, int flags)
8810 {
8811 	int error;
8812 	uint_t count;
8813 	rnode4_t *rp;
8814 	rddir4_cache *rdc;
8815 	rddir4_cache *rrdc;
8816 
8817 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
8818 		return (EIO);
8819 	rp = VTOR4(vp);
8820 
8821 	ASSERT(nfs_rw_lock_held(&rp->r_rwlock, RW_READER));
8822 
8823 	/*
8824 	 * Make sure that the directory cache is valid.
8825 	 */
8826 	if (rp->r_dir != NULL) {
8827 		if (nfs_disable_rddir_cache != 0) {
8828 			/*
8829 			 * Setting nfs_disable_rddir_cache in /etc/system
8830 			 * allows interoperability with servers that do not
8831 			 * properly update the attributes of directories.
8832 			 * Any cached information gets purged before an
8833 			 * access is made to it.
8834 			 */
8835 			nfs4_purge_rddir_cache(vp);
8836 		}
8837 
8838 		error = nfs4_validate_caches(vp, cr);
8839 		if (error)
8840 			return (error);
8841 	}
8842 
8843 	count = MIN(uiop->uio_iov->iov_len, MAXBSIZE);
8844 
8845 	/*
8846 	 * Short circuit last readdir which always returns 0 bytes.
8847 	 * This can be done after the directory has been read through
8848 	 * completely at least once.  This will set r_direof which
8849 	 * can be used to find the value of the last cookie.
8850 	 */
8851 	mutex_enter(&rp->r_statelock);
8852 	if (rp->r_direof != NULL &&
8853 	    uiop->uio_loffset == rp->r_direof->nfs4_ncookie) {
8854 		mutex_exit(&rp->r_statelock);
8855 #ifdef DEBUG
8856 		nfs4_readdir_cache_shorts++;
8857 #endif
8858 		if (eofp)
8859 			*eofp = 1;
8860 		return (0);
8861 	}
8862 
8863 	/*
8864 	 * Look for a cache entry.  Cache entries are identified
8865 	 * by the NFS cookie value and the byte count requested.
8866 	 */
8867 	rdc = rddir4_cache_lookup(rp, uiop->uio_loffset, count);
8868 
8869 	/*
8870 	 * If rdc is NULL then the lookup resulted in an unrecoverable error.
8871 	 */
8872 	if (rdc == NULL) {
8873 		mutex_exit(&rp->r_statelock);
8874 		return (EINTR);
8875 	}
8876 
8877 	/*
8878 	 * Check to see if we need to fill this entry in.
8879 	 */
8880 	if (rdc->flags & RDDIRREQ) {
8881 		rdc->flags &= ~RDDIRREQ;
8882 		rdc->flags |= RDDIR;
8883 		mutex_exit(&rp->r_statelock);
8884 
8885 		/*
8886 		 * Do the readdir.
8887 		 */
8888 		nfs4readdir(vp, rdc, cr);
8889 
8890 		/*
8891 		 * Reacquire the lock, so that we can continue
8892 		 */
8893 		mutex_enter(&rp->r_statelock);
8894 		/*
8895 		 * The entry is now complete
8896 		 */
8897 		rdc->flags &= ~RDDIR;
8898 	}
8899 
8900 	ASSERT(!(rdc->flags & RDDIR));
8901 
8902 	/*
8903 	 * If an error occurred while attempting
8904 	 * to fill the cache entry, mark the entry invalid and
8905 	 * just return the error.
8906 	 */
8907 	if (rdc->error) {
8908 		error = rdc->error;
8909 		rdc->flags |= RDDIRREQ;
8910 		rddir4_cache_rele(rp, rdc);
8911 		mutex_exit(&rp->r_statelock);
8912 		return (error);
8913 	}
8914 
8915 	/*
8916 	 * The cache entry is complete and good,
8917 	 * copyout the dirent structs to the calling
8918 	 * thread.
8919 	 */
8920 	error = uiomove(rdc->entries, rdc->actlen, UIO_READ, uiop);
8921 
8922 	/*
8923 	 * If no error occurred during the copyout,
8924 	 * update the offset in the uio struct to
8925 	 * contain the value of the next NFS 4 cookie
8926 	 * and set the eof value appropriately.
8927 	 */
8928 	if (!error) {
8929 		uiop->uio_loffset = rdc->nfs4_ncookie;
8930 		if (eofp)
8931 			*eofp = rdc->eof;
8932 	}
8933 
8934 	/*
8935 	 * Decide whether to do readahead.  Don't if we
8936 	 * have already read to the end of directory.
8937 	 */
8938 	if (rdc->eof) {
8939 		/*
8940 		 * Make the entry the direof only if it is cached
8941 		 */
8942 		if (rdc->flags & RDDIRCACHED)
8943 			rp->r_direof = rdc;
8944 		rddir4_cache_rele(rp, rdc);
8945 		mutex_exit(&rp->r_statelock);
8946 		return (error);
8947 	}
8948 
8949 	/* Determine if a readdir readahead should be done */
8950 	if (!(rp->r_flags & R4LOOKUP)) {
8951 		rddir4_cache_rele(rp, rdc);
8952 		mutex_exit(&rp->r_statelock);
8953 		return (error);
8954 	}
8955 
8956 	/*
8957 	 * Now look for a readahead entry.
8958 	 *
8959 	 * Check to see whether we found an entry for the readahead.
8960 	 * If so, we don't need to do anything further, so free the new
8961 	 * entry if one was allocated.  Otherwise, allocate a new entry, add
8962 	 * it to the cache, and then initiate an asynchronous readdir
8963 	 * operation to fill it.
8964 	 */
8965 	rrdc = rddir4_cache_lookup(rp, rdc->nfs4_ncookie, count);
8966 
8967 	/*
8968 	 * A readdir cache entry could not be obtained for the readahead.  In
8969 	 * this case we skip the readahead and return.
8970 	 */
8971 	if (rrdc == NULL) {
8972 		rddir4_cache_rele(rp, rdc);
8973 		mutex_exit(&rp->r_statelock);
8974 		return (error);
8975 	}
8976 
8977 	/*
8978 	 * Check to see if we need to fill this entry in.
8979 	 */
8980 	if (rrdc->flags & RDDIRREQ) {
8981 		rrdc->flags &= ~RDDIRREQ;
8982 		rrdc->flags |= RDDIR;
8983 		rddir4_cache_rele(rp, rdc);
8984 		mutex_exit(&rp->r_statelock);
8985 #ifdef DEBUG
8986 		nfs4_readdir_readahead++;
8987 #endif
8988 		/*
8989 		 * Do the readdir.
8990 		 */
8991 		nfs4_async_readdir(vp, rrdc, cr, do_nfs4readdir);
8992 		return (error);
8993 	}
8994 
8995 	rddir4_cache_rele(rp, rrdc);
8996 	rddir4_cache_rele(rp, rdc);
8997 	mutex_exit(&rp->r_statelock);
8998 	return (error);
8999 }
9000 
9001 static int
9002 do_nfs4readdir(vnode_t *vp, rddir4_cache *rdc, cred_t *cr)
9003 {
9004 	int error;
9005 	rnode4_t *rp;
9006 
9007 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
9008 
9009 	rp = VTOR4(vp);
9010 
9011 	/*
9012 	 * Obtain the readdir results for the caller.
9013 	 */
9014 	nfs4readdir(vp, rdc, cr);
9015 
9016 	mutex_enter(&rp->r_statelock);
9017 	/*
9018 	 * The entry is now complete
9019 	 */
9020 	rdc->flags &= ~RDDIR;
9021 
9022 	error = rdc->error;
9023 	if (error)
9024 		rdc->flags |= RDDIRREQ;
9025 	rddir4_cache_rele(rp, rdc);
9026 	mutex_exit(&rp->r_statelock);
9027 
9028 	return (error);
9029 }
9030 
9031 /*
9032  * Read directory entries.
9033  * There are some weird things to look out for here.  The uio_loffset
9034  * field is either 0 or it is the offset returned from a previous
9035  * readdir.  It is an opaque value used by the server to find the
9036  * correct directory block to read. The count field is the number
9037  * of blocks to read on the server.  This is advisory only, the server
9038  * may return only one block's worth of entries.  Entries may be compressed
9039  * on the server.
9040  *
9041  * Generates the following compound request:
9042  * 1. If readdir offset is zero and no dnlc entry for parent exists,
9043  *    must include a Lookupp as well. In this case, send:
9044  *    { Putfh <fh>; Readdir; Lookupp; Getfh; Getattr }
9045  * 2. Otherwise just do: { Putfh <fh>; Readdir }
9046  *
9047  * Get complete attributes and filehandles for entries if this is the
9048  * first read of the directory. Otherwise, just get fileid's.
9049  */
9050 static void
9051 nfs4readdir(vnode_t *vp, rddir4_cache *rdc, cred_t *cr)
9052 {
9053 	COMPOUND4args_clnt args;
9054 	COMPOUND4res_clnt res;
9055 	READDIR4args *rargs;
9056 	READDIR4res_clnt *rd_res;
9057 	bitmap4 rd_bitsval;
9058 	nfs_argop4 argop[5];
9059 	nfs_resop4 *resop;
9060 	rnode4_t *rp = VTOR4(vp);
9061 	mntinfo4_t *mi = VTOMI4(vp);
9062 	int doqueue;
9063 	u_longlong_t nodeid, pnodeid;	/* id's of dir and its parents */
9064 	vnode_t *dvp;
9065 	nfs_cookie4 cookie = (nfs_cookie4)rdc->nfs4_cookie;
9066 	int num_ops, res_opcnt;
9067 	bool_t needrecov = FALSE;
9068 	nfs4_recov_state_t recov_state;
9069 	hrtime_t t;
9070 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
9071 
9072 	ASSERT(nfs_zone() == mi->mi_zone);
9073 	ASSERT(rdc->flags & RDDIR);
9074 	ASSERT(rdc->entries == NULL);
9075 
9076 	/*
9077 	 * If rp were a stub, it should have triggered and caused
9078 	 * a mount for us to get this far.
9079 	 */
9080 	ASSERT(!RP_ISSTUB(rp));
9081 
9082 	num_ops = 2;
9083 	if (cookie == (nfs_cookie4)0 || cookie == (nfs_cookie4)1) {
9084 		/*
9085 		 * Since nfsv4 readdir may not return entries for "." and "..",
9086 		 * the client must recreate them:
9087 		 * To find the correct nodeid, do the following:
9088 		 * For current node, get nodeid from dnlc.
9089 		 * - if current node is rootvp, set pnodeid to nodeid.
9090 		 * - else if parent is in the dnlc, get its nodeid from there.
9091 		 * - else add LOOKUPP+GETATTR to compound.
9092 		 */
9093 		nodeid = rp->r_attr.va_nodeid;
9094 		if (vp->v_flag & VROOT) {
9095 			pnodeid = nodeid;	/* root of mount point */
9096 		} else {
9097 			dvp = dnlc_lookup(vp, "..");
9098 			if (dvp != NULL && dvp != DNLC_NO_VNODE) {
9099 				/* parent in dnlc cache - no need for otw */
9100 				pnodeid = VTOR4(dvp)->r_attr.va_nodeid;
9101 			} else {
9102 				/*
9103 				 * parent not in dnlc cache,
9104 				 * do lookupp to get its id
9105 				 */
9106 				num_ops = 5;
9107 				pnodeid = 0; /* set later by getattr parent */
9108 			}
9109 			if (dvp)
9110 				VN_RELE(dvp);
9111 		}
9112 	}
9113 	recov_state.rs_flags = 0;
9114 	recov_state.rs_num_retry_despite_err = 0;
9115 
9116 	/* Save the original mount point security flavor */
9117 	(void) save_mnt_secinfo(mi->mi_curr_serv);
9118 
9119 recov_retry:
9120 	args.ctag = TAG_READDIR;
9121 
9122 	args.array = argop;
9123 	args.array_len = num_ops;
9124 
9125 	if (e.error = nfs4_start_fop(VTOMI4(vp), vp, NULL, OH_READDIR,
9126 	    &recov_state, NULL)) {
9127 		/*
9128 		 * If readdir a node that is a stub for a crossed mount point,
9129 		 * keep the original secinfo flavor for the current file
9130 		 * system, not the crossed one.
9131 		 */
9132 		(void) check_mnt_secinfo(mi->mi_curr_serv, vp);
9133 		rdc->error = e.error;
9134 		return;
9135 	}
9136 
9137 	/*
9138 	 * Determine which attrs to request for dirents.  This code
9139 	 * must be protected by nfs4_start/end_fop because of r_server
9140 	 * (which will change during failover recovery).
9141 	 *
9142 	 */
9143 	if (rp->r_flags & (R4LOOKUP | R4READDIRWATTR)) {
9144 		/*
9145 		 * Get all vattr attrs plus filehandle and rdattr_error
9146 		 */
9147 		rd_bitsval = NFS4_VATTR_MASK |
9148 		    FATTR4_RDATTR_ERROR_MASK |
9149 		    FATTR4_FILEHANDLE_MASK;
9150 
9151 		if (rp->r_flags & R4READDIRWATTR) {
9152 			mutex_enter(&rp->r_statelock);
9153 			rp->r_flags &= ~R4READDIRWATTR;
9154 			mutex_exit(&rp->r_statelock);
9155 		}
9156 	} else {
9157 		servinfo4_t *svp = rp->r_server;
9158 
9159 		/*
9160 		 * Already read directory. Use readdir with
9161 		 * no attrs (except for mounted_on_fileid) for updates.
9162 		 */
9163 		rd_bitsval = FATTR4_RDATTR_ERROR_MASK;
9164 
9165 		/*
9166 		 * request mounted on fileid if supported, else request
9167 		 * fileid.  maybe we should verify that fileid is supported
9168 		 * and request something else if not.
9169 		 */
9170 		(void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
9171 		if (svp->sv_supp_attrs & FATTR4_MOUNTED_ON_FILEID_MASK)
9172 			rd_bitsval |= FATTR4_MOUNTED_ON_FILEID_MASK;
9173 		nfs_rw_exit(&svp->sv_lock);
9174 	}
9175 
9176 	/* putfh directory fh */
9177 	argop[0].argop = OP_CPUTFH;
9178 	argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
9179 
9180 	argop[1].argop = OP_READDIR;
9181 	rargs = &argop[1].nfs_argop4_u.opreaddir;
9182 	/*
9183 	 * 1 and 2 are reserved for client "." and ".." entry offset.
9184 	 * cookie 0 should be used over-the-wire to start reading at
9185 	 * the beginning of the directory excluding "." and "..".
9186 	 */
9187 	if (rdc->nfs4_cookie == 0 ||
9188 	    rdc->nfs4_cookie == 1 ||
9189 	    rdc->nfs4_cookie == 2) {
9190 		rargs->cookie = (nfs_cookie4)0;
9191 		rargs->cookieverf = 0;
9192 	} else {
9193 		rargs->cookie = (nfs_cookie4)rdc->nfs4_cookie;
9194 		mutex_enter(&rp->r_statelock);
9195 		rargs->cookieverf = rp->r_cookieverf4;
9196 		mutex_exit(&rp->r_statelock);
9197 	}
9198 	rargs->dircount = MIN(rdc->buflen, mi->mi_tsize);
9199 	rargs->maxcount = mi->mi_tsize;
9200 	rargs->attr_request = rd_bitsval;
9201 	rargs->rdc = rdc;
9202 	rargs->dvp = vp;
9203 	rargs->mi = mi;
9204 	rargs->cr = cr;
9205 
9206 
9207 	/*
9208 	 * If count < than the minimum required, we return no entries
9209 	 * and fail with EINVAL
9210 	 */
9211 	if (rargs->dircount < (DIRENT64_RECLEN(1) + DIRENT64_RECLEN(2))) {
9212 		rdc->error = EINVAL;
9213 		goto out;
9214 	}
9215 
9216 	if (args.array_len == 5) {
9217 		/*
9218 		 * Add lookupp and getattr for parent nodeid.
9219 		 */
9220 		argop[2].argop = OP_LOOKUPP;
9221 
9222 		argop[3].argop = OP_GETFH;
9223 
9224 		/* getattr parent */
9225 		argop[4].argop = OP_GETATTR;
9226 		argop[4].nfs_argop4_u.opgetattr.attr_request = NFS4_VATTR_MASK;
9227 		argop[4].nfs_argop4_u.opgetattr.mi = mi;
9228 	}
9229 
9230 	doqueue = 1;
9231 
9232 	if (mi->mi_io_kstats) {
9233 		mutex_enter(&mi->mi_lock);
9234 		kstat_runq_enter(KSTAT_IO_PTR(mi->mi_io_kstats));
9235 		mutex_exit(&mi->mi_lock);
9236 	}
9237 
9238 	/* capture the time of this call */
9239 	rargs->t = t = gethrtime();
9240 
9241 	rfs4call(mi, &args, &res, cr, &doqueue, 0, &e);
9242 
9243 	if (mi->mi_io_kstats) {
9244 		mutex_enter(&mi->mi_lock);
9245 		kstat_runq_exit(KSTAT_IO_PTR(mi->mi_io_kstats));
9246 		mutex_exit(&mi->mi_lock);
9247 	}
9248 
9249 	needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
9250 
9251 	/*
9252 	 * If RPC error occurred and it isn't an error that
9253 	 * triggers recovery, then go ahead and fail now.
9254 	 */
9255 	if (e.error != 0 && !needrecov) {
9256 		rdc->error = e.error;
9257 		goto out;
9258 	}
9259 
9260 	if (needrecov) {
9261 		bool_t abort;
9262 
9263 		NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
9264 		    "nfs4readdir: initiating recovery.\n"));
9265 
9266 		abort = nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
9267 		    NULL, OP_READDIR, NULL);
9268 		if (abort == FALSE) {
9269 			nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_READDIR,
9270 			    &recov_state, needrecov);
9271 			if (!e.error)
9272 				(void) xdr_free(xdr_COMPOUND4res_clnt,
9273 				    (caddr_t)&res);
9274 			if (rdc->entries != NULL) {
9275 				kmem_free(rdc->entries, rdc->entlen);
9276 				rdc->entries = NULL;
9277 			}
9278 			goto recov_retry;
9279 		}
9280 
9281 		if (e.error != 0) {
9282 			rdc->error = e.error;
9283 			goto out;
9284 		}
9285 
9286 		/* fall through for res.status case */
9287 	}
9288 
9289 	res_opcnt = res.array_len;
9290 
9291 	/*
9292 	 * If compound failed first 2 ops (PUTFH+READDIR), then return
9293 	 * failure here.  Subsequent ops are for filling out dot-dot
9294 	 * dirent, and if they fail, we still want to give the caller
9295 	 * the dirents returned by (the successful) READDIR op, so we need
9296 	 * to silently ignore failure for subsequent ops (LOOKUPP+GETATTR).
9297 	 *
9298 	 * One example where PUTFH+READDIR ops would succeed but
9299 	 * LOOKUPP+GETATTR would fail would be a dir that has r perm
9300 	 * but lacks x.  In this case, a POSIX server's VOP_READDIR
9301 	 * would succeed; however, VOP_LOOKUP(..) would fail since no
9302 	 * x perm.  We need to come up with a non-vendor-specific way
9303 	 * for a POSIX server to return d_ino from dotdot's dirent if
9304 	 * client only requests mounted_on_fileid, and just say the
9305 	 * LOOKUPP succeeded and fill out the GETATTR.  However, if
9306 	 * client requested any mandatory attrs, server would be required
9307 	 * to fail the GETATTR op because it can't call VOP_LOOKUP+VOP_GETATTR
9308 	 * for dotdot.
9309 	 */
9310 
9311 	if (res.status) {
9312 		if (res_opcnt <= 2) {
9313 			e.error = geterrno4(res.status);
9314 			nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_READDIR,
9315 			    &recov_state, needrecov);
9316 			nfs4_purge_stale_fh(e.error, vp, cr);
9317 			rdc->error = e.error;
9318 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
9319 			if (rdc->entries != NULL) {
9320 				kmem_free(rdc->entries, rdc->entlen);
9321 				rdc->entries = NULL;
9322 			}
9323 			/*
9324 			 * If readdir a node that is a stub for a
9325 			 * crossed mount point, keep the original
9326 			 * secinfo flavor for the current file system,
9327 			 * not the crossed one.
9328 			 */
9329 			(void) check_mnt_secinfo(mi->mi_curr_serv, vp);
9330 			return;
9331 		}
9332 	}
9333 
9334 	resop = &res.array[1];	/* readdir res */
9335 	rd_res = &resop->nfs_resop4_u.opreaddirclnt;
9336 
9337 	mutex_enter(&rp->r_statelock);
9338 	rp->r_cookieverf4 = rd_res->cookieverf;
9339 	mutex_exit(&rp->r_statelock);
9340 
9341 	/*
9342 	 * For "." and ".." entries
9343 	 * e.g.
9344 	 *	seek(cookie=0) -> "." entry with d_off = 1
9345 	 *	seek(cookie=1) -> ".." entry with d_off = 2
9346 	 */
9347 	if (cookie == (nfs_cookie4) 0) {
9348 		if (rd_res->dotp)
9349 			rd_res->dotp->d_ino = nodeid;
9350 		if (rd_res->dotdotp)
9351 			rd_res->dotdotp->d_ino = pnodeid;
9352 	}
9353 	if (cookie == (nfs_cookie4) 1) {
9354 		if (rd_res->dotdotp)
9355 			rd_res->dotdotp->d_ino = pnodeid;
9356 	}
9357 
9358 
9359 	/* LOOKUPP+GETATTR attemped */
9360 	if (args.array_len == 5 && rd_res->dotdotp) {
9361 		if (res.status == NFS4_OK && res_opcnt == 5) {
9362 			nfs_fh4 *fhp;
9363 			nfs4_sharedfh_t *sfhp;
9364 			vnode_t *pvp;
9365 			nfs4_ga_res_t *garp;
9366 
9367 			resop++;	/* lookupp */
9368 			resop++;	/* getfh   */
9369 			fhp = &resop->nfs_resop4_u.opgetfh.object;
9370 
9371 			resop++;	/* getattr of parent */
9372 
9373 			/*
9374 			 * First, take care of finishing the
9375 			 * readdir results.
9376 			 */
9377 			garp = &resop->nfs_resop4_u.opgetattr.ga_res;
9378 			/*
9379 			 * The d_ino of .. must be the inode number
9380 			 * of the mounted filesystem.
9381 			 */
9382 			if (garp->n4g_va.va_mask & AT_NODEID)
9383 				rd_res->dotdotp->d_ino =
9384 				    garp->n4g_va.va_nodeid;
9385 
9386 
9387 			/*
9388 			 * Next, create the ".." dnlc entry
9389 			 */
9390 			sfhp = sfh4_get(fhp, mi);
9391 			if (!nfs4_make_dotdot(sfhp, t, vp, cr, &pvp, 0)) {
9392 				dnlc_update(vp, "..", pvp);
9393 				VN_RELE(pvp);
9394 			}
9395 			sfh4_rele(&sfhp);
9396 		}
9397 	}
9398 
9399 	if (mi->mi_io_kstats) {
9400 		mutex_enter(&mi->mi_lock);
9401 		KSTAT_IO_PTR(mi->mi_io_kstats)->reads++;
9402 		KSTAT_IO_PTR(mi->mi_io_kstats)->nread += rdc->actlen;
9403 		mutex_exit(&mi->mi_lock);
9404 	}
9405 
9406 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
9407 
9408 out:
9409 	/*
9410 	 * If readdir a node that is a stub for a crossed mount point,
9411 	 * keep the original secinfo flavor for the current file system,
9412 	 * not the crossed one.
9413 	 */
9414 	(void) check_mnt_secinfo(mi->mi_curr_serv, vp);
9415 
9416 	nfs4_end_fop(mi, vp, NULL, OH_READDIR, &recov_state, needrecov);
9417 }
9418 
9419 
9420 static int
9421 nfs4_bio(struct buf *bp, stable_how4 *stab_comm, cred_t *cr, bool_t readahead)
9422 {
9423 	rnode4_t *rp = VTOR4(bp->b_vp);
9424 	int count;
9425 	int error;
9426 	cred_t *cred_otw = NULL;
9427 	offset_t offset;
9428 	nfs4_open_stream_t *osp = NULL;
9429 	bool_t first_time = TRUE;	/* first time getting otw cred */
9430 	bool_t last_time = FALSE;	/* last time getting otw cred */
9431 
9432 	ASSERT(nfs_zone() == VTOMI4(bp->b_vp)->mi_zone);
9433 
9434 	DTRACE_IO1(start, struct buf *, bp);
9435 	offset = ldbtob(bp->b_lblkno);
9436 
9437 	if (bp->b_flags & B_READ) {
9438 	read_again:
9439 		/*
9440 		 * Releases the osp, if it is provided.
9441 		 * Puts a hold on the cred_otw and the new osp (if found).
9442 		 */
9443 		cred_otw = nfs4_get_otw_cred_by_osp(rp, cr, &osp,
9444 		    &first_time, &last_time);
9445 		error = bp->b_error = nfs4read(bp->b_vp, bp->b_un.b_addr,
9446 		    offset, bp->b_bcount, &bp->b_resid, cred_otw,
9447 		    readahead, NULL);
9448 		crfree(cred_otw);
9449 		if (!error) {
9450 			if (bp->b_resid) {
9451 				/*
9452 				 * Didn't get it all because we hit EOF,
9453 				 * zero all the memory beyond the EOF.
9454 				 */
9455 				/* bzero(rdaddr + */
9456 				bzero(bp->b_un.b_addr +
9457 				    bp->b_bcount - bp->b_resid, bp->b_resid);
9458 			}
9459 			mutex_enter(&rp->r_statelock);
9460 			if (bp->b_resid == bp->b_bcount &&
9461 			    offset >= rp->r_size) {
9462 				/*
9463 				 * We didn't read anything at all as we are
9464 				 * past EOF.  Return an error indicator back
9465 				 * but don't destroy the pages (yet).
9466 				 */
9467 				error = NFS_EOF;
9468 			}
9469 			mutex_exit(&rp->r_statelock);
9470 		} else if (error == EACCES && last_time == FALSE) {
9471 				goto read_again;
9472 		}
9473 	} else {
9474 		if (!(rp->r_flags & R4STALE)) {
9475 write_again:
9476 			/*
9477 			 * Releases the osp, if it is provided.
9478 			 * Puts a hold on the cred_otw and the new
9479 			 * osp (if found).
9480 			 */
9481 			cred_otw = nfs4_get_otw_cred_by_osp(rp, cr, &osp,
9482 			    &first_time, &last_time);
9483 			mutex_enter(&rp->r_statelock);
9484 			count = MIN(bp->b_bcount, rp->r_size - offset);
9485 			mutex_exit(&rp->r_statelock);
9486 			if (count < 0)
9487 				cmn_err(CE_PANIC, "nfs4_bio: write count < 0");
9488 #ifdef DEBUG
9489 			if (count == 0) {
9490 				zoneid_t zoneid = getzoneid();
9491 
9492 				zcmn_err(zoneid, CE_WARN,
9493 				    "nfs4_bio: zero length write at %lld",
9494 				    offset);
9495 				zcmn_err(zoneid, CE_CONT, "flags=0x%x, "
9496 				    "b_bcount=%ld, file size=%lld",
9497 				    rp->r_flags, (long)bp->b_bcount,
9498 				    rp->r_size);
9499 				sfh4_printfhandle(VTOR4(bp->b_vp)->r_fh);
9500 				if (nfs4_bio_do_stop)
9501 					debug_enter("nfs4_bio");
9502 			}
9503 #endif
9504 			error = nfs4write(bp->b_vp, bp->b_un.b_addr, offset,
9505 			    count, cred_otw, stab_comm);
9506 			if (error == EACCES && last_time == FALSE) {
9507 				crfree(cred_otw);
9508 				goto write_again;
9509 			}
9510 			bp->b_error = error;
9511 			if (error && error != EINTR &&
9512 			    !(bp->b_vp->v_vfsp->vfs_flag & VFS_UNMOUNTED)) {
9513 				/*
9514 				 * Don't print EDQUOT errors on the console.
9515 				 * Don't print asynchronous EACCES errors.
9516 				 * Don't print EFBIG errors.
9517 				 * Print all other write errors.
9518 				 */
9519 				if (error != EDQUOT && error != EFBIG &&
9520 				    (error != EACCES ||
9521 				    !(bp->b_flags & B_ASYNC)))
9522 					nfs4_write_error(bp->b_vp,
9523 					    error, cred_otw);
9524 				/*
9525 				 * Update r_error and r_flags as appropriate.
9526 				 * If the error was ESTALE, then mark the
9527 				 * rnode as not being writeable and save
9528 				 * the error status.  Otherwise, save any
9529 				 * errors which occur from asynchronous
9530 				 * page invalidations.  Any errors occurring
9531 				 * from other operations should be saved
9532 				 * by the caller.
9533 				 */
9534 				mutex_enter(&rp->r_statelock);
9535 				if (error == ESTALE) {
9536 					rp->r_flags |= R4STALE;
9537 					if (!rp->r_error)
9538 						rp->r_error = error;
9539 				} else if (!rp->r_error &&
9540 				    (bp->b_flags &
9541 				    (B_INVAL|B_FORCE|B_ASYNC)) ==
9542 				    (B_INVAL|B_FORCE|B_ASYNC)) {
9543 					rp->r_error = error;
9544 				}
9545 				mutex_exit(&rp->r_statelock);
9546 			}
9547 			crfree(cred_otw);
9548 		} else
9549 			error = rp->r_error;
9550 	}
9551 
9552 	if (error != 0 && error != NFS_EOF)
9553 		bp->b_flags |= B_ERROR;
9554 
9555 	if (osp)
9556 		open_stream_rele(osp, rp);
9557 
9558 	DTRACE_IO1(done, struct buf *, bp);
9559 
9560 	return (error);
9561 }
9562 
9563 /* ARGSUSED */
9564 int
9565 nfs4_fid(vnode_t *vp, fid_t *fidp, caller_context_t *ct)
9566 {
9567 	return (EREMOTE);
9568 }
9569 
9570 /* ARGSUSED2 */
9571 int
9572 nfs4_rwlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
9573 {
9574 	rnode4_t *rp = VTOR4(vp);
9575 
9576 	if (!write_lock) {
9577 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
9578 		return (V_WRITELOCK_FALSE);
9579 	}
9580 
9581 	if ((rp->r_flags & R4DIRECTIO) ||
9582 	    (VTOMI4(vp)->mi_flags & MI4_DIRECTIO)) {
9583 		(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_READER, FALSE);
9584 		if (rp->r_mapcnt == 0 && !nfs4_has_pages(vp))
9585 			return (V_WRITELOCK_FALSE);
9586 		nfs_rw_exit(&rp->r_rwlock);
9587 	}
9588 
9589 	(void) nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, FALSE);
9590 	return (V_WRITELOCK_TRUE);
9591 }
9592 
9593 /* ARGSUSED */
9594 void
9595 nfs4_rwunlock(vnode_t *vp, int write_lock, caller_context_t *ctp)
9596 {
9597 	rnode4_t *rp = VTOR4(vp);
9598 
9599 	nfs_rw_exit(&rp->r_rwlock);
9600 }
9601 
9602 /* ARGSUSED */
9603 static int
9604 nfs4_seek(vnode_t *vp, offset_t ooff, offset_t *noffp, caller_context_t *ct)
9605 {
9606 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
9607 		return (EIO);
9608 
9609 	/*
9610 	 * Because we stuff the readdir cookie into the offset field
9611 	 * someone may attempt to do an lseek with the cookie which
9612 	 * we want to succeed.
9613 	 */
9614 	if (vp->v_type == VDIR)
9615 		return (0);
9616 	if (*noffp < 0)
9617 		return (EINVAL);
9618 	return (0);
9619 }
9620 
9621 
9622 /*
9623  * Return all the pages from [off..off+len) in file
9624  */
9625 /* ARGSUSED */
9626 static int
9627 nfs4_getpage(vnode_t *vp, offset_t off, size_t len, uint_t *protp,
9628     page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
9629 	enum seg_rw rw, cred_t *cr, caller_context_t *ct)
9630 {
9631 	rnode4_t *rp;
9632 	int error;
9633 	mntinfo4_t *mi;
9634 
9635 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
9636 		return (EIO);
9637 	rp = VTOR4(vp);
9638 	if (IS_SHADOW(vp, rp))
9639 		vp = RTOV4(rp);
9640 
9641 	if (vp->v_flag & VNOMAP)
9642 		return (ENOSYS);
9643 
9644 	if (protp != NULL)
9645 		*protp = PROT_ALL;
9646 
9647 	/*
9648 	 * Now validate that the caches are up to date.
9649 	 */
9650 	if (error = nfs4_validate_caches(vp, cr))
9651 		return (error);
9652 
9653 	mi = VTOMI4(vp);
9654 retry:
9655 	mutex_enter(&rp->r_statelock);
9656 
9657 	/*
9658 	 * Don't create dirty pages faster than they
9659 	 * can be cleaned so that the system doesn't
9660 	 * get imbalanced.  If the async queue is
9661 	 * maxed out, then wait for it to drain before
9662 	 * creating more dirty pages.  Also, wait for
9663 	 * any threads doing pagewalks in the vop_getattr
9664 	 * entry points so that they don't block for
9665 	 * long periods.
9666 	 */
9667 	if (rw == S_CREATE) {
9668 		while ((mi->mi_max_threads != 0 &&
9669 		    rp->r_awcount > 2 * mi->mi_max_threads) ||
9670 		    rp->r_gcount > 0)
9671 			cv_wait(&rp->r_cv, &rp->r_statelock);
9672 	}
9673 
9674 	/*
9675 	 * If we are getting called as a side effect of an nfs_write()
9676 	 * operation the local file size might not be extended yet.
9677 	 * In this case we want to be able to return pages of zeroes.
9678 	 */
9679 	if (off + len > rp->r_size + PAGEOFFSET && seg != segkmap) {
9680 		NFS4_DEBUG(nfs4_pageio_debug,
9681 		    (CE_NOTE, "getpage beyond EOF: off=%lld, "
9682 		    "len=%llu, size=%llu, attrsize =%llu", off,
9683 		    (u_longlong_t)len, rp->r_size, rp->r_attr.va_size));
9684 		mutex_exit(&rp->r_statelock);
9685 		return (EFAULT);		/* beyond EOF */
9686 	}
9687 
9688 	mutex_exit(&rp->r_statelock);
9689 
9690 	if (len <= PAGESIZE) {
9691 		error = nfs4_getapage(vp, off, len, protp, pl, plsz,
9692 		    seg, addr, rw, cr);
9693 		NFS4_DEBUG(nfs4_pageio_debug && error,
9694 		    (CE_NOTE, "getpage error %d; off=%lld, "
9695 		    "len=%lld", error, off, (u_longlong_t)len));
9696 	} else {
9697 		error = pvn_getpages(nfs4_getapage, vp, off, len, protp,
9698 		    pl, plsz, seg, addr, rw, cr);
9699 		NFS4_DEBUG(nfs4_pageio_debug && error,
9700 		    (CE_NOTE, "getpages error %d; off=%lld, "
9701 		    "len=%lld", error, off, (u_longlong_t)len));
9702 	}
9703 
9704 	switch (error) {
9705 	case NFS_EOF:
9706 		nfs4_purge_caches(vp, NFS4_NOPURGE_DNLC, cr, FALSE);
9707 		goto retry;
9708 	case ESTALE:
9709 		nfs4_purge_stale_fh(error, vp, cr);
9710 	}
9711 
9712 	return (error);
9713 }
9714 
9715 /*
9716  * Called from pvn_getpages or nfs4_getpage to get a particular page.
9717  */
9718 /* ARGSUSED */
9719 static int
9720 nfs4_getapage(vnode_t *vp, u_offset_t off, size_t len, uint_t *protp,
9721     page_t *pl[], size_t plsz, struct seg *seg, caddr_t addr,
9722     enum seg_rw rw, cred_t *cr)
9723 {
9724 	rnode4_t *rp;
9725 	uint_t bsize;
9726 	struct buf *bp;
9727 	page_t *pp;
9728 	u_offset_t lbn;
9729 	u_offset_t io_off;
9730 	u_offset_t blkoff;
9731 	u_offset_t rablkoff;
9732 	size_t io_len;
9733 	uint_t blksize;
9734 	int error;
9735 	int readahead;
9736 	int readahead_issued = 0;
9737 	int ra_window; /* readahead window */
9738 	page_t *pagefound;
9739 	page_t *savepp;
9740 
9741 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
9742 		return (EIO);
9743 
9744 	rp = VTOR4(vp);
9745 	ASSERT(!IS_SHADOW(vp, rp));
9746 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
9747 
9748 reread:
9749 	bp = NULL;
9750 	pp = NULL;
9751 	pagefound = NULL;
9752 
9753 	if (pl != NULL)
9754 		pl[0] = NULL;
9755 
9756 	error = 0;
9757 	lbn = off / bsize;
9758 	blkoff = lbn * bsize;
9759 
9760 	/*
9761 	 * Queueing up the readahead before doing the synchronous read
9762 	 * results in a significant increase in read throughput because
9763 	 * of the increased parallelism between the async threads and
9764 	 * the process context.
9765 	 */
9766 	if ((off & ((vp->v_vfsp->vfs_bsize) - 1)) == 0 &&
9767 	    rw != S_CREATE &&
9768 	    !(vp->v_flag & VNOCACHE)) {
9769 		mutex_enter(&rp->r_statelock);
9770 
9771 		/*
9772 		 * Calculate the number of readaheads to do.
9773 		 * a) No readaheads at offset = 0.
9774 		 * b) Do maximum(nfs4_nra) readaheads when the readahead
9775 		 *    window is closed.
9776 		 * c) Do readaheads between 1 to (nfs4_nra - 1) depending
9777 		 *    upon how far the readahead window is open or close.
9778 		 * d) No readaheads if rp->r_nextr is not within the scope
9779 		 *    of the readahead window (random i/o).
9780 		 */
9781 
9782 		if (off == 0)
9783 			readahead = 0;
9784 		else if (blkoff == rp->r_nextr)
9785 			readahead = nfs4_nra;
9786 		else if (rp->r_nextr > blkoff &&
9787 		    ((ra_window = (rp->r_nextr - blkoff) / bsize)
9788 		    <= (nfs4_nra - 1)))
9789 			readahead = nfs4_nra - ra_window;
9790 		else
9791 			readahead = 0;
9792 
9793 		rablkoff = rp->r_nextr;
9794 		while (readahead > 0 && rablkoff + bsize < rp->r_size) {
9795 			mutex_exit(&rp->r_statelock);
9796 			if (nfs4_async_readahead(vp, rablkoff + bsize,
9797 			    addr + (rablkoff + bsize - off),
9798 			    seg, cr, nfs4_readahead) < 0) {
9799 				mutex_enter(&rp->r_statelock);
9800 				break;
9801 			}
9802 			readahead--;
9803 			rablkoff += bsize;
9804 			/*
9805 			 * Indicate that we did a readahead so
9806 			 * readahead offset is not updated
9807 			 * by the synchronous read below.
9808 			 */
9809 			readahead_issued = 1;
9810 			mutex_enter(&rp->r_statelock);
9811 			/*
9812 			 * set readahead offset to
9813 			 * offset of last async readahead
9814 			 * request.
9815 			 */
9816 			rp->r_nextr = rablkoff;
9817 		}
9818 		mutex_exit(&rp->r_statelock);
9819 	}
9820 
9821 again:
9822 	if ((pagefound = page_exists(vp, off)) == NULL) {
9823 		if (pl == NULL) {
9824 			(void) nfs4_async_readahead(vp, blkoff, addr, seg, cr,
9825 			    nfs4_readahead);
9826 		} else if (rw == S_CREATE) {
9827 			/*
9828 			 * Block for this page is not allocated, or the offset
9829 			 * is beyond the current allocation size, or we're
9830 			 * allocating a swap slot and the page was not found,
9831 			 * so allocate it and return a zero page.
9832 			 */
9833 			if ((pp = page_create_va(vp, off,
9834 			    PAGESIZE, PG_WAIT, seg, addr)) == NULL)
9835 				cmn_err(CE_PANIC, "nfs4_getapage: page_create");
9836 			io_len = PAGESIZE;
9837 			mutex_enter(&rp->r_statelock);
9838 			rp->r_nextr = off + PAGESIZE;
9839 			mutex_exit(&rp->r_statelock);
9840 		} else {
9841 			/*
9842 			 * Need to go to server to get a block
9843 			 */
9844 			mutex_enter(&rp->r_statelock);
9845 			if (blkoff < rp->r_size &&
9846 			    blkoff + bsize > rp->r_size) {
9847 				/*
9848 				 * If less than a block left in
9849 				 * file read less than a block.
9850 				 */
9851 				if (rp->r_size <= off) {
9852 					/*
9853 					 * Trying to access beyond EOF,
9854 					 * set up to get at least one page.
9855 					 */
9856 					blksize = off + PAGESIZE - blkoff;
9857 				} else
9858 					blksize = rp->r_size - blkoff;
9859 			} else if ((off == 0) ||
9860 			    (off != rp->r_nextr && !readahead_issued)) {
9861 				blksize = PAGESIZE;
9862 				blkoff = off; /* block = page here */
9863 			} else
9864 				blksize = bsize;
9865 			mutex_exit(&rp->r_statelock);
9866 
9867 			pp = pvn_read_kluster(vp, off, seg, addr, &io_off,
9868 			    &io_len, blkoff, blksize, 0);
9869 
9870 			/*
9871 			 * Some other thread has entered the page,
9872 			 * so just use it.
9873 			 */
9874 			if (pp == NULL)
9875 				goto again;
9876 
9877 			/*
9878 			 * Now round the request size up to page boundaries.
9879 			 * This ensures that the entire page will be
9880 			 * initialized to zeroes if EOF is encountered.
9881 			 */
9882 			io_len = ptob(btopr(io_len));
9883 
9884 			bp = pageio_setup(pp, io_len, vp, B_READ);
9885 			ASSERT(bp != NULL);
9886 
9887 			/*
9888 			 * pageio_setup should have set b_addr to 0.  This
9889 			 * is correct since we want to do I/O on a page
9890 			 * boundary.  bp_mapin will use this addr to calculate
9891 			 * an offset, and then set b_addr to the kernel virtual
9892 			 * address it allocated for us.
9893 			 */
9894 			ASSERT(bp->b_un.b_addr == 0);
9895 
9896 			bp->b_edev = 0;
9897 			bp->b_dev = 0;
9898 			bp->b_lblkno = lbtodb(io_off);
9899 			bp->b_file = vp;
9900 			bp->b_offset = (offset_t)off;
9901 			bp_mapin(bp);
9902 
9903 			/*
9904 			 * If doing a write beyond what we believe is EOF,
9905 			 * don't bother trying to read the pages from the
9906 			 * server, we'll just zero the pages here.  We
9907 			 * don't check that the rw flag is S_WRITE here
9908 			 * because some implementations may attempt a
9909 			 * read access to the buffer before copying data.
9910 			 */
9911 			mutex_enter(&rp->r_statelock);
9912 			if (io_off >= rp->r_size && seg == segkmap) {
9913 				mutex_exit(&rp->r_statelock);
9914 				bzero(bp->b_un.b_addr, io_len);
9915 			} else {
9916 				mutex_exit(&rp->r_statelock);
9917 				error = nfs4_bio(bp, NULL, cr, FALSE);
9918 			}
9919 
9920 			/*
9921 			 * Unmap the buffer before freeing it.
9922 			 */
9923 			bp_mapout(bp);
9924 			pageio_done(bp);
9925 
9926 			savepp = pp;
9927 			do {
9928 				pp->p_fsdata = C_NOCOMMIT;
9929 			} while ((pp = pp->p_next) != savepp);
9930 
9931 			if (error == NFS_EOF) {
9932 				/*
9933 				 * If doing a write system call just return
9934 				 * zeroed pages, else user tried to get pages
9935 				 * beyond EOF, return error.  We don't check
9936 				 * that the rw flag is S_WRITE here because
9937 				 * some implementations may attempt a read
9938 				 * access to the buffer before copying data.
9939 				 */
9940 				if (seg == segkmap)
9941 					error = 0;
9942 				else
9943 					error = EFAULT;
9944 			}
9945 
9946 			if (!readahead_issued && !error) {
9947 				mutex_enter(&rp->r_statelock);
9948 				rp->r_nextr = io_off + io_len;
9949 				mutex_exit(&rp->r_statelock);
9950 			}
9951 		}
9952 	}
9953 
9954 out:
9955 	if (pl == NULL)
9956 		return (error);
9957 
9958 	if (error) {
9959 		if (pp != NULL)
9960 			pvn_read_done(pp, B_ERROR);
9961 		return (error);
9962 	}
9963 
9964 	if (pagefound) {
9965 		se_t se = (rw == S_CREATE ? SE_EXCL : SE_SHARED);
9966 
9967 		/*
9968 		 * Page exists in the cache, acquire the appropriate lock.
9969 		 * If this fails, start all over again.
9970 		 */
9971 		if ((pp = page_lookup(vp, off, se)) == NULL) {
9972 #ifdef DEBUG
9973 			nfs4_lostpage++;
9974 #endif
9975 			goto reread;
9976 		}
9977 		pl[0] = pp;
9978 		pl[1] = NULL;
9979 		return (0);
9980 	}
9981 
9982 	if (pp != NULL)
9983 		pvn_plist_init(pp, pl, plsz, off, io_len, rw);
9984 
9985 	return (error);
9986 }
9987 
9988 static void
9989 nfs4_readahead(vnode_t *vp, u_offset_t blkoff, caddr_t addr, struct seg *seg,
9990     cred_t *cr)
9991 {
9992 	int error;
9993 	page_t *pp;
9994 	u_offset_t io_off;
9995 	size_t io_len;
9996 	struct buf *bp;
9997 	uint_t bsize, blksize;
9998 	rnode4_t *rp = VTOR4(vp);
9999 	page_t *savepp;
10000 
10001 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
10002 
10003 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
10004 
10005 	mutex_enter(&rp->r_statelock);
10006 	if (blkoff < rp->r_size && blkoff + bsize > rp->r_size) {
10007 		/*
10008 		 * If less than a block left in file read less
10009 		 * than a block.
10010 		 */
10011 		blksize = rp->r_size - blkoff;
10012 	} else
10013 		blksize = bsize;
10014 	mutex_exit(&rp->r_statelock);
10015 
10016 	pp = pvn_read_kluster(vp, blkoff, segkmap, addr,
10017 	    &io_off, &io_len, blkoff, blksize, 1);
10018 	/*
10019 	 * The isra flag passed to the kluster function is 1, we may have
10020 	 * gotten a return value of NULL for a variety of reasons (# of free
10021 	 * pages < minfree, someone entered the page on the vnode etc). In all
10022 	 * cases, we want to punt on the readahead.
10023 	 */
10024 	if (pp == NULL)
10025 		return;
10026 
10027 	/*
10028 	 * Now round the request size up to page boundaries.
10029 	 * This ensures that the entire page will be
10030 	 * initialized to zeroes if EOF is encountered.
10031 	 */
10032 	io_len = ptob(btopr(io_len));
10033 
10034 	bp = pageio_setup(pp, io_len, vp, B_READ);
10035 	ASSERT(bp != NULL);
10036 
10037 	/*
10038 	 * pageio_setup should have set b_addr to 0.  This is correct since
10039 	 * we want to do I/O on a page boundary. bp_mapin() will use this addr
10040 	 * to calculate an offset, and then set b_addr to the kernel virtual
10041 	 * address it allocated for us.
10042 	 */
10043 	ASSERT(bp->b_un.b_addr == 0);
10044 
10045 	bp->b_edev = 0;
10046 	bp->b_dev = 0;
10047 	bp->b_lblkno = lbtodb(io_off);
10048 	bp->b_file = vp;
10049 	bp->b_offset = (offset_t)blkoff;
10050 	bp_mapin(bp);
10051 
10052 	/*
10053 	 * If doing a write beyond what we believe is EOF, don't bother trying
10054 	 * to read the pages from the server, we'll just zero the pages here.
10055 	 * We don't check that the rw flag is S_WRITE here because some
10056 	 * implementations may attempt a read access to the buffer before
10057 	 * copying data.
10058 	 */
10059 	mutex_enter(&rp->r_statelock);
10060 	if (io_off >= rp->r_size && seg == segkmap) {
10061 		mutex_exit(&rp->r_statelock);
10062 		bzero(bp->b_un.b_addr, io_len);
10063 		error = 0;
10064 	} else {
10065 		mutex_exit(&rp->r_statelock);
10066 		error = nfs4_bio(bp, NULL, cr, TRUE);
10067 		if (error == NFS_EOF)
10068 			error = 0;
10069 	}
10070 
10071 	/*
10072 	 * Unmap the buffer before freeing it.
10073 	 */
10074 	bp_mapout(bp);
10075 	pageio_done(bp);
10076 
10077 	savepp = pp;
10078 	do {
10079 		pp->p_fsdata = C_NOCOMMIT;
10080 	} while ((pp = pp->p_next) != savepp);
10081 
10082 	pvn_read_done(pp, error ? B_READ | B_ERROR : B_READ);
10083 
10084 	/*
10085 	 * In case of error set readahead offset
10086 	 * to the lowest offset.
10087 	 * pvn_read_done() calls VN_DISPOSE to destroy the pages
10088 	 */
10089 	if (error && rp->r_nextr > io_off) {
10090 		mutex_enter(&rp->r_statelock);
10091 		if (rp->r_nextr > io_off)
10092 			rp->r_nextr = io_off;
10093 		mutex_exit(&rp->r_statelock);
10094 	}
10095 }
10096 
10097 /*
10098  * Flags are composed of {B_INVAL, B_FREE, B_DONTNEED, B_FORCE}
10099  * If len == 0, do from off to EOF.
10100  *
10101  * The normal cases should be len == 0 && off == 0 (entire vp list) or
10102  * len == MAXBSIZE (from segmap_release actions), and len == PAGESIZE
10103  * (from pageout).
10104  */
10105 /* ARGSUSED */
10106 static int
10107 nfs4_putpage(vnode_t *vp, offset_t off, size_t len, int flags, cred_t *cr,
10108 	caller_context_t *ct)
10109 {
10110 	int error;
10111 	rnode4_t *rp;
10112 
10113 	ASSERT(cr != NULL);
10114 
10115 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI4(vp)->mi_zone)
10116 		return (EIO);
10117 
10118 	rp = VTOR4(vp);
10119 	if (IS_SHADOW(vp, rp))
10120 		vp = RTOV4(rp);
10121 
10122 	/*
10123 	 * XXX - Why should this check be made here?
10124 	 */
10125 	if (vp->v_flag & VNOMAP)
10126 		return (ENOSYS);
10127 
10128 	if (len == 0 && !(flags & B_INVAL) &&
10129 	    (vp->v_vfsp->vfs_flag & VFS_RDONLY))
10130 		return (0);
10131 
10132 	mutex_enter(&rp->r_statelock);
10133 	rp->r_count++;
10134 	mutex_exit(&rp->r_statelock);
10135 	error = nfs4_putpages(vp, off, len, flags, cr);
10136 	mutex_enter(&rp->r_statelock);
10137 	rp->r_count--;
10138 	cv_broadcast(&rp->r_cv);
10139 	mutex_exit(&rp->r_statelock);
10140 
10141 	return (error);
10142 }
10143 
10144 /*
10145  * Write out a single page, possibly klustering adjacent dirty pages.
10146  */
10147 int
10148 nfs4_putapage(vnode_t *vp, page_t *pp, u_offset_t *offp, size_t *lenp,
10149     int flags, cred_t *cr)
10150 {
10151 	u_offset_t io_off;
10152 	u_offset_t lbn_off;
10153 	u_offset_t lbn;
10154 	size_t io_len;
10155 	uint_t bsize;
10156 	int error;
10157 	rnode4_t *rp;
10158 
10159 	ASSERT(!(vp->v_vfsp->vfs_flag & VFS_RDONLY));
10160 	ASSERT(pp != NULL);
10161 	ASSERT(cr != NULL);
10162 	ASSERT((flags & B_ASYNC) || nfs_zone() == VTOMI4(vp)->mi_zone);
10163 
10164 	rp = VTOR4(vp);
10165 	ASSERT(rp->r_count > 0);
10166 	ASSERT(!IS_SHADOW(vp, rp));
10167 
10168 	bsize = MAX(vp->v_vfsp->vfs_bsize, PAGESIZE);
10169 	lbn = pp->p_offset / bsize;
10170 	lbn_off = lbn * bsize;
10171 
10172 	/*
10173 	 * Find a kluster that fits in one block, or in
10174 	 * one page if pages are bigger than blocks.  If
10175 	 * there is less file space allocated than a whole
10176 	 * page, we'll shorten the i/o request below.
10177 	 */
10178 	pp = pvn_write_kluster(vp, pp, &io_off, &io_len, lbn_off,
10179 	    roundup(bsize, PAGESIZE), flags);
10180 
10181 	/*
10182 	 * pvn_write_kluster shouldn't have returned a page with offset
10183 	 * behind the original page we were given.  Verify that.
10184 	 */
10185 	ASSERT((pp->p_offset / bsize) >= lbn);
10186 
10187 	/*
10188 	 * Now pp will have the list of kept dirty pages marked for
10189 	 * write back.  It will also handle invalidation and freeing
10190 	 * of pages that are not dirty.  Check for page length rounding
10191 	 * problems.
10192 	 */
10193 	if (io_off + io_len > lbn_off + bsize) {
10194 		ASSERT((io_off + io_len) - (lbn_off + bsize) < PAGESIZE);
10195 		io_len = lbn_off + bsize - io_off;
10196 	}
10197 	/*
10198 	 * The R4MODINPROGRESS flag makes sure that nfs4_bio() sees a
10199 	 * consistent value of r_size. R4MODINPROGRESS is set in writerp4().
10200 	 * When R4MODINPROGRESS is set it indicates that a uiomove() is in
10201 	 * progress and the r_size has not been made consistent with the
10202 	 * new size of the file. When the uiomove() completes the r_size is
10203 	 * updated and the R4MODINPROGRESS flag is cleared.
10204 	 *
10205 	 * The R4MODINPROGRESS flag makes sure that nfs4_bio() sees a
10206 	 * consistent value of r_size. Without this handshaking, it is
10207 	 * possible that nfs4_bio() picks  up the old value of r_size
10208 	 * before the uiomove() in writerp4() completes. This will result
10209 	 * in the write through nfs4_bio() being dropped.
10210 	 *
10211 	 * More precisely, there is a window between the time the uiomove()
10212 	 * completes and the time the r_size is updated. If a VOP_PUTPAGE()
10213 	 * operation intervenes in this window, the page will be picked up,
10214 	 * because it is dirty (it will be unlocked, unless it was
10215 	 * pagecreate'd). When the page is picked up as dirty, the dirty
10216 	 * bit is reset (pvn_getdirty()). In nfs4write(), r_size is
10217 	 * checked. This will still be the old size. Therefore the page will
10218 	 * not be written out. When segmap_release() calls VOP_PUTPAGE(),
10219 	 * the page will be found to be clean and the write will be dropped.
10220 	 */
10221 	if (rp->r_flags & R4MODINPROGRESS) {
10222 		mutex_enter(&rp->r_statelock);
10223 		if ((rp->r_flags & R4MODINPROGRESS) &&
10224 		    rp->r_modaddr + MAXBSIZE > io_off &&
10225 		    rp->r_modaddr < io_off + io_len) {
10226 			page_t *plist;
10227 			/*
10228 			 * A write is in progress for this region of the file.
10229 			 * If we did not detect R4MODINPROGRESS here then this
10230 			 * path through nfs_putapage() would eventually go to
10231 			 * nfs4_bio() and may not write out all of the data
10232 			 * in the pages. We end up losing data. So we decide
10233 			 * to set the modified bit on each page in the page
10234 			 * list and mark the rnode with R4DIRTY. This write
10235 			 * will be restarted at some later time.
10236 			 */
10237 			plist = pp;
10238 			while (plist != NULL) {
10239 				pp = plist;
10240 				page_sub(&plist, pp);
10241 				hat_setmod(pp);
10242 				page_io_unlock(pp);
10243 				page_unlock(pp);
10244 			}
10245 			rp->r_flags |= R4DIRTY;
10246 			mutex_exit(&rp->r_statelock);
10247 			if (offp)
10248 				*offp = io_off;
10249 			if (lenp)
10250 				*lenp = io_len;
10251 			return (0);
10252 		}
10253 		mutex_exit(&rp->r_statelock);
10254 	}
10255 
10256 	if (flags & B_ASYNC) {
10257 		error = nfs4_async_putapage(vp, pp, io_off, io_len, flags, cr,
10258 		    nfs4_sync_putapage);
10259 	} else
10260 		error = nfs4_sync_putapage(vp, pp, io_off, io_len, flags, cr);
10261 
10262 	if (offp)
10263 		*offp = io_off;
10264 	if (lenp)
10265 		*lenp = io_len;
10266 	return (error);
10267 }
10268 
10269 static int
10270 nfs4_sync_putapage(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
10271     int flags, cred_t *cr)
10272 {
10273 	int error;
10274 	rnode4_t *rp;
10275 
10276 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
10277 
10278 	flags |= B_WRITE;
10279 
10280 	error = nfs4_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
10281 
10282 	rp = VTOR4(vp);
10283 
10284 	if ((error == ENOSPC || error == EDQUOT || error == EFBIG ||
10285 	    error == EACCES) &&
10286 	    (flags & (B_INVAL|B_FORCE)) != (B_INVAL|B_FORCE)) {
10287 		if (!(rp->r_flags & R4OUTOFSPACE)) {
10288 			mutex_enter(&rp->r_statelock);
10289 			rp->r_flags |= R4OUTOFSPACE;
10290 			mutex_exit(&rp->r_statelock);
10291 		}
10292 		flags |= B_ERROR;
10293 		pvn_write_done(pp, flags);
10294 		/*
10295 		 * If this was not an async thread, then try again to
10296 		 * write out the pages, but this time, also destroy
10297 		 * them whether or not the write is successful.  This
10298 		 * will prevent memory from filling up with these
10299 		 * pages and destroying them is the only alternative
10300 		 * if they can't be written out.
10301 		 *
10302 		 * Don't do this if this is an async thread because
10303 		 * when the pages are unlocked in pvn_write_done,
10304 		 * some other thread could have come along, locked
10305 		 * them, and queued for an async thread.  It would be
10306 		 * possible for all of the async threads to be tied
10307 		 * up waiting to lock the pages again and they would
10308 		 * all already be locked and waiting for an async
10309 		 * thread to handle them.  Deadlock.
10310 		 */
10311 		if (!(flags & B_ASYNC)) {
10312 			error = nfs4_putpage(vp, io_off, io_len,
10313 			    B_INVAL | B_FORCE, cr, NULL);
10314 		}
10315 	} else {
10316 		if (error)
10317 			flags |= B_ERROR;
10318 		else if (rp->r_flags & R4OUTOFSPACE) {
10319 			mutex_enter(&rp->r_statelock);
10320 			rp->r_flags &= ~R4OUTOFSPACE;
10321 			mutex_exit(&rp->r_statelock);
10322 		}
10323 		pvn_write_done(pp, flags);
10324 		if (freemem < desfree)
10325 			(void) nfs4_commit_vp(vp, (u_offset_t)0, 0, cr,
10326 			    NFS4_WRITE_NOWAIT);
10327 	}
10328 
10329 	return (error);
10330 }
10331 
10332 #ifdef DEBUG
10333 int nfs4_force_open_before_mmap = 0;
10334 #endif
10335 
10336 /* ARGSUSED */
10337 static int
10338 nfs4_map(vnode_t *vp, offset_t off, struct as *as, caddr_t *addrp,
10339     size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr,
10340     caller_context_t *ct)
10341 {
10342 	struct segvn_crargs vn_a;
10343 	int error = 0;
10344 	rnode4_t *rp = VTOR4(vp);
10345 	mntinfo4_t *mi = VTOMI4(vp);
10346 
10347 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
10348 		return (EIO);
10349 
10350 	if (vp->v_flag & VNOMAP)
10351 		return (ENOSYS);
10352 
10353 	if (off < 0 || (off + len) < 0)
10354 		return (ENXIO);
10355 
10356 	if (vp->v_type != VREG)
10357 		return (ENODEV);
10358 
10359 	/*
10360 	 * If the file is delegated to the client don't do anything.
10361 	 * If the file is not delegated, then validate the data cache.
10362 	 */
10363 	mutex_enter(&rp->r_statev4_lock);
10364 	if (rp->r_deleg_type == OPEN_DELEGATE_NONE) {
10365 		mutex_exit(&rp->r_statev4_lock);
10366 		error = nfs4_validate_caches(vp, cr);
10367 		if (error)
10368 			return (error);
10369 	} else {
10370 		mutex_exit(&rp->r_statev4_lock);
10371 	}
10372 
10373 	/*
10374 	 * Check to see if the vnode is currently marked as not cachable.
10375 	 * This means portions of the file are locked (through VOP_FRLOCK).
10376 	 * In this case the map request must be refused.  We use
10377 	 * rp->r_lkserlock to avoid a race with concurrent lock requests.
10378 	 */
10379 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_READER, INTR4(vp)))
10380 		return (EINTR);
10381 
10382 	if (vp->v_flag & VNOCACHE) {
10383 		error = EAGAIN;
10384 		goto done;
10385 	}
10386 
10387 	/*
10388 	 * Don't allow concurrent locks and mapping if mandatory locking is
10389 	 * enabled.
10390 	 */
10391 	if (flk_has_remote_locks(vp)) {
10392 		struct vattr va;
10393 		va.va_mask = AT_MODE;
10394 		error = nfs4getattr(vp, &va, cr);
10395 		if (error != 0)
10396 			goto done;
10397 		if (MANDLOCK(vp, va.va_mode)) {
10398 			error = EAGAIN;
10399 			goto done;
10400 		}
10401 	}
10402 
10403 	/*
10404 	 * It is possible that the rnode has a lost lock request that we
10405 	 * are still trying to recover, and that the request conflicts with
10406 	 * this map request.
10407 	 *
10408 	 * An alternative approach would be for nfs4_safemap() to consider
10409 	 * queued lock requests when deciding whether to set or clear
10410 	 * VNOCACHE.  This would require the frlock code path to call
10411 	 * nfs4_safemap() after enqueing a lost request.
10412 	 */
10413 	if (nfs4_map_lost_lock_conflict(vp)) {
10414 		error = EAGAIN;
10415 		goto done;
10416 	}
10417 
10418 	as_rangelock(as);
10419 	if (!(flags & MAP_FIXED)) {
10420 		map_addr(addrp, len, off, 1, flags);
10421 		if (*addrp == NULL) {
10422 			as_rangeunlock(as);
10423 			error = ENOMEM;
10424 			goto done;
10425 		}
10426 	} else {
10427 		/*
10428 		 * User specified address - blow away any previous mappings
10429 		 */
10430 		(void) as_unmap(as, *addrp, len);
10431 	}
10432 
10433 	if (vp->v_type == VREG) {
10434 		/*
10435 		 * We need to retrieve the open stream
10436 		 */
10437 		nfs4_open_stream_t	*osp = NULL;
10438 		nfs4_open_owner_t	*oop = NULL;
10439 
10440 		oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
10441 		if (oop != NULL) {
10442 			/* returns with 'os_sync_lock' held */
10443 			osp = find_open_stream(oop, rp);
10444 			open_owner_rele(oop);
10445 		}
10446 		if (osp == NULL) {
10447 #ifdef DEBUG
10448 			if (nfs4_force_open_before_mmap) {
10449 				error = EIO;
10450 				goto done;
10451 			}
10452 #endif
10453 			/* returns with 'os_sync_lock' held */
10454 			error = open_and_get_osp(vp, cr, &osp);
10455 			if (osp == NULL) {
10456 				NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE,
10457 				    "nfs4_map: we tried to OPEN the file "
10458 				    "but again no osp, so fail with EIO"));
10459 				goto done;
10460 			}
10461 		}
10462 
10463 		if (osp->os_failed_reopen) {
10464 			mutex_exit(&osp->os_sync_lock);
10465 			open_stream_rele(osp, rp);
10466 			NFS4_DEBUG(nfs4_open_stream_debug, (CE_NOTE,
10467 			    "nfs4_map: os_failed_reopen set on "
10468 			    "osp %p, cr %p, rp %s", (void *)osp,
10469 			    (void *)cr, rnode4info(rp)));
10470 			error = EIO;
10471 			goto done;
10472 		}
10473 		mutex_exit(&osp->os_sync_lock);
10474 		open_stream_rele(osp, rp);
10475 	}
10476 
10477 	vn_a.vp = vp;
10478 	vn_a.offset = off;
10479 	vn_a.type = (flags & MAP_TYPE);
10480 	vn_a.prot = (uchar_t)prot;
10481 	vn_a.maxprot = (uchar_t)maxprot;
10482 	vn_a.flags = (flags & ~MAP_TYPE);
10483 	vn_a.cred = cr;
10484 	vn_a.amp = NULL;
10485 	vn_a.szc = 0;
10486 	vn_a.lgrp_mem_policy_flags = 0;
10487 
10488 	error = as_map(as, *addrp, len, segvn_create, &vn_a);
10489 	as_rangeunlock(as);
10490 
10491 done:
10492 	nfs_rw_exit(&rp->r_lkserlock);
10493 	return (error);
10494 }
10495 
10496 /*
10497  * We're most likely dealing with a kernel module that likes to READ
10498  * and mmap without OPENing the file (ie: lookup/read/mmap), so lets
10499  * officially OPEN the file to create the necessary client state
10500  * for bookkeeping of os_mmap_read/write counts.
10501  *
10502  * Since VOP_MAP only passes in a pointer to the vnode rather than
10503  * a double pointer, we can't handle the case where nfs4open_otw()
10504  * returns a different vnode than the one passed into VOP_MAP (since
10505  * VOP_DELMAP will not see the vnode nfs4open_otw used).  In this case,
10506  * we return NULL and let nfs4_map() fail.  Note: the only case where
10507  * this should happen is if the file got removed and replaced with the
10508  * same name on the server (in addition to the fact that we're trying
10509  * to VOP_MAP withouth VOP_OPENing the file in the first place).
10510  */
10511 static int
10512 open_and_get_osp(vnode_t *map_vp, cred_t *cr, nfs4_open_stream_t **ospp)
10513 {
10514 	rnode4_t		*rp, *drp;
10515 	vnode_t			*dvp, *open_vp;
10516 	char			file_name[MAXNAMELEN];
10517 	int			just_created;
10518 	nfs4_open_stream_t	*osp;
10519 	nfs4_open_owner_t	*oop;
10520 	int			error;
10521 
10522 	*ospp = NULL;
10523 	open_vp = map_vp;
10524 
10525 	rp = VTOR4(open_vp);
10526 	if ((error = vtodv(open_vp, &dvp, cr, TRUE)) != 0)
10527 		return (error);
10528 	drp = VTOR4(dvp);
10529 
10530 	if (nfs_rw_enter_sig(&drp->r_rwlock, RW_READER, INTR4(dvp))) {
10531 		VN_RELE(dvp);
10532 		return (EINTR);
10533 	}
10534 
10535 	if ((error = vtoname(open_vp, file_name, MAXNAMELEN)) != 0) {
10536 		nfs_rw_exit(&drp->r_rwlock);
10537 		VN_RELE(dvp);
10538 		return (error);
10539 	}
10540 
10541 	mutex_enter(&rp->r_statev4_lock);
10542 	if (rp->created_v4) {
10543 		rp->created_v4 = 0;
10544 		mutex_exit(&rp->r_statev4_lock);
10545 
10546 		dnlc_update(dvp, file_name, open_vp);
10547 		/* This is needed so we don't bump the open ref count */
10548 		just_created = 1;
10549 	} else {
10550 		mutex_exit(&rp->r_statev4_lock);
10551 		just_created = 0;
10552 	}
10553 
10554 	VN_HOLD(map_vp);
10555 
10556 	error = nfs4open_otw(dvp, file_name, NULL, &open_vp, cr, 0, FREAD, 0,
10557 	    just_created);
10558 	if (error) {
10559 		nfs_rw_exit(&drp->r_rwlock);
10560 		VN_RELE(dvp);
10561 		VN_RELE(map_vp);
10562 		return (error);
10563 	}
10564 
10565 	nfs_rw_exit(&drp->r_rwlock);
10566 	VN_RELE(dvp);
10567 
10568 	/*
10569 	 * If nfs4open_otw() returned a different vnode then "undo"
10570 	 * the open and return failure to the caller.
10571 	 */
10572 	if (!VN_CMP(open_vp, map_vp)) {
10573 		nfs4_error_t e;
10574 
10575 		NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE, "open_and_get_osp: "
10576 		    "open returned a different vnode"));
10577 		/*
10578 		 * If there's an error, ignore it,
10579 		 * and let VOP_INACTIVE handle it.
10580 		 */
10581 		(void) nfs4close_one(open_vp, NULL, cr, FREAD, NULL, &e,
10582 		    CLOSE_NORM, 0, 0, 0);
10583 		VN_RELE(map_vp);
10584 		return (EIO);
10585 	}
10586 
10587 	VN_RELE(map_vp);
10588 
10589 	oop = find_open_owner(cr, NFS4_PERM_CREATED, VTOMI4(open_vp));
10590 	if (!oop) {
10591 		nfs4_error_t e;
10592 
10593 		NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE, "open_and_get_osp: "
10594 		    "no open owner"));
10595 		/*
10596 		 * If there's an error, ignore it,
10597 		 * and let VOP_INACTIVE handle it.
10598 		 */
10599 		(void) nfs4close_one(open_vp, NULL, cr, FREAD, NULL, &e,
10600 		    CLOSE_NORM, 0, 0, 0);
10601 		return (EIO);
10602 	}
10603 	osp = find_open_stream(oop, rp);
10604 	open_owner_rele(oop);
10605 	*ospp = osp;
10606 	return (0);
10607 }
10608 
10609 /*
10610  * Please be aware that when this function is called, the address space write
10611  * a_lock is held.  Do not put over the wire calls in this function.
10612  */
10613 /* ARGSUSED */
10614 static int
10615 nfs4_addmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
10616     size_t len, uchar_t prot, uchar_t maxprot, uint_t flags, cred_t *cr,
10617     caller_context_t *ct)
10618 {
10619 	rnode4_t		*rp;
10620 	int			error = 0;
10621 	mntinfo4_t		*mi;
10622 
10623 	mi = VTOMI4(vp);
10624 	rp = VTOR4(vp);
10625 
10626 	if (nfs_zone() != mi->mi_zone)
10627 		return (EIO);
10628 	if (vp->v_flag & VNOMAP)
10629 		return (ENOSYS);
10630 
10631 	/*
10632 	 * Need to hold rwlock while incrementing the mapcnt so that
10633 	 * mmap'ing can be serialized with writes so that the caching
10634 	 * can be handled correctly.
10635 	 *
10636 	 * Don't need to update the open stream first, since this
10637 	 * mmap can't add any additional share access that isn't
10638 	 * already contained in the open stream (for the case where we
10639 	 * open/mmap/only update rp->r_mapcnt/server reboots/reopen doesn't
10640 	 * take into account os_mmap_read[write] counts).
10641 	 */
10642 	if (nfs_rw_enter_sig(&rp->r_rwlock, RW_WRITER, INTR(vp)))
10643 		return (EINTR);
10644 	atomic_add_long((ulong_t *)&rp->r_mapcnt, btopr(len));
10645 	nfs_rw_exit(&rp->r_rwlock);
10646 
10647 	if (vp->v_type == VREG) {
10648 		/*
10649 		 * We need to retrieve the open stream and update the counts.
10650 		 * If there is no open stream here, something is wrong.
10651 		 */
10652 		nfs4_open_stream_t	*osp = NULL;
10653 		nfs4_open_owner_t	*oop = NULL;
10654 
10655 		oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
10656 		if (oop != NULL) {
10657 			/* returns with 'os_sync_lock' held */
10658 			osp = find_open_stream(oop, rp);
10659 			open_owner_rele(oop);
10660 		}
10661 		if (osp == NULL) {
10662 			NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE,
10663 			    "nfs4_addmap: we should have an osp"
10664 			    "but we don't, so fail with EIO"));
10665 			error = EIO;
10666 			goto out;
10667 		}
10668 
10669 		NFS4_DEBUG(nfs4_mmap_debug, (CE_NOTE, "nfs4_addmap: osp %p,"
10670 		    " pages %ld, prot 0x%x", (void *)osp, btopr(len), prot));
10671 
10672 		/*
10673 		 * Update the map count in the open stream.
10674 		 * This is necessary in the case where we
10675 		 * open/mmap/close/, then the server reboots, and we
10676 		 * attempt to reopen.  If the mmap doesn't add share
10677 		 * access then we send an invalid reopen with
10678 		 * access = NONE.
10679 		 *
10680 		 * We need to specifically check each PROT_* so a mmap
10681 		 * call of (PROT_WRITE | PROT_EXEC) will ensure us both
10682 		 * read and write access.  A simple comparison of prot
10683 		 * to ~PROT_WRITE to determine read access is insufficient
10684 		 * since prot can be |= with PROT_USER, etc.
10685 		 */
10686 
10687 		/*
10688 		 * Unless we're MAP_SHARED, no sense in adding os_mmap_write
10689 		 */
10690 		if ((flags & MAP_SHARED) && (maxprot & PROT_WRITE))
10691 			osp->os_mmap_write += btopr(len);
10692 		if (maxprot & PROT_READ)
10693 			osp->os_mmap_read += btopr(len);
10694 		if (maxprot & PROT_EXEC)
10695 			osp->os_mmap_read += btopr(len);
10696 		/*
10697 		 * Ensure that os_mmap_read gets incremented, even if
10698 		 * maxprot were to look like PROT_NONE.
10699 		 */
10700 		if (!(maxprot & PROT_READ) && !(maxprot & PROT_WRITE) &&
10701 		    !(maxprot & PROT_EXEC))
10702 			osp->os_mmap_read += btopr(len);
10703 		osp->os_mapcnt += btopr(len);
10704 		mutex_exit(&osp->os_sync_lock);
10705 		open_stream_rele(osp, rp);
10706 	}
10707 
10708 out:
10709 	/*
10710 	 * If we got an error, then undo our
10711 	 * incrementing of 'r_mapcnt'.
10712 	 */
10713 
10714 	if (error) {
10715 		atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(len));
10716 		ASSERT(rp->r_mapcnt >= 0);
10717 	}
10718 	return (error);
10719 }
10720 
10721 /* ARGSUSED */
10722 static int
10723 nfs4_cmp(vnode_t *vp1, vnode_t *vp2, caller_context_t *ct)
10724 {
10725 
10726 	return (VTOR4(vp1) == VTOR4(vp2));
10727 }
10728 
10729 /* ARGSUSED */
10730 static int
10731 nfs4_frlock(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
10732     offset_t offset, struct flk_callback *flk_cbp, cred_t *cr,
10733     caller_context_t *ct)
10734 {
10735 	int rc;
10736 	u_offset_t start, end;
10737 	rnode4_t *rp;
10738 	int error = 0, intr = INTR4(vp);
10739 	nfs4_error_t e;
10740 
10741 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
10742 		return (EIO);
10743 
10744 	/* check for valid cmd parameter */
10745 	if (cmd != F_GETLK && cmd != F_SETLK && cmd != F_SETLKW)
10746 		return (EINVAL);
10747 
10748 	/* Verify l_type. */
10749 	switch (bfp->l_type) {
10750 	case F_RDLCK:
10751 		if (cmd != F_GETLK && !(flag & FREAD))
10752 			return (EBADF);
10753 		break;
10754 	case F_WRLCK:
10755 		if (cmd != F_GETLK && !(flag & FWRITE))
10756 			return (EBADF);
10757 		break;
10758 	case F_UNLCK:
10759 		intr = 0;
10760 		break;
10761 
10762 	default:
10763 		return (EINVAL);
10764 	}
10765 
10766 	/* check the validity of the lock range */
10767 	if (rc = flk_convert_lock_data(vp, bfp, &start, &end, offset))
10768 		return (rc);
10769 	if (rc = flk_check_lock_data(start, end, MAXEND))
10770 		return (rc);
10771 
10772 	/*
10773 	 * If the filesystem is mounted using local locking, pass the
10774 	 * request off to the local locking code.
10775 	 */
10776 	if (VTOMI4(vp)->mi_flags & MI4_LLOCK || vp->v_type != VREG) {
10777 		if (cmd == F_SETLK || cmd == F_SETLKW) {
10778 			/*
10779 			 * For complete safety, we should be holding
10780 			 * r_lkserlock.  However, we can't call
10781 			 * nfs4_safelock and then fs_frlock while
10782 			 * holding r_lkserlock, so just invoke
10783 			 * nfs4_safelock and expect that this will
10784 			 * catch enough of the cases.
10785 			 */
10786 			if (!nfs4_safelock(vp, bfp, cr))
10787 				return (EAGAIN);
10788 		}
10789 		return (fs_frlock(vp, cmd, bfp, flag, offset, flk_cbp, cr, ct));
10790 	}
10791 
10792 	rp = VTOR4(vp);
10793 
10794 	/*
10795 	 * Check whether the given lock request can proceed, given the
10796 	 * current file mappings.
10797 	 */
10798 	if (nfs_rw_enter_sig(&rp->r_lkserlock, RW_WRITER, intr))
10799 		return (EINTR);
10800 	if (cmd == F_SETLK || cmd == F_SETLKW) {
10801 		if (!nfs4_safelock(vp, bfp, cr)) {
10802 			rc = EAGAIN;
10803 			goto done;
10804 		}
10805 	}
10806 
10807 	/*
10808 	 * Flush the cache after waiting for async I/O to finish.  For new
10809 	 * locks, this is so that the process gets the latest bits from the
10810 	 * server.  For unlocks, this is so that other clients see the
10811 	 * latest bits once the file has been unlocked.  If currently dirty
10812 	 * pages can't be flushed, then don't allow a lock to be set.  But
10813 	 * allow unlocks to succeed, to avoid having orphan locks on the
10814 	 * server.
10815 	 */
10816 	if (cmd != F_GETLK) {
10817 		mutex_enter(&rp->r_statelock);
10818 		while (rp->r_count > 0) {
10819 			if (intr) {
10820 				klwp_t *lwp = ttolwp(curthread);
10821 
10822 				if (lwp != NULL)
10823 					lwp->lwp_nostop++;
10824 				if (cv_wait_sig(&rp->r_cv,
10825 				    &rp->r_statelock) == 0) {
10826 					if (lwp != NULL)
10827 						lwp->lwp_nostop--;
10828 					rc = EINTR;
10829 					break;
10830 				}
10831 				if (lwp != NULL)
10832 					lwp->lwp_nostop--;
10833 				} else
10834 					cv_wait(&rp->r_cv, &rp->r_statelock);
10835 		}
10836 		mutex_exit(&rp->r_statelock);
10837 		if (rc != 0)
10838 			goto done;
10839 		error = nfs4_putpage(vp, (offset_t)0, 0, B_INVAL, cr, ct);
10840 		if (error) {
10841 			if (error == ENOSPC || error == EDQUOT) {
10842 				mutex_enter(&rp->r_statelock);
10843 				if (!rp->r_error)
10844 					rp->r_error = error;
10845 				mutex_exit(&rp->r_statelock);
10846 			}
10847 			if (bfp->l_type != F_UNLCK) {
10848 				rc = ENOLCK;
10849 				goto done;
10850 			}
10851 		}
10852 	}
10853 
10854 	/*
10855 	 * Call the lock manager to do the real work of contacting
10856 	 * the server and obtaining the lock.
10857 	 */
10858 	nfs4frlock(NFS4_LCK_CTYPE_NORM, vp, cmd, bfp, flag, offset,
10859 	    cr, &e, NULL, NULL);
10860 	rc = e.error;
10861 
10862 	if (rc == 0)
10863 		nfs4_lockcompletion(vp, cmd);
10864 
10865 done:
10866 	nfs_rw_exit(&rp->r_lkserlock);
10867 
10868 	return (rc);
10869 }
10870 
10871 /*
10872  * Free storage space associated with the specified vnode.  The portion
10873  * to be freed is specified by bfp->l_start and bfp->l_len (already
10874  * normalized to a "whence" of 0).
10875  *
10876  * This is an experimental facility whose continued existence is not
10877  * guaranteed.  Currently, we only support the special case
10878  * of l_len == 0, meaning free to end of file.
10879  */
10880 /* ARGSUSED */
10881 static int
10882 nfs4_space(vnode_t *vp, int cmd, struct flock64 *bfp, int flag,
10883     offset_t offset, cred_t *cr, caller_context_t *ct)
10884 {
10885 	int error;
10886 
10887 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
10888 		return (EIO);
10889 	ASSERT(vp->v_type == VREG);
10890 	if (cmd != F_FREESP)
10891 		return (EINVAL);
10892 
10893 	error = convoff(vp, bfp, 0, offset);
10894 	if (!error) {
10895 		ASSERT(bfp->l_start >= 0);
10896 		if (bfp->l_len == 0) {
10897 			struct vattr va;
10898 
10899 			va.va_mask = AT_SIZE;
10900 			va.va_size = bfp->l_start;
10901 			error = nfs4setattr(vp, &va, 0, cr, NULL);
10902 		} else
10903 			error = EINVAL;
10904 	}
10905 
10906 	return (error);
10907 }
10908 
10909 /* ARGSUSED */
10910 int
10911 nfs4_realvp(vnode_t *vp, vnode_t **vpp, caller_context_t *ct)
10912 {
10913 	rnode4_t *rp;
10914 	rp = VTOR4(vp);
10915 
10916 	if (vp->v_type == VREG && IS_SHADOW(vp, rp)) {
10917 		vp = RTOV4(rp);
10918 	}
10919 	*vpp = vp;
10920 	return (0);
10921 }
10922 
10923 /*
10924  * Setup and add an address space callback to do the work of the delmap call.
10925  * The callback will (and must be) deleted in the actual callback function.
10926  *
10927  * This is done in order to take care of the problem that we have with holding
10928  * the address space's a_lock for a long period of time (e.g. if the NFS server
10929  * is down).  Callbacks will be executed in the address space code while the
10930  * a_lock is not held.  Holding the address space's a_lock causes things such
10931  * as ps and fork to hang because they are trying to acquire this lock as well.
10932  */
10933 /* ARGSUSED */
10934 static int
10935 nfs4_delmap(vnode_t *vp, offset_t off, struct as *as, caddr_t addr,
10936     size_t len, uint_t prot, uint_t maxprot, uint_t flags, cred_t *cr,
10937     caller_context_t *ct)
10938 {
10939 	int			caller_found;
10940 	int			error;
10941 	rnode4_t		*rp;
10942 	nfs4_delmap_args_t	*dmapp;
10943 	nfs4_delmapcall_t	*delmap_call;
10944 
10945 	if (vp->v_flag & VNOMAP)
10946 		return (ENOSYS);
10947 
10948 	/*
10949 	 * A process may not change zones if it has NFS pages mmap'ed
10950 	 * in, so we can't legitimately get here from the wrong zone.
10951 	 */
10952 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
10953 
10954 	rp = VTOR4(vp);
10955 
10956 	/*
10957 	 * The way that the address space of this process deletes its mapping
10958 	 * of this file is via the following call chains:
10959 	 * - as_free()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs4_delmap()
10960 	 * - as_unmap()->SEGOP_UNMAP()/segvn_unmap()->VOP_DELMAP()/nfs4_delmap()
10961 	 *
10962 	 * With the use of address space callbacks we are allowed to drop the
10963 	 * address space lock, a_lock, while executing the NFS operations that
10964 	 * need to go over the wire.  Returning EAGAIN to the caller of this
10965 	 * function is what drives the execution of the callback that we add
10966 	 * below.  The callback will be executed by the address space code
10967 	 * after dropping the a_lock.  When the callback is finished, since
10968 	 * we dropped the a_lock, it must be re-acquired and segvn_unmap()
10969 	 * is called again on the same segment to finish the rest of the work
10970 	 * that needs to happen during unmapping.
10971 	 *
10972 	 * This action of calling back into the segment driver causes
10973 	 * nfs4_delmap() to get called again, but since the callback was
10974 	 * already executed at this point, it already did the work and there
10975 	 * is nothing left for us to do.
10976 	 *
10977 	 * To Summarize:
10978 	 * - The first time nfs4_delmap is called by the current thread is when
10979 	 * we add the caller associated with this delmap to the delmap caller
10980 	 * list, add the callback, and return EAGAIN.
10981 	 * - The second time in this call chain when nfs4_delmap is called we
10982 	 * will find this caller in the delmap caller list and realize there
10983 	 * is no more work to do thus removing this caller from the list and
10984 	 * returning the error that was set in the callback execution.
10985 	 */
10986 	caller_found = nfs4_find_and_delete_delmapcall(rp, &error);
10987 	if (caller_found) {
10988 		/*
10989 		 * 'error' is from the actual delmap operations.  To avoid
10990 		 * hangs, we need to handle the return of EAGAIN differently
10991 		 * since this is what drives the callback execution.
10992 		 * In this case, we don't want to return EAGAIN and do the
10993 		 * callback execution because there are none to execute.
10994 		 */
10995 		if (error == EAGAIN)
10996 			return (0);
10997 		else
10998 			return (error);
10999 	}
11000 
11001 	/* current caller was not in the list */
11002 	delmap_call = nfs4_init_delmapcall();
11003 
11004 	mutex_enter(&rp->r_statelock);
11005 	list_insert_tail(&rp->r_indelmap, delmap_call);
11006 	mutex_exit(&rp->r_statelock);
11007 
11008 	dmapp = kmem_alloc(sizeof (nfs4_delmap_args_t), KM_SLEEP);
11009 
11010 	dmapp->vp = vp;
11011 	dmapp->off = off;
11012 	dmapp->addr = addr;
11013 	dmapp->len = len;
11014 	dmapp->prot = prot;
11015 	dmapp->maxprot = maxprot;
11016 	dmapp->flags = flags;
11017 	dmapp->cr = cr;
11018 	dmapp->caller = delmap_call;
11019 
11020 	error = as_add_callback(as, nfs4_delmap_callback, dmapp,
11021 	    AS_UNMAP_EVENT, addr, len, KM_SLEEP);
11022 
11023 	return (error ? error : EAGAIN);
11024 }
11025 
11026 static nfs4_delmapcall_t *
11027 nfs4_init_delmapcall()
11028 {
11029 	nfs4_delmapcall_t	*delmap_call;
11030 
11031 	delmap_call = kmem_alloc(sizeof (nfs4_delmapcall_t), KM_SLEEP);
11032 	delmap_call->call_id = curthread;
11033 	delmap_call->error = 0;
11034 
11035 	return (delmap_call);
11036 }
11037 
11038 static void
11039 nfs4_free_delmapcall(nfs4_delmapcall_t *delmap_call)
11040 {
11041 	kmem_free(delmap_call, sizeof (nfs4_delmapcall_t));
11042 }
11043 
11044 /*
11045  * Searches for the current delmap caller (based on curthread) in the list of
11046  * callers.  If it is found, we remove it and free the delmap caller.
11047  * Returns:
11048  *      0 if the caller wasn't found
11049  *      1 if the caller was found, removed and freed.  *errp will be set
11050  *	to what the result of the delmap was.
11051  */
11052 static int
11053 nfs4_find_and_delete_delmapcall(rnode4_t *rp, int *errp)
11054 {
11055 	nfs4_delmapcall_t	*delmap_call;
11056 
11057 	/*
11058 	 * If the list doesn't exist yet, we create it and return
11059 	 * that the caller wasn't found.  No list = no callers.
11060 	 */
11061 	mutex_enter(&rp->r_statelock);
11062 	if (!(rp->r_flags & R4DELMAPLIST)) {
11063 		/* The list does not exist */
11064 		list_create(&rp->r_indelmap, sizeof (nfs4_delmapcall_t),
11065 		    offsetof(nfs4_delmapcall_t, call_node));
11066 		rp->r_flags |= R4DELMAPLIST;
11067 		mutex_exit(&rp->r_statelock);
11068 		return (0);
11069 	} else {
11070 		/* The list exists so search it */
11071 		for (delmap_call = list_head(&rp->r_indelmap);
11072 		    delmap_call != NULL;
11073 		    delmap_call = list_next(&rp->r_indelmap, delmap_call)) {
11074 			if (delmap_call->call_id == curthread) {
11075 				/* current caller is in the list */
11076 				*errp = delmap_call->error;
11077 				list_remove(&rp->r_indelmap, delmap_call);
11078 				mutex_exit(&rp->r_statelock);
11079 				nfs4_free_delmapcall(delmap_call);
11080 				return (1);
11081 			}
11082 		}
11083 	}
11084 	mutex_exit(&rp->r_statelock);
11085 	return (0);
11086 }
11087 
11088 /*
11089  * Remove some pages from an mmap'd vnode.  Just update the
11090  * count of pages.  If doing close-to-open, then flush and
11091  * commit all of the pages associated with this file.
11092  * Otherwise, start an asynchronous page flush to write out
11093  * any dirty pages.  This will also associate a credential
11094  * with the rnode which can be used to write the pages.
11095  */
11096 /* ARGSUSED */
11097 static void
11098 nfs4_delmap_callback(struct as *as, void *arg, uint_t event)
11099 {
11100 	nfs4_error_t		e = { 0, NFS4_OK, RPC_SUCCESS };
11101 	rnode4_t		*rp;
11102 	mntinfo4_t		*mi;
11103 	nfs4_delmap_args_t	*dmapp = (nfs4_delmap_args_t *)arg;
11104 
11105 	rp = VTOR4(dmapp->vp);
11106 	mi = VTOMI4(dmapp->vp);
11107 
11108 	atomic_add_long((ulong_t *)&rp->r_mapcnt, -btopr(dmapp->len));
11109 	ASSERT(rp->r_mapcnt >= 0);
11110 
11111 	/*
11112 	 * Initiate a page flush and potential commit if there are
11113 	 * pages, the file system was not mounted readonly, the segment
11114 	 * was mapped shared, and the pages themselves were writeable.
11115 	 */
11116 	if (nfs4_has_pages(dmapp->vp) &&
11117 	    !(dmapp->vp->v_vfsp->vfs_flag & VFS_RDONLY) &&
11118 	    dmapp->flags == MAP_SHARED && (dmapp->maxprot & PROT_WRITE)) {
11119 		mutex_enter(&rp->r_statelock);
11120 		rp->r_flags |= R4DIRTY;
11121 		mutex_exit(&rp->r_statelock);
11122 		e.error = nfs4_putpage_commit(dmapp->vp, dmapp->off,
11123 		    dmapp->len, dmapp->cr);
11124 		if (!e.error) {
11125 			mutex_enter(&rp->r_statelock);
11126 			e.error = rp->r_error;
11127 			rp->r_error = 0;
11128 			mutex_exit(&rp->r_statelock);
11129 		}
11130 	} else
11131 		e.error = 0;
11132 
11133 	if ((rp->r_flags & R4DIRECTIO) || (mi->mi_flags & MI4_DIRECTIO))
11134 		(void) nfs4_putpage(dmapp->vp, dmapp->off, dmapp->len,
11135 		    B_INVAL, dmapp->cr, NULL);
11136 
11137 	if (e.error) {
11138 		e.stat = puterrno4(e.error);
11139 		nfs4_queue_fact(RF_DELMAP_CB_ERR, mi, e.stat, 0,
11140 		    OP_COMMIT, FALSE, NULL, 0, dmapp->vp);
11141 		dmapp->caller->error = e.error;
11142 	}
11143 
11144 	/* Check to see if we need to close the file */
11145 
11146 	if (dmapp->vp->v_type == VREG) {
11147 		nfs4close_one(dmapp->vp, NULL, dmapp->cr, 0, NULL, &e,
11148 		    CLOSE_DELMAP, dmapp->len, dmapp->maxprot, dmapp->flags);
11149 
11150 		if (e.error != 0 || e.stat != NFS4_OK) {
11151 			/*
11152 			 * Since it is possible that e.error == 0 and
11153 			 * e.stat != NFS4_OK (and vice versa),
11154 			 * we do the proper checking in order to get both
11155 			 * e.error and e.stat reporting the correct info.
11156 			 */
11157 			if (e.stat == NFS4_OK)
11158 				e.stat = puterrno4(e.error);
11159 			if (e.error == 0)
11160 				e.error = geterrno4(e.stat);
11161 
11162 			nfs4_queue_fact(RF_DELMAP_CB_ERR, mi, e.stat, 0,
11163 			    OP_CLOSE, FALSE, NULL, 0, dmapp->vp);
11164 			dmapp->caller->error = e.error;
11165 		}
11166 	}
11167 
11168 	(void) as_delete_callback(as, arg);
11169 	kmem_free(dmapp, sizeof (nfs4_delmap_args_t));
11170 }
11171 
11172 
11173 static uint_t
11174 fattr4_maxfilesize_to_bits(uint64_t ll)
11175 {
11176 	uint_t l = 1;
11177 
11178 	if (ll == 0) {
11179 		return (0);
11180 	}
11181 
11182 	if (ll & 0xffffffff00000000) {
11183 		l += 32; ll >>= 32;
11184 	}
11185 	if (ll & 0xffff0000) {
11186 		l += 16; ll >>= 16;
11187 	}
11188 	if (ll & 0xff00) {
11189 		l += 8; ll >>= 8;
11190 	}
11191 	if (ll & 0xf0) {
11192 		l += 4; ll >>= 4;
11193 	}
11194 	if (ll & 0xc) {
11195 		l += 2; ll >>= 2;
11196 	}
11197 	if (ll & 0x2) {
11198 		l += 1;
11199 	}
11200 	return (l);
11201 }
11202 
11203 /* ARGSUSED */
11204 int
11205 nfs4_pathconf(vnode_t *vp, int cmd, ulong_t *valp, cred_t *cr,
11206 	caller_context_t *ct)
11207 {
11208 	int error;
11209 	hrtime_t t;
11210 	rnode4_t *rp;
11211 	nfs4_ga_res_t gar;
11212 	nfs4_ga_ext_res_t ger;
11213 
11214 	gar.n4g_ext_res = &ger;
11215 
11216 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
11217 		return (EIO);
11218 	if (cmd == _PC_PATH_MAX || cmd == _PC_SYMLINK_MAX) {
11219 		*valp = MAXPATHLEN;
11220 		return (0);
11221 	}
11222 	if (cmd == _PC_ACL_ENABLED) {
11223 		*valp = _ACL_ACE_ENABLED;
11224 		return (0);
11225 	}
11226 
11227 	rp = VTOR4(vp);
11228 	if (cmd == _PC_XATTR_EXISTS) {
11229 		/*
11230 		 * Eventually should attempt small client readdir before
11231 		 * going otw with GETATTR(FATTR4_NAMED_ATTR).  For now
11232 		 * just drive the OTW getattr.  This is required because
11233 		 * _PC_XATTR_EXISTS can only return true if attributes
11234 		 * exist -- simply checking for existence of the attrdir
11235 		 * is not sufficient.
11236 		 *
11237 		 * pc4_xattr_valid can be only be trusted when r_xattr_dir
11238 		 * is NULL.  Once the xadir vp exists, we can create xattrs,
11239 		 * and we don't have any way to update the "base" object's
11240 		 * pc4_xattr_exists from the xattr or xadir.  Maybe FEM
11241 		 * could help out.
11242 		 */
11243 		if (ATTRCACHE4_VALID(vp) && rp->r_pathconf.pc4_xattr_valid &&
11244 		    rp->r_xattr_dir == NULL) {
11245 			*valp = rp->r_pathconf.pc4_xattr_exists;
11246 			return (0);
11247 		}
11248 	} else {  /* OLD CODE */
11249 		if (ATTRCACHE4_VALID(vp)) {
11250 			mutex_enter(&rp->r_statelock);
11251 			if (rp->r_pathconf.pc4_cache_valid) {
11252 				error = 0;
11253 				switch (cmd) {
11254 				case _PC_FILESIZEBITS:
11255 					*valp =
11256 					    rp->r_pathconf.pc4_filesizebits;
11257 					break;
11258 				case _PC_LINK_MAX:
11259 					*valp =
11260 					    rp->r_pathconf.pc4_link_max;
11261 					break;
11262 				case _PC_NAME_MAX:
11263 					*valp =
11264 					    rp->r_pathconf.pc4_name_max;
11265 					break;
11266 				case _PC_CHOWN_RESTRICTED:
11267 					*valp =
11268 					    rp->r_pathconf.pc4_chown_restricted;
11269 					break;
11270 				case _PC_NO_TRUNC:
11271 					*valp =
11272 					    rp->r_pathconf.pc4_no_trunc;
11273 					break;
11274 				default:
11275 					error = EINVAL;
11276 					break;
11277 				}
11278 				mutex_exit(&rp->r_statelock);
11279 #ifdef DEBUG
11280 				nfs4_pathconf_cache_hits++;
11281 #endif
11282 				return (error);
11283 			}
11284 			mutex_exit(&rp->r_statelock);
11285 		}
11286 	}
11287 #ifdef DEBUG
11288 	nfs4_pathconf_cache_misses++;
11289 #endif
11290 
11291 	t = gethrtime();
11292 
11293 	error = nfs4_attr_otw(vp, TAG_PATHCONF, &gar, NFS4_PATHCONF_MASK, cr);
11294 
11295 	if (error) {
11296 		mutex_enter(&rp->r_statelock);
11297 		rp->r_pathconf.pc4_cache_valid = FALSE;
11298 		rp->r_pathconf.pc4_xattr_valid = FALSE;
11299 		mutex_exit(&rp->r_statelock);
11300 		return (error);
11301 	}
11302 
11303 	/* interpret the max filesize */
11304 	gar.n4g_ext_res->n4g_pc4.pc4_filesizebits =
11305 	    fattr4_maxfilesize_to_bits(gar.n4g_ext_res->n4g_maxfilesize);
11306 
11307 	/* Store the attributes we just received */
11308 	nfs4_attr_cache(vp, &gar, t, cr, TRUE, NULL);
11309 
11310 	switch (cmd) {
11311 	case _PC_FILESIZEBITS:
11312 		*valp = gar.n4g_ext_res->n4g_pc4.pc4_filesizebits;
11313 		break;
11314 	case _PC_LINK_MAX:
11315 		*valp = gar.n4g_ext_res->n4g_pc4.pc4_link_max;
11316 		break;
11317 	case _PC_NAME_MAX:
11318 		*valp = gar.n4g_ext_res->n4g_pc4.pc4_name_max;
11319 		break;
11320 	case _PC_CHOWN_RESTRICTED:
11321 		*valp = gar.n4g_ext_res->n4g_pc4.pc4_chown_restricted;
11322 		break;
11323 	case _PC_NO_TRUNC:
11324 		*valp = gar.n4g_ext_res->n4g_pc4.pc4_no_trunc;
11325 		break;
11326 	case _PC_XATTR_EXISTS:
11327 		*valp = gar.n4g_ext_res->n4g_pc4.pc4_xattr_exists;
11328 		break;
11329 	default:
11330 		return (EINVAL);
11331 	}
11332 
11333 	return (0);
11334 }
11335 
11336 /*
11337  * Called by async thread to do synchronous pageio. Do the i/o, wait
11338  * for it to complete, and cleanup the page list when done.
11339  */
11340 static int
11341 nfs4_sync_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
11342     int flags, cred_t *cr)
11343 {
11344 	int error;
11345 
11346 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11347 
11348 	error = nfs4_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
11349 	if (flags & B_READ)
11350 		pvn_read_done(pp, (error ? B_ERROR : 0) | flags);
11351 	else
11352 		pvn_write_done(pp, (error ? B_ERROR : 0) | flags);
11353 	return (error);
11354 }
11355 
11356 /* ARGSUSED */
11357 static int
11358 nfs4_pageio(vnode_t *vp, page_t *pp, u_offset_t io_off, size_t io_len,
11359 	int flags, cred_t *cr, caller_context_t *ct)
11360 {
11361 	int error;
11362 	rnode4_t *rp;
11363 
11364 	if (!(flags & B_ASYNC) && nfs_zone() != VTOMI4(vp)->mi_zone)
11365 		return (EIO);
11366 
11367 	if (pp == NULL)
11368 		return (EINVAL);
11369 
11370 	rp = VTOR4(vp);
11371 	mutex_enter(&rp->r_statelock);
11372 	rp->r_count++;
11373 	mutex_exit(&rp->r_statelock);
11374 
11375 	if (flags & B_ASYNC) {
11376 		error = nfs4_async_pageio(vp, pp, io_off, io_len, flags, cr,
11377 		    nfs4_sync_pageio);
11378 	} else
11379 		error = nfs4_rdwrlbn(vp, pp, io_off, io_len, flags, cr);
11380 	mutex_enter(&rp->r_statelock);
11381 	rp->r_count--;
11382 	cv_broadcast(&rp->r_cv);
11383 	mutex_exit(&rp->r_statelock);
11384 	return (error);
11385 }
11386 
11387 /* ARGSUSED */
11388 static void
11389 nfs4_dispose(vnode_t *vp, page_t *pp, int fl, int dn, cred_t *cr,
11390 	caller_context_t *ct)
11391 {
11392 	int error;
11393 	rnode4_t *rp;
11394 	page_t *plist;
11395 	page_t *pptr;
11396 	offset3 offset;
11397 	count3 len;
11398 	k_sigset_t smask;
11399 
11400 	/*
11401 	 * We should get called with fl equal to either B_FREE or
11402 	 * B_INVAL.  Any other value is illegal.
11403 	 *
11404 	 * The page that we are either supposed to free or destroy
11405 	 * should be exclusive locked and its io lock should not
11406 	 * be held.
11407 	 */
11408 	ASSERT(fl == B_FREE || fl == B_INVAL);
11409 	ASSERT((PAGE_EXCL(pp) && !page_iolock_assert(pp)) || panicstr);
11410 
11411 	rp = VTOR4(vp);
11412 
11413 	/*
11414 	 * If the page doesn't need to be committed or we shouldn't
11415 	 * even bother attempting to commit it, then just make sure
11416 	 * that the p_fsdata byte is clear and then either free or
11417 	 * destroy the page as appropriate.
11418 	 */
11419 	if (pp->p_fsdata == C_NOCOMMIT || (rp->r_flags & R4STALE)) {
11420 		pp->p_fsdata = C_NOCOMMIT;
11421 		if (fl == B_FREE)
11422 			page_free(pp, dn);
11423 		else
11424 			page_destroy(pp, dn);
11425 		return;
11426 	}
11427 
11428 	/*
11429 	 * If there is a page invalidation operation going on, then
11430 	 * if this is one of the pages being destroyed, then just
11431 	 * clear the p_fsdata byte and then either free or destroy
11432 	 * the page as appropriate.
11433 	 */
11434 	mutex_enter(&rp->r_statelock);
11435 	if ((rp->r_flags & R4TRUNCATE) && pp->p_offset >= rp->r_truncaddr) {
11436 		mutex_exit(&rp->r_statelock);
11437 		pp->p_fsdata = C_NOCOMMIT;
11438 		if (fl == B_FREE)
11439 			page_free(pp, dn);
11440 		else
11441 			page_destroy(pp, dn);
11442 		return;
11443 	}
11444 
11445 	/*
11446 	 * If we are freeing this page and someone else is already
11447 	 * waiting to do a commit, then just unlock the page and
11448 	 * return.  That other thread will take care of commiting
11449 	 * this page.  The page can be freed sometime after the
11450 	 * commit has finished.  Otherwise, if the page is marked
11451 	 * as delay commit, then we may be getting called from
11452 	 * pvn_write_done, one page at a time.   This could result
11453 	 * in one commit per page, so we end up doing lots of small
11454 	 * commits instead of fewer larger commits.  This is bad,
11455 	 * we want do as few commits as possible.
11456 	 */
11457 	if (fl == B_FREE) {
11458 		if (rp->r_flags & R4COMMITWAIT) {
11459 			page_unlock(pp);
11460 			mutex_exit(&rp->r_statelock);
11461 			return;
11462 		}
11463 		if (pp->p_fsdata == C_DELAYCOMMIT) {
11464 			pp->p_fsdata = C_COMMIT;
11465 			page_unlock(pp);
11466 			mutex_exit(&rp->r_statelock);
11467 			return;
11468 		}
11469 	}
11470 
11471 	/*
11472 	 * Check to see if there is a signal which would prevent an
11473 	 * attempt to commit the pages from being successful.  If so,
11474 	 * then don't bother with all of the work to gather pages and
11475 	 * generate the unsuccessful RPC.  Just return from here and
11476 	 * let the page be committed at some later time.
11477 	 */
11478 	sigintr(&smask, VTOMI4(vp)->mi_flags & MI4_INT);
11479 	if (ttolwp(curthread) != NULL && ISSIG(curthread, JUSTLOOKING)) {
11480 		sigunintr(&smask);
11481 		page_unlock(pp);
11482 		mutex_exit(&rp->r_statelock);
11483 		return;
11484 	}
11485 	sigunintr(&smask);
11486 
11487 	/*
11488 	 * We are starting to need to commit pages, so let's try
11489 	 * to commit as many as possible at once to reduce the
11490 	 * overhead.
11491 	 *
11492 	 * Set the `commit inprogress' state bit.  We must
11493 	 * first wait until any current one finishes.  Then
11494 	 * we initialize the c_pages list with this page.
11495 	 */
11496 	while (rp->r_flags & R4COMMIT) {
11497 		rp->r_flags |= R4COMMITWAIT;
11498 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
11499 		rp->r_flags &= ~R4COMMITWAIT;
11500 	}
11501 	rp->r_flags |= R4COMMIT;
11502 	mutex_exit(&rp->r_statelock);
11503 	ASSERT(rp->r_commit.c_pages == NULL);
11504 	rp->r_commit.c_pages = pp;
11505 	rp->r_commit.c_commbase = (offset3)pp->p_offset;
11506 	rp->r_commit.c_commlen = PAGESIZE;
11507 
11508 	/*
11509 	 * Gather together all other pages which can be committed.
11510 	 * They will all be chained off r_commit.c_pages.
11511 	 */
11512 	nfs4_get_commit(vp);
11513 
11514 	/*
11515 	 * Clear the `commit inprogress' status and disconnect
11516 	 * the list of pages to be committed from the rnode.
11517 	 * At this same time, we also save the starting offset
11518 	 * and length of data to be committed on the server.
11519 	 */
11520 	plist = rp->r_commit.c_pages;
11521 	rp->r_commit.c_pages = NULL;
11522 	offset = rp->r_commit.c_commbase;
11523 	len = rp->r_commit.c_commlen;
11524 	mutex_enter(&rp->r_statelock);
11525 	rp->r_flags &= ~R4COMMIT;
11526 	cv_broadcast(&rp->r_commit.c_cv);
11527 	mutex_exit(&rp->r_statelock);
11528 
11529 	if (curproc == proc_pageout || curproc == proc_fsflush ||
11530 	    nfs_zone() != VTOMI4(vp)->mi_zone) {
11531 		nfs4_async_commit(vp, plist, offset, len,
11532 		    cr, do_nfs4_async_commit);
11533 		return;
11534 	}
11535 
11536 	/*
11537 	 * Actually generate the COMMIT op over the wire operation.
11538 	 */
11539 	error = nfs4_commit(vp, (offset4)offset, (count4)len, cr);
11540 
11541 	/*
11542 	 * If we got an error during the commit, just unlock all
11543 	 * of the pages.  The pages will get retransmitted to the
11544 	 * server during a putpage operation.
11545 	 */
11546 	if (error) {
11547 		while (plist != NULL) {
11548 			pptr = plist;
11549 			page_sub(&plist, pptr);
11550 			page_unlock(pptr);
11551 		}
11552 		return;
11553 	}
11554 
11555 	/*
11556 	 * We've tried as hard as we can to commit the data to stable
11557 	 * storage on the server.  We just unlock the rest of the pages
11558 	 * and clear the commit required state.  They will be put
11559 	 * onto the tail of the cachelist if they are nolonger
11560 	 * mapped.
11561 	 */
11562 	while (plist != pp) {
11563 		pptr = plist;
11564 		page_sub(&plist, pptr);
11565 		pptr->p_fsdata = C_NOCOMMIT;
11566 		page_unlock(pptr);
11567 	}
11568 
11569 	/*
11570 	 * It is possible that nfs4_commit didn't return error but
11571 	 * some other thread has modified the page we are going
11572 	 * to free/destroy.
11573 	 *    In this case we need to rewrite the page. Do an explicit check
11574 	 * before attempting to free/destroy the page. If modified, needs to
11575 	 * be rewritten so unlock the page and return.
11576 	 */
11577 	if (hat_ismod(pp)) {
11578 		pp->p_fsdata = C_NOCOMMIT;
11579 		page_unlock(pp);
11580 		return;
11581 	}
11582 
11583 	/*
11584 	 * Now, as appropriate, either free or destroy the page
11585 	 * that we were called with.
11586 	 */
11587 	pp->p_fsdata = C_NOCOMMIT;
11588 	if (fl == B_FREE)
11589 		page_free(pp, dn);
11590 	else
11591 		page_destroy(pp, dn);
11592 }
11593 
11594 /*
11595  * Commit requires that the current fh be the file written to.
11596  * The compound op structure is:
11597  *      PUTFH(file), COMMIT
11598  */
11599 static int
11600 nfs4_commit(vnode_t *vp, offset4 offset, count4 count, cred_t *cr)
11601 {
11602 	COMPOUND4args_clnt args;
11603 	COMPOUND4res_clnt res;
11604 	COMMIT4res *cm_res;
11605 	nfs_argop4 argop[2];
11606 	nfs_resop4 *resop;
11607 	int doqueue;
11608 	mntinfo4_t *mi;
11609 	rnode4_t *rp;
11610 	cred_t *cred_otw = NULL;
11611 	bool_t needrecov = FALSE;
11612 	nfs4_recov_state_t recov_state;
11613 	nfs4_open_stream_t *osp = NULL;
11614 	bool_t first_time = TRUE;	/* first time getting OTW cred */
11615 	bool_t last_time = FALSE;	/* last time getting OTW cred */
11616 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
11617 
11618 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11619 
11620 	rp = VTOR4(vp);
11621 
11622 	mi = VTOMI4(vp);
11623 	recov_state.rs_flags = 0;
11624 	recov_state.rs_num_retry_despite_err = 0;
11625 get_commit_cred:
11626 	/*
11627 	 * Releases the osp, if a valid open stream is provided.
11628 	 * Puts a hold on the cred_otw and the new osp (if found).
11629 	 */
11630 	cred_otw = nfs4_get_otw_cred_by_osp(rp, cr, &osp,
11631 	    &first_time, &last_time);
11632 	args.ctag = TAG_COMMIT;
11633 recov_retry:
11634 	/*
11635 	 * Commit ops: putfh file; commit
11636 	 */
11637 	args.array_len = 2;
11638 	args.array = argop;
11639 
11640 	e.error = nfs4_start_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11641 	    &recov_state, NULL);
11642 	if (e.error) {
11643 		crfree(cred_otw);
11644 		if (osp != NULL)
11645 			open_stream_rele(osp, rp);
11646 		return (e.error);
11647 	}
11648 
11649 	/* putfh directory */
11650 	argop[0].argop = OP_CPUTFH;
11651 	argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
11652 
11653 	/* commit */
11654 	argop[1].argop = OP_COMMIT;
11655 	argop[1].nfs_argop4_u.opcommit.offset = offset;
11656 	argop[1].nfs_argop4_u.opcommit.count = count;
11657 
11658 	doqueue = 1;
11659 	rfs4call(mi, &args, &res, cred_otw, &doqueue, 0, &e);
11660 
11661 	needrecov = nfs4_needs_recovery(&e, FALSE, mi->mi_vfsp);
11662 	if (!needrecov && e.error) {
11663 		nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT, &recov_state,
11664 		    needrecov);
11665 		crfree(cred_otw);
11666 		if (e.error == EACCES && last_time == FALSE)
11667 			goto get_commit_cred;
11668 		if (osp != NULL)
11669 			open_stream_rele(osp, rp);
11670 		return (e.error);
11671 	}
11672 
11673 	if (needrecov) {
11674 		if (nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
11675 		    NULL, OP_COMMIT, NULL) == FALSE) {
11676 			nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11677 			    &recov_state, needrecov);
11678 			if (!e.error)
11679 				(void) xdr_free(xdr_COMPOUND4res_clnt,
11680 				    (caddr_t)&res);
11681 			goto recov_retry;
11682 		}
11683 		if (e.error) {
11684 			nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11685 			    &recov_state, needrecov);
11686 			crfree(cred_otw);
11687 			if (osp != NULL)
11688 				open_stream_rele(osp, rp);
11689 			return (e.error);
11690 		}
11691 		/* fall through for res.status case */
11692 	}
11693 
11694 	if (res.status) {
11695 		e.error = geterrno4(res.status);
11696 		if (e.error == EACCES && last_time == FALSE) {
11697 			crfree(cred_otw);
11698 			nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11699 			    &recov_state, needrecov);
11700 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
11701 			goto get_commit_cred;
11702 		}
11703 		/*
11704 		 * Can't do a nfs4_purge_stale_fh here because this
11705 		 * can cause a deadlock.  nfs4_commit can
11706 		 * be called from nfs4_dispose which can be called
11707 		 * indirectly via pvn_vplist_dirty.  nfs4_purge_stale_fh
11708 		 * can call back to pvn_vplist_dirty.
11709 		 */
11710 		if (e.error == ESTALE) {
11711 			mutex_enter(&rp->r_statelock);
11712 			rp->r_flags |= R4STALE;
11713 			if (!rp->r_error)
11714 				rp->r_error = e.error;
11715 			mutex_exit(&rp->r_statelock);
11716 			PURGE_ATTRCACHE4(vp);
11717 		} else {
11718 			mutex_enter(&rp->r_statelock);
11719 			if (!rp->r_error)
11720 				rp->r_error = e.error;
11721 			mutex_exit(&rp->r_statelock);
11722 		}
11723 	} else {
11724 		ASSERT(rp->r_flags & R4HAVEVERF);
11725 		resop = &res.array[1];	/* commit res */
11726 		cm_res = &resop->nfs_resop4_u.opcommit;
11727 		mutex_enter(&rp->r_statelock);
11728 		if (cm_res->writeverf == rp->r_writeverf) {
11729 			mutex_exit(&rp->r_statelock);
11730 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
11731 			nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT,
11732 			    &recov_state, needrecov);
11733 			crfree(cred_otw);
11734 			if (osp != NULL)
11735 				open_stream_rele(osp, rp);
11736 			return (0);
11737 		}
11738 		nfs4_set_mod(vp);
11739 		rp->r_writeverf = cm_res->writeverf;
11740 		mutex_exit(&rp->r_statelock);
11741 		e.error = NFS_VERF_MISMATCH;
11742 	}
11743 
11744 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
11745 	nfs4_end_fop(VTOMI4(vp), vp, NULL, OH_COMMIT, &recov_state, needrecov);
11746 	crfree(cred_otw);
11747 	if (osp != NULL)
11748 		open_stream_rele(osp, rp);
11749 
11750 	return (e.error);
11751 }
11752 
11753 static void
11754 nfs4_set_mod(vnode_t *vp)
11755 {
11756 	page_t *pp;
11757 	kmutex_t *vphm;
11758 	rnode4_t *rp;
11759 
11760 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11761 
11762 	/* make sure we're looking at the master vnode, not a shadow */
11763 
11764 	rp = VTOR4(vp);
11765 	if (IS_SHADOW(vp, rp))
11766 		vp = RTOV4(rp);
11767 
11768 	vphm = page_vnode_mutex(vp);
11769 	mutex_enter(vphm);
11770 	/*
11771 	 * If there are no pages associated with this vnode, then
11772 	 * just return.
11773 	 */
11774 	if ((pp = vp->v_pages) == NULL) {
11775 		mutex_exit(vphm);
11776 		return;
11777 	}
11778 
11779 	do {
11780 		if (pp->p_fsdata != C_NOCOMMIT) {
11781 			hat_setmod(pp);
11782 			pp->p_fsdata = C_NOCOMMIT;
11783 		}
11784 	} while ((pp = pp->p_vpnext) != vp->v_pages);
11785 	mutex_exit(vphm);
11786 }
11787 
11788 /*
11789  * This function is used to gather a page list of the pages which
11790  * can be committed on the server.
11791  *
11792  * The calling thread must have set R4COMMIT.  This bit is used to
11793  * serialize access to the commit structure in the rnode.  As long
11794  * as the thread has set R4COMMIT, then it can manipulate the commit
11795  * structure without requiring any other locks.
11796  *
11797  * When this function is called from nfs4_dispose() the page passed
11798  * into nfs4_dispose() will be SE_EXCL locked, and so this function
11799  * will skip it. This is not a problem since we initially add the
11800  * page to the r_commit page list.
11801  *
11802  */
11803 static void
11804 nfs4_get_commit(vnode_t *vp)
11805 {
11806 	rnode4_t *rp;
11807 	page_t *pp;
11808 	kmutex_t *vphm;
11809 
11810 	rp = VTOR4(vp);
11811 
11812 	ASSERT(rp->r_flags & R4COMMIT);
11813 
11814 	/* make sure we're looking at the master vnode, not a shadow */
11815 
11816 	if (IS_SHADOW(vp, rp))
11817 		vp = RTOV4(rp);
11818 
11819 	vphm = page_vnode_mutex(vp);
11820 	mutex_enter(vphm);
11821 
11822 	/*
11823 	 * If there are no pages associated with this vnode, then
11824 	 * just return.
11825 	 */
11826 	if ((pp = vp->v_pages) == NULL) {
11827 		mutex_exit(vphm);
11828 		return;
11829 	}
11830 
11831 	/*
11832 	 * Step through all of the pages associated with this vnode
11833 	 * looking for pages which need to be committed.
11834 	 */
11835 	do {
11836 		/*
11837 		 * First short-cut everything (without the page_lock)
11838 		 * and see if this page does not need to be committed
11839 		 * or is modified if so then we'll just skip it.
11840 		 */
11841 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp))
11842 			continue;
11843 
11844 		/*
11845 		 * Attempt to lock the page.  If we can't, then
11846 		 * someone else is messing with it or we have been
11847 		 * called from nfs4_dispose and this is the page that
11848 		 * nfs4_dispose was called with.. anyway just skip it.
11849 		 */
11850 		if (!page_trylock(pp, SE_EXCL))
11851 			continue;
11852 
11853 		/*
11854 		 * Lets check again now that we have the page lock.
11855 		 */
11856 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
11857 			page_unlock(pp);
11858 			continue;
11859 		}
11860 
11861 		/* this had better not be a free page */
11862 		ASSERT(PP_ISFREE(pp) == 0);
11863 
11864 		/*
11865 		 * The page needs to be committed and we locked it.
11866 		 * Update the base and length parameters and add it
11867 		 * to r_pages.
11868 		 */
11869 		if (rp->r_commit.c_pages == NULL) {
11870 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
11871 			rp->r_commit.c_commlen = PAGESIZE;
11872 		} else if (pp->p_offset < rp->r_commit.c_commbase) {
11873 			rp->r_commit.c_commlen = rp->r_commit.c_commbase -
11874 			    (offset3)pp->p_offset + rp->r_commit.c_commlen;
11875 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
11876 		} else if ((rp->r_commit.c_commbase + rp->r_commit.c_commlen)
11877 		    <= pp->p_offset) {
11878 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
11879 			    rp->r_commit.c_commbase + PAGESIZE;
11880 		}
11881 		page_add(&rp->r_commit.c_pages, pp);
11882 	} while ((pp = pp->p_vpnext) != vp->v_pages);
11883 
11884 	mutex_exit(vphm);
11885 }
11886 
11887 /*
11888  * This routine is used to gather together a page list of the pages
11889  * which are to be committed on the server.  This routine must not
11890  * be called if the calling thread holds any locked pages.
11891  *
11892  * The calling thread must have set R4COMMIT.  This bit is used to
11893  * serialize access to the commit structure in the rnode.  As long
11894  * as the thread has set R4COMMIT, then it can manipulate the commit
11895  * structure without requiring any other locks.
11896  */
11897 static void
11898 nfs4_get_commit_range(vnode_t *vp, u_offset_t soff, size_t len)
11899 {
11900 
11901 	rnode4_t *rp;
11902 	page_t *pp;
11903 	u_offset_t end;
11904 	u_offset_t off;
11905 	ASSERT(len != 0);
11906 	rp = VTOR4(vp);
11907 	ASSERT(rp->r_flags & R4COMMIT);
11908 
11909 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11910 
11911 	/* make sure we're looking at the master vnode, not a shadow */
11912 
11913 	if (IS_SHADOW(vp, rp))
11914 		vp = RTOV4(rp);
11915 
11916 	/*
11917 	 * If there are no pages associated with this vnode, then
11918 	 * just return.
11919 	 */
11920 	if ((pp = vp->v_pages) == NULL)
11921 		return;
11922 	/*
11923 	 * Calculate the ending offset.
11924 	 */
11925 	end = soff + len;
11926 	for (off = soff; off < end; off += PAGESIZE) {
11927 		/*
11928 		 * Lookup each page by vp, offset.
11929 		 */
11930 		if ((pp = page_lookup_nowait(vp, off, SE_EXCL)) == NULL)
11931 			continue;
11932 		/*
11933 		 * If this page does not need to be committed or is
11934 		 * modified, then just skip it.
11935 		 */
11936 		if (pp->p_fsdata == C_NOCOMMIT || hat_ismod(pp)) {
11937 			page_unlock(pp);
11938 			continue;
11939 		}
11940 
11941 		ASSERT(PP_ISFREE(pp) == 0);
11942 		/*
11943 		 * The page needs to be committed and we locked it.
11944 		 * Update the base and length parameters and add it
11945 		 * to r_pages.
11946 		 */
11947 		if (rp->r_commit.c_pages == NULL) {
11948 			rp->r_commit.c_commbase = (offset3)pp->p_offset;
11949 			rp->r_commit.c_commlen = PAGESIZE;
11950 		} else {
11951 			rp->r_commit.c_commlen = (offset3)pp->p_offset -
11952 			    rp->r_commit.c_commbase + PAGESIZE;
11953 		}
11954 		page_add(&rp->r_commit.c_pages, pp);
11955 	}
11956 }
11957 
11958 /*
11959  * Called from nfs4_close(), nfs4_fsync() and nfs4_delmap().
11960  * Flushes and commits data to the server.
11961  */
11962 static int
11963 nfs4_putpage_commit(vnode_t *vp, offset_t poff, size_t plen, cred_t *cr)
11964 {
11965 	int error;
11966 	verifier4 write_verf;
11967 	rnode4_t *rp = VTOR4(vp);
11968 
11969 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
11970 
11971 	/*
11972 	 * Flush the data portion of the file and then commit any
11973 	 * portions which need to be committed.  This may need to
11974 	 * be done twice if the server has changed state since
11975 	 * data was last written.  The data will need to be
11976 	 * rewritten to the server and then a new commit done.
11977 	 *
11978 	 * In fact, this may need to be done several times if the
11979 	 * server is having problems and crashing while we are
11980 	 * attempting to do this.
11981 	 */
11982 
11983 top:
11984 	/*
11985 	 * Do a flush based on the poff and plen arguments.  This
11986 	 * will synchronously write out any modified pages in the
11987 	 * range specified by (poff, plen). This starts all of the
11988 	 * i/o operations which will be waited for in the next
11989 	 * call to nfs4_putpage
11990 	 */
11991 
11992 	mutex_enter(&rp->r_statelock);
11993 	write_verf = rp->r_writeverf;
11994 	mutex_exit(&rp->r_statelock);
11995 
11996 	error = nfs4_putpage(vp, poff, plen, B_ASYNC, cr, NULL);
11997 	if (error == EAGAIN)
11998 		error = 0;
11999 
12000 	/*
12001 	 * Do a flush based on the poff and plen arguments.  This
12002 	 * will synchronously write out any modified pages in the
12003 	 * range specified by (poff, plen) and wait until all of
12004 	 * the asynchronous i/o's in that range are done as well.
12005 	 */
12006 	if (!error)
12007 		error = nfs4_putpage(vp, poff, plen, 0, cr, NULL);
12008 
12009 	if (error)
12010 		return (error);
12011 
12012 	mutex_enter(&rp->r_statelock);
12013 	if (rp->r_writeverf != write_verf) {
12014 		mutex_exit(&rp->r_statelock);
12015 		goto top;
12016 	}
12017 	mutex_exit(&rp->r_statelock);
12018 
12019 	/*
12020 	 * Now commit any pages which might need to be committed.
12021 	 * If the error, NFS_VERF_MISMATCH, is returned, then
12022 	 * start over with the flush operation.
12023 	 */
12024 	error = nfs4_commit_vp(vp, poff, plen, cr, NFS4_WRITE_WAIT);
12025 
12026 	if (error == NFS_VERF_MISMATCH)
12027 		goto top;
12028 
12029 	return (error);
12030 }
12031 
12032 /*
12033  * nfs4_commit_vp()  will wait for other pending commits and
12034  * will either commit the whole file or a range, plen dictates
12035  * if we commit whole file. a value of zero indicates the whole
12036  * file. Called from nfs4_putpage_commit() or nfs4_sync_putapage()
12037  */
12038 static int
12039 nfs4_commit_vp(vnode_t *vp, u_offset_t poff, size_t plen,
12040     cred_t *cr, int wait_on_writes)
12041 {
12042 	rnode4_t *rp;
12043 	page_t *plist;
12044 	offset3 offset;
12045 	count3 len;
12046 
12047 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12048 
12049 	rp = VTOR4(vp);
12050 
12051 	/*
12052 	 *  before we gather commitable pages make
12053 	 *  sure there are no outstanding async writes
12054 	 */
12055 	if (rp->r_count && wait_on_writes == NFS4_WRITE_WAIT) {
12056 		mutex_enter(&rp->r_statelock);
12057 		while (rp->r_count > 0) {
12058 			cv_wait(&rp->r_cv, &rp->r_statelock);
12059 		}
12060 		mutex_exit(&rp->r_statelock);
12061 	}
12062 
12063 	/*
12064 	 * Set the `commit inprogress' state bit.  We must
12065 	 * first wait until any current one finishes.
12066 	 */
12067 	mutex_enter(&rp->r_statelock);
12068 	while (rp->r_flags & R4COMMIT) {
12069 		rp->r_flags |= R4COMMITWAIT;
12070 		cv_wait(&rp->r_commit.c_cv, &rp->r_statelock);
12071 		rp->r_flags &= ~R4COMMITWAIT;
12072 	}
12073 	rp->r_flags |= R4COMMIT;
12074 	mutex_exit(&rp->r_statelock);
12075 
12076 	/*
12077 	 * Gather all of the pages which need to be
12078 	 * committed.
12079 	 */
12080 	if (plen == 0)
12081 		nfs4_get_commit(vp);
12082 	else
12083 		nfs4_get_commit_range(vp, poff, plen);
12084 
12085 	/*
12086 	 * Clear the `commit inprogress' bit and disconnect the
12087 	 * page list which was gathered by nfs4_get_commit.
12088 	 */
12089 	plist = rp->r_commit.c_pages;
12090 	rp->r_commit.c_pages = NULL;
12091 	offset = rp->r_commit.c_commbase;
12092 	len = rp->r_commit.c_commlen;
12093 	mutex_enter(&rp->r_statelock);
12094 	rp->r_flags &= ~R4COMMIT;
12095 	cv_broadcast(&rp->r_commit.c_cv);
12096 	mutex_exit(&rp->r_statelock);
12097 
12098 	/*
12099 	 * If any pages need to be committed, commit them and
12100 	 * then unlock them so that they can be freed some
12101 	 * time later.
12102 	 */
12103 	if (plist == NULL)
12104 		return (0);
12105 
12106 	/*
12107 	 * No error occurred during the flush portion
12108 	 * of this operation, so now attempt to commit
12109 	 * the data to stable storage on the server.
12110 	 *
12111 	 * This will unlock all of the pages on the list.
12112 	 */
12113 	return (nfs4_sync_commit(vp, plist, offset, len, cr));
12114 }
12115 
12116 static int
12117 nfs4_sync_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
12118     cred_t *cr)
12119 {
12120 	int error;
12121 	page_t *pp;
12122 
12123 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12124 
12125 	error = nfs4_commit(vp, (offset4)offset, (count3)count, cr);
12126 
12127 	/*
12128 	 * If we got an error, then just unlock all of the pages
12129 	 * on the list.
12130 	 */
12131 	if (error) {
12132 		while (plist != NULL) {
12133 			pp = plist;
12134 			page_sub(&plist, pp);
12135 			page_unlock(pp);
12136 		}
12137 		return (error);
12138 	}
12139 	/*
12140 	 * We've tried as hard as we can to commit the data to stable
12141 	 * storage on the server.  We just unlock the pages and clear
12142 	 * the commit required state.  They will get freed later.
12143 	 */
12144 	while (plist != NULL) {
12145 		pp = plist;
12146 		page_sub(&plist, pp);
12147 		pp->p_fsdata = C_NOCOMMIT;
12148 		page_unlock(pp);
12149 	}
12150 
12151 	return (error);
12152 }
12153 
12154 static void
12155 do_nfs4_async_commit(vnode_t *vp, page_t *plist, offset3 offset, count3 count,
12156     cred_t *cr)
12157 {
12158 
12159 	(void) nfs4_sync_commit(vp, plist, offset, count, cr);
12160 }
12161 
12162 /*ARGSUSED*/
12163 static int
12164 nfs4_setsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
12165 	caller_context_t *ct)
12166 {
12167 	int		error = 0;
12168 	mntinfo4_t	*mi;
12169 	vattr_t		va;
12170 	vsecattr_t	nfsace4_vsap;
12171 
12172 	mi = VTOMI4(vp);
12173 	if (nfs_zone() != mi->mi_zone)
12174 		return (EIO);
12175 	if (mi->mi_flags & MI4_ACL) {
12176 		/* if we have a delegation, return it */
12177 		if (VTOR4(vp)->r_deleg_type != OPEN_DELEGATE_NONE)
12178 			(void) nfs4delegreturn(VTOR4(vp),
12179 			    NFS4_DR_REOPEN|NFS4_DR_PUSH);
12180 
12181 		error = nfs4_is_acl_mask_valid(vsecattr->vsa_mask,
12182 		    NFS4_ACL_SET);
12183 		if (error) /* EINVAL */
12184 			return (error);
12185 
12186 		if (vsecattr->vsa_mask & (VSA_ACL | VSA_DFACL)) {
12187 			/*
12188 			 * These are aclent_t type entries.
12189 			 */
12190 			error = vs_aent_to_ace4(vsecattr, &nfsace4_vsap,
12191 			    vp->v_type == VDIR, FALSE);
12192 			if (error)
12193 				return (error);
12194 		} else {
12195 			/*
12196 			 * These are ace_t type entries.
12197 			 */
12198 			error = vs_acet_to_ace4(vsecattr, &nfsace4_vsap,
12199 			    FALSE);
12200 			if (error)
12201 				return (error);
12202 		}
12203 		bzero(&va, sizeof (va));
12204 		error = nfs4setattr(vp, &va, flag, cr, &nfsace4_vsap);
12205 		vs_ace4_destroy(&nfsace4_vsap);
12206 		return (error);
12207 	}
12208 	return (ENOSYS);
12209 }
12210 
12211 /* ARGSUSED */
12212 int
12213 nfs4_getsecattr(vnode_t *vp, vsecattr_t *vsecattr, int flag, cred_t *cr,
12214 	caller_context_t *ct)
12215 {
12216 	int		error;
12217 	mntinfo4_t	*mi;
12218 	nfs4_ga_res_t	gar;
12219 	rnode4_t	*rp = VTOR4(vp);
12220 
12221 	mi = VTOMI4(vp);
12222 	if (nfs_zone() != mi->mi_zone)
12223 		return (EIO);
12224 
12225 	bzero(&gar, sizeof (gar));
12226 	gar.n4g_vsa.vsa_mask = vsecattr->vsa_mask;
12227 
12228 	/*
12229 	 * vsecattr->vsa_mask holds the original acl request mask.
12230 	 * This is needed when determining what to return.
12231 	 * (See: nfs4_create_getsecattr_return())
12232 	 */
12233 	error = nfs4_is_acl_mask_valid(vsecattr->vsa_mask, NFS4_ACL_GET);
12234 	if (error) /* EINVAL */
12235 		return (error);
12236 
12237 	if (mi->mi_flags & MI4_ACL) {
12238 		/*
12239 		 * Check if the data is cached and the cache is valid.  If it
12240 		 * is we don't go over the wire.
12241 		 */
12242 		if (rp->r_secattr != NULL && ATTRCACHE4_VALID(vp)) {
12243 			mutex_enter(&rp->r_statelock);
12244 			if (rp->r_secattr != NULL) {
12245 				error = nfs4_create_getsecattr_return(
12246 				    rp->r_secattr, vsecattr, rp->r_attr.va_uid,
12247 				    rp->r_attr.va_gid,
12248 				    vp->v_type == VDIR);
12249 				if (!error) { /* error == 0 - Success! */
12250 					mutex_exit(&rp->r_statelock);
12251 					return (error);
12252 				}
12253 			}
12254 			mutex_exit(&rp->r_statelock);
12255 		}
12256 
12257 		/*
12258 		 * The getattr otw call will always get both the acl, in
12259 		 * the form of a list of nfsace4's, and the number of acl
12260 		 * entries; independent of the value of gar.n4g_vsa.vsa_mask.
12261 		 */
12262 		gar.n4g_va.va_mask = AT_ALL;
12263 		error =  nfs4_getattr_otw(vp, &gar, cr, 1);
12264 		if (error) {
12265 			vs_ace4_destroy(&gar.n4g_vsa);
12266 			if (error == ENOTSUP || error == EOPNOTSUPP)
12267 				error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12268 			return (error);
12269 		}
12270 
12271 		if (!(gar.n4g_resbmap & FATTR4_ACL_MASK)) {
12272 			/*
12273 			 * No error was returned, but according to the response
12274 			 * bitmap, neither was an acl.
12275 			 */
12276 			vs_ace4_destroy(&gar.n4g_vsa);
12277 			error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12278 			return (error);
12279 		}
12280 
12281 		/*
12282 		 * Update the cache with the ACL.
12283 		 */
12284 		nfs4_acl_fill_cache(rp, &gar.n4g_vsa);
12285 
12286 		error = nfs4_create_getsecattr_return(&gar.n4g_vsa,
12287 		    vsecattr, gar.n4g_va.va_uid, gar.n4g_va.va_gid,
12288 		    vp->v_type == VDIR);
12289 		vs_ace4_destroy(&gar.n4g_vsa);
12290 		if ((error) && (vsecattr->vsa_mask &
12291 		    (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT)) &&
12292 		    (error != EACCES)) {
12293 			error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12294 		}
12295 		return (error);
12296 	}
12297 	error = fs_fab_acl(vp, vsecattr, flag, cr, ct);
12298 	return (error);
12299 }
12300 
12301 /*
12302  * The function returns:
12303  * 	- 0 (zero) if the passed in "acl_mask" is a valid request.
12304  * 	- EINVAL if the passed in "acl_mask" is an invalid request.
12305  *
12306  * In the case of getting an acl (op == NFS4_ACL_GET) the mask is invalid if:
12307  * - We have a mixture of ACE and ACL requests (e.g. VSA_ACL | VSA_ACE)
12308  *
12309  * In the case of setting an acl (op == NFS4_ACL_SET) the mask is invalid if:
12310  * - We have a mixture of ACE and ACL requests (e.g. VSA_ACL | VSA_ACE)
12311  * - We have a count field set without the corresponding acl field set. (e.g. -
12312  * VSA_ACECNT is set, but VSA_ACE is not)
12313  */
12314 static int
12315 nfs4_is_acl_mask_valid(uint_t acl_mask, nfs4_acl_op_t op)
12316 {
12317 	/* Shortcut the masks that are always valid. */
12318 	if (acl_mask == (VSA_ACE | VSA_ACECNT))
12319 		return (0);
12320 	if (acl_mask == (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT))
12321 		return (0);
12322 
12323 	if (acl_mask & (VSA_ACE | VSA_ACECNT)) {
12324 		/*
12325 		 * We can't have any VSA_ACL type stuff in the mask now.
12326 		 */
12327 		if (acl_mask & (VSA_ACL | VSA_ACLCNT | VSA_DFACL |
12328 		    VSA_DFACLCNT))
12329 			return (EINVAL);
12330 
12331 		if (op == NFS4_ACL_SET) {
12332 			if ((acl_mask & VSA_ACECNT) && !(acl_mask & VSA_ACE))
12333 				return (EINVAL);
12334 		}
12335 	}
12336 
12337 	if (acl_mask & (VSA_ACL | VSA_ACLCNT | VSA_DFACL | VSA_DFACLCNT)) {
12338 		/*
12339 		 * We can't have any VSA_ACE type stuff in the mask now.
12340 		 */
12341 		if (acl_mask & (VSA_ACE | VSA_ACECNT))
12342 			return (EINVAL);
12343 
12344 		if (op == NFS4_ACL_SET) {
12345 			if ((acl_mask & VSA_ACLCNT) && !(acl_mask & VSA_ACL))
12346 				return (EINVAL);
12347 
12348 			if ((acl_mask & VSA_DFACLCNT) &&
12349 			    !(acl_mask & VSA_DFACL))
12350 				return (EINVAL);
12351 		}
12352 	}
12353 	return (0);
12354 }
12355 
12356 /*
12357  * The theory behind creating the correct getsecattr return is simply this:
12358  * "Don't return anything that the caller is not expecting to have to free."
12359  */
12360 static int
12361 nfs4_create_getsecattr_return(vsecattr_t *filled_vsap, vsecattr_t *vsap,
12362     uid_t uid, gid_t gid, int isdir)
12363 {
12364 	int error = 0;
12365 	/* Save the mask since the translators modify it. */
12366 	uint_t	orig_mask = vsap->vsa_mask;
12367 
12368 	if (orig_mask & (VSA_ACE | VSA_ACECNT)) {
12369 		error = vs_ace4_to_acet(filled_vsap, vsap, uid, gid,
12370 		    FALSE, ((orig_mask & VSA_ACE) ? FALSE : TRUE));
12371 
12372 		if (error)
12373 			return (error);
12374 
12375 		/*
12376 		 * If the caller only asked for the ace count (VSA_ACECNT)
12377 		 * don't give them the full acl (VSA_ACE), free it.
12378 		 */
12379 		if (!orig_mask & VSA_ACE) {
12380 			if (vsap->vsa_aclentp != NULL) {
12381 				kmem_free(vsap->vsa_aclentp,
12382 				    vsap->vsa_aclcnt * sizeof (ace_t));
12383 				vsap->vsa_aclentp = NULL;
12384 			}
12385 		}
12386 		vsap->vsa_mask = orig_mask;
12387 
12388 	} else if (orig_mask & (VSA_ACL | VSA_ACLCNT | VSA_DFACL |
12389 	    VSA_DFACLCNT)) {
12390 		error = vs_ace4_to_aent(filled_vsap, vsap, uid, gid,
12391 		    isdir, FALSE,
12392 		    ((orig_mask & (VSA_ACL | VSA_DFACL)) ? FALSE : TRUE));
12393 
12394 		if (error)
12395 			return (error);
12396 
12397 		/*
12398 		 * If the caller only asked for the acl count (VSA_ACLCNT)
12399 		 * and/or the default acl count (VSA_DFACLCNT) don't give them
12400 		 * the acl (VSA_ACL) or default acl (VSA_DFACL), free it.
12401 		 */
12402 		if (!orig_mask & VSA_ACL) {
12403 			if (vsap->vsa_aclentp != NULL) {
12404 				kmem_free(vsap->vsa_aclentp,
12405 				    vsap->vsa_aclcnt * sizeof (aclent_t));
12406 				vsap->vsa_aclentp = NULL;
12407 			}
12408 		}
12409 
12410 		if (!orig_mask & VSA_DFACL) {
12411 			if (vsap->vsa_dfaclentp != NULL) {
12412 				kmem_free(vsap->vsa_dfaclentp,
12413 				    vsap->vsa_dfaclcnt * sizeof (aclent_t));
12414 				vsap->vsa_dfaclentp = NULL;
12415 			}
12416 		}
12417 		vsap->vsa_mask = orig_mask;
12418 	}
12419 	return (0);
12420 }
12421 
12422 /* ARGSUSED */
12423 int
12424 nfs4_shrlock(vnode_t *vp, int cmd, struct shrlock *shr, int flag, cred_t *cr,
12425     caller_context_t *ct)
12426 {
12427 	int error;
12428 
12429 	if (nfs_zone() != VTOMI4(vp)->mi_zone)
12430 		return (EIO);
12431 	/*
12432 	 * check for valid cmd parameter
12433 	 */
12434 	if (cmd != F_SHARE && cmd != F_UNSHARE && cmd != F_HASREMOTELOCKS)
12435 		return (EINVAL);
12436 
12437 	/*
12438 	 * Check access permissions
12439 	 */
12440 	if ((cmd & F_SHARE) &&
12441 	    (((shr->s_access & F_RDACC) && (flag & FREAD) == 0) ||
12442 	    (shr->s_access == F_WRACC && (flag & FWRITE) == 0)))
12443 		return (EBADF);
12444 
12445 	/*
12446 	 * If the filesystem is mounted using local locking, pass the
12447 	 * request off to the local share code.
12448 	 */
12449 	if (VTOMI4(vp)->mi_flags & MI4_LLOCK)
12450 		return (fs_shrlock(vp, cmd, shr, flag, cr, ct));
12451 
12452 	switch (cmd) {
12453 	case F_SHARE:
12454 	case F_UNSHARE:
12455 		/*
12456 		 * This will be properly implemented later,
12457 		 * see RFE: 4823948 .
12458 		 */
12459 		error = EAGAIN;
12460 		break;
12461 
12462 	case F_HASREMOTELOCKS:
12463 		/*
12464 		 * NFS client can't store remote locks itself
12465 		 */
12466 		shr->s_access = 0;
12467 		error = 0;
12468 		break;
12469 
12470 	default:
12471 		error = EINVAL;
12472 		break;
12473 	}
12474 
12475 	return (error);
12476 }
12477 
12478 /*
12479  * Common code called by directory ops to update the attrcache
12480  */
12481 static int
12482 nfs4_update_attrcache(nfsstat4 status, nfs4_ga_res_t *garp,
12483     hrtime_t t, vnode_t *vp, cred_t *cr)
12484 {
12485 	int error = 0;
12486 
12487 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12488 
12489 	if (status != NFS4_OK) {
12490 		/* getattr not done or failed */
12491 		PURGE_ATTRCACHE4(vp);
12492 		return (error);
12493 	}
12494 
12495 	if (garp) {
12496 		nfs4_attr_cache(vp, garp, t, cr, FALSE, NULL);
12497 	} else {
12498 		PURGE_ATTRCACHE4(vp);
12499 	}
12500 	return (error);
12501 }
12502 
12503 /*
12504  * Update directory caches for directory modification ops (link, rename, etc.)
12505  * When dinfo is NULL, manage dircaches in the old way.
12506  */
12507 static void
12508 nfs4_update_dircaches(change_info4 *cinfo, vnode_t *dvp, vnode_t *vp, char *nm,
12509     dirattr_info_t *dinfo)
12510 {
12511 	rnode4_t	*drp = VTOR4(dvp);
12512 
12513 	ASSERT(nfs_zone() == VTOMI4(dvp)->mi_zone);
12514 
12515 	/* Purge rddir cache for dir since it changed */
12516 	if (drp->r_dir != NULL)
12517 		nfs4_purge_rddir_cache(dvp);
12518 
12519 	/*
12520 	 * If caller provided dinfo, then use it to manage dir caches.
12521 	 */
12522 	if (dinfo != NULL) {
12523 		if (vp != NULL) {
12524 			mutex_enter(&VTOR4(vp)->r_statev4_lock);
12525 			if (!VTOR4(vp)->created_v4) {
12526 				mutex_exit(&VTOR4(vp)->r_statev4_lock);
12527 				dnlc_update(dvp, nm, vp);
12528 			} else {
12529 				/*
12530 				 * XXX don't update if the created_v4 flag is
12531 				 * set
12532 				 */
12533 				mutex_exit(&VTOR4(vp)->r_statev4_lock);
12534 				NFS4_DEBUG(nfs4_client_state_debug,
12535 				    (CE_NOTE, "nfs4_update_dircaches: "
12536 				    "don't update dnlc: created_v4 flag"));
12537 			}
12538 		}
12539 
12540 		nfs4_attr_cache(dvp, dinfo->di_garp, dinfo->di_time_call,
12541 		    dinfo->di_cred, FALSE, cinfo);
12542 
12543 		return;
12544 	}
12545 
12546 	/*
12547 	 * Caller didn't provide dinfo, then check change_info4 to update DNLC.
12548 	 * Since caller modified dir but didn't receive post-dirmod-op dir
12549 	 * attrs, the dir's attrs must be purged.
12550 	 *
12551 	 * XXX this check and dnlc update/purge should really be atomic,
12552 	 * XXX but can't use rnode statelock because it'll deadlock in
12553 	 * XXX dnlc_purge_vp, however, the risk is minimal even if a race
12554 	 * XXX does occur.
12555 	 *
12556 	 * XXX We also may want to check that atomic is true in the
12557 	 * XXX change_info struct. If it is not, the change_info may
12558 	 * XXX reflect changes by more than one clients which means that
12559 	 * XXX our cache may not be valid.
12560 	 */
12561 	PURGE_ATTRCACHE4(dvp);
12562 	if (drp->r_change == cinfo->before) {
12563 		/* no changes took place in the directory prior to our link */
12564 		if (vp != NULL) {
12565 			mutex_enter(&VTOR4(vp)->r_statev4_lock);
12566 			if (!VTOR4(vp)->created_v4) {
12567 				mutex_exit(&VTOR4(vp)->r_statev4_lock);
12568 				dnlc_update(dvp, nm, vp);
12569 			} else {
12570 				/*
12571 				 * XXX dont' update if the created_v4 flag
12572 				 * is set
12573 				 */
12574 				mutex_exit(&VTOR4(vp)->r_statev4_lock);
12575 				NFS4_DEBUG(nfs4_client_state_debug, (CE_NOTE,
12576 				    "nfs4_update_dircaches: don't"
12577 				    " update dnlc: created_v4 flag"));
12578 			}
12579 		}
12580 	} else {
12581 		/* Another client modified directory - purge its dnlc cache */
12582 		dnlc_purge_vp(dvp);
12583 	}
12584 }
12585 
12586 /*
12587  * The OPEN_CONFIRM operation confirms the sequence number used in OPENing a
12588  * file.
12589  *
12590  * The 'reopening_file' boolean should be set to TRUE if we are reopening this
12591  * file (ie: client recovery) and otherwise set to FALSE.
12592  *
12593  * 'nfs4_start/end_op' should have been called by the proper (ie: not recovery
12594  * initiated) calling functions.
12595  *
12596  * 'resend' is set to TRUE if this is a OPEN_CONFIRM issued as a result
12597  * of resending a 'lost' open request.
12598  *
12599  * 'num_bseqid_retryp' makes sure we don't loop forever on a broken
12600  * server that hands out BAD_SEQID on open confirm.
12601  *
12602  * Errors are returned via the nfs4_error_t parameter.
12603  */
12604 void
12605 nfs4open_confirm(vnode_t *vp, seqid4 *seqid, stateid4 *stateid, cred_t *cr,
12606     bool_t reopening_file, bool_t *retry_open, nfs4_open_owner_t *oop,
12607     bool_t resend, nfs4_error_t *ep, int *num_bseqid_retryp)
12608 {
12609 	COMPOUND4args_clnt args;
12610 	COMPOUND4res_clnt res;
12611 	nfs_argop4 argop[2];
12612 	nfs_resop4 *resop;
12613 	int doqueue = 1;
12614 	mntinfo4_t *mi;
12615 	OPEN_CONFIRM4args *open_confirm_args;
12616 	int needrecov;
12617 
12618 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12619 #if DEBUG
12620 	mutex_enter(&oop->oo_lock);
12621 	ASSERT(oop->oo_seqid_inuse);
12622 	mutex_exit(&oop->oo_lock);
12623 #endif
12624 
12625 recov_retry_confirm:
12626 	nfs4_error_zinit(ep);
12627 	*retry_open = FALSE;
12628 
12629 	if (resend)
12630 		args.ctag = TAG_OPEN_CONFIRM_LOST;
12631 	else
12632 		args.ctag = TAG_OPEN_CONFIRM;
12633 
12634 	args.array_len = 2;
12635 	args.array = argop;
12636 
12637 	/* putfh target fh */
12638 	argop[0].argop = OP_CPUTFH;
12639 	argop[0].nfs_argop4_u.opcputfh.sfh = VTOR4(vp)->r_fh;
12640 
12641 	argop[1].argop = OP_OPEN_CONFIRM;
12642 	open_confirm_args = &argop[1].nfs_argop4_u.opopen_confirm;
12643 
12644 	(*seqid) += 1;
12645 	open_confirm_args->seqid = *seqid;
12646 	open_confirm_args->open_stateid = *stateid;
12647 
12648 	mi = VTOMI4(vp);
12649 
12650 	rfs4call(mi, &args, &res, cr, &doqueue, 0, ep);
12651 
12652 	if (!ep->error && nfs4_need_to_bump_seqid(&res)) {
12653 		nfs4_set_open_seqid((*seqid), oop, args.ctag);
12654 	}
12655 
12656 	needrecov = nfs4_needs_recovery(ep, FALSE, mi->mi_vfsp);
12657 	if (!needrecov && ep->error)
12658 		return;
12659 
12660 	if (needrecov) {
12661 		bool_t abort = FALSE;
12662 
12663 		if (reopening_file == FALSE) {
12664 			nfs4_bseqid_entry_t *bsep = NULL;
12665 
12666 			if (!ep->error && res.status == NFS4ERR_BAD_SEQID)
12667 				bsep = nfs4_create_bseqid_entry(oop, NULL,
12668 				    vp, 0, args.ctag,
12669 				    open_confirm_args->seqid);
12670 
12671 			abort = nfs4_start_recovery(ep, VTOMI4(vp), vp,
12672 			    NULL, NULL, NULL, OP_OPEN_CONFIRM, bsep);
12673 			if (bsep) {
12674 				kmem_free(bsep, sizeof (*bsep));
12675 				if (num_bseqid_retryp &&
12676 				    --(*num_bseqid_retryp) == 0)
12677 					abort = TRUE;
12678 			}
12679 		}
12680 		if ((ep->error == ETIMEDOUT ||
12681 		    res.status == NFS4ERR_RESOURCE) &&
12682 		    abort == FALSE && resend == FALSE) {
12683 			if (!ep->error)
12684 				(void) xdr_free(xdr_COMPOUND4res_clnt,
12685 				    (caddr_t)&res);
12686 
12687 			delay(SEC_TO_TICK(confirm_retry_sec));
12688 			goto recov_retry_confirm;
12689 		}
12690 		/* State may have changed so retry the entire OPEN op */
12691 		if (abort == FALSE)
12692 			*retry_open = TRUE;
12693 		else
12694 			*retry_open = FALSE;
12695 		if (!ep->error)
12696 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
12697 		return;
12698 	}
12699 
12700 	if (res.status) {
12701 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
12702 		return;
12703 	}
12704 
12705 	resop = &res.array[1];  /* open confirm res */
12706 	bcopy(&resop->nfs_resop4_u.opopen_confirm.open_stateid,
12707 	    stateid, sizeof (*stateid));
12708 
12709 	(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)&res);
12710 }
12711 
12712 /*
12713  * Return the credentials associated with a client state object.  The
12714  * caller is responsible for freeing the credentials.
12715  */
12716 
12717 static cred_t *
12718 state_to_cred(nfs4_open_stream_t *osp)
12719 {
12720 	cred_t *cr;
12721 
12722 	/*
12723 	 * It's ok to not lock the open stream and open owner to get
12724 	 * the oo_cred since this is only written once (upon creation)
12725 	 * and will not change.
12726 	 */
12727 	cr = osp->os_open_owner->oo_cred;
12728 	crhold(cr);
12729 
12730 	return (cr);
12731 }
12732 
12733 /*
12734  * nfs4_find_sysid
12735  *
12736  * Find the sysid for the knetconfig associated with the given mi.
12737  */
12738 static struct lm_sysid *
12739 nfs4_find_sysid(mntinfo4_t *mi)
12740 {
12741 	ASSERT(nfs_zone() == mi->mi_zone);
12742 
12743 	/*
12744 	 * Switch from RDMA knconf to original mount knconf
12745 	 */
12746 	return (lm_get_sysid(ORIG_KNCONF(mi), &mi->mi_curr_serv->sv_addr,
12747 	    mi->mi_curr_serv->sv_hostname, NULL));
12748 }
12749 
12750 #ifdef DEBUG
12751 /*
12752  * Return a string version of the call type for easy reading.
12753  */
12754 static char *
12755 nfs4frlock_get_call_type(nfs4_lock_call_type_t ctype)
12756 {
12757 	switch (ctype) {
12758 	case NFS4_LCK_CTYPE_NORM:
12759 		return ("NORMAL");
12760 	case NFS4_LCK_CTYPE_RECLAIM:
12761 		return ("RECLAIM");
12762 	case NFS4_LCK_CTYPE_RESEND:
12763 		return ("RESEND");
12764 	case NFS4_LCK_CTYPE_REINSTATE:
12765 		return ("REINSTATE");
12766 	default:
12767 		cmn_err(CE_PANIC, "nfs4frlock_get_call_type: got illegal "
12768 		    "type %d", ctype);
12769 		return ("");
12770 	}
12771 }
12772 #endif
12773 
12774 /*
12775  * Map the frlock cmd and lock type to the NFSv4 over-the-wire lock type
12776  * Unlock requests don't have an over-the-wire locktype, so we just return
12777  * something non-threatening.
12778  */
12779 
12780 static nfs_lock_type4
12781 flk_to_locktype(int cmd, int l_type)
12782 {
12783 	ASSERT(l_type == F_RDLCK || l_type == F_WRLCK || l_type == F_UNLCK);
12784 
12785 	switch (l_type) {
12786 	case F_UNLCK:
12787 		return (READ_LT);
12788 	case F_RDLCK:
12789 		if (cmd == F_SETLK)
12790 			return (READ_LT);
12791 		else
12792 			return (READW_LT);
12793 	case F_WRLCK:
12794 		if (cmd == F_SETLK)
12795 			return (WRITE_LT);
12796 		else
12797 			return (WRITEW_LT);
12798 	}
12799 	panic("flk_to_locktype");
12800 	/*NOTREACHED*/
12801 }
12802 
12803 /*
12804  * Do some preliminary checks for nfs4frlock.
12805  */
12806 static int
12807 nfs4frlock_validate_args(int cmd, flock64_t *flk, int flag, vnode_t *vp,
12808     u_offset_t offset)
12809 {
12810 	int error = 0;
12811 
12812 	/*
12813 	 * If we are setting a lock, check that the file is opened
12814 	 * with the correct mode.
12815 	 */
12816 	if (cmd == F_SETLK || cmd == F_SETLKW) {
12817 		if ((flk->l_type == F_RDLCK && (flag & FREAD) == 0) ||
12818 		    (flk->l_type == F_WRLCK && (flag & FWRITE) == 0)) {
12819 			NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
12820 			    "nfs4frlock_validate_args: file was opened with "
12821 			    "incorrect mode"));
12822 			return (EBADF);
12823 		}
12824 	}
12825 
12826 	/* Convert the offset. It may need to be restored before returning. */
12827 	if (error = convoff(vp, flk, 0, offset)) {
12828 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
12829 		    "nfs4frlock_validate_args: convoff  =>  error= %d\n",
12830 		    error));
12831 		return (error);
12832 	}
12833 
12834 	return (error);
12835 }
12836 
12837 /*
12838  * Set the flock64's lm_sysid for nfs4frlock.
12839  */
12840 static int
12841 nfs4frlock_get_sysid(struct lm_sysid **lspp, vnode_t *vp, flock64_t *flk)
12842 {
12843 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12844 
12845 	/* Find the lm_sysid */
12846 	*lspp = nfs4_find_sysid(VTOMI4(vp));
12847 
12848 	if (*lspp == NULL) {
12849 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
12850 		    "nfs4frlock_get_sysid: no sysid, return ENOLCK"));
12851 		return (ENOLCK);
12852 	}
12853 
12854 	flk->l_sysid = lm_sysidt(*lspp);
12855 
12856 	return (0);
12857 }
12858 
12859 /*
12860  * Do the remaining preliminary setup for nfs4frlock.
12861  */
12862 static void
12863 nfs4frlock_pre_setup(clock_t *tick_delayp, nfs4_recov_state_t *recov_statep,
12864     flock64_t *flk, short *whencep, vnode_t *vp, cred_t *search_cr,
12865     cred_t **cred_otw)
12866 {
12867 	/*
12868 	 * set tick_delay to the base delay time.
12869 	 * (NFS4_BASE_WAIT_TIME is in secs)
12870 	 */
12871 
12872 	*tick_delayp = drv_usectohz(NFS4_BASE_WAIT_TIME * 1000 * 1000);
12873 
12874 	/*
12875 	 * If lock is relative to EOF, we need the newest length of the
12876 	 * file. Therefore invalidate the ATTR_CACHE.
12877 	 */
12878 
12879 	*whencep = flk->l_whence;
12880 
12881 	if (*whencep == 2)		/* SEEK_END */
12882 		PURGE_ATTRCACHE4(vp);
12883 
12884 	recov_statep->rs_flags = 0;
12885 	recov_statep->rs_num_retry_despite_err = 0;
12886 	*cred_otw = nfs4_get_otw_cred(search_cr, VTOMI4(vp), NULL);
12887 }
12888 
12889 /*
12890  * Initialize and allocate the data structures necessary for
12891  * the nfs4frlock call.
12892  * Allocates argsp's op array, frees up the saved_rqstpp if there is one.
12893  */
12894 static void
12895 nfs4frlock_call_init(COMPOUND4args_clnt *argsp, COMPOUND4args_clnt **argspp,
12896     nfs_argop4 **argopp, nfs4_op_hint_t *op_hintp, flock64_t *flk, int cmd,
12897     bool_t *retry, bool_t *did_start_fop, COMPOUND4res_clnt **respp,
12898     bool_t *skip_get_err, nfs4_lost_rqst_t *lost_rqstp)
12899 {
12900 	int		argoplist_size;
12901 	int		num_ops = 2;
12902 
12903 	*retry = FALSE;
12904 	*did_start_fop = FALSE;
12905 	*skip_get_err = FALSE;
12906 	lost_rqstp->lr_op = 0;
12907 	argoplist_size  = num_ops * sizeof (nfs_argop4);
12908 	/* fill array with zero */
12909 	*argopp = kmem_zalloc(argoplist_size, KM_SLEEP);
12910 
12911 	*argspp = argsp;
12912 	*respp = NULL;
12913 
12914 	argsp->array_len = num_ops;
12915 	argsp->array = *argopp;
12916 
12917 	/* initialize in case of error; will get real value down below */
12918 	argsp->ctag = TAG_NONE;
12919 
12920 	if ((cmd == F_SETLK || cmd == F_SETLKW) && flk->l_type == F_UNLCK)
12921 		*op_hintp = OH_LOCKU;
12922 	else
12923 		*op_hintp = OH_OTHER;
12924 }
12925 
12926 /*
12927  * Call the nfs4_start_fop() for nfs4frlock, if necessary.  Assign
12928  * the proper nfs4_server_t for this instance of nfs4frlock.
12929  * Returns 0 (success) or an errno value.
12930  */
12931 static int
12932 nfs4frlock_start_call(nfs4_lock_call_type_t ctype, vnode_t *vp,
12933     nfs4_op_hint_t op_hint, nfs4_recov_state_t *recov_statep,
12934     bool_t *did_start_fop, bool_t *startrecovp)
12935 {
12936 	int error = 0;
12937 	rnode4_t *rp;
12938 
12939 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
12940 
12941 	if (ctype == NFS4_LCK_CTYPE_NORM) {
12942 		error = nfs4_start_fop(VTOMI4(vp), vp, NULL, op_hint,
12943 		    recov_statep, startrecovp);
12944 		if (error)
12945 			return (error);
12946 		*did_start_fop = TRUE;
12947 	} else {
12948 		*did_start_fop = FALSE;
12949 		*startrecovp = FALSE;
12950 	}
12951 
12952 	if (!error) {
12953 		rp = VTOR4(vp);
12954 
12955 		/* If the file failed recovery, just quit. */
12956 		mutex_enter(&rp->r_statelock);
12957 		if (rp->r_flags & R4RECOVERR) {
12958 			error = EIO;
12959 		}
12960 		mutex_exit(&rp->r_statelock);
12961 	}
12962 
12963 	return (error);
12964 }
12965 
12966 /*
12967  * Setup the LOCK4/LOCKU4 arguments for resending a lost lock request.  A
12968  * resend nfs4frlock call is initiated by the recovery framework.
12969  * Acquires the lop and oop seqid synchronization.
12970  */
12971 static void
12972 nfs4frlock_setup_resend_lock_args(nfs4_lost_rqst_t *resend_rqstp,
12973     COMPOUND4args_clnt *argsp, nfs_argop4 *argop, nfs4_lock_owner_t **lopp,
12974     nfs4_open_owner_t **oopp, nfs4_open_stream_t **ospp,
12975     LOCK4args **lock_argsp, LOCKU4args **locku_argsp)
12976 {
12977 	mntinfo4_t *mi = VTOMI4(resend_rqstp->lr_vp);
12978 	int error;
12979 
12980 	NFS4_DEBUG((nfs4_lost_rqst_debug || nfs4_client_lock_debug),
12981 	    (CE_NOTE,
12982 	    "nfs4frlock_setup_resend_lock_args: have lost lock to resend"));
12983 	ASSERT(resend_rqstp != NULL);
12984 	ASSERT(resend_rqstp->lr_op == OP_LOCK ||
12985 	    resend_rqstp->lr_op == OP_LOCKU);
12986 
12987 	*oopp = resend_rqstp->lr_oop;
12988 	if (resend_rqstp->lr_oop) {
12989 		open_owner_hold(resend_rqstp->lr_oop);
12990 		error = nfs4_start_open_seqid_sync(resend_rqstp->lr_oop, mi);
12991 		ASSERT(error == 0);	/* recov thread always succeeds */
12992 	}
12993 
12994 	/* Must resend this lost lock/locku request. */
12995 	ASSERT(resend_rqstp->lr_lop != NULL);
12996 	*lopp = resend_rqstp->lr_lop;
12997 	lock_owner_hold(resend_rqstp->lr_lop);
12998 	error = nfs4_start_lock_seqid_sync(resend_rqstp->lr_lop, mi);
12999 	ASSERT(error == 0);	/* recov thread always succeeds */
13000 
13001 	*ospp = resend_rqstp->lr_osp;
13002 	if (*ospp)
13003 		open_stream_hold(resend_rqstp->lr_osp);
13004 
13005 	if (resend_rqstp->lr_op == OP_LOCK) {
13006 		LOCK4args *lock_args;
13007 
13008 		argop->argop = OP_LOCK;
13009 		*lock_argsp = lock_args = &argop->nfs_argop4_u.oplock;
13010 		lock_args->locktype = resend_rqstp->lr_locktype;
13011 		lock_args->reclaim =
13012 		    (resend_rqstp->lr_ctype == NFS4_LCK_CTYPE_RECLAIM);
13013 		lock_args->offset = resend_rqstp->lr_flk->l_start;
13014 		lock_args->length = resend_rqstp->lr_flk->l_len;
13015 		if (lock_args->length == 0)
13016 			lock_args->length = ~lock_args->length;
13017 		nfs4_setup_lock_args(*lopp, *oopp, *ospp,
13018 		    mi2clientid(mi), &lock_args->locker);
13019 
13020 		switch (resend_rqstp->lr_ctype) {
13021 		case NFS4_LCK_CTYPE_RESEND:
13022 			argsp->ctag = TAG_LOCK_RESEND;
13023 			break;
13024 		case NFS4_LCK_CTYPE_REINSTATE:
13025 			argsp->ctag = TAG_LOCK_REINSTATE;
13026 			break;
13027 		case NFS4_LCK_CTYPE_RECLAIM:
13028 			argsp->ctag = TAG_LOCK_RECLAIM;
13029 			break;
13030 		default:
13031 			argsp->ctag = TAG_LOCK_UNKNOWN;
13032 			break;
13033 		}
13034 	} else {
13035 		LOCKU4args *locku_args;
13036 		nfs4_lock_owner_t *lop = resend_rqstp->lr_lop;
13037 
13038 		argop->argop = OP_LOCKU;
13039 		*locku_argsp = locku_args = &argop->nfs_argop4_u.oplocku;
13040 		locku_args->locktype = READ_LT;
13041 		locku_args->seqid = lop->lock_seqid + 1;
13042 		mutex_enter(&lop->lo_lock);
13043 		locku_args->lock_stateid = lop->lock_stateid;
13044 		mutex_exit(&lop->lo_lock);
13045 		locku_args->offset = resend_rqstp->lr_flk->l_start;
13046 		locku_args->length = resend_rqstp->lr_flk->l_len;
13047 		if (locku_args->length == 0)
13048 			locku_args->length = ~locku_args->length;
13049 
13050 		switch (resend_rqstp->lr_ctype) {
13051 		case NFS4_LCK_CTYPE_RESEND:
13052 			argsp->ctag = TAG_LOCKU_RESEND;
13053 			break;
13054 		case NFS4_LCK_CTYPE_REINSTATE:
13055 			argsp->ctag = TAG_LOCKU_REINSTATE;
13056 			break;
13057 		default:
13058 			argsp->ctag = TAG_LOCK_UNKNOWN;
13059 			break;
13060 		}
13061 	}
13062 }
13063 
13064 /*
13065  * Setup the LOCKT4 arguments.
13066  */
13067 static void
13068 nfs4frlock_setup_lockt_args(nfs4_lock_call_type_t ctype, nfs_argop4 *argop,
13069     LOCKT4args **lockt_argsp, COMPOUND4args_clnt *argsp, flock64_t *flk,
13070     rnode4_t *rp)
13071 {
13072 	LOCKT4args *lockt_args;
13073 
13074 	ASSERT(nfs_zone() == VTOMI4(RTOV4(rp))->mi_zone);
13075 	ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
13076 	argop->argop = OP_LOCKT;
13077 	argsp->ctag = TAG_LOCKT;
13078 	lockt_args = &argop->nfs_argop4_u.oplockt;
13079 
13080 	/*
13081 	 * The locktype will be READ_LT unless it's
13082 	 * a write lock. We do this because the Solaris
13083 	 * system call allows the combination of
13084 	 * F_UNLCK and F_GETLK* and so in that case the
13085 	 * unlock is mapped to a read.
13086 	 */
13087 	if (flk->l_type == F_WRLCK)
13088 		lockt_args->locktype = WRITE_LT;
13089 	else
13090 		lockt_args->locktype = READ_LT;
13091 
13092 	lockt_args->owner.clientid = mi2clientid(VTOMI4(RTOV4(rp)));
13093 	/* set the lock owner4 args */
13094 	nfs4_setlockowner_args(&lockt_args->owner, rp,
13095 	    ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pidp->pid_id :
13096 	    flk->l_pid);
13097 	lockt_args->offset = flk->l_start;
13098 	lockt_args->length = flk->l_len;
13099 	if (flk->l_len == 0)
13100 		lockt_args->length = ~lockt_args->length;
13101 
13102 	*lockt_argsp = lockt_args;
13103 }
13104 
13105 /*
13106  * If the client is holding a delegation, and the open stream to be used
13107  * with this lock request is a delegation open stream, then re-open the stream.
13108  * Sets the nfs4_error_t to all zeros unless the open stream has already
13109  * failed a reopen or we couldn't find the open stream.  NFS4ERR_DELAY
13110  * means the caller should retry (like a recovery retry).
13111  */
13112 static void
13113 nfs4frlock_check_deleg(vnode_t *vp, nfs4_error_t *ep, cred_t *cr, int lt)
13114 {
13115 	open_delegation_type4	dt;
13116 	bool_t			reopen_needed, force;
13117 	nfs4_open_stream_t	*osp;
13118 	open_claim_type4 	oclaim;
13119 	rnode4_t		*rp = VTOR4(vp);
13120 	mntinfo4_t		*mi = VTOMI4(vp);
13121 
13122 	ASSERT(nfs_zone() == mi->mi_zone);
13123 
13124 	nfs4_error_zinit(ep);
13125 
13126 	mutex_enter(&rp->r_statev4_lock);
13127 	dt = rp->r_deleg_type;
13128 	mutex_exit(&rp->r_statev4_lock);
13129 
13130 	if (dt != OPEN_DELEGATE_NONE) {
13131 		nfs4_open_owner_t	*oop;
13132 
13133 		oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
13134 		if (!oop) {
13135 			ep->stat = NFS4ERR_IO;
13136 			return;
13137 		}
13138 		/* returns with 'os_sync_lock' held */
13139 		osp = find_open_stream(oop, rp);
13140 		if (!osp) {
13141 			open_owner_rele(oop);
13142 			ep->stat = NFS4ERR_IO;
13143 			return;
13144 		}
13145 
13146 		if (osp->os_failed_reopen) {
13147 			NFS4_DEBUG((nfs4_open_stream_debug ||
13148 			    nfs4_client_lock_debug), (CE_NOTE,
13149 			    "nfs4frlock_check_deleg: os_failed_reopen set "
13150 			    "for osp %p, cr %p, rp %s", (void *)osp,
13151 			    (void *)cr, rnode4info(rp)));
13152 			mutex_exit(&osp->os_sync_lock);
13153 			open_stream_rele(osp, rp);
13154 			open_owner_rele(oop);
13155 			ep->stat = NFS4ERR_IO;
13156 			return;
13157 		}
13158 
13159 		/*
13160 		 * Determine whether a reopen is needed.  If this
13161 		 * is a delegation open stream, then send the open
13162 		 * to the server to give visibility to the open owner.
13163 		 * Even if it isn't a delegation open stream, we need
13164 		 * to check if the previous open CLAIM_DELEGATE_CUR
13165 		 * was sufficient.
13166 		 */
13167 
13168 		reopen_needed = osp->os_delegation ||
13169 		    ((lt == F_RDLCK &&
13170 		    !(osp->os_dc_openacc & OPEN4_SHARE_ACCESS_READ)) ||
13171 		    (lt == F_WRLCK &&
13172 		    !(osp->os_dc_openacc & OPEN4_SHARE_ACCESS_WRITE)));
13173 
13174 		mutex_exit(&osp->os_sync_lock);
13175 		open_owner_rele(oop);
13176 
13177 		if (reopen_needed) {
13178 			/*
13179 			 * Always use CLAIM_PREVIOUS after server reboot.
13180 			 * The server will reject CLAIM_DELEGATE_CUR if
13181 			 * it is used during the grace period.
13182 			 */
13183 			mutex_enter(&mi->mi_lock);
13184 			if (mi->mi_recovflags & MI4R_SRV_REBOOT) {
13185 				oclaim = CLAIM_PREVIOUS;
13186 				force = TRUE;
13187 			} else {
13188 				oclaim = CLAIM_DELEGATE_CUR;
13189 				force = FALSE;
13190 			}
13191 			mutex_exit(&mi->mi_lock);
13192 
13193 			nfs4_reopen(vp, osp, ep, oclaim, force, FALSE);
13194 			if (ep->error == EAGAIN) {
13195 				nfs4_error_zinit(ep);
13196 				ep->stat = NFS4ERR_DELAY;
13197 			}
13198 		}
13199 		open_stream_rele(osp, rp);
13200 		osp = NULL;
13201 	}
13202 }
13203 
13204 /*
13205  * Setup the LOCKU4 arguments.
13206  * Returns errors via the nfs4_error_t.
13207  * NFS4_OK		no problems.  *go_otwp is TRUE if call should go
13208  *			over-the-wire.  The caller must release the
13209  *			reference on *lopp.
13210  * NFS4ERR_DELAY	caller should retry (like recovery retry)
13211  * (other)		unrecoverable error.
13212  */
13213 static void
13214 nfs4frlock_setup_locku_args(nfs4_lock_call_type_t ctype, nfs_argop4 *argop,
13215     LOCKU4args **locku_argsp, flock64_t *flk,
13216     nfs4_lock_owner_t **lopp, nfs4_error_t *ep, COMPOUND4args_clnt *argsp,
13217     vnode_t *vp, int flag, u_offset_t offset, cred_t *cr,
13218     bool_t *skip_get_err, bool_t *go_otwp)
13219 {
13220 	nfs4_lock_owner_t	*lop = NULL;
13221 	LOCKU4args		*locku_args;
13222 	pid_t			pid;
13223 	bool_t			is_spec = FALSE;
13224 	rnode4_t		*rp = VTOR4(vp);
13225 
13226 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13227 	ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
13228 
13229 	nfs4frlock_check_deleg(vp, ep, cr, F_UNLCK);
13230 	if (ep->error || ep->stat)
13231 		return;
13232 
13233 	argop->argop = OP_LOCKU;
13234 	if (ctype == NFS4_LCK_CTYPE_REINSTATE)
13235 		argsp->ctag = TAG_LOCKU_REINSTATE;
13236 	else
13237 		argsp->ctag = TAG_LOCKU;
13238 	locku_args = &argop->nfs_argop4_u.oplocku;
13239 	*locku_argsp = locku_args;
13240 
13241 	/*
13242 	 * XXX what should locku_args->locktype be?
13243 	 * setting to ALWAYS be READ_LT so at least
13244 	 * it is a valid locktype.
13245 	 */
13246 
13247 	locku_args->locktype = READ_LT;
13248 
13249 	pid = ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pidp->pid_id :
13250 	    flk->l_pid;
13251 
13252 	/*
13253 	 * Get the lock owner stateid.  If no lock owner
13254 	 * exists, return success.
13255 	 */
13256 	lop = find_lock_owner(rp, pid, LOWN_ANY);
13257 	*lopp = lop;
13258 	if (lop && CLNT_ISSPECIAL(&lop->lock_stateid))
13259 		is_spec = TRUE;
13260 	if (!lop || is_spec) {
13261 		/*
13262 		 * No lock owner so no locks to unlock.
13263 		 * Return success.  If there was a failed
13264 		 * reclaim earlier, the lock might still be
13265 		 * registered with the local locking code,
13266 		 * so notify it of the unlock.
13267 		 *
13268 		 * If the lockowner is using a special stateid,
13269 		 * then the original lock request (that created
13270 		 * this lockowner) was never successful, so we
13271 		 * have no lock to undo OTW.
13272 		 */
13273 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
13274 		    "nfs4frlock_setup_locku_args: LOCKU: no lock owner "
13275 		    "(%ld) so return success", (long)pid));
13276 
13277 		if (ctype == NFS4_LCK_CTYPE_NORM)
13278 			flk->l_pid = curproc->p_pid;
13279 		nfs4_register_lock_locally(vp, flk, flag, offset);
13280 		/*
13281 		 * Release our hold and NULL out so final_cleanup
13282 		 * doesn't try to end a lock seqid sync we
13283 		 * never started.
13284 		 */
13285 		if (is_spec) {
13286 			lock_owner_rele(lop);
13287 			*lopp = NULL;
13288 		}
13289 		*skip_get_err = TRUE;
13290 		*go_otwp = FALSE;
13291 		return;
13292 	}
13293 
13294 	ep->error = nfs4_start_lock_seqid_sync(lop, VTOMI4(vp));
13295 	if (ep->error == EAGAIN) {
13296 		lock_owner_rele(lop);
13297 		*lopp = NULL;
13298 		return;
13299 	}
13300 
13301 	mutex_enter(&lop->lo_lock);
13302 	locku_args->lock_stateid = lop->lock_stateid;
13303 	mutex_exit(&lop->lo_lock);
13304 	locku_args->seqid = lop->lock_seqid + 1;
13305 
13306 	/* leave the ref count on lop, rele after RPC call */
13307 
13308 	locku_args->offset = flk->l_start;
13309 	locku_args->length = flk->l_len;
13310 	if (flk->l_len == 0)
13311 		locku_args->length = ~locku_args->length;
13312 
13313 	*go_otwp = TRUE;
13314 }
13315 
13316 /*
13317  * Setup the LOCK4 arguments.
13318  *
13319  * Returns errors via the nfs4_error_t.
13320  * NFS4_OK		no problems
13321  * NFS4ERR_DELAY	caller should retry (like recovery retry)
13322  * (other)		unrecoverable error
13323  */
13324 static void
13325 nfs4frlock_setup_lock_args(nfs4_lock_call_type_t ctype, LOCK4args **lock_argsp,
13326     nfs4_open_owner_t **oopp, nfs4_open_stream_t **ospp,
13327     nfs4_lock_owner_t **lopp, nfs_argop4 *argop, COMPOUND4args_clnt *argsp,
13328     flock64_t *flk, int cmd, vnode_t *vp, cred_t *cr, nfs4_error_t *ep)
13329 {
13330 	LOCK4args		*lock_args;
13331 	nfs4_open_owner_t	*oop = NULL;
13332 	nfs4_open_stream_t	*osp = NULL;
13333 	nfs4_lock_owner_t	*lop = NULL;
13334 	pid_t			pid;
13335 	rnode4_t		*rp = VTOR4(vp);
13336 
13337 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13338 
13339 	nfs4frlock_check_deleg(vp, ep, cr, flk->l_type);
13340 	if (ep->error || ep->stat != NFS4_OK)
13341 		return;
13342 
13343 	argop->argop = OP_LOCK;
13344 	if (ctype == NFS4_LCK_CTYPE_NORM)
13345 		argsp->ctag = TAG_LOCK;
13346 	else if (ctype == NFS4_LCK_CTYPE_RECLAIM)
13347 		argsp->ctag = TAG_RELOCK;
13348 	else
13349 		argsp->ctag = TAG_LOCK_REINSTATE;
13350 	lock_args = &argop->nfs_argop4_u.oplock;
13351 	lock_args->locktype = flk_to_locktype(cmd, flk->l_type);
13352 	lock_args->reclaim = ctype == NFS4_LCK_CTYPE_RECLAIM ? 1 : 0;
13353 	/*
13354 	 * Get the lock owner.  If no lock owner exists,
13355 	 * create a 'temporary' one and grab the open seqid
13356 	 * synchronization (which puts a hold on the open
13357 	 * owner and open stream).
13358 	 * This also grabs the lock seqid synchronization.
13359 	 */
13360 	pid = ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pid : flk->l_pid;
13361 	ep->stat =
13362 	    nfs4_find_or_create_lock_owner(pid, rp, cr, &oop, &osp, &lop);
13363 
13364 	if (ep->stat != NFS4_OK)
13365 		goto out;
13366 
13367 	nfs4_setup_lock_args(lop, oop, osp, mi2clientid(VTOMI4(vp)),
13368 	    &lock_args->locker);
13369 
13370 	lock_args->offset = flk->l_start;
13371 	lock_args->length = flk->l_len;
13372 	if (flk->l_len == 0)
13373 		lock_args->length = ~lock_args->length;
13374 	*lock_argsp = lock_args;
13375 out:
13376 	*oopp = oop;
13377 	*ospp = osp;
13378 	*lopp = lop;
13379 }
13380 
13381 /*
13382  * After we get the reply from the server, record the proper information
13383  * for possible resend lock requests.
13384  *
13385  * Allocates memory for the saved_rqstp if we have a lost lock to save.
13386  */
13387 static void
13388 nfs4frlock_save_lost_rqst(nfs4_lock_call_type_t ctype, int error,
13389     nfs_lock_type4 locktype, nfs4_open_owner_t *oop,
13390     nfs4_open_stream_t *osp, nfs4_lock_owner_t *lop, flock64_t *flk,
13391     nfs4_lost_rqst_t *lost_rqstp, cred_t *cr, vnode_t *vp)
13392 {
13393 	bool_t unlock = (flk->l_type == F_UNLCK);
13394 
13395 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13396 	ASSERT(ctype == NFS4_LCK_CTYPE_NORM ||
13397 	    ctype == NFS4_LCK_CTYPE_REINSTATE);
13398 
13399 	if (error != 0 && !unlock) {
13400 		NFS4_DEBUG((nfs4_lost_rqst_debug ||
13401 		    nfs4_client_lock_debug), (CE_NOTE,
13402 		    "nfs4frlock_save_lost_rqst: set lo_pending_rqsts to 1 "
13403 		    " for lop %p", (void *)lop));
13404 		ASSERT(lop != NULL);
13405 		mutex_enter(&lop->lo_lock);
13406 		lop->lo_pending_rqsts = 1;
13407 		mutex_exit(&lop->lo_lock);
13408 	}
13409 
13410 	lost_rqstp->lr_putfirst = FALSE;
13411 	lost_rqstp->lr_op = 0;
13412 
13413 	/*
13414 	 * For lock/locku requests, we treat EINTR as ETIMEDOUT for
13415 	 * recovery purposes so that the lock request that was sent
13416 	 * can be saved and re-issued later.  Ditto for EIO from a forced
13417 	 * unmount.  This is done to have the client's local locking state
13418 	 * match the v4 server's state; that is, the request was
13419 	 * potentially received and accepted by the server but the client
13420 	 * thinks it was not.
13421 	 */
13422 	if (error == ETIMEDOUT || error == EINTR ||
13423 	    NFS4_FRC_UNMT_ERR(error, vp->v_vfsp)) {
13424 		NFS4_DEBUG((nfs4_lost_rqst_debug ||
13425 		    nfs4_client_lock_debug), (CE_NOTE,
13426 		    "nfs4frlock_save_lost_rqst: got a lost %s lock for "
13427 		    "lop %p oop %p osp %p", unlock ? "LOCKU" : "LOCK",
13428 		    (void *)lop, (void *)oop, (void *)osp));
13429 		if (unlock)
13430 			lost_rqstp->lr_op = OP_LOCKU;
13431 		else {
13432 			lost_rqstp->lr_op = OP_LOCK;
13433 			lost_rqstp->lr_locktype = locktype;
13434 		}
13435 		/*
13436 		 * Objects are held and rele'd via the recovery code.
13437 		 * See nfs4_save_lost_rqst.
13438 		 */
13439 		lost_rqstp->lr_vp = vp;
13440 		lost_rqstp->lr_dvp = NULL;
13441 		lost_rqstp->lr_oop = oop;
13442 		lost_rqstp->lr_osp = osp;
13443 		lost_rqstp->lr_lop = lop;
13444 		lost_rqstp->lr_cr = cr;
13445 		switch (ctype) {
13446 		case NFS4_LCK_CTYPE_NORM:
13447 			flk->l_pid = ttoproc(curthread)->p_pid;
13448 			lost_rqstp->lr_ctype = NFS4_LCK_CTYPE_RESEND;
13449 			break;
13450 		case NFS4_LCK_CTYPE_REINSTATE:
13451 			lost_rqstp->lr_putfirst = TRUE;
13452 			lost_rqstp->lr_ctype = ctype;
13453 			break;
13454 		default:
13455 			break;
13456 		}
13457 		lost_rqstp->lr_flk = flk;
13458 	}
13459 }
13460 
13461 /*
13462  * Update lop's seqid.  Also update the seqid stored in a resend request,
13463  * if any.  (Some recovery errors increment the seqid, and we may have to
13464  * send the resend request again.)
13465  */
13466 
13467 static void
13468 nfs4frlock_bump_seqid(LOCK4args *lock_args, LOCKU4args *locku_args,
13469     nfs4_open_owner_t *oop, nfs4_lock_owner_t *lop, nfs4_tag_type_t tag_type)
13470 {
13471 	if (lock_args) {
13472 		if (lock_args->locker.new_lock_owner == TRUE)
13473 			nfs4_get_and_set_next_open_seqid(oop, tag_type);
13474 		else {
13475 			ASSERT(lop->lo_flags & NFS4_LOCK_SEQID_INUSE);
13476 			nfs4_set_lock_seqid(lop->lock_seqid + 1, lop);
13477 		}
13478 	} else if (locku_args) {
13479 		ASSERT(lop->lo_flags & NFS4_LOCK_SEQID_INUSE);
13480 		nfs4_set_lock_seqid(lop->lock_seqid +1, lop);
13481 	}
13482 }
13483 
13484 /*
13485  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13486  * COMPOUND4 args/res for calls that need to retry.
13487  * Switches the *cred_otwp to base_cr.
13488  */
13489 static void
13490 nfs4frlock_check_access(vnode_t *vp, nfs4_op_hint_t op_hint,
13491     nfs4_recov_state_t *recov_statep, int needrecov, bool_t *did_start_fop,
13492     COMPOUND4args_clnt **argspp, COMPOUND4res_clnt **respp, int error,
13493     nfs4_lock_owner_t **lopp, nfs4_open_owner_t **oopp,
13494     nfs4_open_stream_t **ospp, cred_t *base_cr, cred_t **cred_otwp)
13495 {
13496 	nfs4_open_owner_t	*oop = *oopp;
13497 	nfs4_open_stream_t	*osp = *ospp;
13498 	nfs4_lock_owner_t	*lop = *lopp;
13499 	nfs_argop4		*argop = (*argspp)->array;
13500 
13501 	if (*did_start_fop) {
13502 		nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint, recov_statep,
13503 		    needrecov);
13504 		*did_start_fop = FALSE;
13505 	}
13506 	ASSERT((*argspp)->array_len == 2);
13507 	if (argop[1].argop == OP_LOCK)
13508 		nfs4args_lock_free(&argop[1]);
13509 	else if (argop[1].argop == OP_LOCKT)
13510 		nfs4args_lockt_free(&argop[1]);
13511 	kmem_free(argop, 2 * sizeof (nfs_argop4));
13512 	if (!error)
13513 		(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)*respp);
13514 	*argspp = NULL;
13515 	*respp = NULL;
13516 
13517 	if (lop) {
13518 		nfs4_end_lock_seqid_sync(lop);
13519 		lock_owner_rele(lop);
13520 		*lopp = NULL;
13521 	}
13522 
13523 	/* need to free up the reference on osp for lock args */
13524 	if (osp != NULL) {
13525 		open_stream_rele(osp, VTOR4(vp));
13526 		*ospp = NULL;
13527 	}
13528 
13529 	/* need to free up the reference on oop for lock args */
13530 	if (oop != NULL) {
13531 		nfs4_end_open_seqid_sync(oop);
13532 		open_owner_rele(oop);
13533 		*oopp = NULL;
13534 	}
13535 
13536 	crfree(*cred_otwp);
13537 	*cred_otwp = base_cr;
13538 	crhold(*cred_otwp);
13539 }
13540 
13541 /*
13542  * Function to process the client's recovery for nfs4frlock.
13543  * Returns TRUE if we should retry the lock request; FALSE otherwise.
13544  *
13545  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13546  * COMPOUND4 args/res for calls that need to retry.
13547  *
13548  * Note: the rp's r_lkserlock is *not* dropped during this path.
13549  */
13550 static bool_t
13551 nfs4frlock_recovery(int needrecov, nfs4_error_t *ep,
13552     COMPOUND4args_clnt **argspp, COMPOUND4res_clnt **respp,
13553     LOCK4args *lock_args, LOCKU4args *locku_args,
13554     nfs4_open_owner_t **oopp, nfs4_open_stream_t **ospp,
13555     nfs4_lock_owner_t **lopp, rnode4_t *rp, vnode_t *vp,
13556     nfs4_recov_state_t *recov_statep, nfs4_op_hint_t op_hint,
13557     bool_t *did_start_fop, nfs4_lost_rqst_t *lost_rqstp, flock64_t *flk)
13558 {
13559 	nfs4_open_owner_t	*oop = *oopp;
13560 	nfs4_open_stream_t	*osp = *ospp;
13561 	nfs4_lock_owner_t	*lop = *lopp;
13562 
13563 	bool_t abort, retry;
13564 
13565 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13566 	ASSERT((*argspp) != NULL);
13567 	ASSERT((*respp) != NULL);
13568 	if (lock_args || locku_args)
13569 		ASSERT(lop != NULL);
13570 
13571 	NFS4_DEBUG((nfs4_client_lock_debug || nfs4_client_recov_debug),
13572 	    (CE_NOTE, "nfs4frlock_recovery: initiating recovery\n"));
13573 
13574 	retry = TRUE;
13575 	abort = FALSE;
13576 	if (needrecov) {
13577 		nfs4_bseqid_entry_t *bsep = NULL;
13578 		nfs_opnum4 op;
13579 
13580 		op = lock_args ? OP_LOCK : locku_args ? OP_LOCKU : OP_LOCKT;
13581 
13582 		if (!ep->error && ep->stat == NFS4ERR_BAD_SEQID) {
13583 			seqid4 seqid;
13584 
13585 			if (lock_args) {
13586 				if (lock_args->locker.new_lock_owner == TRUE)
13587 					seqid = lock_args->locker.locker4_u.
13588 					    open_owner.open_seqid;
13589 				else
13590 					seqid = lock_args->locker.locker4_u.
13591 					    lock_owner.lock_seqid;
13592 			} else if (locku_args) {
13593 				seqid = locku_args->seqid;
13594 			} else {
13595 				seqid = 0;
13596 			}
13597 
13598 			bsep = nfs4_create_bseqid_entry(oop, lop, vp,
13599 			    flk->l_pid, (*argspp)->ctag, seqid);
13600 		}
13601 
13602 		abort = nfs4_start_recovery(ep, VTOMI4(vp), vp, NULL, NULL,
13603 		    (lost_rqstp && (lost_rqstp->lr_op == OP_LOCK ||
13604 		    lost_rqstp->lr_op == OP_LOCKU)) ? lost_rqstp :
13605 		    NULL, op, bsep);
13606 
13607 		if (bsep)
13608 			kmem_free(bsep, sizeof (*bsep));
13609 	}
13610 
13611 	/*
13612 	 * Return that we do not want to retry the request for 3 cases:
13613 	 * 1. If we received EINTR or are bailing out because of a forced
13614 	 *    unmount, we came into this code path just for the sake of
13615 	 *    initiating recovery, we now need to return the error.
13616 	 * 2. If we have aborted recovery.
13617 	 * 3. We received NFS4ERR_BAD_SEQID.
13618 	 */
13619 	if (ep->error == EINTR || NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp) ||
13620 	    abort == TRUE || (ep->error == 0 && ep->stat == NFS4ERR_BAD_SEQID))
13621 		retry = FALSE;
13622 
13623 	if (*did_start_fop == TRUE) {
13624 		nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint, recov_statep,
13625 		    needrecov);
13626 		*did_start_fop = FALSE;
13627 	}
13628 
13629 	if (retry == TRUE) {
13630 		nfs_argop4	*argop;
13631 
13632 		argop = (*argspp)->array;
13633 		ASSERT((*argspp)->array_len == 2);
13634 
13635 		if (argop[1].argop == OP_LOCK)
13636 			nfs4args_lock_free(&argop[1]);
13637 		else if (argop[1].argop == OP_LOCKT)
13638 			nfs4args_lockt_free(&argop[1]);
13639 		kmem_free(argop, 2 * sizeof (nfs_argop4));
13640 		if (!ep->error)
13641 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)*respp);
13642 		*respp = NULL;
13643 		*argspp = NULL;
13644 	}
13645 
13646 	if (lop != NULL) {
13647 		nfs4_end_lock_seqid_sync(lop);
13648 		lock_owner_rele(lop);
13649 	}
13650 
13651 	*lopp = NULL;
13652 
13653 	/* need to free up the reference on osp for lock args */
13654 	if (osp != NULL) {
13655 		open_stream_rele(osp, rp);
13656 		*ospp = NULL;
13657 	}
13658 
13659 	/* need to free up the reference on oop for lock args */
13660 	if (oop != NULL) {
13661 		nfs4_end_open_seqid_sync(oop);
13662 		open_owner_rele(oop);
13663 		*oopp = NULL;
13664 	}
13665 
13666 	return (retry);
13667 }
13668 
13669 /*
13670  * Handles the successful reply from the server for nfs4frlock.
13671  */
13672 static void
13673 nfs4frlock_results_ok(nfs4_lock_call_type_t ctype, int cmd, flock64_t *flk,
13674     vnode_t *vp, int flag, u_offset_t offset,
13675     nfs4_lost_rqst_t *resend_rqstp)
13676 {
13677 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13678 	if ((cmd == F_SETLK || cmd == F_SETLKW) &&
13679 	    (flk->l_type == F_RDLCK || flk->l_type == F_WRLCK)) {
13680 		if (ctype == NFS4_LCK_CTYPE_NORM) {
13681 			flk->l_pid = ttoproc(curthread)->p_pid;
13682 			/*
13683 			 * We do not register lost locks locally in
13684 			 * the 'resend' case since the user/application
13685 			 * doesn't think we have the lock.
13686 			 */
13687 			ASSERT(!resend_rqstp);
13688 			nfs4_register_lock_locally(vp, flk, flag, offset);
13689 		}
13690 	}
13691 }
13692 
13693 /*
13694  * Handle the DENIED reply from the server for nfs4frlock.
13695  * Returns TRUE if we should retry the request; FALSE otherwise.
13696  *
13697  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13698  * COMPOUND4 args/res for calls that need to retry.  Can also
13699  * drop and regrab the r_lkserlock.
13700  */
13701 static bool_t
13702 nfs4frlock_results_denied(nfs4_lock_call_type_t ctype, LOCK4args *lock_args,
13703     LOCKT4args *lockt_args, nfs4_open_owner_t **oopp,
13704     nfs4_open_stream_t **ospp, nfs4_lock_owner_t **lopp, int cmd,
13705     vnode_t *vp, flock64_t *flk, nfs4_op_hint_t op_hint,
13706     nfs4_recov_state_t *recov_statep, int needrecov,
13707     COMPOUND4args_clnt **argspp, COMPOUND4res_clnt **respp,
13708     clock_t *tick_delayp, short *whencep, int *errorp,
13709     nfs_resop4 *resop, cred_t *cr, bool_t *did_start_fop,
13710     bool_t *skip_get_err)
13711 {
13712 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13713 
13714 	if (lock_args) {
13715 		nfs4_open_owner_t	*oop = *oopp;
13716 		nfs4_open_stream_t	*osp = *ospp;
13717 		nfs4_lock_owner_t	*lop = *lopp;
13718 		int			intr;
13719 
13720 		/*
13721 		 * Blocking lock needs to sleep and retry from the request.
13722 		 *
13723 		 * Do not block and wait for 'resend' or 'reinstate'
13724 		 * lock requests, just return the error.
13725 		 *
13726 		 * Note: reclaim requests have cmd == F_SETLK, not F_SETLKW.
13727 		 */
13728 		if (cmd == F_SETLKW) {
13729 			rnode4_t *rp = VTOR4(vp);
13730 			nfs_argop4 *argop = (*argspp)->array;
13731 
13732 			ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
13733 
13734 			nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint,
13735 			    recov_statep, needrecov);
13736 			*did_start_fop = FALSE;
13737 			ASSERT((*argspp)->array_len == 2);
13738 			if (argop[1].argop == OP_LOCK)
13739 				nfs4args_lock_free(&argop[1]);
13740 			else if (argop[1].argop == OP_LOCKT)
13741 				nfs4args_lockt_free(&argop[1]);
13742 			kmem_free(argop, 2 * sizeof (nfs_argop4));
13743 			if (*respp)
13744 				(void) xdr_free(xdr_COMPOUND4res_clnt,
13745 				    (caddr_t)*respp);
13746 			*argspp = NULL;
13747 			*respp = NULL;
13748 			nfs4_end_lock_seqid_sync(lop);
13749 			lock_owner_rele(lop);
13750 			*lopp = NULL;
13751 			if (osp != NULL) {
13752 				open_stream_rele(osp, rp);
13753 				*ospp = NULL;
13754 			}
13755 			if (oop != NULL) {
13756 				nfs4_end_open_seqid_sync(oop);
13757 				open_owner_rele(oop);
13758 				*oopp = NULL;
13759 			}
13760 
13761 			nfs_rw_exit(&rp->r_lkserlock);
13762 
13763 			intr = nfs4_block_and_wait(tick_delayp, rp);
13764 
13765 			if (intr) {
13766 				(void) nfs_rw_enter_sig(&rp->r_lkserlock,
13767 				    RW_WRITER, FALSE);
13768 				*errorp = EINTR;
13769 				return (FALSE);
13770 			}
13771 
13772 			(void) nfs_rw_enter_sig(&rp->r_lkserlock,
13773 			    RW_WRITER, FALSE);
13774 
13775 			/*
13776 			 * Make sure we are still safe to lock with
13777 			 * regards to mmapping.
13778 			 */
13779 			if (!nfs4_safelock(vp, flk, cr)) {
13780 				*errorp = EAGAIN;
13781 				return (FALSE);
13782 			}
13783 
13784 			return (TRUE);
13785 		}
13786 		if (ctype == NFS4_LCK_CTYPE_NORM)
13787 			*errorp = EAGAIN;
13788 		*skip_get_err = TRUE;
13789 		flk->l_whence = 0;
13790 		*whencep = 0;
13791 		return (FALSE);
13792 	} else if (lockt_args) {
13793 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
13794 		    "nfs4frlock_results_denied: OP_LOCKT DENIED"));
13795 
13796 		denied_to_flk(&resop->nfs_resop4_u.oplockt.denied,
13797 		    flk, lockt_args);
13798 
13799 		/* according to NLM code */
13800 		*errorp = 0;
13801 		*whencep = 0;
13802 		*skip_get_err = TRUE;
13803 		return (FALSE);
13804 	}
13805 	return (FALSE);
13806 }
13807 
13808 /*
13809  * Handles all NFS4 errors besides NFS4_OK and NFS4ERR_DENIED for nfs4frlock.
13810  */
13811 static void
13812 nfs4frlock_results_default(COMPOUND4res_clnt *resp, int *errorp)
13813 {
13814 	switch (resp->status) {
13815 	case NFS4ERR_ACCESS:
13816 	case NFS4ERR_ADMIN_REVOKED:
13817 	case NFS4ERR_BADHANDLE:
13818 	case NFS4ERR_BAD_RANGE:
13819 	case NFS4ERR_BAD_SEQID:
13820 	case NFS4ERR_BAD_STATEID:
13821 	case NFS4ERR_BADXDR:
13822 	case NFS4ERR_DEADLOCK:
13823 	case NFS4ERR_DELAY:
13824 	case NFS4ERR_EXPIRED:
13825 	case NFS4ERR_FHEXPIRED:
13826 	case NFS4ERR_GRACE:
13827 	case NFS4ERR_INVAL:
13828 	case NFS4ERR_ISDIR:
13829 	case NFS4ERR_LEASE_MOVED:
13830 	case NFS4ERR_LOCK_NOTSUPP:
13831 	case NFS4ERR_LOCK_RANGE:
13832 	case NFS4ERR_MOVED:
13833 	case NFS4ERR_NOFILEHANDLE:
13834 	case NFS4ERR_NO_GRACE:
13835 	case NFS4ERR_OLD_STATEID:
13836 	case NFS4ERR_OPENMODE:
13837 	case NFS4ERR_RECLAIM_BAD:
13838 	case NFS4ERR_RECLAIM_CONFLICT:
13839 	case NFS4ERR_RESOURCE:
13840 	case NFS4ERR_SERVERFAULT:
13841 	case NFS4ERR_STALE:
13842 	case NFS4ERR_STALE_CLIENTID:
13843 	case NFS4ERR_STALE_STATEID:
13844 		return;
13845 	default:
13846 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
13847 		    "nfs4frlock_results_default: got unrecognizable "
13848 		    "res.status %d", resp->status));
13849 		*errorp = NFS4ERR_INVAL;
13850 	}
13851 }
13852 
13853 /*
13854  * The lock request was successful, so update the client's state.
13855  */
13856 static void
13857 nfs4frlock_update_state(LOCK4args *lock_args, LOCKU4args *locku_args,
13858     LOCKT4args *lockt_args, nfs_resop4 *resop, nfs4_lock_owner_t *lop,
13859     vnode_t *vp, flock64_t *flk, cred_t *cr,
13860     nfs4_lost_rqst_t *resend_rqstp)
13861 {
13862 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
13863 
13864 	if (lock_args) {
13865 		LOCK4res *lock_res;
13866 
13867 		lock_res = &resop->nfs_resop4_u.oplock;
13868 		/* update the stateid with server's response */
13869 
13870 		if (lock_args->locker.new_lock_owner == TRUE) {
13871 			mutex_enter(&lop->lo_lock);
13872 			lop->lo_just_created = NFS4_PERM_CREATED;
13873 			mutex_exit(&lop->lo_lock);
13874 		}
13875 
13876 		nfs4_set_lock_stateid(lop, lock_res->LOCK4res_u.lock_stateid);
13877 
13878 		/*
13879 		 * If the lock was the result of a resending a lost
13880 		 * request, we've synched up the stateid and seqid
13881 		 * with the server, but now the server might be out of sync
13882 		 * with what the application thinks it has for locks.
13883 		 * Clean that up here.  It's unclear whether we should do
13884 		 * this even if the filesystem has been forcibly unmounted.
13885 		 * For most servers, it's probably wasted effort, but
13886 		 * RFC3530 lets servers require that unlocks exactly match
13887 		 * the locks that are held.
13888 		 */
13889 		if (resend_rqstp != NULL &&
13890 		    resend_rqstp->lr_ctype != NFS4_LCK_CTYPE_REINSTATE) {
13891 			nfs4_reinstitute_local_lock_state(vp, flk, cr, lop);
13892 		} else {
13893 			flk->l_whence = 0;
13894 		}
13895 	} else if (locku_args) {
13896 		LOCKU4res *locku_res;
13897 
13898 		locku_res = &resop->nfs_resop4_u.oplocku;
13899 
13900 		/* Update the stateid with the server's response */
13901 		nfs4_set_lock_stateid(lop, locku_res->lock_stateid);
13902 	} else if (lockt_args) {
13903 		/* Switch the lock type to express success, see fcntl */
13904 		flk->l_type = F_UNLCK;
13905 		flk->l_whence = 0;
13906 	}
13907 }
13908 
13909 /*
13910  * Do final cleanup before exiting nfs4frlock.
13911  * Calls nfs4_end_fop, drops the seqid syncs, and frees up the
13912  * COMPOUND4 args/res for calls that haven't already.
13913  */
13914 static void
13915 nfs4frlock_final_cleanup(nfs4_lock_call_type_t ctype, COMPOUND4args_clnt *argsp,
13916     COMPOUND4res_clnt *resp, vnode_t *vp, nfs4_op_hint_t op_hint,
13917     nfs4_recov_state_t *recov_statep, int needrecov, nfs4_open_owner_t *oop,
13918     nfs4_open_stream_t *osp, nfs4_lock_owner_t *lop, flock64_t *flk,
13919     short whence, u_offset_t offset, struct lm_sysid *ls,
13920     int *errorp, LOCK4args *lock_args, LOCKU4args *locku_args,
13921     bool_t did_start_fop, bool_t skip_get_err,
13922     cred_t *cred_otw, cred_t *cred)
13923 {
13924 	mntinfo4_t	*mi = VTOMI4(vp);
13925 	rnode4_t	*rp = VTOR4(vp);
13926 	int		error = *errorp;
13927 	nfs_argop4	*argop;
13928 
13929 	ASSERT(nfs_zone() == mi->mi_zone);
13930 	/*
13931 	 * The client recovery code wants the raw status information,
13932 	 * so don't map the NFS status code to an errno value for
13933 	 * non-normal call types.
13934 	 */
13935 	if (ctype == NFS4_LCK_CTYPE_NORM) {
13936 		if (*errorp == 0 && resp != NULL && skip_get_err == FALSE)
13937 			*errorp = geterrno4(resp->status);
13938 		if (did_start_fop == TRUE)
13939 			nfs4_end_fop(mi, vp, NULL, op_hint, recov_statep,
13940 			    needrecov);
13941 
13942 		/*
13943 		 * We've established a new lock on the server, so invalidate
13944 		 * the pages associated with the vnode to get the most up to
13945 		 * date pages from the server after acquiring the lock. We
13946 		 * want to be sure that the read operation gets the newest data.
13947 		 * N.B.
13948 		 * We used to do this in nfs4frlock_results_ok but that doesn't
13949 		 * work since VOP_PUTPAGE can call nfs4_commit which calls
13950 		 * nfs4_start_fop. We flush the pages below after calling
13951 		 * nfs4_end_fop above
13952 		 */
13953 		if (!error && resp && resp->status == NFS4_OK) {
13954 			int error;
13955 
13956 			error = VOP_PUTPAGE(vp, (u_offset_t)0,
13957 			    0, B_INVAL, cred, NULL);
13958 
13959 			if (error && (error == ENOSPC || error == EDQUOT)) {
13960 				rnode4_t *rp = VTOR4(vp);
13961 
13962 				mutex_enter(&rp->r_statelock);
13963 				if (!rp->r_error)
13964 					rp->r_error = error;
13965 				mutex_exit(&rp->r_statelock);
13966 			}
13967 		}
13968 	}
13969 	if (argsp) {
13970 		ASSERT(argsp->array_len == 2);
13971 		argop = argsp->array;
13972 		if (argop[1].argop == OP_LOCK)
13973 			nfs4args_lock_free(&argop[1]);
13974 		else if (argop[1].argop == OP_LOCKT)
13975 			nfs4args_lockt_free(&argop[1]);
13976 		kmem_free(argop, 2 * sizeof (nfs_argop4));
13977 		if (resp)
13978 			(void) xdr_free(xdr_COMPOUND4res_clnt, (caddr_t)resp);
13979 	}
13980 
13981 	/* free the reference on the lock owner */
13982 	if (lop != NULL) {
13983 		nfs4_end_lock_seqid_sync(lop);
13984 		lock_owner_rele(lop);
13985 	}
13986 
13987 	/* need to free up the reference on osp for lock args */
13988 	if (osp != NULL)
13989 		open_stream_rele(osp, rp);
13990 
13991 	/* need to free up the reference on oop for lock args */
13992 	if (oop != NULL) {
13993 		nfs4_end_open_seqid_sync(oop);
13994 		open_owner_rele(oop);
13995 	}
13996 
13997 	(void) convoff(vp, flk, whence, offset);
13998 
13999 	lm_rel_sysid(ls);
14000 
14001 	/*
14002 	 * Record debug information in the event we get EINVAL.
14003 	 */
14004 	mutex_enter(&mi->mi_lock);
14005 	if (*errorp == EINVAL && (lock_args || locku_args) &&
14006 	    (!(mi->mi_flags & MI4_POSIX_LOCK))) {
14007 		if (!(mi->mi_flags & MI4_LOCK_DEBUG)) {
14008 			zcmn_err(getzoneid(), CE_NOTE,
14009 			    "%s operation failed with "
14010 			    "EINVAL probably since the server, %s,"
14011 			    " doesn't support POSIX style locking",
14012 			    lock_args ? "LOCK" : "LOCKU",
14013 			    mi->mi_curr_serv->sv_hostname);
14014 			mi->mi_flags |= MI4_LOCK_DEBUG;
14015 		}
14016 	}
14017 	mutex_exit(&mi->mi_lock);
14018 
14019 	if (cred_otw)
14020 		crfree(cred_otw);
14021 }
14022 
14023 /*
14024  * This calls the server and the local locking code.
14025  *
14026  * Client locks are registerred locally by oring the sysid with
14027  * LM_SYSID_CLIENT. The server registers locks locally using just the sysid.
14028  * We need to distinguish between the two to avoid collision in case one
14029  * machine is used as both client and server.
14030  *
14031  * Blocking lock requests will continually retry to acquire the lock
14032  * forever.
14033  *
14034  * The ctype is defined as follows:
14035  * NFS4_LCK_CTYPE_NORM: normal lock request.
14036  *
14037  * NFS4_LCK_CTYPE_RECLAIM:  bypass the usual calls for synchronizing with client
14038  * recovery, get the pid from flk instead of curproc, and don't reregister
14039  * the lock locally.
14040  *
14041  * NFS4_LCK_CTYPE_RESEND: same as NFS4_LCK_CTYPE_RECLAIM, with the addition
14042  * that we will use the information passed in via resend_rqstp to setup the
14043  * lock/locku request.  This resend is the exact same request as the 'lost
14044  * lock', and is initiated by the recovery framework. A successful resend
14045  * request can initiate one or more reinstate requests.
14046  *
14047  * NFS4_LCK_CTYPE_REINSTATE: same as NFS4_LCK_CTYPE_RESEND, except that it
14048  * does not trigger additional reinstate requests.  This lock call type is
14049  * set for setting the v4 server's locking state back to match what the
14050  * client's local locking state is in the event of a received 'lost lock'.
14051  *
14052  * Errors are returned via the nfs4_error_t parameter.
14053  */
14054 void
14055 nfs4frlock(nfs4_lock_call_type_t ctype, vnode_t *vp, int cmd, flock64_t *flk,
14056     int flag, u_offset_t offset, cred_t *cr, nfs4_error_t *ep,
14057     nfs4_lost_rqst_t *resend_rqstp, int *did_reclaimp)
14058 {
14059 	COMPOUND4args_clnt	args, *argsp = NULL;
14060 	COMPOUND4res_clnt	res, *resp = NULL;
14061 	nfs_argop4	*argop;
14062 	nfs_resop4	*resop;
14063 	rnode4_t	*rp;
14064 	int		doqueue = 1;
14065 	clock_t		tick_delay;  /* delay in clock ticks */
14066 	struct lm_sysid	*ls;
14067 	LOCK4args	*lock_args = NULL;
14068 	LOCKU4args	*locku_args = NULL;
14069 	LOCKT4args	*lockt_args = NULL;
14070 	nfs4_open_owner_t *oop = NULL;
14071 	nfs4_open_stream_t *osp = NULL;
14072 	nfs4_lock_owner_t *lop = NULL;
14073 	bool_t		needrecov = FALSE;
14074 	nfs4_recov_state_t recov_state;
14075 	short		whence;
14076 	nfs4_op_hint_t	op_hint;
14077 	nfs4_lost_rqst_t lost_rqst;
14078 	bool_t		retry = FALSE;
14079 	bool_t		did_start_fop = FALSE;
14080 	bool_t		skip_get_err = FALSE;
14081 	cred_t		*cred_otw = NULL;
14082 	bool_t		recovonly;	/* just queue request */
14083 	int		frc_no_reclaim = 0;
14084 #ifdef DEBUG
14085 	char *name;
14086 #endif
14087 
14088 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14089 
14090 #ifdef DEBUG
14091 	name = fn_name(VTOSV(vp)->sv_name);
14092 	NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4frlock: "
14093 	    "%s: cmd %d, type %d, offset %llu, start %"PRIx64", "
14094 	    "length %"PRIu64", pid %d, sysid %d, call type %s, "
14095 	    "resend request %s", name, cmd, flk->l_type, offset, flk->l_start,
14096 	    flk->l_len, ctype == NFS4_LCK_CTYPE_NORM ? curproc->p_pid :
14097 	    flk->l_pid, flk->l_sysid, nfs4frlock_get_call_type(ctype),
14098 	    resend_rqstp ? "TRUE" : "FALSE"));
14099 	kmem_free(name, MAXNAMELEN);
14100 #endif
14101 
14102 	nfs4_error_zinit(ep);
14103 	ep->error = nfs4frlock_validate_args(cmd, flk, flag, vp, offset);
14104 	if (ep->error)
14105 		return;
14106 	ep->error = nfs4frlock_get_sysid(&ls, vp, flk);
14107 	if (ep->error)
14108 		return;
14109 	nfs4frlock_pre_setup(&tick_delay, &recov_state, flk, &whence,
14110 	    vp, cr, &cred_otw);
14111 
14112 recov_retry:
14113 	nfs4frlock_call_init(&args, &argsp, &argop, &op_hint, flk, cmd,
14114 	    &retry, &did_start_fop, &resp, &skip_get_err, &lost_rqst);
14115 	rp = VTOR4(vp);
14116 
14117 	ep->error = nfs4frlock_start_call(ctype, vp, op_hint, &recov_state,
14118 	    &did_start_fop, &recovonly);
14119 
14120 	if (ep->error)
14121 		goto out;
14122 
14123 	if (recovonly) {
14124 		/*
14125 		 * Leave the request for the recovery system to deal with.
14126 		 */
14127 		ASSERT(ctype == NFS4_LCK_CTYPE_NORM);
14128 		ASSERT(cmd != F_GETLK);
14129 		ASSERT(flk->l_type == F_UNLCK);
14130 
14131 		nfs4_error_init(ep, EINTR);
14132 		needrecov = TRUE;
14133 		lop = find_lock_owner(rp, curproc->p_pid, LOWN_ANY);
14134 		if (lop != NULL) {
14135 			nfs4frlock_save_lost_rqst(ctype, ep->error, READ_LT,
14136 			    NULL, NULL, lop, flk, &lost_rqst, cr, vp);
14137 			(void) nfs4_start_recovery(ep,
14138 			    VTOMI4(vp), vp, NULL, NULL,
14139 			    (lost_rqst.lr_op == OP_LOCK ||
14140 			    lost_rqst.lr_op == OP_LOCKU) ?
14141 			    &lost_rqst : NULL, OP_LOCKU, NULL);
14142 			lock_owner_rele(lop);
14143 			lop = NULL;
14144 		}
14145 		flk->l_pid = curproc->p_pid;
14146 		nfs4_register_lock_locally(vp, flk, flag, offset);
14147 		goto out;
14148 	}
14149 
14150 	/* putfh directory fh */
14151 	argop[0].argop = OP_CPUTFH;
14152 	argop[0].nfs_argop4_u.opcputfh.sfh = rp->r_fh;
14153 
14154 	/*
14155 	 * Set up the over-the-wire arguments and get references to the
14156 	 * open owner, etc.
14157 	 */
14158 
14159 	if (ctype == NFS4_LCK_CTYPE_RESEND ||
14160 	    ctype == NFS4_LCK_CTYPE_REINSTATE) {
14161 		nfs4frlock_setup_resend_lock_args(resend_rqstp, argsp,
14162 		    &argop[1], &lop, &oop, &osp, &lock_args, &locku_args);
14163 	} else {
14164 		bool_t go_otw = TRUE;
14165 
14166 		ASSERT(resend_rqstp == NULL);
14167 
14168 		switch (cmd) {
14169 		case F_GETLK:
14170 		case F_O_GETLK:
14171 			nfs4frlock_setup_lockt_args(ctype, &argop[1],
14172 			    &lockt_args, argsp, flk, rp);
14173 			break;
14174 		case F_SETLKW:
14175 		case F_SETLK:
14176 			if (flk->l_type == F_UNLCK)
14177 				nfs4frlock_setup_locku_args(ctype,
14178 				    &argop[1], &locku_args, flk,
14179 				    &lop, ep, argsp,
14180 				    vp, flag, offset, cr,
14181 				    &skip_get_err, &go_otw);
14182 			else
14183 				nfs4frlock_setup_lock_args(ctype,
14184 				    &lock_args, &oop, &osp, &lop, &argop[1],
14185 				    argsp, flk, cmd, vp, cr, ep);
14186 
14187 			if (ep->error)
14188 				goto out;
14189 
14190 			switch (ep->stat) {
14191 			case NFS4_OK:
14192 				break;
14193 			case NFS4ERR_DELAY:
14194 				/* recov thread never gets this error */
14195 				ASSERT(resend_rqstp == NULL);
14196 				ASSERT(did_start_fop);
14197 
14198 				nfs4_end_fop(VTOMI4(vp), vp, NULL, op_hint,
14199 				    &recov_state, TRUE);
14200 				did_start_fop = FALSE;
14201 				if (argop[1].argop == OP_LOCK)
14202 					nfs4args_lock_free(&argop[1]);
14203 				else if (argop[1].argop == OP_LOCKT)
14204 					nfs4args_lockt_free(&argop[1]);
14205 				kmem_free(argop, 2 * sizeof (nfs_argop4));
14206 				argsp = NULL;
14207 				goto recov_retry;
14208 			default:
14209 				ep->error = EIO;
14210 				goto out;
14211 			}
14212 			break;
14213 		default:
14214 			NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14215 			    "nfs4_frlock: invalid cmd %d", cmd));
14216 			ep->error = EINVAL;
14217 			goto out;
14218 		}
14219 
14220 		if (!go_otw)
14221 			goto out;
14222 	}
14223 
14224 	/* XXX should we use the local reclock as a cache ? */
14225 	/*
14226 	 * Unregister the lock with the local locking code before
14227 	 * contacting the server.  This avoids a potential race where
14228 	 * another process gets notified that it has been granted a lock
14229 	 * before we can unregister ourselves locally.
14230 	 */
14231 	if ((cmd == F_SETLK || cmd == F_SETLKW) && flk->l_type == F_UNLCK) {
14232 		if (ctype == NFS4_LCK_CTYPE_NORM)
14233 			flk->l_pid = ttoproc(curthread)->p_pid;
14234 		nfs4_register_lock_locally(vp, flk, flag, offset);
14235 	}
14236 
14237 	/*
14238 	 * Send the server the lock request.  Continually loop with a delay
14239 	 * if get error NFS4ERR_DENIED (for blocking locks) or NFS4ERR_GRACE.
14240 	 */
14241 	resp = &res;
14242 
14243 	NFS4_DEBUG((nfs4_client_call_debug || nfs4_client_lock_debug),
14244 	    (CE_NOTE,
14245 	    "nfs4frlock: %s call, rp %s", needrecov ? "recov" : "first",
14246 	    rnode4info(rp)));
14247 
14248 	if (lock_args && frc_no_reclaim) {
14249 		ASSERT(ctype == NFS4_LCK_CTYPE_RECLAIM);
14250 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14251 		    "nfs4frlock: frc_no_reclaim: clearing reclaim"));
14252 		lock_args->reclaim = FALSE;
14253 		if (did_reclaimp)
14254 			*did_reclaimp = 0;
14255 	}
14256 
14257 	/*
14258 	 * Do the OTW call.
14259 	 */
14260 	rfs4call(VTOMI4(vp), argsp, resp, cred_otw, &doqueue, 0, ep);
14261 
14262 	NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14263 	    "nfs4frlock: error %d, status %d", ep->error, resp->status));
14264 
14265 	needrecov = nfs4_needs_recovery(ep, TRUE, vp->v_vfsp);
14266 	NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14267 	    "nfs4frlock: needrecov %d", needrecov));
14268 
14269 	if (ep->error == 0 && nfs4_need_to_bump_seqid(resp))
14270 		nfs4frlock_bump_seqid(lock_args, locku_args, oop, lop,
14271 		    args.ctag);
14272 
14273 	/*
14274 	 * Check if one of these mutually exclusive error cases has
14275 	 * happened:
14276 	 *   need to swap credentials due to access error
14277 	 *   recovery is needed
14278 	 *   different error (only known case is missing Kerberos ticket)
14279 	 */
14280 
14281 	if ((ep->error == EACCES ||
14282 	    (ep->error == 0 && resp->status == NFS4ERR_ACCESS)) &&
14283 	    cred_otw != cr) {
14284 		nfs4frlock_check_access(vp, op_hint, &recov_state, needrecov,
14285 		    &did_start_fop, &argsp, &resp, ep->error, &lop, &oop, &osp,
14286 		    cr, &cred_otw);
14287 		goto recov_retry;
14288 	}
14289 
14290 	if (needrecov) {
14291 		/*
14292 		 * LOCKT requests don't need to recover from lost
14293 		 * requests since they don't create/modify state.
14294 		 */
14295 		if ((ep->error == EINTR ||
14296 		    NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp)) &&
14297 		    lockt_args)
14298 			goto out;
14299 		/*
14300 		 * Do not attempt recovery for requests initiated by
14301 		 * the recovery framework.  Let the framework redrive them.
14302 		 */
14303 		if (ctype != NFS4_LCK_CTYPE_NORM)
14304 			goto out;
14305 		else {
14306 			ASSERT(resend_rqstp == NULL);
14307 		}
14308 
14309 		nfs4frlock_save_lost_rqst(ctype, ep->error,
14310 		    flk_to_locktype(cmd, flk->l_type),
14311 		    oop, osp, lop, flk, &lost_rqst, cred_otw, vp);
14312 
14313 		retry = nfs4frlock_recovery(needrecov, ep, &argsp,
14314 		    &resp, lock_args, locku_args, &oop, &osp, &lop,
14315 		    rp, vp, &recov_state, op_hint, &did_start_fop,
14316 		    cmd != F_GETLK ? &lost_rqst : NULL, flk);
14317 
14318 		if (retry) {
14319 			ASSERT(oop == NULL);
14320 			ASSERT(osp == NULL);
14321 			ASSERT(lop == NULL);
14322 			goto recov_retry;
14323 		}
14324 		goto out;
14325 	}
14326 
14327 	/*
14328 	 * Bail out if have reached this point with ep->error set. Can
14329 	 * happen if (ep->error == EACCES && !needrecov && cred_otw == cr).
14330 	 * This happens if Kerberos ticket has expired or has been
14331 	 * destroyed.
14332 	 */
14333 	if (ep->error != 0)
14334 		goto out;
14335 
14336 	/*
14337 	 * Process the reply.
14338 	 */
14339 	switch (resp->status) {
14340 	case NFS4_OK:
14341 		resop = &resp->array[1];
14342 		nfs4frlock_results_ok(ctype, cmd, flk, vp, flag, offset,
14343 		    resend_rqstp);
14344 		/*
14345 		 * Have a successful lock operation, now update state.
14346 		 */
14347 		nfs4frlock_update_state(lock_args, locku_args, lockt_args,
14348 		    resop, lop, vp, flk, cr, resend_rqstp);
14349 		break;
14350 
14351 	case NFS4ERR_DENIED:
14352 		resop = &resp->array[1];
14353 		retry = nfs4frlock_results_denied(ctype, lock_args, lockt_args,
14354 		    &oop, &osp, &lop, cmd, vp, flk, op_hint,
14355 		    &recov_state, needrecov, &argsp, &resp,
14356 		    &tick_delay, &whence, &ep->error, resop, cr,
14357 		    &did_start_fop, &skip_get_err);
14358 
14359 		if (retry) {
14360 			ASSERT(oop == NULL);
14361 			ASSERT(osp == NULL);
14362 			ASSERT(lop == NULL);
14363 			goto recov_retry;
14364 		}
14365 		break;
14366 	/*
14367 	 * If the server won't let us reclaim, fall-back to trying to lock
14368 	 * the file from scratch. Code elsewhere will check the changeinfo
14369 	 * to ensure the file hasn't been changed.
14370 	 */
14371 	case NFS4ERR_NO_GRACE:
14372 		if (lock_args && lock_args->reclaim == TRUE) {
14373 			ASSERT(ctype == NFS4_LCK_CTYPE_RECLAIM);
14374 			NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14375 			    "nfs4frlock: reclaim: NFS4ERR_NO_GRACE"));
14376 			frc_no_reclaim = 1;
14377 			/* clean up before retrying */
14378 			needrecov = 0;
14379 			(void) nfs4frlock_recovery(needrecov, ep, &argsp, &resp,
14380 			    lock_args, locku_args, &oop, &osp, &lop, rp, vp,
14381 			    &recov_state, op_hint, &did_start_fop, NULL, flk);
14382 			goto recov_retry;
14383 		}
14384 		/* FALLTHROUGH */
14385 
14386 	default:
14387 		nfs4frlock_results_default(resp, &ep->error);
14388 		break;
14389 	}
14390 out:
14391 	/*
14392 	 * Process and cleanup from error.  Make interrupted unlock
14393 	 * requests look successful, since they will be handled by the
14394 	 * client recovery code.
14395 	 */
14396 	nfs4frlock_final_cleanup(ctype, argsp, resp, vp, op_hint, &recov_state,
14397 	    needrecov, oop, osp, lop, flk, whence, offset, ls, &ep->error,
14398 	    lock_args, locku_args, did_start_fop,
14399 	    skip_get_err, cred_otw, cr);
14400 
14401 	if (ep->error == EINTR && flk->l_type == F_UNLCK &&
14402 	    (cmd == F_SETLK || cmd == F_SETLKW))
14403 		ep->error = 0;
14404 }
14405 
14406 /*
14407  * nfs4_safelock:
14408  *
14409  * Return non-zero if the given lock request can be handled without
14410  * violating the constraints on concurrent mapping and locking.
14411  */
14412 
14413 static int
14414 nfs4_safelock(vnode_t *vp, const struct flock64 *bfp, cred_t *cr)
14415 {
14416 	rnode4_t *rp = VTOR4(vp);
14417 	struct vattr va;
14418 	int error;
14419 
14420 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14421 	ASSERT(rp->r_mapcnt >= 0);
14422 	NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock %s: "
14423 	    "(%"PRIx64", %"PRIx64"); mapcnt = %ld", bfp->l_type == F_WRLCK ?
14424 	    "write" : bfp->l_type == F_RDLCK ? "read" : "unlock",
14425 	    bfp->l_start, bfp->l_len, rp->r_mapcnt));
14426 
14427 	if (rp->r_mapcnt == 0)
14428 		return (1);		/* always safe if not mapped */
14429 
14430 	/*
14431 	 * If the file is already mapped and there are locks, then they
14432 	 * should be all safe locks.  So adding or removing a lock is safe
14433 	 * as long as the new request is safe (i.e., whole-file, meaning
14434 	 * length and starting offset are both zero).
14435 	 */
14436 
14437 	if (bfp->l_start != 0 || bfp->l_len != 0) {
14438 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock: "
14439 		    "cannot lock a memory mapped file unless locking the "
14440 		    "entire file: start %"PRIx64", len %"PRIx64,
14441 		    bfp->l_start, bfp->l_len));
14442 		return (0);
14443 	}
14444 
14445 	/* mandatory locking and mapping don't mix */
14446 	va.va_mask = AT_MODE;
14447 	error = VOP_GETATTR(vp, &va, 0, cr, NULL);
14448 	if (error != 0) {
14449 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock: "
14450 		    "getattr error %d", error));
14451 		return (0);		/* treat errors conservatively */
14452 	}
14453 	if (MANDLOCK(vp, va.va_mode)) {
14454 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_safelock: "
14455 		    "cannot mandatory lock and mmap a file"));
14456 		return (0);
14457 	}
14458 
14459 	return (1);
14460 }
14461 
14462 
14463 /*
14464  * Register the lock locally within Solaris.
14465  * As the client, we "or" the sysid with LM_SYSID_CLIENT when
14466  * recording locks locally.
14467  *
14468  * This should handle conflicts/cooperation with NFS v2/v3 since all locks
14469  * are registered locally.
14470  */
14471 void
14472 nfs4_register_lock_locally(vnode_t *vp, struct flock64 *flk, int flag,
14473     u_offset_t offset)
14474 {
14475 	int oldsysid;
14476 	int error;
14477 #ifdef DEBUG
14478 	char *name;
14479 #endif
14480 
14481 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14482 
14483 #ifdef DEBUG
14484 	name = fn_name(VTOSV(vp)->sv_name);
14485 	NFS4_DEBUG(nfs4_client_lock_debug,
14486 	    (CE_NOTE, "nfs4_register_lock_locally: %s: type %d, "
14487 	    "start %"PRIx64", length %"PRIx64", pid %ld, sysid %d",
14488 	    name, flk->l_type, flk->l_start, flk->l_len, (long)flk->l_pid,
14489 	    flk->l_sysid));
14490 	kmem_free(name, MAXNAMELEN);
14491 #endif
14492 
14493 	/* register the lock with local locking */
14494 	oldsysid = flk->l_sysid;
14495 	flk->l_sysid |= LM_SYSID_CLIENT;
14496 	error = reclock(vp, flk, SETFLCK, flag, offset, NULL);
14497 #ifdef DEBUG
14498 	if (error != 0) {
14499 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14500 		    "nfs4_register_lock_locally: could not register with"
14501 		    " local locking"));
14502 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_CONT,
14503 		    "error %d, vp 0x%p, pid %d, sysid 0x%x",
14504 		    error, (void *)vp, flk->l_pid, flk->l_sysid));
14505 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_CONT,
14506 		    "type %d off 0x%" PRIx64 " len 0x%" PRIx64,
14507 		    flk->l_type, flk->l_start, flk->l_len));
14508 		(void) reclock(vp, flk, 0, flag, offset, NULL);
14509 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_CONT,
14510 		    "blocked by pid %d sysid 0x%x type %d "
14511 		    "off 0x%" PRIx64 " len 0x%" PRIx64,
14512 		    flk->l_pid, flk->l_sysid, flk->l_type, flk->l_start,
14513 		    flk->l_len));
14514 	}
14515 #endif
14516 	flk->l_sysid = oldsysid;
14517 }
14518 
14519 /*
14520  * nfs4_lockrelease:
14521  *
14522  * Release any locks on the given vnode that are held by the current
14523  * process.  Also removes the lock owner (if one exists) from the rnode's
14524  * list.
14525  */
14526 static int
14527 nfs4_lockrelease(vnode_t *vp, int flag, offset_t offset, cred_t *cr)
14528 {
14529 	flock64_t ld;
14530 	int ret, error;
14531 	rnode4_t *rp;
14532 	nfs4_lock_owner_t *lop;
14533 	nfs4_recov_state_t recov_state;
14534 	mntinfo4_t *mi;
14535 	bool_t possible_orphan = FALSE;
14536 	bool_t recovonly;
14537 
14538 	ASSERT((uintptr_t)vp > KERNELBASE);
14539 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14540 
14541 	rp = VTOR4(vp);
14542 	mi = VTOMI4(vp);
14543 
14544 	/*
14545 	 * If we have not locked anything then we can
14546 	 * just return since we have no work to do.
14547 	 */
14548 	if (rp->r_lo_head.lo_next_rnode == &rp->r_lo_head) {
14549 		return (0);
14550 	}
14551 
14552 	/*
14553 	 * We need to comprehend that another thread may
14554 	 * kick off recovery and the lock_owner we have stashed
14555 	 * in lop might be invalid so we should NOT cache it
14556 	 * locally!
14557 	 */
14558 	recov_state.rs_flags = 0;
14559 	recov_state.rs_num_retry_despite_err = 0;
14560 	error = nfs4_start_fop(mi, vp, NULL, OH_LOCKU, &recov_state,
14561 	    &recovonly);
14562 	if (error) {
14563 		mutex_enter(&rp->r_statelock);
14564 		rp->r_flags |= R4LODANGLERS;
14565 		mutex_exit(&rp->r_statelock);
14566 		return (error);
14567 	}
14568 
14569 	lop = find_lock_owner(rp, curproc->p_pid, LOWN_ANY);
14570 
14571 	/*
14572 	 * Check if the lock owner might have a lock (request was sent but
14573 	 * no response was received).  Also check if there are any remote
14574 	 * locks on the file.  (In theory we shouldn't have to make this
14575 	 * second check if there's no lock owner, but for now we'll be
14576 	 * conservative and do it anyway.)  If either condition is true,
14577 	 * send an unlock for the entire file to the server.
14578 	 *
14579 	 * Note that no explicit synchronization is needed here.  At worst,
14580 	 * flk_has_remote_locks() will return a false positive, in which case
14581 	 * the unlock call wastes time but doesn't harm correctness.
14582 	 */
14583 
14584 	if (lop) {
14585 		mutex_enter(&lop->lo_lock);
14586 		possible_orphan = lop->lo_pending_rqsts;
14587 		mutex_exit(&lop->lo_lock);
14588 		lock_owner_rele(lop);
14589 	}
14590 
14591 	nfs4_end_fop(mi, vp, NULL, OH_LOCKU, &recov_state, 0);
14592 
14593 	NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14594 	    "nfs4_lockrelease: possible orphan %d, remote locks %d, for "
14595 	    "lop %p.", possible_orphan, flk_has_remote_locks(vp),
14596 	    (void *)lop));
14597 
14598 	if (possible_orphan || flk_has_remote_locks(vp)) {
14599 		ld.l_type = F_UNLCK;    /* set to unlock entire file */
14600 		ld.l_whence = 0;	/* unlock from start of file */
14601 		ld.l_start = 0;
14602 		ld.l_len = 0;		/* do entire file */
14603 
14604 		ret = VOP_FRLOCK(vp, F_SETLK, &ld, flag, offset, NULL,
14605 		    cr, NULL);
14606 
14607 		if (ret != 0) {
14608 			/*
14609 			 * If VOP_FRLOCK fails, make sure we unregister
14610 			 * local locks before we continue.
14611 			 */
14612 			ld.l_pid = ttoproc(curthread)->p_pid;
14613 			nfs4_register_lock_locally(vp, &ld, flag, offset);
14614 			NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
14615 			    "nfs4_lockrelease: lock release error on vp"
14616 			    " %p: error %d.\n", (void *)vp, ret));
14617 		}
14618 	}
14619 
14620 	recov_state.rs_flags = 0;
14621 	recov_state.rs_num_retry_despite_err = 0;
14622 	error = nfs4_start_fop(mi, vp, NULL, OH_LOCKU, &recov_state,
14623 	    &recovonly);
14624 	if (error) {
14625 		mutex_enter(&rp->r_statelock);
14626 		rp->r_flags |= R4LODANGLERS;
14627 		mutex_exit(&rp->r_statelock);
14628 		return (error);
14629 	}
14630 
14631 	/*
14632 	 * So, here we're going to need to retrieve the lock-owner
14633 	 * again (in case recovery has done a switch-a-roo) and
14634 	 * remove it because we can.
14635 	 */
14636 	lop = find_lock_owner(rp, curproc->p_pid, LOWN_ANY);
14637 
14638 	if (lop) {
14639 		nfs4_rnode_remove_lock_owner(rp, lop);
14640 		lock_owner_rele(lop);
14641 	}
14642 
14643 	nfs4_end_fop(mi, vp, NULL, OH_LOCKU, &recov_state, 0);
14644 	return (0);
14645 }
14646 
14647 /*
14648  * Wait for 'tick_delay' clock ticks.
14649  * Implement exponential backoff until hit the lease_time of this nfs4_server.
14650  * NOTE: lock_lease_time is in seconds.
14651  *
14652  * XXX For future improvements, should implement a waiting queue scheme.
14653  */
14654 static int
14655 nfs4_block_and_wait(clock_t *tick_delay, rnode4_t *rp)
14656 {
14657 	long milliseconds_delay;
14658 	time_t lock_lease_time;
14659 
14660 	/* wait tick_delay clock ticks or siginteruptus */
14661 	if (delay_sig(*tick_delay)) {
14662 		return (EINTR);
14663 	}
14664 	NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE, "nfs4_block_and_wait: "
14665 	    "reissue the lock request: blocked for %ld clock ticks: %ld "
14666 	    "milliseconds", *tick_delay, drv_hztousec(*tick_delay) / 1000));
14667 
14668 	/* get the lease time */
14669 	lock_lease_time = r2lease_time(rp);
14670 
14671 	/* drv_hztousec converts ticks to microseconds */
14672 	milliseconds_delay = drv_hztousec(*tick_delay) / 1000;
14673 	if (milliseconds_delay < lock_lease_time * 1000) {
14674 		*tick_delay = 2 * *tick_delay;
14675 		if (drv_hztousec(*tick_delay) > lock_lease_time * 1000 * 1000)
14676 			*tick_delay = drv_usectohz(lock_lease_time*1000*1000);
14677 	}
14678 	return (0);
14679 }
14680 
14681 
14682 void
14683 nfs4_vnops_init(void)
14684 {
14685 }
14686 
14687 void
14688 nfs4_vnops_fini(void)
14689 {
14690 }
14691 
14692 /*
14693  * Return a reference to the directory (parent) vnode for a given vnode,
14694  * using the saved pathname information and the directory file handle.  The
14695  * caller is responsible for disposing of the reference.
14696  * Returns zero or an errno value.
14697  *
14698  * Caller should set need_start_op to FALSE if it is the recovery
14699  * thread, or if a start_fop has already been done.  Otherwise, TRUE.
14700  */
14701 int
14702 vtodv(vnode_t *vp, vnode_t **dvpp, cred_t *cr, bool_t need_start_op)
14703 {
14704 	svnode_t *svnp;
14705 	vnode_t *dvp = NULL;
14706 	servinfo4_t *svp;
14707 	nfs4_fname_t *mfname;
14708 	int error;
14709 
14710 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14711 
14712 	if (vp->v_flag & VROOT) {
14713 		nfs4_sharedfh_t *sfh;
14714 		nfs_fh4 fh;
14715 		mntinfo4_t *mi;
14716 
14717 		ASSERT(vp->v_type == VREG);
14718 
14719 		mi = VTOMI4(vp);
14720 		svp = mi->mi_curr_serv;
14721 		(void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
14722 		fh.nfs_fh4_len = svp->sv_pfhandle.fh_len;
14723 		fh.nfs_fh4_val = svp->sv_pfhandle.fh_buf;
14724 		sfh = sfh4_get(&fh, VTOMI4(vp));
14725 		nfs_rw_exit(&svp->sv_lock);
14726 		mfname = mi->mi_fname;
14727 		fn_hold(mfname);
14728 		dvp = makenfs4node_by_fh(sfh, NULL, &mfname, NULL, mi, cr, 0);
14729 		sfh4_rele(&sfh);
14730 
14731 		if (dvp->v_type == VNON)
14732 			dvp->v_type = VDIR;
14733 		*dvpp = dvp;
14734 		return (0);
14735 	}
14736 
14737 	svnp = VTOSV(vp);
14738 
14739 	if (svnp == NULL) {
14740 		NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14741 		    "shadow node is NULL"));
14742 		return (EINVAL);
14743 	}
14744 
14745 	if (svnp->sv_name == NULL || svnp->sv_dfh == NULL) {
14746 		NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14747 		    "shadow node name or dfh val == NULL"));
14748 		return (EINVAL);
14749 	}
14750 
14751 	error = nfs4_make_dotdot(svnp->sv_dfh, 0, vp, cr, &dvp,
14752 	    (int)need_start_op);
14753 	if (error != 0) {
14754 		NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14755 		    "nfs4_make_dotdot returned %d", error));
14756 		return (error);
14757 	}
14758 	if (!dvp) {
14759 		NFS4_DEBUG(nfs4_client_shadow_debug, (CE_NOTE, "vtodv: "
14760 		    "nfs4_make_dotdot returned a NULL dvp"));
14761 		return (EIO);
14762 	}
14763 	if (dvp->v_type == VNON)
14764 		dvp->v_type = VDIR;
14765 	ASSERT(dvp->v_type == VDIR);
14766 	if (VTOR4(vp)->r_flags & R4ISXATTR) {
14767 		mutex_enter(&dvp->v_lock);
14768 		dvp->v_flag |= V_XATTRDIR;
14769 		mutex_exit(&dvp->v_lock);
14770 	}
14771 	*dvpp = dvp;
14772 	return (0);
14773 }
14774 
14775 /*
14776  * Copy the (final) component name of vp to fnamep.  maxlen is the maximum
14777  * length that fnamep can accept, including the trailing null.
14778  * Returns 0 if okay, returns an errno value if there was a problem.
14779  */
14780 
14781 int
14782 vtoname(vnode_t *vp, char *fnamep, ssize_t maxlen)
14783 {
14784 	char *fn;
14785 	int err = 0;
14786 	servinfo4_t *svp;
14787 	svnode_t *shvp;
14788 
14789 	/*
14790 	 * If the file being opened has VROOT set, then this is
14791 	 * a "file" mount.  sv_name will not be interesting, so
14792 	 * go back to the servinfo4 to get the original mount
14793 	 * path and strip off all but the final edge.  Otherwise
14794 	 * just return the name from the shadow vnode.
14795 	 */
14796 
14797 	if (vp->v_flag & VROOT) {
14798 
14799 		svp = VTOMI4(vp)->mi_curr_serv;
14800 		(void) nfs_rw_enter_sig(&svp->sv_lock, RW_READER, 0);
14801 
14802 		fn = strrchr(svp->sv_path, '/');
14803 		if (fn == NULL)
14804 			err = EINVAL;
14805 		else
14806 			fn++;
14807 	} else {
14808 		shvp = VTOSV(vp);
14809 		fn = fn_name(shvp->sv_name);
14810 	}
14811 
14812 	if (err == 0)
14813 		if (strlen(fn) < maxlen)
14814 			(void) strcpy(fnamep, fn);
14815 		else
14816 			err = ENAMETOOLONG;
14817 
14818 	if (vp->v_flag & VROOT)
14819 		nfs_rw_exit(&svp->sv_lock);
14820 	else
14821 		kmem_free(fn, MAXNAMELEN);
14822 
14823 	return (err);
14824 }
14825 
14826 /*
14827  * Bookkeeping for a close that doesn't need to go over the wire.
14828  * *have_lockp is set to 0 if 'os_sync_lock' is released; otherwise
14829  * it is left at 1.
14830  */
14831 void
14832 nfs4close_notw(vnode_t *vp, nfs4_open_stream_t *osp, int *have_lockp)
14833 {
14834 	rnode4_t		*rp;
14835 	mntinfo4_t		*mi;
14836 
14837 	mi = VTOMI4(vp);
14838 	rp = VTOR4(vp);
14839 
14840 	NFS4_DEBUG(nfs4close_notw_debug, (CE_NOTE, "nfs4close_notw: "
14841 	    "rp=%p osp=%p", (void *)rp, (void *)osp));
14842 	ASSERT(nfs_zone() == mi->mi_zone);
14843 	ASSERT(mutex_owned(&osp->os_sync_lock));
14844 	ASSERT(*have_lockp);
14845 
14846 	if (!osp->os_valid ||
14847 	    osp->os_open_ref_count > 0 || osp->os_mapcnt > 0) {
14848 		return;
14849 	}
14850 
14851 	/*
14852 	 * This removes the reference obtained at OPEN; ie,
14853 	 * when the open stream structure was created.
14854 	 *
14855 	 * We don't have to worry about calling 'open_stream_rele'
14856 	 * since we our currently holding a reference to this
14857 	 * open stream which means the count can not go to 0 with
14858 	 * this decrement.
14859 	 */
14860 	ASSERT(osp->os_ref_count >= 2);
14861 	osp->os_ref_count--;
14862 	osp->os_valid = 0;
14863 	mutex_exit(&osp->os_sync_lock);
14864 	*have_lockp = 0;
14865 
14866 	nfs4_dec_state_ref_count(mi);
14867 }
14868 
14869 /*
14870  * Close all remaining open streams on the rnode.  These open streams
14871  * could be here because:
14872  * - The close attempted at either close or delmap failed
14873  * - Some kernel entity did VOP_OPEN but never did VOP_CLOSE
14874  * - Someone did mknod on a regular file but never opened it
14875  */
14876 int
14877 nfs4close_all(vnode_t *vp, cred_t *cr)
14878 {
14879 	nfs4_open_stream_t *osp;
14880 	int error;
14881 	nfs4_error_t e = { 0, NFS4_OK, RPC_SUCCESS };
14882 	rnode4_t *rp;
14883 
14884 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
14885 
14886 	error = 0;
14887 	rp = VTOR4(vp);
14888 
14889 	/*
14890 	 * At this point, all we know is that the last time
14891 	 * someone called vn_rele, the count was 1.  Since then,
14892 	 * the vnode could have been re-activated.  We want to
14893 	 * loop through the open streams and close each one, but
14894 	 * we have to be careful since once we release the rnode
14895 	 * hash bucket lock, someone else is free to come in and
14896 	 * re-activate the rnode and add new open streams.  The
14897 	 * strategy is take the rnode hash bucket lock, verify that
14898 	 * the count is still 1, grab the open stream off the
14899 	 * head of the list and mark it invalid, then release the
14900 	 * rnode hash bucket lock and proceed with that open stream.
14901 	 * This is ok because nfs4close_one() will acquire the proper
14902 	 * open/create to close/destroy synchronization for open
14903 	 * streams, and will ensure that if someone has reopened
14904 	 * the open stream after we've dropped the hash bucket lock
14905 	 * then we'll just simply return without destroying the
14906 	 * open stream.
14907 	 * Repeat until the list is empty.
14908 	 */
14909 
14910 	for (;;) {
14911 
14912 		/* make sure vnode hasn't been reactivated */
14913 		rw_enter(&rp->r_hashq->r_lock, RW_READER);
14914 		mutex_enter(&vp->v_lock);
14915 		if (vp->v_count > 1) {
14916 			mutex_exit(&vp->v_lock);
14917 			rw_exit(&rp->r_hashq->r_lock);
14918 			break;
14919 		}
14920 		/*
14921 		 * Grabbing r_os_lock before releasing v_lock prevents
14922 		 * a window where the rnode/open stream could get
14923 		 * reactivated (and os_force_close set to 0) before we
14924 		 * had a chance to set os_force_close to 1.
14925 		 */
14926 		mutex_enter(&rp->r_os_lock);
14927 		mutex_exit(&vp->v_lock);
14928 
14929 		osp = list_head(&rp->r_open_streams);
14930 		if (!osp) {
14931 			/* nothing left to CLOSE OTW, so return */
14932 			mutex_exit(&rp->r_os_lock);
14933 			rw_exit(&rp->r_hashq->r_lock);
14934 			break;
14935 		}
14936 
14937 		mutex_enter(&rp->r_statev4_lock);
14938 		/* the file can't still be mem mapped */
14939 		ASSERT(rp->r_mapcnt == 0);
14940 		if (rp->created_v4)
14941 			rp->created_v4 = 0;
14942 		mutex_exit(&rp->r_statev4_lock);
14943 
14944 		/*
14945 		 * Grab a ref on this open stream; nfs4close_one
14946 		 * will mark it as invalid
14947 		 */
14948 		mutex_enter(&osp->os_sync_lock);
14949 		osp->os_ref_count++;
14950 		osp->os_force_close = 1;
14951 		mutex_exit(&osp->os_sync_lock);
14952 		mutex_exit(&rp->r_os_lock);
14953 		rw_exit(&rp->r_hashq->r_lock);
14954 
14955 		nfs4close_one(vp, osp, cr, 0, NULL, &e, CLOSE_FORCE, 0, 0, 0);
14956 
14957 		/* Update error if it isn't already non-zero */
14958 		if (error == 0) {
14959 			if (e.error)
14960 				error = e.error;
14961 			else if (e.stat)
14962 				error = geterrno4(e.stat);
14963 		}
14964 
14965 #ifdef	DEBUG
14966 		nfs4close_all_cnt++;
14967 #endif
14968 		/* Release the ref on osp acquired above. */
14969 		open_stream_rele(osp, rp);
14970 
14971 		/* Proceed to the next open stream, if any */
14972 	}
14973 	return (error);
14974 }
14975 
14976 /*
14977  * nfs4close_one - close one open stream for a file if needed.
14978  *
14979  * "close_type" indicates which close path this is:
14980  * CLOSE_NORM: close initiated via VOP_CLOSE.
14981  * CLOSE_DELMAP: close initiated via VOP_DELMAP.
14982  * CLOSE_FORCE: close initiated via VOP_INACTIVE.  This path forces
14983  *	the close and release of client state for this open stream
14984  *	(unless someone else has the open stream open).
14985  * CLOSE_RESEND: indicates the request is a replay of an earlier request
14986  *	(e.g., due to abort because of a signal).
14987  * CLOSE_AFTER_RESEND: close initiated to "undo" a successful resent OPEN.
14988  *
14989  * CLOSE_RESEND and CLOSE_AFTER_RESEND will not attempt to retry after client
14990  * recovery.  Instead, the caller is expected to deal with retries.
14991  *
14992  * The caller can either pass in the osp ('provided_osp') or not.
14993  *
14994  * 'access_bits' represents the access we are closing/downgrading.
14995  *
14996  * 'len', 'prot', and 'mmap_flags' are used for CLOSE_DELMAP.  'len' is the
14997  * number of bytes we are unmapping, 'maxprot' is the mmap protection, and
14998  * 'mmap_flags' tells us the type of sharing (MAP_PRIVATE or MAP_SHARED).
14999  *
15000  * Errors are returned via the nfs4_error_t.
15001  */
15002 void
15003 nfs4close_one(vnode_t *vp, nfs4_open_stream_t *provided_osp, cred_t *cr,
15004     int access_bits, nfs4_lost_rqst_t *lrp, nfs4_error_t *ep,
15005     nfs4_close_type_t close_type, size_t len, uint_t maxprot,
15006     uint_t mmap_flags)
15007 {
15008 	nfs4_open_owner_t *oop;
15009 	nfs4_open_stream_t *osp = NULL;
15010 	int retry = 0;
15011 	int num_retries = NFS4_NUM_RECOV_RETRIES;
15012 	rnode4_t *rp;
15013 	mntinfo4_t *mi;
15014 	nfs4_recov_state_t recov_state;
15015 	cred_t *cred_otw = NULL;
15016 	bool_t recovonly = FALSE;
15017 	int isrecov;
15018 	int force_close;
15019 	int close_failed = 0;
15020 	int did_dec_count = 0;
15021 	int did_start_op = 0;
15022 	int did_force_recovlock = 0;
15023 	int did_start_seqid_sync = 0;
15024 	int have_sync_lock = 0;
15025 
15026 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
15027 
15028 	NFS4_DEBUG(nfs4close_one_debug, (CE_NOTE, "closing vp %p osp %p, "
15029 	    "lrp %p, close type %d len %ld prot %x mmap flags %x bits %x",
15030 	    (void *)vp, (void *)provided_osp, (void *)lrp, close_type,
15031 	    len, maxprot, mmap_flags, access_bits));
15032 
15033 	nfs4_error_zinit(ep);
15034 	rp = VTOR4(vp);
15035 	mi = VTOMI4(vp);
15036 	isrecov = (close_type == CLOSE_RESEND ||
15037 	    close_type == CLOSE_AFTER_RESEND);
15038 
15039 	/*
15040 	 * First get the open owner.
15041 	 */
15042 	if (!provided_osp) {
15043 		oop = find_open_owner(cr, NFS4_PERM_CREATED, mi);
15044 	} else {
15045 		oop = provided_osp->os_open_owner;
15046 		ASSERT(oop != NULL);
15047 		open_owner_hold(oop);
15048 	}
15049 
15050 	if (!oop) {
15051 		NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
15052 		    "nfs4close_one: no oop, rp %p, mi %p, cr %p, osp %p, "
15053 		    "close type %d", (void *)rp, (void *)mi, (void *)cr,
15054 		    (void *)provided_osp, close_type));
15055 		ep->error = EIO;
15056 		goto out;
15057 	}
15058 
15059 	cred_otw = nfs4_get_otw_cred(cr, mi, oop);
15060 recov_retry:
15061 	osp = NULL;
15062 	close_failed = 0;
15063 	force_close = (close_type == CLOSE_FORCE);
15064 	retry = 0;
15065 	did_start_op = 0;
15066 	did_force_recovlock = 0;
15067 	did_start_seqid_sync = 0;
15068 	have_sync_lock = 0;
15069 	recovonly = FALSE;
15070 	recov_state.rs_flags = 0;
15071 	recov_state.rs_num_retry_despite_err = 0;
15072 
15073 	/*
15074 	 * Second synchronize with recovery.
15075 	 */
15076 	if (!isrecov) {
15077 		ep->error = nfs4_start_fop(mi, vp, NULL, OH_CLOSE,
15078 		    &recov_state, &recovonly);
15079 		if (!ep->error) {
15080 			did_start_op = 1;
15081 		} else {
15082 			close_failed = 1;
15083 			/*
15084 			 * If we couldn't get start_fop, but have to
15085 			 * cleanup state, then at least acquire the
15086 			 * mi_recovlock so we can synchronize with
15087 			 * recovery.
15088 			 */
15089 			if (close_type == CLOSE_FORCE) {
15090 				(void) nfs_rw_enter_sig(&mi->mi_recovlock,
15091 				    RW_READER, FALSE);
15092 				did_force_recovlock = 1;
15093 			} else
15094 				goto out;
15095 		}
15096 	}
15097 
15098 	/*
15099 	 * We cannot attempt to get the open seqid sync if nfs4_start_fop
15100 	 * set 'recovonly' to TRUE since most likely this is due to
15101 	 * reovery being active (MI4_RECOV_ACTIV).  If recovery is active,
15102 	 * nfs4_start_open_seqid_sync() will fail with EAGAIN asking us
15103 	 * to retry, causing us to loop until recovery finishes.  Plus we
15104 	 * don't need protection over the open seqid since we're not going
15105 	 * OTW, hence don't need to use the seqid.
15106 	 */
15107 	if (recovonly == FALSE) {
15108 		/* need to grab the open owner sync before 'os_sync_lock' */
15109 		ep->error = nfs4_start_open_seqid_sync(oop, mi);
15110 		if (ep->error == EAGAIN) {
15111 			ASSERT(!isrecov);
15112 			if (did_start_op)
15113 				nfs4_end_fop(mi, vp, NULL, OH_CLOSE,
15114 				    &recov_state, TRUE);
15115 			if (did_force_recovlock)
15116 				nfs_rw_exit(&mi->mi_recovlock);
15117 			goto recov_retry;
15118 		}
15119 		did_start_seqid_sync = 1;
15120 	}
15121 
15122 	/*
15123 	 * Third get an open stream and acquire 'os_sync_lock' to
15124 	 * sychronize the opening/creating of an open stream with the
15125 	 * closing/destroying of an open stream.
15126 	 */
15127 	if (!provided_osp) {
15128 		/* returns with 'os_sync_lock' held */
15129 		osp = find_open_stream(oop, rp);
15130 		if (!osp) {
15131 			ep->error = EIO;
15132 			goto out;
15133 		}
15134 	} else {
15135 		osp = provided_osp;
15136 		open_stream_hold(osp);
15137 		mutex_enter(&osp->os_sync_lock);
15138 	}
15139 	have_sync_lock = 1;
15140 
15141 	ASSERT(oop == osp->os_open_owner);
15142 
15143 	/*
15144 	 * Fourth, do any special pre-OTW CLOSE processing
15145 	 * based on the specific close type.
15146 	 */
15147 	if ((close_type == CLOSE_NORM || close_type == CLOSE_AFTER_RESEND) &&
15148 	    !did_dec_count) {
15149 		ASSERT(osp->os_open_ref_count > 0);
15150 		osp->os_open_ref_count--;
15151 		did_dec_count = 1;
15152 		if (osp->os_open_ref_count == 0)
15153 			osp->os_final_close = 1;
15154 	}
15155 
15156 	if (close_type == CLOSE_FORCE) {
15157 		/* see if somebody reopened the open stream. */
15158 		if (!osp->os_force_close) {
15159 			NFS4_DEBUG(nfs4close_one_debug, (CE_NOTE,
15160 			    "nfs4close_one: skip CLOSE_FORCE as osp %p "
15161 			    "was reopened, vp %p", (void *)osp, (void *)vp));
15162 			ep->error = 0;
15163 			ep->stat = NFS4_OK;
15164 			goto out;
15165 		}
15166 
15167 		if (!osp->os_final_close && !did_dec_count) {
15168 			osp->os_open_ref_count--;
15169 			did_dec_count = 1;
15170 		}
15171 
15172 		/*
15173 		 * We can't depend on os_open_ref_count being 0 due to the
15174 		 * way executables are opened (VN_RELE to match a VOP_OPEN).
15175 		 */
15176 #ifdef	NOTYET
15177 		ASSERT(osp->os_open_ref_count == 0);
15178 #endif
15179 		if (osp->os_open_ref_count != 0) {
15180 			NFS4_DEBUG(nfs4close_one_debug, (CE_NOTE,
15181 			    "nfs4close_one: should panic here on an "
15182 			    "ASSERT(osp->os_open_ref_count == 0). Ignoring "
15183 			    "since this is probably the exec problem."));
15184 
15185 			osp->os_open_ref_count = 0;
15186 		}
15187 
15188 		/*
15189 		 * There is the possibility that nfs4close_one()
15190 		 * for close_type == CLOSE_DELMAP couldn't find the
15191 		 * open stream, thus couldn't decrement its os_mapcnt;
15192 		 * therefore we can't use this ASSERT yet.
15193 		 */
15194 #ifdef	NOTYET
15195 		ASSERT(osp->os_mapcnt == 0);
15196 #endif
15197 		osp->os_mapcnt = 0;
15198 	}
15199 
15200 	if (close_type == CLOSE_DELMAP && !did_dec_count) {
15201 		ASSERT(osp->os_mapcnt >= btopr(len));
15202 
15203 		if ((mmap_flags & MAP_SHARED) && (maxprot & PROT_WRITE))
15204 			osp->os_mmap_write -= btopr(len);
15205 		if (maxprot & PROT_READ)
15206 			osp->os_mmap_read -= btopr(len);
15207 		if (maxprot & PROT_EXEC)
15208 			osp->os_mmap_read -= btopr(len);
15209 		/* mirror the PROT_NONE check in nfs4_addmap() */
15210 		if (!(maxprot & PROT_READ) && !(maxprot & PROT_WRITE) &&
15211 		    !(maxprot & PROT_EXEC))
15212 			osp->os_mmap_read -= btopr(len);
15213 		osp->os_mapcnt -= btopr(len);
15214 		did_dec_count = 1;
15215 	}
15216 
15217 	if (recovonly) {
15218 		nfs4_lost_rqst_t lost_rqst;
15219 
15220 		/* request should not already be in recovery queue */
15221 		ASSERT(lrp == NULL);
15222 		nfs4_error_init(ep, EINTR);
15223 		nfs4close_save_lost_rqst(ep->error, &lost_rqst, oop,
15224 		    osp, cred_otw, vp);
15225 		mutex_exit(&osp->os_sync_lock);
15226 		have_sync_lock = 0;
15227 		(void) nfs4_start_recovery(ep, mi, vp, NULL, NULL,
15228 		    lost_rqst.lr_op == OP_CLOSE ?
15229 		    &lost_rqst : NULL, OP_CLOSE, NULL);
15230 		close_failed = 1;
15231 		force_close = 0;
15232 		goto close_cleanup;
15233 	}
15234 
15235 	/*
15236 	 * If a previous OTW call got NFS4ERR_BAD_SEQID, then
15237 	 * we stopped operating on the open owner's <old oo_name, old seqid>
15238 	 * space, which means we stopped operating on the open stream
15239 	 * too.  So don't go OTW (as the seqid is likely bad, and the
15240 	 * stateid could be stale, potentially triggering a false
15241 	 * setclientid), and just clean up the client's internal state.
15242 	 */
15243 	if (osp->os_orig_oo_name != oop->oo_name) {
15244 		NFS4_DEBUG(nfs4close_one_debug || nfs4_client_recov_debug,
15245 		    (CE_NOTE, "nfs4close_one: skip OTW close for osp %p "
15246 		    "oop %p due to bad seqid (orig oo_name %" PRIx64 " current "
15247 		    "oo_name %" PRIx64")",
15248 		    (void *)osp, (void *)oop, osp->os_orig_oo_name,
15249 		    oop->oo_name));
15250 		close_failed = 1;
15251 	}
15252 
15253 	/* If the file failed recovery, just quit. */
15254 	mutex_enter(&rp->r_statelock);
15255 	if (rp->r_flags & R4RECOVERR) {
15256 		close_failed = 1;
15257 	}
15258 	mutex_exit(&rp->r_statelock);
15259 
15260 	/*
15261 	 * If the force close path failed to obtain start_fop
15262 	 * then skip the OTW close and just remove the state.
15263 	 */
15264 	if (close_failed)
15265 		goto close_cleanup;
15266 
15267 	/*
15268 	 * Fifth, check to see if there are still mapped pages or other
15269 	 * opens using this open stream.  If there are then we can't
15270 	 * close yet but we can see if an OPEN_DOWNGRADE is necessary.
15271 	 */
15272 	if (osp->os_open_ref_count > 0 || osp->os_mapcnt > 0) {
15273 		nfs4_lost_rqst_t	new_lost_rqst;
15274 		bool_t			needrecov = FALSE;
15275 		cred_t			*odg_cred_otw = NULL;
15276 		seqid4			open_dg_seqid = 0;
15277 
15278 		if (osp->os_delegation) {
15279 			/*
15280 			 * If this open stream was never OPENed OTW then we
15281 			 * surely can't DOWNGRADE it (especially since the
15282 			 * osp->open_stateid is really a delegation stateid
15283 			 * when os_delegation is 1).
15284 			 */
15285 			if (access_bits & FREAD)
15286 				osp->os_share_acc_read--;
15287 			if (access_bits & FWRITE)
15288 				osp->os_share_acc_write--;
15289 			osp->os_share_deny_none--;
15290 			nfs4_error_zinit(ep);
15291 			goto out;
15292 		}
15293 		nfs4_open_downgrade(access_bits, 0, oop, osp, vp, cr,
15294 		    lrp, ep, &odg_cred_otw, &open_dg_seqid);
15295 		needrecov = nfs4_needs_recovery(ep, TRUE, mi->mi_vfsp);
15296 		if (needrecov && !isrecov) {
15297 			bool_t abort;
15298 			nfs4_bseqid_entry_t *bsep = NULL;
15299 
15300 			if (!ep->error && ep->stat == NFS4ERR_BAD_SEQID)
15301 				bsep = nfs4_create_bseqid_entry(oop, NULL,
15302 				    vp, 0,
15303 				    lrp ? TAG_OPEN_DG_LOST : TAG_OPEN_DG,
15304 				    open_dg_seqid);
15305 
15306 			nfs4open_dg_save_lost_rqst(ep->error, &new_lost_rqst,
15307 			    oop, osp, odg_cred_otw, vp, access_bits, 0);
15308 			mutex_exit(&osp->os_sync_lock);
15309 			have_sync_lock = 0;
15310 			abort = nfs4_start_recovery(ep, mi, vp, NULL, NULL,
15311 			    new_lost_rqst.lr_op == OP_OPEN_DOWNGRADE ?
15312 			    &new_lost_rqst : NULL, OP_OPEN_DOWNGRADE,
15313 			    bsep);
15314 			if (odg_cred_otw)
15315 				crfree(odg_cred_otw);
15316 			if (bsep)
15317 				kmem_free(bsep, sizeof (*bsep));
15318 
15319 			if (abort == TRUE)
15320 				goto out;
15321 
15322 			if (did_start_seqid_sync) {
15323 				nfs4_end_open_seqid_sync(oop);
15324 				did_start_seqid_sync = 0;
15325 			}
15326 			open_stream_rele(osp, rp);
15327 
15328 			if (did_start_op)
15329 				nfs4_end_fop(mi, vp, NULL, OH_CLOSE,
15330 				    &recov_state, FALSE);
15331 			if (did_force_recovlock)
15332 				nfs_rw_exit(&mi->mi_recovlock);
15333 
15334 			goto recov_retry;
15335 		} else {
15336 			if (odg_cred_otw)
15337 				crfree(odg_cred_otw);
15338 		}
15339 		goto out;
15340 	}
15341 
15342 	/*
15343 	 * If this open stream was created as the results of an open
15344 	 * while holding a delegation, then just release it; no need
15345 	 * to do an OTW close.  Otherwise do a "normal" OTW close.
15346 	 */
15347 	if (osp->os_delegation) {
15348 		nfs4close_notw(vp, osp, &have_sync_lock);
15349 		nfs4_error_zinit(ep);
15350 		goto out;
15351 	}
15352 
15353 	/*
15354 	 * If this stream is not valid, we're done.
15355 	 */
15356 	if (!osp->os_valid) {
15357 		nfs4_error_zinit(ep);
15358 		goto out;
15359 	}
15360 
15361 	/*
15362 	 * Last open or mmap ref has vanished, need to do an OTW close.
15363 	 * First check to see if a close is still necessary.
15364 	 */
15365 	if (osp->os_failed_reopen) {
15366 		NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
15367 		    "don't close OTW osp %p since reopen failed.",
15368 		    (void *)osp));
15369 		/*
15370 		 * Reopen of the open stream failed, hence the
15371 		 * stateid of the open stream is invalid/stale, and
15372 		 * sending this OTW would incorrectly cause another
15373 		 * round of recovery.  In this case, we need to set
15374 		 * the 'os_valid' bit to 0 so another thread doesn't
15375 		 * come in and re-open this open stream before
15376 		 * this "closing" thread cleans up state (decrementing
15377 		 * the nfs4_server_t's state_ref_count and decrementing
15378 		 * the os_ref_count).
15379 		 */
15380 		osp->os_valid = 0;
15381 		/*
15382 		 * This removes the reference obtained at OPEN; ie,
15383 		 * when the open stream structure was created.
15384 		 *
15385 		 * We don't have to worry about calling 'open_stream_rele'
15386 		 * since we our currently holding a reference to this
15387 		 * open stream which means the count can not go to 0 with
15388 		 * this decrement.
15389 		 */
15390 		ASSERT(osp->os_ref_count >= 2);
15391 		osp->os_ref_count--;
15392 		nfs4_error_zinit(ep);
15393 		close_failed = 0;
15394 		goto close_cleanup;
15395 	}
15396 
15397 	ASSERT(osp->os_ref_count > 1);
15398 
15399 	/*
15400 	 * Sixth, try the CLOSE OTW.
15401 	 */
15402 	nfs4close_otw(rp, cred_otw, oop, osp, &retry, &did_start_seqid_sync,
15403 	    close_type, ep, &have_sync_lock);
15404 
15405 	if (ep->error == EINTR || NFS4_FRC_UNMT_ERR(ep->error, vp->v_vfsp)) {
15406 		/*
15407 		 * Let the recovery thread be responsible for
15408 		 * removing the state for CLOSE.
15409 		 */
15410 		close_failed = 1;
15411 		force_close = 0;
15412 		retry = 0;
15413 	}
15414 
15415 	/* See if we need to retry with a different cred */
15416 	if ((ep->error == EACCES ||
15417 	    (ep->error == 0 && ep->stat == NFS4ERR_ACCESS)) &&
15418 	    cred_otw != cr) {
15419 		crfree(cred_otw);
15420 		cred_otw = cr;
15421 		crhold(cred_otw);
15422 		retry = 1;
15423 	}
15424 
15425 	if (ep->error || ep->stat)
15426 		close_failed = 1;
15427 
15428 	if (retry && !isrecov && num_retries-- > 0) {
15429 		if (have_sync_lock) {
15430 			mutex_exit(&osp->os_sync_lock);
15431 			have_sync_lock = 0;
15432 		}
15433 		if (did_start_seqid_sync) {
15434 			nfs4_end_open_seqid_sync(oop);
15435 			did_start_seqid_sync = 0;
15436 		}
15437 		open_stream_rele(osp, rp);
15438 
15439 		if (did_start_op)
15440 			nfs4_end_fop(mi, vp, NULL, OH_CLOSE,
15441 			    &recov_state, FALSE);
15442 		if (did_force_recovlock)
15443 			nfs_rw_exit(&mi->mi_recovlock);
15444 		NFS4_DEBUG(nfs4_client_recov_debug, (CE_NOTE,
15445 		    "nfs4close_one: need to retry the close "
15446 		    "operation"));
15447 		goto recov_retry;
15448 	}
15449 close_cleanup:
15450 	/*
15451 	 * Seventh and lastly, process our results.
15452 	 */
15453 	if (close_failed && force_close) {
15454 		/*
15455 		 * It's ok to drop and regrab the 'os_sync_lock' since
15456 		 * nfs4close_notw() will recheck to make sure the
15457 		 * "close"/removal of state should happen.
15458 		 */
15459 		if (!have_sync_lock) {
15460 			mutex_enter(&osp->os_sync_lock);
15461 			have_sync_lock = 1;
15462 		}
15463 		/*
15464 		 * This is last call, remove the ref on the open
15465 		 * stream created by open and clean everything up.
15466 		 */
15467 		osp->os_pending_close = 0;
15468 		nfs4close_notw(vp, osp, &have_sync_lock);
15469 		nfs4_error_zinit(ep);
15470 	}
15471 
15472 	if (!close_failed) {
15473 		if (have_sync_lock) {
15474 			osp->os_pending_close = 0;
15475 			mutex_exit(&osp->os_sync_lock);
15476 			have_sync_lock = 0;
15477 		} else {
15478 			mutex_enter(&osp->os_sync_lock);
15479 			osp->os_pending_close = 0;
15480 			mutex_exit(&osp->os_sync_lock);
15481 		}
15482 		if (did_start_op && recov_state.rs_sp != NULL) {
15483 			mutex_enter(&recov_state.rs_sp->s_lock);
15484 			nfs4_dec_state_ref_count_nolock(recov_state.rs_sp, mi);
15485 			mutex_exit(&recov_state.rs_sp->s_lock);
15486 		} else {
15487 			nfs4_dec_state_ref_count(mi);
15488 		}
15489 		nfs4_error_zinit(ep);
15490 	}
15491 
15492 out:
15493 	if (have_sync_lock)
15494 		mutex_exit(&osp->os_sync_lock);
15495 	if (did_start_op)
15496 		nfs4_end_fop(mi, vp, NULL, OH_CLOSE, &recov_state,
15497 		    recovonly ? TRUE : FALSE);
15498 	if (did_force_recovlock)
15499 		nfs_rw_exit(&mi->mi_recovlock);
15500 	if (cred_otw)
15501 		crfree(cred_otw);
15502 	if (osp)
15503 		open_stream_rele(osp, rp);
15504 	if (oop) {
15505 		if (did_start_seqid_sync)
15506 			nfs4_end_open_seqid_sync(oop);
15507 		open_owner_rele(oop);
15508 	}
15509 }
15510 
15511 /*
15512  * Convert information returned by the server in the LOCK4denied
15513  * structure to the form required by fcntl.
15514  */
15515 static void
15516 denied_to_flk(LOCK4denied *lockt_denied, flock64_t *flk, LOCKT4args *lockt_args)
15517 {
15518 	nfs4_lo_name_t *lo;
15519 
15520 #ifdef	DEBUG
15521 	if (denied_to_flk_debug) {
15522 		lockt_denied_debug = lockt_denied;
15523 		debug_enter("lockt_denied");
15524 	}
15525 #endif
15526 
15527 	flk->l_type = lockt_denied->locktype == READ_LT ? F_RDLCK : F_WRLCK;
15528 	flk->l_whence = 0;	/* aka SEEK_SET */
15529 	flk->l_start = lockt_denied->offset;
15530 	flk->l_len = lockt_denied->length;
15531 
15532 	/*
15533 	 * If the blocking clientid matches our client id, then we can
15534 	 * interpret the lockowner (since we built it).  If not, then
15535 	 * fabricate a sysid and pid.  Note that the l_sysid field
15536 	 * in *flk already has the local sysid.
15537 	 */
15538 
15539 	if (lockt_denied->owner.clientid == lockt_args->owner.clientid) {
15540 
15541 		if (lockt_denied->owner.owner_len == sizeof (*lo)) {
15542 			lo = (nfs4_lo_name_t *)
15543 			    lockt_denied->owner.owner_val;
15544 
15545 			flk->l_pid = lo->ln_pid;
15546 		} else {
15547 			NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
15548 			    "denied_to_flk: bad lock owner length\n"));
15549 
15550 			flk->l_pid = lo_to_pid(&lockt_denied->owner);
15551 		}
15552 	} else {
15553 		NFS4_DEBUG(nfs4_client_lock_debug, (CE_NOTE,
15554 		"denied_to_flk: foreign clientid\n"));
15555 
15556 		/*
15557 		 * Construct a new sysid which should be different from
15558 		 * sysids of other systems.
15559 		 */
15560 
15561 		flk->l_sysid++;
15562 		flk->l_pid = lo_to_pid(&lockt_denied->owner);
15563 	}
15564 }
15565 
15566 static pid_t
15567 lo_to_pid(lock_owner4 *lop)
15568 {
15569 	pid_t pid = 0;
15570 	uchar_t *cp;
15571 	int i;
15572 
15573 	cp = (uchar_t *)&lop->clientid;
15574 
15575 	for (i = 0; i < sizeof (lop->clientid); i++)
15576 		pid += (pid_t)*cp++;
15577 
15578 	cp = (uchar_t *)lop->owner_val;
15579 
15580 	for (i = 0; i < lop->owner_len; i++)
15581 		pid += (pid_t)*cp++;
15582 
15583 	return (pid);
15584 }
15585 
15586 /*
15587  * Given a lock pointer, returns the length of that lock.
15588  * "end" is the last locked offset the "l_len" covers from
15589  * the start of the lock.
15590  */
15591 static off64_t
15592 lock_to_end(flock64_t *lock)
15593 {
15594 	off64_t lock_end;
15595 
15596 	if (lock->l_len == 0)
15597 		lock_end = (off64_t)MAXEND;
15598 	else
15599 		lock_end = lock->l_start + lock->l_len - 1;
15600 
15601 	return (lock_end);
15602 }
15603 
15604 /*
15605  * Given the end of a lock, it will return you the length "l_len" for that lock.
15606  */
15607 static off64_t
15608 end_to_len(off64_t start, off64_t end)
15609 {
15610 	off64_t lock_len;
15611 
15612 	ASSERT(end >= start);
15613 	if (end == MAXEND)
15614 		lock_len = 0;
15615 	else
15616 		lock_len = end - start + 1;
15617 
15618 	return (lock_len);
15619 }
15620 
15621 /*
15622  * On given end for a lock it determines if it is the last locked offset
15623  * or not, if so keeps it as is, else adds one to return the length for
15624  * valid start.
15625  */
15626 static off64_t
15627 start_check(off64_t x)
15628 {
15629 	if (x == MAXEND)
15630 		return (x);
15631 	else
15632 		return (x + 1);
15633 }
15634 
15635 /*
15636  * See if these two locks overlap, and if so return 1;
15637  * otherwise, return 0.
15638  */
15639 static int
15640 locks_intersect(flock64_t *llfp, flock64_t *curfp)
15641 {
15642 	off64_t llfp_end, curfp_end;
15643 
15644 	llfp_end = lock_to_end(llfp);
15645 	curfp_end = lock_to_end(curfp);
15646 
15647 	if (((llfp_end >= curfp->l_start) &&
15648 	    (llfp->l_start <= curfp->l_start)) ||
15649 	    ((curfp->l_start <= llfp->l_start) && (curfp_end >= llfp->l_start)))
15650 		return (1);
15651 	return (0);
15652 }
15653 
15654 /*
15655  * Determine what the intersecting lock region is, and add that to the
15656  * 'nl_llpp' locklist in increasing order (by l_start).
15657  */
15658 static void
15659 nfs4_add_lock_range(flock64_t *lost_flp, flock64_t *local_flp,
15660     locklist_t **nl_llpp, vnode_t *vp)
15661 {
15662 	locklist_t *intersect_llp, *tmp_fllp, *cur_fllp;
15663 	off64_t lost_flp_end, local_flp_end, len, start;
15664 
15665 	NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE, "nfs4_add_lock_range:"));
15666 
15667 	if (!locks_intersect(lost_flp, local_flp))
15668 		return;
15669 
15670 	NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE, "nfs4_add_lock_range: "
15671 	    "locks intersect"));
15672 
15673 	lost_flp_end = lock_to_end(lost_flp);
15674 	local_flp_end = lock_to_end(local_flp);
15675 
15676 	/* Find the starting point of the intersecting region */
15677 	if (local_flp->l_start > lost_flp->l_start)
15678 		start = local_flp->l_start;
15679 	else
15680 		start = lost_flp->l_start;
15681 
15682 	/* Find the lenght of the intersecting region */
15683 	if (lost_flp_end < local_flp_end)
15684 		len = end_to_len(start, lost_flp_end);
15685 	else
15686 		len = end_to_len(start, local_flp_end);
15687 
15688 	/*
15689 	 * Prepare the flock structure for the intersection found and insert
15690 	 * it into the new list in increasing l_start order. This list contains
15691 	 * intersections of locks registered by the client with the local host
15692 	 * and the lost lock.
15693 	 * The lock type of this lock is the same as that of the local_flp.
15694 	 */
15695 	intersect_llp = (locklist_t *)kmem_alloc(sizeof (locklist_t), KM_SLEEP);
15696 	intersect_llp->ll_flock.l_start = start;
15697 	intersect_llp->ll_flock.l_len = len;
15698 	intersect_llp->ll_flock.l_type = local_flp->l_type;
15699 	intersect_llp->ll_flock.l_pid = local_flp->l_pid;
15700 	intersect_llp->ll_flock.l_sysid = local_flp->l_sysid;
15701 	intersect_llp->ll_flock.l_whence = 0;	/* aka SEEK_SET */
15702 	intersect_llp->ll_vp = vp;
15703 
15704 	tmp_fllp = *nl_llpp;
15705 	cur_fllp = NULL;
15706 	while (tmp_fllp != NULL && tmp_fllp->ll_flock.l_start <
15707 	    intersect_llp->ll_flock.l_start) {
15708 			cur_fllp = tmp_fllp;
15709 			tmp_fllp = tmp_fllp->ll_next;
15710 	}
15711 	if (cur_fllp == NULL) {
15712 		/* first on the list */
15713 		intersect_llp->ll_next = *nl_llpp;
15714 		*nl_llpp = intersect_llp;
15715 	} else {
15716 		intersect_llp->ll_next = cur_fllp->ll_next;
15717 		cur_fllp->ll_next = intersect_llp;
15718 	}
15719 
15720 	NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE, "nfs4_add_lock_range: "
15721 	    "created lock region: start %"PRIx64" end %"PRIx64" : %s\n",
15722 	    intersect_llp->ll_flock.l_start,
15723 	    intersect_llp->ll_flock.l_start + intersect_llp->ll_flock.l_len,
15724 	    intersect_llp->ll_flock.l_type == F_RDLCK ? "READ" : "WRITE"));
15725 }
15726 
15727 /*
15728  * Our local locking current state is potentially different than
15729  * what the NFSv4 server thinks we have due to a lost lock that was
15730  * resent and then received.  We need to reset our "NFSv4" locking
15731  * state to match the current local locking state for this pid since
15732  * that is what the user/application sees as what the world is.
15733  *
15734  * We cannot afford to drop the open/lock seqid sync since then we can
15735  * get confused about what the current local locking state "is" versus
15736  * "was".
15737  *
15738  * If we are unable to fix up the locks, we send SIGLOST to the affected
15739  * process.  This is not done if the filesystem has been forcibly
15740  * unmounted, in case the process has already exited and a new process
15741  * exists with the same pid.
15742  */
15743 static void
15744 nfs4_reinstitute_local_lock_state(vnode_t *vp, flock64_t *lost_flp, cred_t *cr,
15745     nfs4_lock_owner_t *lop)
15746 {
15747 	locklist_t *locks, *llp, *ri_llp, *tmp_llp;
15748 	mntinfo4_t *mi = VTOMI4(vp);
15749 	const int cmd = F_SETLK;
15750 	off64_t cur_start, llp_ll_flock_end, lost_flp_end;
15751 	flock64_t ul_fl;
15752 
15753 	NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15754 	    "nfs4_reinstitute_local_lock_state"));
15755 
15756 	/*
15757 	 * Find active locks for this vp from the local locking code.
15758 	 * Scan through this list and find out the locks that intersect with
15759 	 * the lost lock. Once we find the lock that intersects, add the
15760 	 * intersection area as a new lock to a new list "ri_llp". The lock
15761 	 * type of the intersection region lock added to ri_llp is the same
15762 	 * as that found in the active lock list, "list". The intersecting
15763 	 * region locks are added to ri_llp in increasing l_start order.
15764 	 */
15765 	ASSERT(nfs_zone() == mi->mi_zone);
15766 
15767 	locks = flk_active_locks_for_vp(vp);
15768 	ri_llp = NULL;
15769 
15770 	for (llp = locks; llp != NULL; llp = llp->ll_next) {
15771 		ASSERT(llp->ll_vp == vp);
15772 		/*
15773 		 * Pick locks that belong to this pid/lockowner
15774 		 */
15775 		if (llp->ll_flock.l_pid != lost_flp->l_pid)
15776 			continue;
15777 
15778 		nfs4_add_lock_range(lost_flp, &llp->ll_flock, &ri_llp, vp);
15779 	}
15780 
15781 	/*
15782 	 * Now we have the list of intersections with the lost lock. These are
15783 	 * the locks that were/are active before the server replied to the
15784 	 * last/lost lock. Issue these locks to the server here. Playing these
15785 	 * locks to the server will re-establish aur current local locking state
15786 	 * with the v4 server.
15787 	 * If we get an error, send SIGLOST to the application for that lock.
15788 	 */
15789 
15790 	for (llp = ri_llp; llp != NULL; llp = llp->ll_next) {
15791 		NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15792 		    "nfs4_reinstitute_local_lock_state: need to issue "
15793 		    "flock: [%"PRIx64" - %"PRIx64"] : %s",
15794 		    llp->ll_flock.l_start,
15795 		    llp->ll_flock.l_start + llp->ll_flock.l_len,
15796 		    llp->ll_flock.l_type == F_RDLCK ? "READ" :
15797 		    llp->ll_flock.l_type == F_WRLCK ? "WRITE" : "INVALID"));
15798 		/*
15799 		 * No need to relock what we already have
15800 		 */
15801 		if (llp->ll_flock.l_type == lost_flp->l_type)
15802 			continue;
15803 
15804 		push_reinstate(vp, cmd, &llp->ll_flock, cr, lop);
15805 	}
15806 
15807 	/*
15808 	 * Now keeping the start of the lost lock as our reference parse the
15809 	 * newly created ri_llp locklist to find the ranges that we have locked
15810 	 * with the v4 server but not in the current local locking. We need
15811 	 * to unlock these ranges.
15812 	 * These ranges can also be reffered to as those ranges, where the lost
15813 	 * lock does not overlap with the locks in the ri_llp but are locked
15814 	 * since the server replied to the lost lock.
15815 	 */
15816 	cur_start = lost_flp->l_start;
15817 	lost_flp_end = lock_to_end(lost_flp);
15818 
15819 	ul_fl.l_type = F_UNLCK;
15820 	ul_fl.l_whence = 0;	/* aka SEEK_SET */
15821 	ul_fl.l_sysid = lost_flp->l_sysid;
15822 	ul_fl.l_pid = lost_flp->l_pid;
15823 
15824 	for (llp = ri_llp; llp != NULL; llp = llp->ll_next) {
15825 		llp_ll_flock_end = lock_to_end(&llp->ll_flock);
15826 
15827 		if (llp->ll_flock.l_start <= cur_start) {
15828 			cur_start = start_check(llp_ll_flock_end);
15829 			continue;
15830 		}
15831 		NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15832 		    "nfs4_reinstitute_local_lock_state: "
15833 		    "UNLOCK [%"PRIx64" - %"PRIx64"]",
15834 		    cur_start, llp->ll_flock.l_start));
15835 
15836 		ul_fl.l_start = cur_start;
15837 		ul_fl.l_len = end_to_len(cur_start,
15838 		    (llp->ll_flock.l_start - 1));
15839 
15840 		push_reinstate(vp, cmd, &ul_fl, cr, lop);
15841 		cur_start = start_check(llp_ll_flock_end);
15842 	}
15843 
15844 	/*
15845 	 * In the case where the lost lock ends after all intersecting locks,
15846 	 * unlock the last part of the lost lock range.
15847 	 */
15848 	if (cur_start != start_check(lost_flp_end)) {
15849 		NFS4_DEBUG(nfs4_lost_rqst_debug, (CE_NOTE,
15850 		    "nfs4_reinstitute_local_lock_state: UNLOCK end of the "
15851 		    "lost lock region [%"PRIx64" - %"PRIx64"]",
15852 		    cur_start, lost_flp->l_start + lost_flp->l_len));
15853 
15854 		ul_fl.l_start = cur_start;
15855 		/*
15856 		 * Is it an to-EOF lock? if so unlock till the end
15857 		 */
15858 		if (lost_flp->l_len == 0)
15859 			ul_fl.l_len = 0;
15860 		else
15861 			ul_fl.l_len = start_check(lost_flp_end) - cur_start;
15862 
15863 		push_reinstate(vp, cmd, &ul_fl, cr, lop);
15864 	}
15865 
15866 	if (locks != NULL)
15867 		flk_free_locklist(locks);
15868 
15869 	/* Free up our newly created locklist */
15870 	for (llp = ri_llp; llp != NULL; ) {
15871 		tmp_llp = llp->ll_next;
15872 		kmem_free(llp, sizeof (locklist_t));
15873 		llp = tmp_llp;
15874 	}
15875 
15876 	/*
15877 	 * Now return back to the original calling nfs4frlock()
15878 	 * and let us naturally drop our seqid syncs.
15879 	 */
15880 }
15881 
15882 /*
15883  * Create a lost state record for the given lock reinstantiation request
15884  * and push it onto the lost state queue.
15885  */
15886 static void
15887 push_reinstate(vnode_t *vp, int cmd, flock64_t *flk, cred_t *cr,
15888     nfs4_lock_owner_t *lop)
15889 {
15890 	nfs4_lost_rqst_t req;
15891 	nfs_lock_type4 locktype;
15892 	nfs4_error_t e = { EINTR, NFS4_OK, RPC_SUCCESS };
15893 
15894 	ASSERT(nfs_zone() == VTOMI4(vp)->mi_zone);
15895 
15896 	locktype = flk_to_locktype(cmd, flk->l_type);
15897 	nfs4frlock_save_lost_rqst(NFS4_LCK_CTYPE_REINSTATE, EINTR, locktype,
15898 	    NULL, NULL, lop, flk, &req, cr, vp);
15899 	(void) nfs4_start_recovery(&e, VTOMI4(vp), vp, NULL, NULL,
15900 	    (req.lr_op == OP_LOCK || req.lr_op == OP_LOCKU) ?
15901 	    &req : NULL, flk->l_type == F_UNLCK ? OP_LOCKU : OP_LOCK,
15902 	    NULL);
15903 }
15904