xref: /titanic_50/usr/src/uts/common/fs/nfs/nfs4_state.c (revision c3a558e7c77127215b010652905be7916ec5a080)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <sys/systm.h>
27 #include <sys/kmem.h>
28 #include <sys/cmn_err.h>
29 #include <sys/atomic.h>
30 #include <sys/clconf.h>
31 #include <sys/cladm.h>
32 #include <sys/flock.h>
33 #include <nfs/export.h>
34 #include <nfs/nfs.h>
35 #include <nfs/nfs4.h>
36 #include <nfs/nfssys.h>
37 #include <nfs/lm.h>
38 #include <sys/pathname.h>
39 #include <sys/sdt.h>
40 #include <sys/nvpair.h>
41 
42 extern u_longlong_t nfs4_srv_caller_id;
43 
44 extern time_t rfs4_start_time;
45 extern uint_t nfs4_srv_vkey;
46 
47 stateid4 special0 = {
48 	0,
49 	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
50 };
51 
52 stateid4 special1 = {
53 	0xffffffff,
54 	{
55 		(char)0xff, (char)0xff, (char)0xff, (char)0xff,
56 		(char)0xff, (char)0xff, (char)0xff, (char)0xff,
57 		(char)0xff, (char)0xff, (char)0xff, (char)0xff
58 	}
59 };
60 
61 
62 #define	ISSPECIAL(id)  (stateid4_cmp(id, &special0) || \
63 			stateid4_cmp(id, &special1))
64 
65 /* For embedding the cluster nodeid into our clientid */
66 #define	CLUSTER_NODEID_SHIFT	24
67 #define	CLUSTER_MAX_NODEID	255
68 
69 #ifdef DEBUG
70 int rfs4_debug;
71 #endif
72 
73 static uint32_t rfs4_database_debug = 0x00;
74 
75 static void rfs4_ss_clid_write(rfs4_client_t *cp, char *leaf);
76 static void rfs4_ss_clid_write_one(rfs4_client_t *cp, char *dir, char *leaf);
77 static void rfs4_dss_clear_oldstate(rfs4_servinst_t *sip);
78 static void rfs4_ss_chkclid_sip(rfs4_client_t *cp, rfs4_servinst_t *sip);
79 
80 /*
81  * Couple of simple init/destroy functions for a general waiter
82  */
83 void
84 rfs4_sw_init(rfs4_state_wait_t *swp)
85 {
86 	mutex_init(swp->sw_cv_lock, NULL, MUTEX_DEFAULT, NULL);
87 	cv_init(swp->sw_cv, NULL, CV_DEFAULT, NULL);
88 	swp->sw_active = FALSE;
89 	swp->sw_wait_count = 0;
90 }
91 
92 void
93 rfs4_sw_destroy(rfs4_state_wait_t *swp)
94 {
95 	mutex_destroy(swp->sw_cv_lock);
96 	cv_destroy(swp->sw_cv);
97 }
98 
99 void
100 rfs4_sw_enter(rfs4_state_wait_t *swp)
101 {
102 	mutex_enter(swp->sw_cv_lock);
103 	while (swp->sw_active) {
104 		swp->sw_wait_count++;
105 		cv_wait(swp->sw_cv, swp->sw_cv_lock);
106 		swp->sw_wait_count--;
107 	}
108 	ASSERT(swp->sw_active == FALSE);
109 	swp->sw_active = TRUE;
110 	mutex_exit(swp->sw_cv_lock);
111 }
112 
113 void
114 rfs4_sw_exit(rfs4_state_wait_t *swp)
115 {
116 	mutex_enter(swp->sw_cv_lock);
117 	ASSERT(swp->sw_active == TRUE);
118 	swp->sw_active = FALSE;
119 	if (swp->sw_wait_count != 0)
120 		cv_broadcast(swp->sw_cv);
121 	mutex_exit(swp->sw_cv_lock);
122 }
123 
124 /*
125  * CPR callback id -- not related to v4 callbacks
126  */
127 static callb_id_t cpr_id = 0;
128 
129 static void
130 deep_lock_copy(LOCK4res *dres, LOCK4res *sres)
131 {
132 	lock_owner4 *slo = &sres->LOCK4res_u.denied.owner;
133 	lock_owner4 *dlo = &dres->LOCK4res_u.denied.owner;
134 
135 	if (sres->status == NFS4ERR_DENIED) {
136 		dlo->owner_val = kmem_alloc(slo->owner_len, KM_SLEEP);
137 		bcopy(slo->owner_val, dlo->owner_val, slo->owner_len);
138 	}
139 }
140 
141 static void
142 deep_lock_free(LOCK4res *res)
143 {
144 	lock_owner4 *lo = &res->LOCK4res_u.denied.owner;
145 
146 	if (res->status == NFS4ERR_DENIED)
147 		kmem_free(lo->owner_val, lo->owner_len);
148 }
149 
150 static void
151 deep_open_copy(OPEN4res *dres, OPEN4res *sres)
152 {
153 	nfsace4 *sacep, *dacep;
154 
155 	if (sres->status != NFS4_OK) {
156 		return;
157 	}
158 
159 	dres->attrset = sres->attrset;
160 
161 	switch (sres->delegation.delegation_type) {
162 	case OPEN_DELEGATE_NONE:
163 		return;
164 	case OPEN_DELEGATE_READ:
165 		sacep = &sres->delegation.open_delegation4_u.read.permissions;
166 		dacep = &dres->delegation.open_delegation4_u.read.permissions;
167 		break;
168 	case OPEN_DELEGATE_WRITE:
169 		sacep = &sres->delegation.open_delegation4_u.write.permissions;
170 		dacep = &dres->delegation.open_delegation4_u.write.permissions;
171 		break;
172 	}
173 	dacep->who.utf8string_val =
174 	    kmem_alloc(sacep->who.utf8string_len, KM_SLEEP);
175 	bcopy(sacep->who.utf8string_val, dacep->who.utf8string_val,
176 	    sacep->who.utf8string_len);
177 }
178 
179 static void
180 deep_open_free(OPEN4res *res)
181 {
182 	nfsace4 *acep;
183 	if (res->status != NFS4_OK)
184 		return;
185 
186 	switch (res->delegation.delegation_type) {
187 	case OPEN_DELEGATE_NONE:
188 		return;
189 	case OPEN_DELEGATE_READ:
190 		acep = &res->delegation.open_delegation4_u.read.permissions;
191 		break;
192 	case OPEN_DELEGATE_WRITE:
193 		acep = &res->delegation.open_delegation4_u.write.permissions;
194 		break;
195 	}
196 
197 	if (acep->who.utf8string_val) {
198 		kmem_free(acep->who.utf8string_val, acep->who.utf8string_len);
199 		acep->who.utf8string_val = NULL;
200 	}
201 }
202 
203 void
204 rfs4_free_reply(nfs_resop4 *rp)
205 {
206 	switch (rp->resop) {
207 	case OP_LOCK:
208 		deep_lock_free(&rp->nfs_resop4_u.oplock);
209 		break;
210 	case OP_OPEN:
211 		deep_open_free(&rp->nfs_resop4_u.opopen);
212 	default:
213 		break;
214 	}
215 }
216 
217 void
218 rfs4_copy_reply(nfs_resop4 *dst, nfs_resop4 *src)
219 {
220 	*dst = *src;
221 
222 	/* Handle responses that need deep copy */
223 	switch (src->resop) {
224 	case OP_LOCK:
225 		deep_lock_copy(&dst->nfs_resop4_u.oplock,
226 		    &src->nfs_resop4_u.oplock);
227 		break;
228 	case OP_OPEN:
229 		deep_open_copy(&dst->nfs_resop4_u.opopen,
230 		    &src->nfs_resop4_u.opopen);
231 		break;
232 	default:
233 		break;
234 	};
235 }
236 
237 /*
238  * This is the implementation of the underlying state engine. The
239  * public interface to this engine is described by
240  * nfs4_state.h. Callers to the engine should hold no state engine
241  * locks when they call in to it. If the protocol needs to lock data
242  * structures it should do so after acquiring all references to them
243  * first and then follow the following lock order:
244  *
245  *	client > openowner > state > lo_state > lockowner > file.
246  *
247  * Internally we only allow a thread to hold one hash bucket lock at a
248  * time and the lock is higher in the lock order (must be acquired
249  * first) than the data structure that is on that hash list.
250  *
251  * If a new reference was acquired by the caller, that reference needs
252  * to be released after releasing all acquired locks with the
253  * corresponding rfs4_*_rele routine.
254  */
255 
256 /*
257  * This code is some what prototypical for now. Its purpose currently is to
258  * implement the interfaces sufficiently to finish the higher protocol
259  * elements. This will be replaced by a dynamically resizeable tables
260  * backed by kmem_cache allocator. However synchronization is handled
261  * correctly (I hope) and will not change by much.  The mutexes for
262  * the hash buckets that can be used to create new instances of data
263  * structures  might be good candidates to evolve into reader writer
264  * locks. If it has to do a creation, it would be holding the
265  * mutex across a kmem_alloc with KM_SLEEP specified.
266  */
267 
268 #ifdef DEBUG
269 #define	TABSIZE 17
270 #else
271 #define	TABSIZE 2047
272 #endif
273 
274 #define	ADDRHASH(key) ((unsigned long)(key) >> 3)
275 
276 /* Used to serialize create/destroy of rfs4_server_state database */
277 kmutex_t	rfs4_state_lock;
278 static rfs4_database_t *rfs4_server_state = NULL;
279 
280 /* Used to serialize lookups of clientids */
281 static	krwlock_t	rfs4_findclient_lock;
282 
283 /*
284  * For now this "table" is exposed so that the CPR callback
285  * function can tromp through it..
286  */
287 rfs4_table_t *rfs4_client_tab;
288 
289 static rfs4_index_t *rfs4_clientid_idx;
290 static rfs4_index_t *rfs4_nfsclnt_idx;
291 static rfs4_table_t *rfs4_clntip_tab;
292 static rfs4_index_t *rfs4_clntip_idx;
293 static rfs4_table_t *rfs4_openowner_tab;
294 static rfs4_index_t *rfs4_openowner_idx;
295 static rfs4_table_t *rfs4_state_tab;
296 static rfs4_index_t *rfs4_state_idx;
297 static rfs4_index_t *rfs4_state_owner_file_idx;
298 static rfs4_index_t *rfs4_state_file_idx;
299 static rfs4_table_t *rfs4_lo_state_tab;
300 static rfs4_index_t *rfs4_lo_state_idx;
301 static rfs4_index_t *rfs4_lo_state_owner_idx;
302 static rfs4_table_t *rfs4_lockowner_tab;
303 static rfs4_index_t *rfs4_lockowner_idx;
304 static rfs4_index_t *rfs4_lockowner_pid_idx;
305 static rfs4_table_t *rfs4_file_tab;
306 static rfs4_index_t *rfs4_file_idx;
307 static rfs4_table_t *rfs4_deleg_state_tab;
308 static rfs4_index_t *rfs4_deleg_idx;
309 static rfs4_index_t *rfs4_deleg_state_idx;
310 
311 #define	MAXTABSZ 1024*1024
312 
313 /* The values below are rfs4_lease_time units */
314 
315 #ifdef DEBUG
316 #define	CLIENT_CACHE_TIME 1
317 #define	OPENOWNER_CACHE_TIME 1
318 #define	STATE_CACHE_TIME 1
319 #define	LO_STATE_CACHE_TIME 1
320 #define	LOCKOWNER_CACHE_TIME 1
321 #define	FILE_CACHE_TIME 3
322 #define	DELEG_STATE_CACHE_TIME 1
323 #else
324 #define	CLIENT_CACHE_TIME 10
325 #define	OPENOWNER_CACHE_TIME 5
326 #define	STATE_CACHE_TIME 1
327 #define	LO_STATE_CACHE_TIME 1
328 #define	LOCKOWNER_CACHE_TIME 3
329 #define	FILE_CACHE_TIME 40
330 #define	DELEG_STATE_CACHE_TIME 1
331 #endif
332 
333 
334 static time_t rfs4_client_cache_time = 0;
335 static time_t rfs4_clntip_cache_time = 0;
336 static time_t rfs4_openowner_cache_time = 0;
337 static time_t rfs4_state_cache_time = 0;
338 static time_t rfs4_lo_state_cache_time = 0;
339 static time_t rfs4_lockowner_cache_time = 0;
340 static time_t rfs4_file_cache_time = 0;
341 static time_t rfs4_deleg_state_cache_time = 0;
342 
343 static bool_t rfs4_client_create(rfs4_entry_t, void *);
344 static void rfs4_dss_remove_cpleaf(rfs4_client_t *);
345 static void rfs4_dss_remove_leaf(rfs4_servinst_t *, char *, char *);
346 static void rfs4_client_destroy(rfs4_entry_t);
347 static bool_t rfs4_client_expiry(rfs4_entry_t);
348 static uint32_t clientid_hash(void *);
349 static bool_t clientid_compare(rfs4_entry_t, void *);
350 static void *clientid_mkkey(rfs4_entry_t);
351 static uint32_t nfsclnt_hash(void *);
352 static bool_t nfsclnt_compare(rfs4_entry_t, void *);
353 static void *nfsclnt_mkkey(rfs4_entry_t);
354 static bool_t rfs4_clntip_expiry(rfs4_entry_t);
355 static void rfs4_clntip_destroy(rfs4_entry_t);
356 static bool_t rfs4_clntip_create(rfs4_entry_t, void *);
357 static uint32_t clntip_hash(void *);
358 static bool_t clntip_compare(rfs4_entry_t, void *);
359 static void *clntip_mkkey(rfs4_entry_t);
360 static bool_t rfs4_openowner_create(rfs4_entry_t, void *);
361 static void rfs4_openowner_destroy(rfs4_entry_t);
362 static bool_t rfs4_openowner_expiry(rfs4_entry_t);
363 static uint32_t openowner_hash(void *);
364 static bool_t openowner_compare(rfs4_entry_t, void *);
365 static void *openowner_mkkey(rfs4_entry_t);
366 static bool_t rfs4_state_create(rfs4_entry_t, void *);
367 static void rfs4_state_destroy(rfs4_entry_t);
368 static bool_t rfs4_state_expiry(rfs4_entry_t);
369 static uint32_t state_hash(void *);
370 static bool_t state_compare(rfs4_entry_t, void *);
371 static void *state_mkkey(rfs4_entry_t);
372 static uint32_t state_owner_file_hash(void *);
373 static bool_t state_owner_file_compare(rfs4_entry_t, void *);
374 static void *state_owner_file_mkkey(rfs4_entry_t);
375 static uint32_t state_file_hash(void *);
376 static bool_t state_file_compare(rfs4_entry_t, void *);
377 static void *state_file_mkkey(rfs4_entry_t);
378 static bool_t rfs4_lo_state_create(rfs4_entry_t, void *);
379 static void rfs4_lo_state_destroy(rfs4_entry_t);
380 static bool_t rfs4_lo_state_expiry(rfs4_entry_t);
381 static uint32_t lo_state_hash(void *);
382 static bool_t lo_state_compare(rfs4_entry_t, void *);
383 static void *lo_state_mkkey(rfs4_entry_t);
384 static uint32_t lo_state_lo_hash(void *);
385 static bool_t lo_state_lo_compare(rfs4_entry_t, void *);
386 static void *lo_state_lo_mkkey(rfs4_entry_t);
387 static bool_t rfs4_lockowner_create(rfs4_entry_t, void *);
388 static void rfs4_lockowner_destroy(rfs4_entry_t);
389 static bool_t rfs4_lockowner_expiry(rfs4_entry_t);
390 static uint32_t lockowner_hash(void *);
391 static bool_t lockowner_compare(rfs4_entry_t, void *);
392 static void *lockowner_mkkey(rfs4_entry_t);
393 static uint32_t pid_hash(void *);
394 static bool_t pid_compare(rfs4_entry_t, void *);
395 static void *pid_mkkey(rfs4_entry_t);
396 static bool_t rfs4_file_create(rfs4_entry_t, void *);
397 static void rfs4_file_destroy(rfs4_entry_t);
398 static uint32_t file_hash(void *);
399 static bool_t file_compare(rfs4_entry_t, void *);
400 static void *file_mkkey(rfs4_entry_t);
401 static bool_t rfs4_deleg_state_create(rfs4_entry_t, void *);
402 static void rfs4_deleg_state_destroy(rfs4_entry_t);
403 static bool_t rfs4_deleg_state_expiry(rfs4_entry_t);
404 static uint32_t deleg_hash(void *);
405 static bool_t deleg_compare(rfs4_entry_t, void *);
406 static void *deleg_mkkey(rfs4_entry_t);
407 static uint32_t deleg_state_hash(void *);
408 static bool_t deleg_state_compare(rfs4_entry_t, void *);
409 static void *deleg_state_mkkey(rfs4_entry_t);
410 
411 static void rfs4_state_rele_nounlock(rfs4_state_t *);
412 
413 static int rfs4_ss_enabled = 0;
414 
415 extern void (*rfs4_client_clrst)(struct nfs4clrst_args *);
416 
417 void
418 rfs4_ss_pnfree(rfs4_ss_pn_t *ss_pn)
419 {
420 	kmem_free(ss_pn, sizeof (rfs4_ss_pn_t));
421 }
422 
423 static rfs4_ss_pn_t *
424 rfs4_ss_pnalloc(char *dir, char *leaf)
425 {
426 	rfs4_ss_pn_t *ss_pn;
427 	int 	dir_len, leaf_len;
428 
429 	/*
430 	 * validate we have a resonable path
431 	 * (account for the '/' and trailing null)
432 	 */
433 	if ((dir_len = strlen(dir)) > MAXPATHLEN ||
434 	    (leaf_len = strlen(leaf)) > MAXNAMELEN ||
435 	    (dir_len + leaf_len + 2) > MAXPATHLEN) {
436 		return (NULL);
437 	}
438 
439 	ss_pn = kmem_alloc(sizeof (rfs4_ss_pn_t), KM_SLEEP);
440 
441 	(void) snprintf(ss_pn->pn, MAXPATHLEN, "%s/%s", dir, leaf);
442 	/* Handy pointer to just the leaf name */
443 	ss_pn->leaf = ss_pn->pn + dir_len + 1;
444 	return (ss_pn);
445 }
446 
447 
448 /*
449  * Move the "leaf" filename from "sdir" directory
450  * to the "ddir" directory. Return the pathname of
451  * the destination unless the rename fails in which
452  * case we need to return the source pathname.
453  */
454 static rfs4_ss_pn_t *
455 rfs4_ss_movestate(char *sdir, char *ddir, char *leaf)
456 {
457 	rfs4_ss_pn_t *src, *dst;
458 
459 	if ((src = rfs4_ss_pnalloc(sdir, leaf)) == NULL)
460 		return (NULL);
461 
462 	if ((dst = rfs4_ss_pnalloc(ddir, leaf)) == NULL) {
463 		rfs4_ss_pnfree(src);
464 		return (NULL);
465 	}
466 
467 	/*
468 	 * If the rename fails we shall return the src
469 	 * pathname and free the dst. Otherwise we need
470 	 * to free the src and return the dst pathanme.
471 	 */
472 	if (vn_rename(src->pn, dst->pn, UIO_SYSSPACE)) {
473 		rfs4_ss_pnfree(dst);
474 		return (src);
475 	}
476 	rfs4_ss_pnfree(src);
477 	return (dst);
478 }
479 
480 
481 static rfs4_oldstate_t *
482 rfs4_ss_getstate(vnode_t *dvp, rfs4_ss_pn_t *ss_pn)
483 {
484 	struct uio uio;
485 	struct iovec iov[3];
486 
487 	rfs4_oldstate_t *cl_ss = NULL;
488 	vnode_t *vp;
489 	vattr_t va;
490 	uint_t id_len;
491 	int err, kill_file, file_vers;
492 
493 	if (ss_pn == NULL)
494 		return (NULL);
495 
496 	/*
497 	 * open the state file.
498 	 */
499 	if (vn_open(ss_pn->pn, UIO_SYSSPACE, FREAD, 0, &vp, 0, 0) != 0) {
500 		return (NULL);
501 	}
502 
503 	if (vp->v_type != VREG) {
504 		(void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, CRED(), NULL);
505 		VN_RELE(vp);
506 		return (NULL);
507 	}
508 
509 	err = VOP_ACCESS(vp, VREAD, 0, CRED(), NULL);
510 	if (err) {
511 		/*
512 		 * We don't have read access? better get the heck out.
513 		 */
514 		(void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, CRED(), NULL);
515 		VN_RELE(vp);
516 		return (NULL);
517 	}
518 
519 	(void) VOP_RWLOCK(vp, V_WRITELOCK_FALSE, NULL);
520 	/*
521 	 * get the file size to do some basic validation
522 	 */
523 	va.va_mask = AT_SIZE;
524 	err = VOP_GETATTR(vp, &va, 0, CRED(), NULL);
525 
526 	kill_file = (va.va_size == 0 || va.va_size <
527 	    (NFS4_VERIFIER_SIZE + sizeof (uint_t)+1));
528 
529 	if (err || kill_file) {
530 		VOP_RWUNLOCK(vp, V_WRITELOCK_FALSE, NULL);
531 		(void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, CRED(), NULL);
532 		VN_RELE(vp);
533 		if (kill_file) {
534 			(void) VOP_REMOVE(dvp, ss_pn->leaf, CRED(), NULL, 0);
535 		}
536 		return (NULL);
537 	}
538 
539 	cl_ss = kmem_alloc(sizeof (rfs4_oldstate_t), KM_SLEEP);
540 
541 	/*
542 	 * build iovecs to read in the file_version, verifier and id_len
543 	 */
544 	iov[0].iov_base = (caddr_t)&file_vers;
545 	iov[0].iov_len = sizeof (int);
546 	iov[1].iov_base = (caddr_t)&cl_ss->cl_id4.verifier;
547 	iov[1].iov_len = NFS4_VERIFIER_SIZE;
548 	iov[2].iov_base = (caddr_t)&id_len;
549 	iov[2].iov_len = sizeof (uint_t);
550 
551 	uio.uio_iov = iov;
552 	uio.uio_iovcnt = 3;
553 	uio.uio_segflg = UIO_SYSSPACE;
554 	uio.uio_loffset = 0;
555 	uio.uio_resid = sizeof (int) + NFS4_VERIFIER_SIZE + sizeof (uint_t);
556 
557 	if (err = VOP_READ(vp, &uio, FREAD, CRED(), NULL)) {
558 		VOP_RWUNLOCK(vp, V_WRITELOCK_FALSE, NULL);
559 		(void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, CRED(), NULL);
560 		VN_RELE(vp);
561 		kmem_free(cl_ss, sizeof (rfs4_oldstate_t));
562 		return (NULL);
563 	}
564 
565 	/*
566 	 * if the file_version doesn't match or if the
567 	 * id_len is zero or the combination of the verifier,
568 	 * id_len and id_val is bigger than the file we have
569 	 * a problem. If so ditch the file.
570 	 */
571 	kill_file = (file_vers != NFS4_SS_VERSION || id_len == 0 ||
572 	    (id_len + NFS4_VERIFIER_SIZE + sizeof (uint_t)) > va.va_size);
573 
574 	if (err || kill_file) {
575 		VOP_RWUNLOCK(vp, V_WRITELOCK_FALSE, NULL);
576 		(void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, CRED(), NULL);
577 		VN_RELE(vp);
578 		kmem_free(cl_ss, sizeof (rfs4_oldstate_t));
579 		if (kill_file) {
580 			(void) VOP_REMOVE(dvp, ss_pn->leaf, CRED(), NULL, 0);
581 		}
582 		return (NULL);
583 	}
584 
585 	/*
586 	 * now get the client id value
587 	 */
588 	cl_ss->cl_id4.id_val = kmem_alloc(id_len, KM_SLEEP);
589 	iov[0].iov_base = cl_ss->cl_id4.id_val;
590 	iov[0].iov_len = id_len;
591 
592 	uio.uio_iov = iov;
593 	uio.uio_iovcnt = 1;
594 	uio.uio_segflg = UIO_SYSSPACE;
595 	uio.uio_resid = cl_ss->cl_id4.id_len = id_len;
596 
597 	if (err = VOP_READ(vp, &uio, FREAD, CRED(), NULL)) {
598 		VOP_RWUNLOCK(vp, V_WRITELOCK_FALSE, NULL);
599 		(void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, CRED(), NULL);
600 		VN_RELE(vp);
601 		kmem_free(cl_ss->cl_id4.id_val, id_len);
602 		kmem_free(cl_ss, sizeof (rfs4_oldstate_t));
603 		return (NULL);
604 	}
605 
606 	VOP_RWUNLOCK(vp, V_WRITELOCK_FALSE, NULL);
607 	(void) VOP_CLOSE(vp, FREAD, 1, (offset_t)0, CRED(), NULL);
608 	VN_RELE(vp);
609 	return (cl_ss);
610 }
611 
612 #ifdef	nextdp
613 #undef nextdp
614 #endif
615 #define	nextdp(dp)	((struct dirent64 *)((char *)(dp) + (dp)->d_reclen))
616 
617 /*
618  * Add entries from statedir to supplied oldstate list.
619  * Optionally, move all entries from statedir -> destdir.
620  */
621 void
622 rfs4_ss_oldstate(rfs4_oldstate_t *oldstate, char *statedir, char *destdir)
623 {
624 	rfs4_ss_pn_t *ss_pn;
625 	rfs4_oldstate_t *cl_ss = NULL;
626 	char	*dirt = NULL;
627 	int	err, dir_eof = 0, size = 0;
628 	vnode_t *dvp;
629 	struct iovec iov;
630 	struct uio uio;
631 	struct dirent64 *dep;
632 	offset_t dirchunk_offset = 0;
633 
634 	/*
635 	 * open the state directory
636 	 */
637 	if (vn_open(statedir, UIO_SYSSPACE, FREAD, 0, &dvp, 0, 0))
638 		return;
639 
640 	if (dvp->v_type != VDIR || VOP_ACCESS(dvp, VREAD, 0, CRED(), NULL))
641 		goto out;
642 
643 	dirt = kmem_alloc(RFS4_SS_DIRSIZE, KM_SLEEP);
644 
645 	/*
646 	 * Get and process the directory entries
647 	 */
648 	while (!dir_eof) {
649 		(void) VOP_RWLOCK(dvp, V_WRITELOCK_FALSE, NULL);
650 		iov.iov_base = dirt;
651 		iov.iov_len = RFS4_SS_DIRSIZE;
652 		uio.uio_iov = &iov;
653 		uio.uio_iovcnt = 1;
654 		uio.uio_segflg = UIO_SYSSPACE;
655 		uio.uio_loffset = dirchunk_offset;
656 		uio.uio_resid = RFS4_SS_DIRSIZE;
657 
658 		err = VOP_READDIR(dvp, &uio, CRED(), &dir_eof, NULL, 0);
659 		VOP_RWUNLOCK(dvp, V_WRITELOCK_FALSE, NULL);
660 		if (err)
661 			goto out;
662 
663 		size = RFS4_SS_DIRSIZE - uio.uio_resid;
664 
665 		/*
666 		 * Process all the directory entries in this
667 		 * readdir chunk
668 		 */
669 		for (dep = (struct dirent64 *)dirt; size > 0;
670 		    dep = nextdp(dep)) {
671 
672 			size -= dep->d_reclen;
673 			dirchunk_offset = dep->d_off;
674 
675 			/*
676 			 * Skip '.' and '..'
677 			 */
678 			if (NFS_IS_DOTNAME(dep->d_name))
679 				continue;
680 
681 			ss_pn = rfs4_ss_pnalloc(statedir, dep->d_name);
682 			if (ss_pn == NULL)
683 				continue;
684 
685 			if (cl_ss = rfs4_ss_getstate(dvp, ss_pn)) {
686 				if (destdir != NULL) {
687 					rfs4_ss_pnfree(ss_pn);
688 					cl_ss->ss_pn = rfs4_ss_movestate(
689 					    statedir, destdir, dep->d_name);
690 				} else {
691 					cl_ss->ss_pn = ss_pn;
692 				}
693 				insque(cl_ss, oldstate);
694 			} else {
695 				rfs4_ss_pnfree(ss_pn);
696 			}
697 		}
698 	}
699 
700 out:
701 	(void) VOP_CLOSE(dvp, FREAD, 1, (offset_t)0, CRED(), NULL);
702 	VN_RELE(dvp);
703 	if (dirt)
704 		kmem_free((caddr_t)dirt, RFS4_SS_DIRSIZE);
705 }
706 
707 static void
708 rfs4_ss_init(void)
709 {
710 	int npaths = 1;
711 	char *default_dss_path = NFS4_DSS_VAR_DIR;
712 
713 	/* read the default stable storage state */
714 	rfs4_dss_readstate(npaths, &default_dss_path);
715 
716 	rfs4_ss_enabled = 1;
717 }
718 
719 static void
720 rfs4_ss_fini(void)
721 {
722 	rfs4_servinst_t *sip;
723 
724 	mutex_enter(&rfs4_servinst_lock);
725 	sip = rfs4_cur_servinst;
726 	while (sip != NULL) {
727 		rfs4_dss_clear_oldstate(sip);
728 		sip = sip->next;
729 	}
730 	mutex_exit(&rfs4_servinst_lock);
731 }
732 
733 /*
734  * Remove all oldstate files referenced by this servinst.
735  */
736 static void
737 rfs4_dss_clear_oldstate(rfs4_servinst_t *sip)
738 {
739 	rfs4_oldstate_t *os_head, *osp;
740 
741 	rw_enter(&sip->oldstate_lock, RW_WRITER);
742 	os_head = sip->oldstate;
743 
744 	if (os_head == NULL)
745 		return;
746 
747 	/* skip dummy entry */
748 	osp = os_head->next;
749 	while (osp != os_head) {
750 		char *leaf = osp->ss_pn->leaf;
751 		rfs4_oldstate_t *os_next;
752 
753 		rfs4_dss_remove_leaf(sip, NFS4_DSS_OLDSTATE_LEAF, leaf);
754 
755 		if (osp->cl_id4.id_val)
756 			kmem_free(osp->cl_id4.id_val, osp->cl_id4.id_len);
757 		if (osp->ss_pn)
758 			kmem_free(osp->ss_pn, sizeof (rfs4_ss_pn_t));
759 
760 		os_next = osp->next;
761 		remque(osp);
762 		kmem_free(osp, sizeof (rfs4_oldstate_t));
763 		osp = os_next;
764 	}
765 
766 	/* free dummy entry */
767 	kmem_free(osp, sizeof (rfs4_oldstate_t));
768 
769 	sip->oldstate = NULL;
770 
771 	rw_exit(&sip->oldstate_lock);
772 }
773 
774 /*
775  * Form the state and oldstate paths, and read in the stable storage files.
776  */
777 void
778 rfs4_dss_readstate(int npaths, char **paths)
779 {
780 	int i;
781 	char *state, *oldstate;
782 
783 	state = kmem_alloc(MAXPATHLEN, KM_SLEEP);
784 	oldstate = kmem_alloc(MAXPATHLEN, KM_SLEEP);
785 
786 	for (i = 0; i < npaths; i++) {
787 		char *path = paths[i];
788 
789 		(void) sprintf(state, "%s/%s", path, NFS4_DSS_STATE_LEAF);
790 		(void) sprintf(oldstate, "%s/%s", path, NFS4_DSS_OLDSTATE_LEAF);
791 
792 		/*
793 		 * Populate the current server instance's oldstate list.
794 		 *
795 		 * 1. Read stable storage data from old state directory,
796 		 *    leaving its contents alone.
797 		 *
798 		 * 2. Read stable storage data from state directory,
799 		 *    and move the latter's contents to old state
800 		 *    directory.
801 		 */
802 		rfs4_ss_oldstate(rfs4_cur_servinst->oldstate, oldstate, NULL);
803 		rfs4_ss_oldstate(rfs4_cur_servinst->oldstate, state, oldstate);
804 	}
805 
806 	kmem_free(state, MAXPATHLEN);
807 	kmem_free(oldstate, MAXPATHLEN);
808 }
809 
810 
811 /*
812  * Check if we are still in grace and if the client can be
813  * granted permission to perform reclaims.
814  */
815 void
816 rfs4_ss_chkclid(rfs4_client_t *cp)
817 {
818 	rfs4_servinst_t *sip;
819 
820 	/*
821 	 * It should be sufficient to check the oldstate data for just
822 	 * this client's instance. However, since our per-instance
823 	 * client grouping is solely temporal, HA-NFSv4 RG failover
824 	 * might result in clients of the same RG being partitioned into
825 	 * separate instances.
826 	 *
827 	 * Until the client grouping is improved, we must check the
828 	 * oldstate data for all instances with an active grace period.
829 	 *
830 	 * This also serves as the mechanism to remove stale oldstate data.
831 	 * The first time we check an instance after its grace period has
832 	 * expired, the oldstate data should be cleared.
833 	 *
834 	 * Start at the current instance, and walk the list backwards
835 	 * to the first.
836 	 */
837 	mutex_enter(&rfs4_servinst_lock);
838 	for (sip = rfs4_cur_servinst; sip != NULL; sip = sip->prev) {
839 		rfs4_ss_chkclid_sip(cp, sip);
840 
841 		/* if the above check found this client, we're done */
842 		if (cp->rc_can_reclaim)
843 			break;
844 	}
845 	mutex_exit(&rfs4_servinst_lock);
846 }
847 
848 static void
849 rfs4_ss_chkclid_sip(rfs4_client_t *cp, rfs4_servinst_t *sip)
850 {
851 	rfs4_oldstate_t *osp, *os_head;
852 
853 	/* short circuit everything if this server instance has no oldstate */
854 	rw_enter(&sip->oldstate_lock, RW_READER);
855 	os_head = sip->oldstate;
856 	rw_exit(&sip->oldstate_lock);
857 	if (os_head == NULL)
858 		return;
859 
860 	/*
861 	 * If this server instance is no longer in a grace period then
862 	 * the client won't be able to reclaim. No further need for this
863 	 * instance's oldstate data, so it can be cleared.
864 	 */
865 	if (!rfs4_servinst_in_grace(sip))
866 		return;
867 
868 	/* this instance is still in grace; search for the clientid */
869 
870 	rw_enter(&sip->oldstate_lock, RW_READER);
871 
872 	os_head = sip->oldstate;
873 	/* skip dummy entry */
874 	osp = os_head->next;
875 	while (osp != os_head) {
876 		if (osp->cl_id4.id_len == cp->rc_nfs_client.id_len) {
877 			if (bcmp(osp->cl_id4.id_val, cp->rc_nfs_client.id_val,
878 			    osp->cl_id4.id_len) == 0) {
879 				cp->rc_can_reclaim = 1;
880 				break;
881 			}
882 		}
883 		osp = osp->next;
884 	}
885 
886 	rw_exit(&sip->oldstate_lock);
887 }
888 
889 /*
890  * Place client information into stable storage: 1/3.
891  * First, generate the leaf filename, from the client's IP address and
892  * the server-generated short-hand clientid.
893  */
894 void
895 rfs4_ss_clid(rfs4_client_t *cp)
896 {
897 	const char *kinet_ntop6(uchar_t *, char *, size_t);
898 	char leaf[MAXNAMELEN], buf[INET6_ADDRSTRLEN];
899 	struct sockaddr *ca;
900 	uchar_t *b;
901 
902 	if (rfs4_ss_enabled == 0) {
903 		return;
904 	}
905 
906 	buf[0] = 0;
907 
908 	ca = (struct sockaddr *)&cp->rc_addr;
909 
910 	/*
911 	 * Convert the caller's IP address to a dotted string
912 	 */
913 	if (ca->sa_family == AF_INET) {
914 		b = (uchar_t *)&((struct sockaddr_in *)ca)->sin_addr;
915 		(void) sprintf(buf, "%03d.%03d.%03d.%03d", b[0] & 0xFF,
916 		    b[1] & 0xFF, b[2] & 0xFF, b[3] & 0xFF);
917 	} else if (ca->sa_family == AF_INET6) {
918 		struct sockaddr_in6 *sin6;
919 
920 		sin6 = (struct sockaddr_in6 *)ca;
921 		(void) kinet_ntop6((uchar_t *)&sin6->sin6_addr,
922 		    buf, INET6_ADDRSTRLEN);
923 	}
924 
925 	(void) snprintf(leaf, MAXNAMELEN, "%s-%llx", buf,
926 	    (longlong_t)cp->rc_clientid);
927 	rfs4_ss_clid_write(cp, leaf);
928 }
929 
930 /*
931  * Place client information into stable storage: 2/3.
932  * DSS: distributed stable storage: the file may need to be written to
933  * multiple directories.
934  */
935 static void
936 rfs4_ss_clid_write(rfs4_client_t *cp, char *leaf)
937 {
938 	rfs4_servinst_t *sip;
939 
940 	/*
941 	 * It should be sufficient to write the leaf file to (all) DSS paths
942 	 * associated with just this client's instance. However, since our
943 	 * per-instance client grouping is solely temporal, HA-NFSv4 RG
944 	 * failover might result in us losing DSS data.
945 	 *
946 	 * Until the client grouping is improved, we must write the DSS data
947 	 * to all instances' paths. Start at the current instance, and
948 	 * walk the list backwards to the first.
949 	 */
950 	mutex_enter(&rfs4_servinst_lock);
951 	for (sip = rfs4_cur_servinst; sip != NULL; sip = sip->prev) {
952 		int i, npaths = sip->dss_npaths;
953 
954 		/* write the leaf file to all DSS paths */
955 		for (i = 0; i < npaths; i++) {
956 			rfs4_dss_path_t *dss_path = sip->dss_paths[i];
957 
958 			/* HA-NFSv4 path might have been failed-away from us */
959 			if (dss_path == NULL)
960 				continue;
961 
962 			rfs4_ss_clid_write_one(cp, dss_path->path, leaf);
963 		}
964 	}
965 	mutex_exit(&rfs4_servinst_lock);
966 }
967 
968 /*
969  * Place client information into stable storage: 3/3.
970  * Write the stable storage data to the requested file.
971  */
972 static void
973 rfs4_ss_clid_write_one(rfs4_client_t *cp, char *dss_path, char *leaf)
974 {
975 	int ioflag;
976 	int file_vers = NFS4_SS_VERSION;
977 	size_t dirlen;
978 	struct uio uio;
979 	struct iovec iov[4];
980 	char *dir;
981 	rfs4_ss_pn_t *ss_pn;
982 	vnode_t *vp;
983 	nfs_client_id4 *cl_id4 = &(cp->rc_nfs_client);
984 
985 	/* allow 2 extra bytes for '/' & NUL */
986 	dirlen = strlen(dss_path) + strlen(NFS4_DSS_STATE_LEAF) + 2;
987 	dir = kmem_alloc(dirlen, KM_SLEEP);
988 	(void) sprintf(dir, "%s/%s", dss_path, NFS4_DSS_STATE_LEAF);
989 
990 	ss_pn = rfs4_ss_pnalloc(dir, leaf);
991 	/* rfs4_ss_pnalloc takes its own copy */
992 	kmem_free(dir, dirlen);
993 	if (ss_pn == NULL)
994 		return;
995 
996 	if (vn_open(ss_pn->pn, UIO_SYSSPACE, FCREAT|FWRITE, 0600, &vp,
997 	    CRCREAT, 0)) {
998 		rfs4_ss_pnfree(ss_pn);
999 		return;
1000 	}
1001 
1002 	/*
1003 	 * We need to record leaf - i.e. the filename - so that we know
1004 	 * what to remove, in the future. However, the dir part of cp->ss_pn
1005 	 * should never be referenced directly, since it's potentially only
1006 	 * one of several paths with this leaf in it.
1007 	 */
1008 	if (cp->rc_ss_pn != NULL) {
1009 		if (strcmp(cp->rc_ss_pn->leaf, leaf) == 0) {
1010 			/* we've already recorded *this* leaf */
1011 			rfs4_ss_pnfree(ss_pn);
1012 		} else {
1013 			/* replace with this leaf */
1014 			rfs4_ss_pnfree(cp->rc_ss_pn);
1015 			cp->rc_ss_pn = ss_pn;
1016 		}
1017 	} else {
1018 		cp->rc_ss_pn = ss_pn;
1019 	}
1020 
1021 	/*
1022 	 * Build a scatter list that points to the nfs_client_id4
1023 	 */
1024 	iov[0].iov_base = (caddr_t)&file_vers;
1025 	iov[0].iov_len = sizeof (int);
1026 	iov[1].iov_base = (caddr_t)&(cl_id4->verifier);
1027 	iov[1].iov_len = NFS4_VERIFIER_SIZE;
1028 	iov[2].iov_base = (caddr_t)&(cl_id4->id_len);
1029 	iov[2].iov_len = sizeof (uint_t);
1030 	iov[3].iov_base = (caddr_t)cl_id4->id_val;
1031 	iov[3].iov_len = cl_id4->id_len;
1032 
1033 	uio.uio_iov = iov;
1034 	uio.uio_iovcnt = 4;
1035 	uio.uio_loffset = 0;
1036 	uio.uio_segflg = UIO_SYSSPACE;
1037 	uio.uio_llimit = (rlim64_t)MAXOFFSET_T;
1038 	uio.uio_resid = cl_id4->id_len + sizeof (int) +
1039 	    NFS4_VERIFIER_SIZE + sizeof (uint_t);
1040 
1041 	ioflag = uio.uio_fmode = (FWRITE|FSYNC);
1042 	uio.uio_extflg = UIO_COPY_DEFAULT;
1043 
1044 	(void) VOP_RWLOCK(vp, V_WRITELOCK_TRUE, NULL);
1045 	/* write the full client id to the file. */
1046 	(void) VOP_WRITE(vp, &uio, ioflag, CRED(), NULL);
1047 	VOP_RWUNLOCK(vp, V_WRITELOCK_TRUE, NULL);
1048 
1049 	(void) VOP_CLOSE(vp, FWRITE, 1, (offset_t)0, CRED(), NULL);
1050 	VN_RELE(vp);
1051 }
1052 
1053 /*
1054  * DSS: distributed stable storage.
1055  * Unpack the list of paths passed by nfsd.
1056  * Use nvlist_alloc(9F) to manage the data.
1057  * The caller is responsible for allocating and freeing the buffer.
1058  */
1059 int
1060 rfs4_dss_setpaths(char *buf, size_t buflen)
1061 {
1062 	int error;
1063 
1064 	/*
1065 	 * If this is a "warm start", i.e. we previously had DSS paths,
1066 	 * preserve the old paths.
1067 	 */
1068 	if (rfs4_dss_paths != NULL) {
1069 		/*
1070 		 * Before we lose the ptr, destroy the nvlist and pathnames
1071 		 * array from the warm start before this one.
1072 		 */
1073 		if (rfs4_dss_oldpaths)
1074 			nvlist_free(rfs4_dss_oldpaths);
1075 		rfs4_dss_oldpaths = rfs4_dss_paths;
1076 	}
1077 
1078 	/* unpack the buffer into a searchable nvlist */
1079 	error = nvlist_unpack(buf, buflen, &rfs4_dss_paths, KM_SLEEP);
1080 	if (error)
1081 		return (error);
1082 
1083 	/*
1084 	 * Search the nvlist for the pathnames nvpair (which is the only nvpair
1085 	 * in the list, and record its location.
1086 	 */
1087 	error = nvlist_lookup_string_array(rfs4_dss_paths, NFS4_DSS_NVPAIR_NAME,
1088 	    &rfs4_dss_newpaths, &rfs4_dss_numnewpaths);
1089 	return (error);
1090 }
1091 
1092 /*
1093  * Ultimately the nfssys() call NFS4_CLR_STATE endsup here
1094  * to find and mark the client for forced expire.
1095  */
1096 static void
1097 rfs4_client_scrub(rfs4_entry_t ent, void *arg)
1098 {
1099 	rfs4_client_t *cp = (rfs4_client_t *)ent;
1100 	struct nfs4clrst_args *clr = arg;
1101 	struct sockaddr_in6 *ent_sin6;
1102 	struct in6_addr  clr_in6;
1103 	struct sockaddr_in  *ent_sin;
1104 	struct in_addr   clr_in;
1105 
1106 	if (clr->addr_type != cp->rc_addr.ss_family) {
1107 		return;
1108 	}
1109 
1110 	switch (clr->addr_type) {
1111 
1112 	case AF_INET6:
1113 		/* copyin the address from user space */
1114 		if (copyin(clr->ap, &clr_in6, sizeof (clr_in6))) {
1115 			break;
1116 		}
1117 
1118 		ent_sin6 = (struct sockaddr_in6 *)&cp->rc_addr;
1119 
1120 		/*
1121 		 * now compare, and if equivalent mark entry
1122 		 * for forced expiration
1123 		 */
1124 		if (IN6_ARE_ADDR_EQUAL(&ent_sin6->sin6_addr, &clr_in6)) {
1125 			cp->rc_forced_expire = 1;
1126 		}
1127 		break;
1128 
1129 	case AF_INET:
1130 		/* copyin the address from user space */
1131 		if (copyin(clr->ap, &clr_in, sizeof (clr_in))) {
1132 			break;
1133 		}
1134 
1135 		ent_sin = (struct sockaddr_in *)&cp->rc_addr;
1136 
1137 		/*
1138 		 * now compare, and if equivalent mark entry
1139 		 * for forced expiration
1140 		 */
1141 		if (ent_sin->sin_addr.s_addr == clr_in.s_addr) {
1142 			cp->rc_forced_expire = 1;
1143 		}
1144 		break;
1145 
1146 	default:
1147 		/* force this assert to fail */
1148 		ASSERT(clr->addr_type != clr->addr_type);
1149 	}
1150 }
1151 
1152 /*
1153  * This is called from nfssys() in order to clear server state
1154  * for the specified client IP Address.
1155  */
1156 void
1157 rfs4_clear_client_state(struct nfs4clrst_args *clr)
1158 {
1159 	(void) rfs4_dbe_walk(rfs4_client_tab, rfs4_client_scrub, clr);
1160 }
1161 
1162 /*
1163  * Used to initialize the NFSv4 server's state or database.  All of
1164  * the tables are created and timers are set. Only called when NFSv4
1165  * service is provided.
1166  */
1167 void
1168 rfs4_state_init()
1169 {
1170 	int start_grace;
1171 	extern boolean_t rfs4_cpr_callb(void *, int);
1172 	char *dss_path = NFS4_DSS_VAR_DIR;
1173 
1174 	mutex_enter(&rfs4_state_lock);
1175 
1176 	/*
1177 	 * If the server state database has already been initialized,
1178 	 * skip it
1179 	 */
1180 	if (rfs4_server_state != NULL) {
1181 		mutex_exit(&rfs4_state_lock);
1182 		return;
1183 	}
1184 
1185 	rw_init(&rfs4_findclient_lock, NULL, RW_DEFAULT, NULL);
1186 
1187 	/*
1188 	 * Set the boot time.  If the server
1189 	 * has been restarted quickly and has had the opportunity to
1190 	 * service clients, then the start_time needs to be bumped
1191 	 * regardless.  A small window but it exists...
1192 	 */
1193 	if (rfs4_start_time != gethrestime_sec())
1194 		rfs4_start_time = gethrestime_sec();
1195 	else
1196 		rfs4_start_time++;
1197 
1198 	/* DSS: distributed stable storage: initialise served paths list */
1199 	rfs4_dss_pathlist = NULL;
1200 
1201 	/*
1202 	 * Create the first server instance, or a new one if the server has
1203 	 * been restarted; see above comments on rfs4_start_time. Don't
1204 	 * start its grace period; that will be done later, to maximise the
1205 	 * clients' recovery window.
1206 	 */
1207 	start_grace = 0;
1208 	rfs4_servinst_create(start_grace, 1, &dss_path);
1209 
1210 	/* reset the "first NFSv4 request" status */
1211 	rfs4_seen_first_compound = 0;
1212 
1213 	/*
1214 	 * Add a CPR callback so that we can update client
1215 	 * access times to extend the lease after a suspend
1216 	 * and resume (using the same class as rpcmod/connmgr)
1217 	 */
1218 	cpr_id = callb_add(rfs4_cpr_callb, 0, CB_CL_CPR_RPC, "rfs4");
1219 
1220 	/* set the various cache timers for table creation */
1221 	if (rfs4_client_cache_time == 0)
1222 		rfs4_client_cache_time = CLIENT_CACHE_TIME;
1223 	if (rfs4_openowner_cache_time == 0)
1224 		rfs4_openowner_cache_time = OPENOWNER_CACHE_TIME;
1225 	if (rfs4_state_cache_time == 0)
1226 		rfs4_state_cache_time = STATE_CACHE_TIME;
1227 	if (rfs4_lo_state_cache_time == 0)
1228 		rfs4_lo_state_cache_time = LO_STATE_CACHE_TIME;
1229 	if (rfs4_lockowner_cache_time == 0)
1230 		rfs4_lockowner_cache_time = LOCKOWNER_CACHE_TIME;
1231 	if (rfs4_file_cache_time == 0)
1232 		rfs4_file_cache_time = FILE_CACHE_TIME;
1233 	if (rfs4_deleg_state_cache_time == 0)
1234 		rfs4_deleg_state_cache_time = DELEG_STATE_CACHE_TIME;
1235 
1236 	/* Create the overall database to hold all server state */
1237 	rfs4_server_state = rfs4_database_create(rfs4_database_debug);
1238 
1239 	/* Now create the individual tables */
1240 	rfs4_client_cache_time *= rfs4_lease_time;
1241 	rfs4_client_tab = rfs4_table_create(rfs4_server_state,
1242 	    "Client",
1243 	    rfs4_client_cache_time,
1244 	    2,
1245 	    rfs4_client_create,
1246 	    rfs4_client_destroy,
1247 	    rfs4_client_expiry,
1248 	    sizeof (rfs4_client_t),
1249 	    TABSIZE,
1250 	    MAXTABSZ/8, 100);
1251 	rfs4_nfsclnt_idx = rfs4_index_create(rfs4_client_tab,
1252 	    "nfs_client_id4", nfsclnt_hash,
1253 	    nfsclnt_compare, nfsclnt_mkkey,
1254 	    TRUE);
1255 	rfs4_clientid_idx = rfs4_index_create(rfs4_client_tab,
1256 	    "client_id", clientid_hash,
1257 	    clientid_compare, clientid_mkkey,
1258 	    FALSE);
1259 
1260 	rfs4_clntip_cache_time = 86400 * 365;	/* about a year */
1261 	rfs4_clntip_tab = rfs4_table_create(rfs4_server_state,
1262 	    "ClntIP",
1263 	    rfs4_clntip_cache_time,
1264 	    1,
1265 	    rfs4_clntip_create,
1266 	    rfs4_clntip_destroy,
1267 	    rfs4_clntip_expiry,
1268 	    sizeof (rfs4_clntip_t),
1269 	    TABSIZE,
1270 	    MAXTABSZ, 100);
1271 	rfs4_clntip_idx = rfs4_index_create(rfs4_clntip_tab,
1272 	    "client_ip", clntip_hash,
1273 	    clntip_compare, clntip_mkkey,
1274 	    TRUE);
1275 
1276 	rfs4_openowner_cache_time *= rfs4_lease_time;
1277 	rfs4_openowner_tab = rfs4_table_create(rfs4_server_state,
1278 	    "OpenOwner",
1279 	    rfs4_openowner_cache_time,
1280 	    1,
1281 	    rfs4_openowner_create,
1282 	    rfs4_openowner_destroy,
1283 	    rfs4_openowner_expiry,
1284 	    sizeof (rfs4_openowner_t),
1285 	    TABSIZE,
1286 	    MAXTABSZ, 100);
1287 	rfs4_openowner_idx = rfs4_index_create(rfs4_openowner_tab,
1288 	    "open_owner4", openowner_hash,
1289 	    openowner_compare,
1290 	    openowner_mkkey, TRUE);
1291 
1292 	rfs4_state_cache_time *= rfs4_lease_time;
1293 	rfs4_state_tab = rfs4_table_create(rfs4_server_state,
1294 	    "OpenStateID",
1295 	    rfs4_state_cache_time,
1296 	    3,
1297 	    rfs4_state_create,
1298 	    rfs4_state_destroy,
1299 	    rfs4_state_expiry,
1300 	    sizeof (rfs4_state_t),
1301 	    TABSIZE,
1302 	    MAXTABSZ, 100);
1303 
1304 	rfs4_state_owner_file_idx = rfs4_index_create(rfs4_state_tab,
1305 	    "Openowner-File",
1306 	    state_owner_file_hash,
1307 	    state_owner_file_compare,
1308 	    state_owner_file_mkkey, TRUE);
1309 
1310 	rfs4_state_idx = rfs4_index_create(rfs4_state_tab,
1311 	    "State-id", state_hash,
1312 	    state_compare, state_mkkey, FALSE);
1313 
1314 	rfs4_state_file_idx = rfs4_index_create(rfs4_state_tab,
1315 	    "File", state_file_hash,
1316 	    state_file_compare, state_file_mkkey,
1317 	    FALSE);
1318 
1319 	rfs4_lo_state_cache_time *= rfs4_lease_time;
1320 	rfs4_lo_state_tab = rfs4_table_create(rfs4_server_state,
1321 	    "LockStateID",
1322 	    rfs4_lo_state_cache_time,
1323 	    2,
1324 	    rfs4_lo_state_create,
1325 	    rfs4_lo_state_destroy,
1326 	    rfs4_lo_state_expiry,
1327 	    sizeof (rfs4_lo_state_t),
1328 	    TABSIZE,
1329 	    MAXTABSZ, 100);
1330 
1331 	rfs4_lo_state_owner_idx = rfs4_index_create(rfs4_lo_state_tab,
1332 	    "lockownerxstate",
1333 	    lo_state_lo_hash,
1334 	    lo_state_lo_compare,
1335 	    lo_state_lo_mkkey, TRUE);
1336 
1337 	rfs4_lo_state_idx = rfs4_index_create(rfs4_lo_state_tab,
1338 	    "State-id",
1339 	    lo_state_hash, lo_state_compare,
1340 	    lo_state_mkkey, FALSE);
1341 
1342 	rfs4_lockowner_cache_time *= rfs4_lease_time;
1343 
1344 	rfs4_lockowner_tab = rfs4_table_create(rfs4_server_state,
1345 	    "Lockowner",
1346 	    rfs4_lockowner_cache_time,
1347 	    2,
1348 	    rfs4_lockowner_create,
1349 	    rfs4_lockowner_destroy,
1350 	    rfs4_lockowner_expiry,
1351 	    sizeof (rfs4_lockowner_t),
1352 	    TABSIZE,
1353 	    MAXTABSZ, 100);
1354 
1355 	rfs4_lockowner_idx = rfs4_index_create(rfs4_lockowner_tab,
1356 	    "lock_owner4", lockowner_hash,
1357 	    lockowner_compare,
1358 	    lockowner_mkkey, TRUE);
1359 
1360 	rfs4_lockowner_pid_idx = rfs4_index_create(rfs4_lockowner_tab,
1361 	    "pid", pid_hash,
1362 	    pid_compare, pid_mkkey,
1363 	    FALSE);
1364 
1365 	rfs4_file_cache_time *= rfs4_lease_time;
1366 	rfs4_file_tab = rfs4_table_create(rfs4_server_state,
1367 	    "File",
1368 	    rfs4_file_cache_time,
1369 	    1,
1370 	    rfs4_file_create,
1371 	    rfs4_file_destroy,
1372 	    NULL,
1373 	    sizeof (rfs4_file_t),
1374 	    TABSIZE,
1375 	    MAXTABSZ, -1);
1376 
1377 	rfs4_file_idx = rfs4_index_create(rfs4_file_tab,
1378 	    "Filehandle", file_hash,
1379 	    file_compare, file_mkkey, TRUE);
1380 
1381 	rfs4_deleg_state_cache_time *= rfs4_lease_time;
1382 	rfs4_deleg_state_tab = rfs4_table_create(rfs4_server_state,
1383 	    "DelegStateID",
1384 	    rfs4_deleg_state_cache_time,
1385 	    2,
1386 	    rfs4_deleg_state_create,
1387 	    rfs4_deleg_state_destroy,
1388 	    rfs4_deleg_state_expiry,
1389 	    sizeof (rfs4_deleg_state_t),
1390 	    TABSIZE,
1391 	    MAXTABSZ, 100);
1392 	rfs4_deleg_idx = rfs4_index_create(rfs4_deleg_state_tab,
1393 	    "DelegByFileClient",
1394 	    deleg_hash,
1395 	    deleg_compare,
1396 	    deleg_mkkey, TRUE);
1397 
1398 	rfs4_deleg_state_idx = rfs4_index_create(rfs4_deleg_state_tab,
1399 	    "DelegState",
1400 	    deleg_state_hash,
1401 	    deleg_state_compare,
1402 	    deleg_state_mkkey, FALSE);
1403 
1404 	/*
1405 	 * Init the stable storage.
1406 	 */
1407 	rfs4_ss_init();
1408 
1409 	rfs4_client_clrst = rfs4_clear_client_state;
1410 
1411 	mutex_exit(&rfs4_state_lock);
1412 }
1413 
1414 
1415 /*
1416  * Used at server shutdown to cleanup all of the NFSv4 server's structures
1417  * and other state.
1418  */
1419 void
1420 rfs4_state_fini()
1421 {
1422 	rfs4_database_t *dbp;
1423 
1424 	mutex_enter(&rfs4_state_lock);
1425 
1426 	if (rfs4_server_state == NULL) {
1427 		mutex_exit(&rfs4_state_lock);
1428 		return;
1429 	}
1430 
1431 	rfs4_client_clrst = NULL;
1432 
1433 	rfs4_set_deleg_policy(SRV_NEVER_DELEGATE);
1434 	dbp = rfs4_server_state;
1435 	rfs4_server_state = NULL;
1436 
1437 	/*
1438 	 * Cleanup the CPR callback.
1439 	 */
1440 	if (cpr_id)
1441 		(void) callb_delete(cpr_id);
1442 
1443 	rw_destroy(&rfs4_findclient_lock);
1444 
1445 	/* First stop all of the reaper threads in the database */
1446 	rfs4_database_shutdown(dbp);
1447 	/* clean up any dangling stable storage structures */
1448 	rfs4_ss_fini();
1449 	/* Now actually destroy/release the database and its tables */
1450 	rfs4_database_destroy(dbp);
1451 
1452 	/* Reset the cache timers for next time */
1453 	rfs4_client_cache_time = 0;
1454 	rfs4_openowner_cache_time = 0;
1455 	rfs4_state_cache_time = 0;
1456 	rfs4_lo_state_cache_time = 0;
1457 	rfs4_lockowner_cache_time = 0;
1458 	rfs4_file_cache_time = 0;
1459 	rfs4_deleg_state_cache_time = 0;
1460 
1461 	mutex_exit(&rfs4_state_lock);
1462 
1463 	/* destroy server instances and current instance ptr */
1464 	rfs4_servinst_destroy_all();
1465 
1466 	/* reset the "first NFSv4 request" status */
1467 	rfs4_seen_first_compound = 0;
1468 
1469 	/* DSS: distributed stable storage */
1470 	if (rfs4_dss_oldpaths)
1471 		nvlist_free(rfs4_dss_oldpaths);
1472 	if (rfs4_dss_paths)
1473 		nvlist_free(rfs4_dss_paths);
1474 	rfs4_dss_paths = rfs4_dss_oldpaths = NULL;
1475 }
1476 
1477 typedef union {
1478 	struct {
1479 		uint32_t start_time;
1480 		uint32_t c_id;
1481 	} impl_id;
1482 	clientid4 id4;
1483 } cid;
1484 
1485 static int foreign_stateid(stateid_t *id);
1486 static int foreign_clientid(cid *cidp);
1487 static void embed_nodeid(cid *cidp);
1488 
1489 typedef union {
1490 	struct {
1491 		uint32_t c_id;
1492 		uint32_t gen_num;
1493 	} cv_impl;
1494 	verifier4	confirm_verf;
1495 } scid_confirm_verf;
1496 
1497 static uint32_t
1498 clientid_hash(void *key)
1499 {
1500 	cid *idp = key;
1501 
1502 	return (idp->impl_id.c_id);
1503 }
1504 
1505 static bool_t
1506 clientid_compare(rfs4_entry_t entry, void *key)
1507 {
1508 	rfs4_client_t *cp = (rfs4_client_t *)entry;
1509 	clientid4 *idp = key;
1510 
1511 	return (*idp == cp->rc_clientid);
1512 }
1513 
1514 static void *
1515 clientid_mkkey(rfs4_entry_t entry)
1516 {
1517 	rfs4_client_t *cp = (rfs4_client_t *)entry;
1518 
1519 	return (&cp->rc_clientid);
1520 }
1521 
1522 static uint32_t
1523 nfsclnt_hash(void *key)
1524 {
1525 	nfs_client_id4 *client = key;
1526 	int i;
1527 	uint32_t hash = 0;
1528 
1529 	for (i = 0; i < client->id_len; i++) {
1530 		hash <<= 1;
1531 		hash += (uint_t)client->id_val[i];
1532 	}
1533 	return (hash);
1534 }
1535 
1536 
1537 static bool_t
1538 nfsclnt_compare(rfs4_entry_t entry, void *key)
1539 {
1540 	rfs4_client_t *cp = (rfs4_client_t *)entry;
1541 	nfs_client_id4 *nfs_client = key;
1542 
1543 	if (cp->rc_nfs_client.id_len != nfs_client->id_len)
1544 		return (FALSE);
1545 
1546 	return (bcmp(cp->rc_nfs_client.id_val, nfs_client->id_val,
1547 	    nfs_client->id_len) == 0);
1548 }
1549 
1550 static void *
1551 nfsclnt_mkkey(rfs4_entry_t entry)
1552 {
1553 	rfs4_client_t *cp = (rfs4_client_t *)entry;
1554 
1555 	return (&cp->rc_nfs_client);
1556 }
1557 
1558 static bool_t
1559 rfs4_client_expiry(rfs4_entry_t u_entry)
1560 {
1561 	rfs4_client_t *cp = (rfs4_client_t *)u_entry;
1562 	bool_t cp_expired;
1563 
1564 	if (rfs4_dbe_is_invalid(cp->rc_dbe)) {
1565 		cp->rc_ss_remove = 1;
1566 		return (TRUE);
1567 	}
1568 	/*
1569 	 * If the sysadmin has used clear_locks for this
1570 	 * entry then forced_expire will be set and we
1571 	 * want this entry to be reaped. Or the entry
1572 	 * has exceeded its lease period.
1573 	 */
1574 	cp_expired = (cp->rc_forced_expire ||
1575 	    (gethrestime_sec() - cp->rc_last_access
1576 	    > rfs4_lease_time));
1577 
1578 	if (!cp->rc_ss_remove && cp_expired)
1579 		cp->rc_ss_remove = 1;
1580 	return (cp_expired);
1581 }
1582 
1583 /*
1584  * Remove the leaf file from all distributed stable storage paths.
1585  */
1586 static void
1587 rfs4_dss_remove_cpleaf(rfs4_client_t *cp)
1588 {
1589 	rfs4_servinst_t *sip;
1590 	char *leaf = cp->rc_ss_pn->leaf;
1591 
1592 	/*
1593 	 * since the state files are written to all DSS
1594 	 * paths we must remove this leaf file instance
1595 	 * from all server instances.
1596 	 */
1597 
1598 	mutex_enter(&rfs4_servinst_lock);
1599 	for (sip = rfs4_cur_servinst; sip != NULL; sip = sip->prev) {
1600 		/* remove the leaf file associated with this server instance */
1601 		rfs4_dss_remove_leaf(sip, NFS4_DSS_STATE_LEAF, leaf);
1602 	}
1603 	mutex_exit(&rfs4_servinst_lock);
1604 }
1605 
1606 static void
1607 rfs4_dss_remove_leaf(rfs4_servinst_t *sip, char *dir_leaf, char *leaf)
1608 {
1609 	int i, npaths = sip->dss_npaths;
1610 
1611 	for (i = 0; i < npaths; i++) {
1612 		rfs4_dss_path_t *dss_path = sip->dss_paths[i];
1613 		char *path, *dir;
1614 		size_t pathlen;
1615 
1616 		/* the HA-NFSv4 path might have been failed-over away from us */
1617 		if (dss_path == NULL)
1618 			continue;
1619 
1620 		dir = dss_path->path;
1621 
1622 		/* allow 3 extra bytes for two '/' & a NUL */
1623 		pathlen = strlen(dir) + strlen(dir_leaf) + strlen(leaf) + 3;
1624 		path = kmem_alloc(pathlen, KM_SLEEP);
1625 		(void) sprintf(path, "%s/%s/%s", dir, dir_leaf, leaf);
1626 
1627 		(void) vn_remove(path, UIO_SYSSPACE, RMFILE);
1628 
1629 		kmem_free(path, pathlen);
1630 	}
1631 }
1632 
1633 static void
1634 rfs4_client_destroy(rfs4_entry_t u_entry)
1635 {
1636 	rfs4_client_t *cp = (rfs4_client_t *)u_entry;
1637 
1638 	mutex_destroy(cp->rc_cbinfo.cb_lock);
1639 	cv_destroy(cp->rc_cbinfo.cb_cv);
1640 	cv_destroy(cp->rc_cbinfo.cb_cv_nullcaller);
1641 	list_destroy(&cp->rc_openownerlist);
1642 
1643 	/* free callback info */
1644 	rfs4_cbinfo_free(&cp->rc_cbinfo);
1645 
1646 	if (cp->rc_cp_confirmed)
1647 		rfs4_client_rele(cp->rc_cp_confirmed);
1648 
1649 	if (cp->rc_ss_pn) {
1650 		/* check if the stable storage files need to be removed */
1651 		if (cp->rc_ss_remove)
1652 			rfs4_dss_remove_cpleaf(cp);
1653 		rfs4_ss_pnfree(cp->rc_ss_pn);
1654 	}
1655 
1656 	/* Free the client supplied client id */
1657 	kmem_free(cp->rc_nfs_client.id_val, cp->rc_nfs_client.id_len);
1658 
1659 	if (cp->rc_sysidt != LM_NOSYSID)
1660 		lm_free_sysidt(cp->rc_sysidt);
1661 }
1662 
1663 static bool_t
1664 rfs4_client_create(rfs4_entry_t u_entry, void *arg)
1665 {
1666 	rfs4_client_t *cp = (rfs4_client_t *)u_entry;
1667 	nfs_client_id4 *client = (nfs_client_id4 *)arg;
1668 	struct sockaddr *ca;
1669 	cid *cidp;
1670 	scid_confirm_verf *scvp;
1671 
1672 	/* Get a clientid to give to the client */
1673 	cidp = (cid *)&cp->rc_clientid;
1674 	cidp->impl_id.start_time = rfs4_start_time;
1675 	cidp->impl_id.c_id = (uint32_t)rfs4_dbe_getid(cp->rc_dbe);
1676 
1677 	/* If we are booted as a cluster node, embed our nodeid */
1678 	if (cluster_bootflags & CLUSTER_BOOTED)
1679 		embed_nodeid(cidp);
1680 
1681 	/* Allocate and copy client's client id value */
1682 	cp->rc_nfs_client.id_val = kmem_alloc(client->id_len, KM_SLEEP);
1683 	cp->rc_nfs_client.id_len = client->id_len;
1684 	bcopy(client->id_val, cp->rc_nfs_client.id_val, client->id_len);
1685 	cp->rc_nfs_client.verifier = client->verifier;
1686 
1687 	/* Copy client's IP address */
1688 	ca = client->cl_addr;
1689 	if (ca->sa_family == AF_INET)
1690 		bcopy(ca, &cp->rc_addr, sizeof (struct sockaddr_in));
1691 	else if (ca->sa_family == AF_INET6)
1692 		bcopy(ca, &cp->rc_addr, sizeof (struct sockaddr_in6));
1693 	cp->rc_nfs_client.cl_addr = (struct sockaddr *)&cp->rc_addr;
1694 
1695 	/* Init the value for the SETCLIENTID_CONFIRM verifier */
1696 	scvp = (scid_confirm_verf *)&cp->rc_confirm_verf;
1697 	scvp->cv_impl.c_id = cidp->impl_id.c_id;
1698 	scvp->cv_impl.gen_num = 0;
1699 
1700 	/* An F_UNLKSYS has been done for this client */
1701 	cp->rc_unlksys_completed = FALSE;
1702 
1703 	/* We need the client to ack us */
1704 	cp->rc_need_confirm = TRUE;
1705 	cp->rc_cp_confirmed = NULL;
1706 
1707 	/* TRUE all the time until the callback path actually fails */
1708 	cp->rc_cbinfo.cb_notified_of_cb_path_down = TRUE;
1709 
1710 	/* Initialize the access time to now */
1711 	cp->rc_last_access = gethrestime_sec();
1712 
1713 	cp->rc_cr_set = NULL;
1714 
1715 	cp->rc_sysidt = LM_NOSYSID;
1716 
1717 	list_create(&cp->rc_openownerlist, sizeof (rfs4_openowner_t),
1718 	    offsetof(rfs4_openowner_t, ro_node));
1719 
1720 	/* set up the callback control structure */
1721 	cp->rc_cbinfo.cb_state = CB_UNINIT;
1722 	mutex_init(cp->rc_cbinfo.cb_lock, NULL, MUTEX_DEFAULT, NULL);
1723 	cv_init(cp->rc_cbinfo.cb_cv, NULL, CV_DEFAULT, NULL);
1724 	cv_init(cp->rc_cbinfo.cb_cv_nullcaller, NULL, CV_DEFAULT, NULL);
1725 
1726 	/*
1727 	 * Associate the client_t with the current server instance.
1728 	 * The hold is solely to satisfy the calling requirement of
1729 	 * rfs4_servinst_assign(). In this case it's not strictly necessary.
1730 	 */
1731 	rfs4_dbe_hold(cp->rc_dbe);
1732 	rfs4_servinst_assign(cp, rfs4_cur_servinst);
1733 	rfs4_dbe_rele(cp->rc_dbe);
1734 
1735 	return (TRUE);
1736 }
1737 
1738 /*
1739  * Caller wants to generate/update the setclientid_confirm verifier
1740  * associated with a client.  This is done during the SETCLIENTID
1741  * processing.
1742  */
1743 void
1744 rfs4_client_scv_next(rfs4_client_t *cp)
1745 {
1746 	scid_confirm_verf *scvp;
1747 
1748 	/* Init the value for the SETCLIENTID_CONFIRM verifier */
1749 	scvp = (scid_confirm_verf *)&cp->rc_confirm_verf;
1750 	scvp->cv_impl.gen_num++;
1751 }
1752 
1753 void
1754 rfs4_client_rele(rfs4_client_t *cp)
1755 {
1756 	rfs4_dbe_rele(cp->rc_dbe);
1757 }
1758 
1759 rfs4_client_t *
1760 rfs4_findclient(nfs_client_id4 *client, bool_t *create,	rfs4_client_t *oldcp)
1761 {
1762 	rfs4_client_t *cp;
1763 
1764 
1765 	if (oldcp) {
1766 		rw_enter(&rfs4_findclient_lock, RW_WRITER);
1767 		rfs4_dbe_hide(oldcp->rc_dbe);
1768 	} else {
1769 		rw_enter(&rfs4_findclient_lock, RW_READER);
1770 	}
1771 
1772 	cp = (rfs4_client_t *)rfs4_dbsearch(rfs4_nfsclnt_idx, client,
1773 	    create, (void *)client, RFS4_DBS_VALID);
1774 
1775 	if (oldcp)
1776 		rfs4_dbe_unhide(oldcp->rc_dbe);
1777 
1778 	rw_exit(&rfs4_findclient_lock);
1779 
1780 	return (cp);
1781 }
1782 
1783 rfs4_client_t *
1784 rfs4_findclient_by_id(clientid4 clientid, bool_t find_unconfirmed)
1785 {
1786 	rfs4_client_t *cp;
1787 	bool_t create = FALSE;
1788 	cid *cidp = (cid *)&clientid;
1789 
1790 	/* If we're a cluster and the nodeid isn't right, short-circuit */
1791 	if (cluster_bootflags & CLUSTER_BOOTED && foreign_clientid(cidp))
1792 		return (NULL);
1793 
1794 	rw_enter(&rfs4_findclient_lock, RW_READER);
1795 
1796 	cp = (rfs4_client_t *)rfs4_dbsearch(rfs4_clientid_idx, &clientid,
1797 	    &create, NULL, RFS4_DBS_VALID);
1798 
1799 	rw_exit(&rfs4_findclient_lock);
1800 
1801 	if (cp && cp->rc_need_confirm && find_unconfirmed == FALSE) {
1802 		rfs4_client_rele(cp);
1803 		return (NULL);
1804 	} else {
1805 		return (cp);
1806 	}
1807 }
1808 
1809 static uint32_t
1810 clntip_hash(void *key)
1811 {
1812 	struct sockaddr *addr = key;
1813 	int i, len = 0;
1814 	uint32_t hash = 0;
1815 	char *ptr;
1816 
1817 	if (addr->sa_family == AF_INET) {
1818 		struct sockaddr_in *a = (struct sockaddr_in *)addr;
1819 		len = sizeof (struct in_addr);
1820 		ptr = (char *)&a->sin_addr;
1821 	} else if (addr->sa_family == AF_INET6) {
1822 		struct sockaddr_in6 *a = (struct sockaddr_in6 *)addr;
1823 		len = sizeof (struct in6_addr);
1824 		ptr = (char *)&a->sin6_addr;
1825 	} else
1826 		return (0);
1827 
1828 	for (i = 0; i < len; i++) {
1829 		hash <<= 1;
1830 		hash += (uint_t)ptr[i];
1831 	}
1832 	return (hash);
1833 }
1834 
1835 static bool_t
1836 clntip_compare(rfs4_entry_t entry, void *key)
1837 {
1838 	rfs4_clntip_t *cp = (rfs4_clntip_t *)entry;
1839 	struct sockaddr *addr = key;
1840 	int len = 0;
1841 	char *p1, *p2;
1842 
1843 	if (addr->sa_family == AF_INET) {
1844 		struct sockaddr_in *a1 = (struct sockaddr_in *)&cp->ri_addr;
1845 		struct sockaddr_in *a2 = (struct sockaddr_in *)addr;
1846 		len = sizeof (struct in_addr);
1847 		p1 = (char *)&a1->sin_addr;
1848 		p2 = (char *)&a2->sin_addr;
1849 	} else if (addr->sa_family == AF_INET6) {
1850 		struct sockaddr_in6 *a1 = (struct sockaddr_in6 *)&cp->ri_addr;
1851 		struct sockaddr_in6 *a2 = (struct sockaddr_in6 *)addr;
1852 		len = sizeof (struct in6_addr);
1853 		p1 = (char *)&a1->sin6_addr;
1854 		p2 = (char *)&a2->sin6_addr;
1855 	} else
1856 		return (0);
1857 
1858 	return (bcmp(p1, p2, len) == 0);
1859 }
1860 
1861 static void *
1862 clntip_mkkey(rfs4_entry_t entry)
1863 {
1864 	rfs4_clntip_t *cp = (rfs4_clntip_t *)entry;
1865 
1866 	return (&cp->ri_addr);
1867 }
1868 
1869 static bool_t
1870 rfs4_clntip_expiry(rfs4_entry_t u_entry)
1871 {
1872 	rfs4_clntip_t *cp = (rfs4_clntip_t *)u_entry;
1873 
1874 	if (rfs4_dbe_is_invalid(cp->ri_dbe))
1875 		return (TRUE);
1876 	return (FALSE);
1877 }
1878 
1879 /* ARGSUSED */
1880 static void
1881 rfs4_clntip_destroy(rfs4_entry_t u_entry)
1882 {
1883 }
1884 
1885 static bool_t
1886 rfs4_clntip_create(rfs4_entry_t u_entry, void *arg)
1887 {
1888 	rfs4_clntip_t *cp = (rfs4_clntip_t *)u_entry;
1889 	struct sockaddr *ca = (struct sockaddr *)arg;
1890 
1891 	/* Copy client's IP address */
1892 	if (ca->sa_family == AF_INET)
1893 		bcopy(ca, &cp->ri_addr, sizeof (struct sockaddr_in));
1894 	else if (ca->sa_family == AF_INET6)
1895 		bcopy(ca, &cp->ri_addr, sizeof (struct sockaddr_in6));
1896 	else
1897 		return (FALSE);
1898 	cp->ri_no_referrals = 1;
1899 
1900 	return (TRUE);
1901 }
1902 
1903 rfs4_clntip_t *
1904 rfs4_find_clntip(struct sockaddr *addr, bool_t *create)
1905 {
1906 	rfs4_clntip_t *cp;
1907 
1908 	rw_enter(&rfs4_findclient_lock, RW_READER);
1909 
1910 	cp = (rfs4_clntip_t *)rfs4_dbsearch(rfs4_clntip_idx, addr,
1911 	    create, addr, RFS4_DBS_VALID);
1912 
1913 	rw_exit(&rfs4_findclient_lock);
1914 
1915 	return (cp);
1916 }
1917 
1918 void
1919 rfs4_invalidate_clntip(struct sockaddr *addr)
1920 {
1921 	rfs4_clntip_t *cp;
1922 	bool_t create = FALSE;
1923 
1924 	rw_enter(&rfs4_findclient_lock, RW_READER);
1925 
1926 	cp = (rfs4_clntip_t *)rfs4_dbsearch(rfs4_clntip_idx, addr,
1927 	    &create, NULL, RFS4_DBS_VALID);
1928 	if (cp == NULL) {
1929 		rw_exit(&rfs4_findclient_lock);
1930 		return;
1931 	}
1932 	rfs4_dbe_invalidate(cp->ri_dbe);
1933 	rfs4_dbe_rele(cp->ri_dbe);
1934 
1935 	rw_exit(&rfs4_findclient_lock);
1936 }
1937 
1938 bool_t
1939 rfs4_lease_expired(rfs4_client_t *cp)
1940 {
1941 	bool_t rc;
1942 
1943 	rfs4_dbe_lock(cp->rc_dbe);
1944 
1945 	/*
1946 	 * If the admin has executed clear_locks for this
1947 	 * client id, force expire will be set, so no need
1948 	 * to calculate anything because it's "outa here".
1949 	 */
1950 	if (cp->rc_forced_expire) {
1951 		rc = TRUE;
1952 	} else {
1953 		rc = (gethrestime_sec() - cp->rc_last_access > rfs4_lease_time);
1954 	}
1955 
1956 	/*
1957 	 * If the lease has expired we will also want
1958 	 * to remove any stable storage state data. So
1959 	 * mark the client id accordingly.
1960 	 */
1961 	if (!cp->rc_ss_remove)
1962 		cp->rc_ss_remove = (rc == TRUE);
1963 
1964 	rfs4_dbe_unlock(cp->rc_dbe);
1965 
1966 	return (rc);
1967 }
1968 
1969 void
1970 rfs4_update_lease(rfs4_client_t *cp)
1971 {
1972 	rfs4_dbe_lock(cp->rc_dbe);
1973 	if (!cp->rc_forced_expire)
1974 		cp->rc_last_access = gethrestime_sec();
1975 	rfs4_dbe_unlock(cp->rc_dbe);
1976 }
1977 
1978 
1979 static bool_t
1980 EQOPENOWNER(open_owner4 *a, open_owner4 *b)
1981 {
1982 	bool_t rc;
1983 
1984 	if (a->clientid != b->clientid)
1985 		return (FALSE);
1986 
1987 	if (a->owner_len != b->owner_len)
1988 		return (FALSE);
1989 
1990 	rc = (bcmp(a->owner_val, b->owner_val, a->owner_len) == 0);
1991 
1992 	return (rc);
1993 }
1994 
1995 static uint_t
1996 openowner_hash(void *key)
1997 {
1998 	int i;
1999 	open_owner4 *openowner = key;
2000 	uint_t hash = 0;
2001 
2002 	for (i = 0; i < openowner->owner_len; i++) {
2003 		hash <<= 4;
2004 		hash += (uint_t)openowner->owner_val[i];
2005 	}
2006 	hash += (uint_t)openowner->clientid;
2007 	hash |= (openowner->clientid >> 32);
2008 
2009 	return (hash);
2010 }
2011 
2012 static bool_t
2013 openowner_compare(rfs4_entry_t u_entry, void *key)
2014 {
2015 	rfs4_openowner_t *oo = (rfs4_openowner_t *)u_entry;
2016 	open_owner4 *arg = key;
2017 
2018 	return (EQOPENOWNER(&oo->ro_owner, arg));
2019 }
2020 
2021 void *
2022 openowner_mkkey(rfs4_entry_t u_entry)
2023 {
2024 	rfs4_openowner_t *oo = (rfs4_openowner_t *)u_entry;
2025 
2026 	return (&oo->ro_owner);
2027 }
2028 
2029 static bool_t
2030 rfs4_openowner_expiry(rfs4_entry_t u_entry)
2031 {
2032 	rfs4_openowner_t *oo = (rfs4_openowner_t *)u_entry;
2033 
2034 	if (rfs4_dbe_is_invalid(oo->ro_dbe))
2035 		return (TRUE);
2036 	return ((gethrestime_sec() - oo->ro_client->rc_last_access
2037 	    > rfs4_lease_time));
2038 }
2039 
2040 static void
2041 rfs4_openowner_destroy(rfs4_entry_t u_entry)
2042 {
2043 	rfs4_openowner_t *oo = (rfs4_openowner_t *)u_entry;
2044 
2045 	/* Remove open owner from client's lists of open owners */
2046 	rfs4_dbe_lock(oo->ro_client->rc_dbe);
2047 	list_remove(&oo->ro_client->rc_openownerlist, oo);
2048 	rfs4_dbe_unlock(oo->ro_client->rc_dbe);
2049 
2050 	/* One less reference to the client */
2051 	rfs4_client_rele(oo->ro_client);
2052 	oo->ro_client = NULL;
2053 
2054 	/* Free the last reply for this lock owner */
2055 	rfs4_free_reply(&oo->ro_reply);
2056 
2057 	if (oo->ro_reply_fh.nfs_fh4_val) {
2058 		kmem_free(oo->ro_reply_fh.nfs_fh4_val,
2059 		    oo->ro_reply_fh.nfs_fh4_len);
2060 		oo->ro_reply_fh.nfs_fh4_val = NULL;
2061 		oo->ro_reply_fh.nfs_fh4_len = 0;
2062 	}
2063 
2064 	rfs4_sw_destroy(&oo->ro_sw);
2065 	list_destroy(&oo->ro_statelist);
2066 
2067 	/* Free the lock owner id */
2068 	kmem_free(oo->ro_owner.owner_val, oo->ro_owner.owner_len);
2069 }
2070 
2071 void
2072 rfs4_openowner_rele(rfs4_openowner_t *oo)
2073 {
2074 	rfs4_dbe_rele(oo->ro_dbe);
2075 }
2076 
2077 static bool_t
2078 rfs4_openowner_create(rfs4_entry_t u_entry, void *arg)
2079 {
2080 	rfs4_openowner_t *oo = (rfs4_openowner_t *)u_entry;
2081 	rfs4_openowner_t *argp = (rfs4_openowner_t *)arg;
2082 	open_owner4 *openowner = &argp->ro_owner;
2083 	seqid4 seqid = argp->ro_open_seqid;
2084 	rfs4_client_t *cp;
2085 	bool_t create = FALSE;
2086 
2087 	rw_enter(&rfs4_findclient_lock, RW_READER);
2088 
2089 	cp = (rfs4_client_t *)rfs4_dbsearch(rfs4_clientid_idx,
2090 	    &openowner->clientid,
2091 	    &create, NULL, RFS4_DBS_VALID);
2092 
2093 	rw_exit(&rfs4_findclient_lock);
2094 
2095 	if (cp == NULL)
2096 		return (FALSE);
2097 
2098 	oo->ro_reply_fh.nfs_fh4_len = 0;
2099 	oo->ro_reply_fh.nfs_fh4_val = NULL;
2100 
2101 	oo->ro_owner.clientid = openowner->clientid;
2102 	oo->ro_owner.owner_val =
2103 	    kmem_alloc(openowner->owner_len, KM_SLEEP);
2104 
2105 	bcopy(openowner->owner_val,
2106 	    oo->ro_owner.owner_val, openowner->owner_len);
2107 
2108 	oo->ro_owner.owner_len = openowner->owner_len;
2109 
2110 	oo->ro_need_confirm = TRUE;
2111 
2112 	rfs4_sw_init(&oo->ro_sw);
2113 
2114 	oo->ro_open_seqid = seqid;
2115 	bzero(&oo->ro_reply, sizeof (nfs_resop4));
2116 	oo->ro_client = cp;
2117 	oo->ro_cr_set = NULL;
2118 
2119 	list_create(&oo->ro_statelist, sizeof (rfs4_state_t),
2120 	    offsetof(rfs4_state_t, rs_node));
2121 
2122 	/* Insert openowner into client's open owner list */
2123 	rfs4_dbe_lock(cp->rc_dbe);
2124 	list_insert_tail(&cp->rc_openownerlist, oo);
2125 	rfs4_dbe_unlock(cp->rc_dbe);
2126 
2127 	return (TRUE);
2128 }
2129 
2130 rfs4_openowner_t *
2131 rfs4_findopenowner(open_owner4 *openowner, bool_t *create, seqid4 seqid)
2132 {
2133 	rfs4_openowner_t *oo;
2134 	rfs4_openowner_t arg;
2135 
2136 	arg.ro_owner = *openowner;
2137 	arg.ro_open_seqid = seqid;
2138 	oo = (rfs4_openowner_t *)rfs4_dbsearch(rfs4_openowner_idx, openowner,
2139 	    create, &arg, RFS4_DBS_VALID);
2140 
2141 	return (oo);
2142 }
2143 
2144 void
2145 rfs4_update_open_sequence(rfs4_openowner_t *oo)
2146 {
2147 
2148 	rfs4_dbe_lock(oo->ro_dbe);
2149 
2150 	oo->ro_open_seqid++;
2151 
2152 	rfs4_dbe_unlock(oo->ro_dbe);
2153 }
2154 
2155 void
2156 rfs4_update_open_resp(rfs4_openowner_t *oo, nfs_resop4 *resp, nfs_fh4 *fh)
2157 {
2158 
2159 	rfs4_dbe_lock(oo->ro_dbe);
2160 
2161 	rfs4_free_reply(&oo->ro_reply);
2162 
2163 	rfs4_copy_reply(&oo->ro_reply, resp);
2164 
2165 	/* Save the filehandle if provided and free if not used */
2166 	if (resp->nfs_resop4_u.opopen.status == NFS4_OK &&
2167 	    fh && fh->nfs_fh4_len) {
2168 		if (oo->ro_reply_fh.nfs_fh4_val == NULL)
2169 			oo->ro_reply_fh.nfs_fh4_val =
2170 			    kmem_alloc(fh->nfs_fh4_len, KM_SLEEP);
2171 		nfs_fh4_copy(fh, &oo->ro_reply_fh);
2172 	} else {
2173 		if (oo->ro_reply_fh.nfs_fh4_val) {
2174 			kmem_free(oo->ro_reply_fh.nfs_fh4_val,
2175 			    oo->ro_reply_fh.nfs_fh4_len);
2176 			oo->ro_reply_fh.nfs_fh4_val = NULL;
2177 			oo->ro_reply_fh.nfs_fh4_len = 0;
2178 		}
2179 	}
2180 
2181 	rfs4_dbe_unlock(oo->ro_dbe);
2182 }
2183 
2184 static bool_t
2185 lockowner_compare(rfs4_entry_t u_entry, void *key)
2186 {
2187 	rfs4_lockowner_t *lo = (rfs4_lockowner_t *)u_entry;
2188 	lock_owner4 *b = (lock_owner4 *)key;
2189 
2190 	if (lo->rl_owner.clientid != b->clientid)
2191 		return (FALSE);
2192 
2193 	if (lo->rl_owner.owner_len != b->owner_len)
2194 		return (FALSE);
2195 
2196 	return (bcmp(lo->rl_owner.owner_val, b->owner_val,
2197 	    lo->rl_owner.owner_len) == 0);
2198 }
2199 
2200 void *
2201 lockowner_mkkey(rfs4_entry_t u_entry)
2202 {
2203 	rfs4_lockowner_t *lo = (rfs4_lockowner_t *)u_entry;
2204 
2205 	return (&lo->rl_owner);
2206 }
2207 
2208 static uint32_t
2209 lockowner_hash(void *key)
2210 {
2211 	int i;
2212 	lock_owner4 *lockowner = key;
2213 	uint_t hash = 0;
2214 
2215 	for (i = 0; i < lockowner->owner_len; i++) {
2216 		hash <<= 4;
2217 		hash += (uint_t)lockowner->owner_val[i];
2218 	}
2219 	hash += (uint_t)lockowner->clientid;
2220 	hash |= (lockowner->clientid >> 32);
2221 
2222 	return (hash);
2223 }
2224 
2225 static uint32_t
2226 pid_hash(void *key)
2227 {
2228 	return ((uint32_t)(uintptr_t)key);
2229 }
2230 
2231 static void *
2232 pid_mkkey(rfs4_entry_t u_entry)
2233 {
2234 	rfs4_lockowner_t *lo = (rfs4_lockowner_t *)u_entry;
2235 
2236 	return ((void *)(uintptr_t)lo->rl_pid);
2237 }
2238 
2239 static bool_t
2240 pid_compare(rfs4_entry_t u_entry, void *key)
2241 {
2242 	rfs4_lockowner_t *lo = (rfs4_lockowner_t *)u_entry;
2243 
2244 	return (lo->rl_pid == (pid_t)(uintptr_t)key);
2245 }
2246 
2247 static void
2248 rfs4_lockowner_destroy(rfs4_entry_t u_entry)
2249 {
2250 	rfs4_lockowner_t *lo = (rfs4_lockowner_t *)u_entry;
2251 
2252 	/* Free the lock owner id */
2253 	kmem_free(lo->rl_owner.owner_val, lo->rl_owner.owner_len);
2254 	rfs4_client_rele(lo->rl_client);
2255 }
2256 
2257 void
2258 rfs4_lockowner_rele(rfs4_lockowner_t *lo)
2259 {
2260 	rfs4_dbe_rele(lo->rl_dbe);
2261 }
2262 
2263 /* ARGSUSED */
2264 static bool_t
2265 rfs4_lockowner_expiry(rfs4_entry_t u_entry)
2266 {
2267 	/*
2268 	 * Since expiry is called with no other references on
2269 	 * this struct, go ahead and have it removed.
2270 	 */
2271 	return (TRUE);
2272 }
2273 
2274 static bool_t
2275 rfs4_lockowner_create(rfs4_entry_t u_entry, void *arg)
2276 {
2277 	rfs4_lockowner_t *lo = (rfs4_lockowner_t *)u_entry;
2278 	lock_owner4 *lockowner = (lock_owner4 *)arg;
2279 	rfs4_client_t *cp;
2280 	bool_t create = FALSE;
2281 
2282 	rw_enter(&rfs4_findclient_lock, RW_READER);
2283 
2284 	cp = (rfs4_client_t *)rfs4_dbsearch(rfs4_clientid_idx,
2285 	    &lockowner->clientid,
2286 	    &create, NULL, RFS4_DBS_VALID);
2287 
2288 	rw_exit(&rfs4_findclient_lock);
2289 
2290 	if (cp == NULL)
2291 		return (FALSE);
2292 
2293 	/* Reference client */
2294 	lo->rl_client = cp;
2295 	lo->rl_owner.clientid = lockowner->clientid;
2296 	lo->rl_owner.owner_val = kmem_alloc(lockowner->owner_len, KM_SLEEP);
2297 	bcopy(lockowner->owner_val, lo->rl_owner.owner_val,
2298 	    lockowner->owner_len);
2299 	lo->rl_owner.owner_len = lockowner->owner_len;
2300 	lo->rl_pid = rfs4_dbe_getid(lo->rl_dbe);
2301 
2302 	return (TRUE);
2303 }
2304 
2305 rfs4_lockowner_t *
2306 rfs4_findlockowner(lock_owner4 *lockowner, bool_t *create)
2307 {
2308 	rfs4_lockowner_t *lo;
2309 
2310 	lo = (rfs4_lockowner_t *)rfs4_dbsearch(rfs4_lockowner_idx, lockowner,
2311 	    create, lockowner, RFS4_DBS_VALID);
2312 
2313 	return (lo);
2314 }
2315 
2316 rfs4_lockowner_t *
2317 rfs4_findlockowner_by_pid(pid_t pid)
2318 {
2319 	rfs4_lockowner_t *lo;
2320 	bool_t create = FALSE;
2321 
2322 	lo = (rfs4_lockowner_t *)rfs4_dbsearch(rfs4_lockowner_pid_idx,
2323 	    (void *)(uintptr_t)pid, &create, NULL, RFS4_DBS_VALID);
2324 
2325 	return (lo);
2326 }
2327 
2328 
2329 static uint32_t
2330 file_hash(void *key)
2331 {
2332 	return (ADDRHASH(key));
2333 }
2334 
2335 static void *
2336 file_mkkey(rfs4_entry_t u_entry)
2337 {
2338 	rfs4_file_t *fp = (rfs4_file_t *)u_entry;
2339 
2340 	return (fp->rf_vp);
2341 }
2342 
2343 static bool_t
2344 file_compare(rfs4_entry_t u_entry, void *key)
2345 {
2346 	rfs4_file_t *fp = (rfs4_file_t *)u_entry;
2347 
2348 	return (fp->rf_vp == (vnode_t *)key);
2349 }
2350 
2351 static void
2352 rfs4_file_destroy(rfs4_entry_t u_entry)
2353 {
2354 	rfs4_file_t *fp = (rfs4_file_t *)u_entry;
2355 
2356 	list_destroy(&fp->rf_delegstatelist);
2357 
2358 	if (fp->rf_filehandle.nfs_fh4_val)
2359 		kmem_free(fp->rf_filehandle.nfs_fh4_val,
2360 		    fp->rf_filehandle.nfs_fh4_len);
2361 	cv_destroy(fp->rf_dinfo.rd_recall_cv);
2362 	if (fp->rf_vp) {
2363 		vnode_t *vp = fp->rf_vp;
2364 
2365 		mutex_enter(&vp->v_vsd_lock);
2366 		(void) vsd_set(vp, nfs4_srv_vkey, NULL);
2367 		mutex_exit(&vp->v_vsd_lock);
2368 		VN_RELE(vp);
2369 		fp->rf_vp = NULL;
2370 	}
2371 	rw_destroy(&fp->rf_file_rwlock);
2372 }
2373 
2374 /*
2375  * Used to unlock the underlying dbe struct only
2376  */
2377 void
2378 rfs4_file_rele(rfs4_file_t *fp)
2379 {
2380 	rfs4_dbe_rele(fp->rf_dbe);
2381 }
2382 
2383 typedef struct {
2384     vnode_t *vp;
2385     nfs_fh4 *fh;
2386 } rfs4_fcreate_arg;
2387 
2388 static bool_t
2389 rfs4_file_create(rfs4_entry_t u_entry, void *arg)
2390 {
2391 	rfs4_file_t *fp = (rfs4_file_t *)u_entry;
2392 	rfs4_fcreate_arg *ap = (rfs4_fcreate_arg *)arg;
2393 	vnode_t *vp = ap->vp;
2394 	nfs_fh4 *fh = ap->fh;
2395 
2396 	VN_HOLD(vp);
2397 
2398 	fp->rf_filehandle.nfs_fh4_len = 0;
2399 	fp->rf_filehandle.nfs_fh4_val = NULL;
2400 	ASSERT(fh && fh->nfs_fh4_len);
2401 	if (fh && fh->nfs_fh4_len) {
2402 		fp->rf_filehandle.nfs_fh4_val =
2403 		    kmem_alloc(fh->nfs_fh4_len, KM_SLEEP);
2404 		nfs_fh4_copy(fh, &fp->rf_filehandle);
2405 	}
2406 	fp->rf_vp = vp;
2407 
2408 	list_create(&fp->rf_delegstatelist, sizeof (rfs4_deleg_state_t),
2409 	    offsetof(rfs4_deleg_state_t, rds_node));
2410 
2411 	fp->rf_share_deny = fp->rf_share_access = fp->rf_access_read = 0;
2412 	fp->rf_access_write = fp->rf_deny_read = fp->rf_deny_write = 0;
2413 
2414 	mutex_init(fp->rf_dinfo.rd_recall_lock, NULL, MUTEX_DEFAULT, NULL);
2415 	cv_init(fp->rf_dinfo.rd_recall_cv, NULL, CV_DEFAULT, NULL);
2416 
2417 	fp->rf_dinfo.rd_dtype = OPEN_DELEGATE_NONE;
2418 
2419 	rw_init(&fp->rf_file_rwlock, NULL, RW_DEFAULT, NULL);
2420 
2421 	mutex_enter(&vp->v_vsd_lock);
2422 	VERIFY(vsd_set(vp, nfs4_srv_vkey, (void *)fp) == 0);
2423 	mutex_exit(&vp->v_vsd_lock);
2424 
2425 	return (TRUE);
2426 }
2427 
2428 rfs4_file_t *
2429 rfs4_findfile(vnode_t *vp, nfs_fh4 *fh, bool_t *create)
2430 {
2431 	rfs4_file_t *fp;
2432 	rfs4_fcreate_arg arg;
2433 
2434 	arg.vp = vp;
2435 	arg.fh = fh;
2436 
2437 	if (*create == TRUE)
2438 		fp = (rfs4_file_t *)rfs4_dbsearch(rfs4_file_idx, vp, create,
2439 		    &arg, RFS4_DBS_VALID);
2440 	else {
2441 		mutex_enter(&vp->v_vsd_lock);
2442 		fp = (rfs4_file_t *)vsd_get(vp, nfs4_srv_vkey);
2443 		if (fp) {
2444 			rfs4_dbe_lock(fp->rf_dbe);
2445 			if (rfs4_dbe_is_invalid(fp->rf_dbe) ||
2446 			    (rfs4_dbe_refcnt(fp->rf_dbe) == 0)) {
2447 				rfs4_dbe_unlock(fp->rf_dbe);
2448 				fp = NULL;
2449 			} else {
2450 				rfs4_dbe_hold(fp->rf_dbe);
2451 				rfs4_dbe_unlock(fp->rf_dbe);
2452 			}
2453 		}
2454 		mutex_exit(&vp->v_vsd_lock);
2455 	}
2456 	return (fp);
2457 }
2458 
2459 /*
2460  * Find a file in the db and once it is located, take the rw lock.
2461  * Need to check the vnode pointer and if it does not exist (it was
2462  * removed between the db location and check) redo the find.  This
2463  * assumes that a file struct that has a NULL vnode pointer is marked
2464  * at 'invalid' and will not be found in the db the second time
2465  * around.
2466  */
2467 rfs4_file_t *
2468 rfs4_findfile_withlock(vnode_t *vp, nfs_fh4 *fh, bool_t *create)
2469 {
2470 	rfs4_file_t *fp;
2471 	rfs4_fcreate_arg arg;
2472 	bool_t screate = *create;
2473 
2474 	if (screate == FALSE) {
2475 		mutex_enter(&vp->v_vsd_lock);
2476 		fp = (rfs4_file_t *)vsd_get(vp, nfs4_srv_vkey);
2477 		if (fp) {
2478 			rfs4_dbe_lock(fp->rf_dbe);
2479 			if (rfs4_dbe_is_invalid(fp->rf_dbe) ||
2480 			    (rfs4_dbe_refcnt(fp->rf_dbe) == 0)) {
2481 				rfs4_dbe_unlock(fp->rf_dbe);
2482 				mutex_exit(&vp->v_vsd_lock);
2483 				fp = NULL;
2484 			} else {
2485 				rfs4_dbe_hold(fp->rf_dbe);
2486 				rfs4_dbe_unlock(fp->rf_dbe);
2487 				mutex_exit(&vp->v_vsd_lock);
2488 				rw_enter(&fp->rf_file_rwlock, RW_WRITER);
2489 				if (fp->rf_vp == NULL) {
2490 					rw_exit(&fp->rf_file_rwlock);
2491 					rfs4_file_rele(fp);
2492 					fp = NULL;
2493 				}
2494 			}
2495 		} else {
2496 			mutex_exit(&vp->v_vsd_lock);
2497 		}
2498 	} else {
2499 retry:
2500 		arg.vp = vp;
2501 		arg.fh = fh;
2502 
2503 		fp = (rfs4_file_t *)rfs4_dbsearch(rfs4_file_idx, vp, create,
2504 		    &arg, RFS4_DBS_VALID);
2505 		if (fp != NULL) {
2506 			rw_enter(&fp->rf_file_rwlock, RW_WRITER);
2507 			if (fp->rf_vp == NULL) {
2508 				rw_exit(&fp->rf_file_rwlock);
2509 				rfs4_file_rele(fp);
2510 				*create = screate;
2511 				goto retry;
2512 			}
2513 		}
2514 	}
2515 
2516 	return (fp);
2517 }
2518 
2519 static uint32_t
2520 lo_state_hash(void *key)
2521 {
2522 	stateid_t *id = key;
2523 
2524 	return (id->bits.ident+id->bits.pid);
2525 }
2526 
2527 static bool_t
2528 lo_state_compare(rfs4_entry_t u_entry, void *key)
2529 {
2530 	rfs4_lo_state_t *lsp = (rfs4_lo_state_t *)u_entry;
2531 	stateid_t *id = key;
2532 	bool_t rc;
2533 
2534 	rc = (lsp->rls_lockid.bits.boottime == id->bits.boottime &&
2535 	    lsp->rls_lockid.bits.type == id->bits.type &&
2536 	    lsp->rls_lockid.bits.ident == id->bits.ident &&
2537 	    lsp->rls_lockid.bits.pid == id->bits.pid);
2538 
2539 	return (rc);
2540 }
2541 
2542 static void *
2543 lo_state_mkkey(rfs4_entry_t u_entry)
2544 {
2545 	rfs4_lo_state_t *lsp = (rfs4_lo_state_t *)u_entry;
2546 
2547 	return (&lsp->rls_lockid);
2548 }
2549 
2550 static bool_t
2551 rfs4_lo_state_expiry(rfs4_entry_t u_entry)
2552 {
2553 	rfs4_lo_state_t *lsp = (rfs4_lo_state_t *)u_entry;
2554 
2555 	if (rfs4_dbe_is_invalid(lsp->rls_dbe))
2556 		return (TRUE);
2557 	if (lsp->rls_state->rs_closed)
2558 		return (TRUE);
2559 	return ((gethrestime_sec() -
2560 	    lsp->rls_state->rs_owner->ro_client->rc_last_access
2561 	    > rfs4_lease_time));
2562 }
2563 
2564 static void
2565 rfs4_lo_state_destroy(rfs4_entry_t u_entry)
2566 {
2567 	rfs4_lo_state_t *lsp = (rfs4_lo_state_t *)u_entry;
2568 
2569 	rfs4_dbe_lock(lsp->rls_state->rs_dbe);
2570 	list_remove(&lsp->rls_state->rs_lostatelist, lsp);
2571 	rfs4_dbe_unlock(lsp->rls_state->rs_dbe);
2572 
2573 	rfs4_sw_destroy(&lsp->rls_sw);
2574 
2575 	/* Make sure to release the file locks */
2576 	if (lsp->rls_locks_cleaned == FALSE) {
2577 		lsp->rls_locks_cleaned = TRUE;
2578 		if (lsp->rls_locker->rl_client->rc_sysidt != LM_NOSYSID) {
2579 			/* Is the PxFS kernel module loaded? */
2580 			if (lm_remove_file_locks != NULL) {
2581 				int new_sysid;
2582 
2583 				/* Encode the cluster nodeid in new sysid */
2584 				new_sysid =
2585 				    lsp->rls_locker->rl_client->rc_sysidt;
2586 				lm_set_nlmid_flk(&new_sysid);
2587 
2588 				/*
2589 				 * This PxFS routine removes file locks for a
2590 				 * client over all nodes of a cluster.
2591 				 */
2592 				DTRACE_PROBE1(nfss_i_clust_rm_lck,
2593 				    int, new_sysid);
2594 				(*lm_remove_file_locks)(new_sysid);
2595 			} else {
2596 				(void) cleanlocks(
2597 				    lsp->rls_state->rs_finfo->rf_vp,
2598 				    lsp->rls_locker->rl_pid,
2599 				    lsp->rls_locker->rl_client->rc_sysidt);
2600 			}
2601 		}
2602 	}
2603 
2604 	/* Free the last reply for this state */
2605 	rfs4_free_reply(&lsp->rls_reply);
2606 
2607 	rfs4_lockowner_rele(lsp->rls_locker);
2608 	lsp->rls_locker = NULL;
2609 
2610 	rfs4_state_rele_nounlock(lsp->rls_state);
2611 	lsp->rls_state = NULL;
2612 }
2613 
2614 static bool_t
2615 rfs4_lo_state_create(rfs4_entry_t u_entry, void *arg)
2616 {
2617 	rfs4_lo_state_t *lsp = (rfs4_lo_state_t *)u_entry;
2618 	rfs4_lo_state_t *argp = (rfs4_lo_state_t *)arg;
2619 	rfs4_lockowner_t *lo = argp->rls_locker;
2620 	rfs4_state_t *sp = argp->rls_state;
2621 
2622 	lsp->rls_state = sp;
2623 
2624 	lsp->rls_lockid = sp->rs_stateid;
2625 	lsp->rls_lockid.bits.type = LOCKID;
2626 	lsp->rls_lockid.bits.chgseq = 0;
2627 	lsp->rls_lockid.bits.pid = lo->rl_pid;
2628 
2629 	lsp->rls_locks_cleaned = FALSE;
2630 	lsp->rls_lock_completed = FALSE;
2631 
2632 	rfs4_sw_init(&lsp->rls_sw);
2633 
2634 	/* Attached the supplied lock owner */
2635 	rfs4_dbe_hold(lo->rl_dbe);
2636 	lsp->rls_locker = lo;
2637 
2638 	rfs4_dbe_lock(sp->rs_dbe);
2639 	list_insert_tail(&sp->rs_lostatelist, lsp);
2640 	rfs4_dbe_hold(sp->rs_dbe);
2641 	rfs4_dbe_unlock(sp->rs_dbe);
2642 
2643 	return (TRUE);
2644 }
2645 
2646 void
2647 rfs4_lo_state_rele(rfs4_lo_state_t *lsp, bool_t unlock_fp)
2648 {
2649 	if (unlock_fp == TRUE)
2650 		rw_exit(&lsp->rls_state->rs_finfo->rf_file_rwlock);
2651 	rfs4_dbe_rele(lsp->rls_dbe);
2652 }
2653 
2654 static rfs4_lo_state_t *
2655 rfs4_findlo_state(stateid_t *id, bool_t lock_fp)
2656 {
2657 	rfs4_lo_state_t *lsp;
2658 	bool_t create = FALSE;
2659 
2660 	lsp = (rfs4_lo_state_t *)rfs4_dbsearch(rfs4_lo_state_idx, id,
2661 	    &create, NULL, RFS4_DBS_VALID);
2662 	if (lock_fp == TRUE && lsp != NULL)
2663 		rw_enter(&lsp->rls_state->rs_finfo->rf_file_rwlock, RW_READER);
2664 
2665 	return (lsp);
2666 }
2667 
2668 
2669 static uint32_t
2670 lo_state_lo_hash(void *key)
2671 {
2672 	rfs4_lo_state_t *lsp = key;
2673 
2674 	return (ADDRHASH(lsp->rls_locker) ^ ADDRHASH(lsp->rls_state));
2675 }
2676 
2677 static bool_t
2678 lo_state_lo_compare(rfs4_entry_t u_entry, void *key)
2679 {
2680 	rfs4_lo_state_t *lsp = (rfs4_lo_state_t *)u_entry;
2681 	rfs4_lo_state_t *keyp = key;
2682 
2683 	return (keyp->rls_locker == lsp->rls_locker &&
2684 	    keyp->rls_state == lsp->rls_state);
2685 }
2686 
2687 static void *
2688 lo_state_lo_mkkey(rfs4_entry_t u_entry)
2689 {
2690 	return (u_entry);
2691 }
2692 
2693 rfs4_lo_state_t *
2694 rfs4_findlo_state_by_owner(rfs4_lockowner_t *lo, rfs4_state_t *sp,
2695     bool_t *create)
2696 {
2697 	rfs4_lo_state_t *lsp;
2698 	rfs4_lo_state_t arg;
2699 
2700 	arg.rls_locker = lo;
2701 	arg.rls_state = sp;
2702 
2703 	lsp = (rfs4_lo_state_t *)rfs4_dbsearch(rfs4_lo_state_owner_idx, &arg,
2704 	    create, &arg, RFS4_DBS_VALID);
2705 
2706 	return (lsp);
2707 }
2708 
2709 static stateid_t
2710 get_stateid(id_t eid)
2711 {
2712 	stateid_t id;
2713 
2714 	id.bits.boottime = rfs4_start_time;
2715 	id.bits.ident = eid;
2716 	id.bits.chgseq = 0;
2717 	id.bits.type = 0;
2718 	id.bits.pid = 0;
2719 
2720 	/*
2721 	 * If we are booted as a cluster node, embed our nodeid.
2722 	 * We've already done sanity checks in rfs4_client_create() so no
2723 	 * need to repeat them here.
2724 	 */
2725 	id.bits.clnodeid = (cluster_bootflags & CLUSTER_BOOTED) ?
2726 	    clconf_get_nodeid() : 0;
2727 
2728 	return (id);
2729 }
2730 
2731 /*
2732  * For use only when booted as a cluster node.
2733  * Returns TRUE if the embedded nodeid indicates that this stateid was
2734  * generated on another node.
2735  */
2736 static int
2737 foreign_stateid(stateid_t *id)
2738 {
2739 	ASSERT(cluster_bootflags & CLUSTER_BOOTED);
2740 	return (id->bits.clnodeid != (uint32_t)clconf_get_nodeid());
2741 }
2742 
2743 /*
2744  * For use only when booted as a cluster node.
2745  * Returns TRUE if the embedded nodeid indicates that this clientid was
2746  * generated on another node.
2747  */
2748 static int
2749 foreign_clientid(cid *cidp)
2750 {
2751 	ASSERT(cluster_bootflags & CLUSTER_BOOTED);
2752 	return (cidp->impl_id.c_id >> CLUSTER_NODEID_SHIFT !=
2753 	    (uint32_t)clconf_get_nodeid());
2754 }
2755 
2756 /*
2757  * For use only when booted as a cluster node.
2758  * Embed our cluster nodeid into the clientid.
2759  */
2760 static void
2761 embed_nodeid(cid *cidp)
2762 {
2763 	int clnodeid;
2764 	/*
2765 	 * Currently, our state tables are small enough that their
2766 	 * ids will leave enough bits free for the nodeid. If the
2767 	 * tables become larger, we mustn't overwrite the id.
2768 	 * Equally, we only have room for so many bits of nodeid, so
2769 	 * must check that too.
2770 	 */
2771 	ASSERT(cluster_bootflags & CLUSTER_BOOTED);
2772 	ASSERT(cidp->impl_id.c_id >> CLUSTER_NODEID_SHIFT == 0);
2773 	clnodeid = clconf_get_nodeid();
2774 	ASSERT(clnodeid <= CLUSTER_MAX_NODEID);
2775 	ASSERT(clnodeid != NODEID_UNKNOWN);
2776 	cidp->impl_id.c_id |= (clnodeid << CLUSTER_NODEID_SHIFT);
2777 }
2778 
2779 static uint32_t
2780 state_hash(void *key)
2781 {
2782 	stateid_t *ip = (stateid_t *)key;
2783 
2784 	return (ip->bits.ident);
2785 }
2786 
2787 static bool_t
2788 state_compare(rfs4_entry_t u_entry, void *key)
2789 {
2790 	rfs4_state_t *sp = (rfs4_state_t *)u_entry;
2791 	stateid_t *id = (stateid_t *)key;
2792 	bool_t rc;
2793 
2794 	rc = (sp->rs_stateid.bits.boottime == id->bits.boottime &&
2795 	    sp->rs_stateid.bits.ident == id->bits.ident);
2796 
2797 	return (rc);
2798 }
2799 
2800 static void *
2801 state_mkkey(rfs4_entry_t u_entry)
2802 {
2803 	rfs4_state_t *sp = (rfs4_state_t *)u_entry;
2804 
2805 	return (&sp->rs_stateid);
2806 }
2807 
2808 static void
2809 rfs4_state_destroy(rfs4_entry_t u_entry)
2810 {
2811 	rfs4_state_t *sp = (rfs4_state_t *)u_entry;
2812 
2813 	/* remove from openowner list */
2814 	rfs4_dbe_lock(sp->rs_owner->ro_dbe);
2815 	list_remove(&sp->rs_owner->ro_statelist, sp);
2816 	rfs4_dbe_unlock(sp->rs_owner->ro_dbe);
2817 
2818 	list_destroy(&sp->rs_lostatelist);
2819 
2820 	/* release any share locks for this stateid if it's still open */
2821 	if (!sp->rs_closed) {
2822 		rfs4_dbe_lock(sp->rs_dbe);
2823 		(void) rfs4_unshare(sp);
2824 		rfs4_dbe_unlock(sp->rs_dbe);
2825 	}
2826 
2827 	/* Were done with the file */
2828 	rfs4_file_rele(sp->rs_finfo);
2829 	sp->rs_finfo = NULL;
2830 
2831 	/* And now with the openowner */
2832 	rfs4_openowner_rele(sp->rs_owner);
2833 	sp->rs_owner = NULL;
2834 }
2835 
2836 static void
2837 rfs4_state_rele_nounlock(rfs4_state_t *sp)
2838 {
2839 	rfs4_dbe_rele(sp->rs_dbe);
2840 }
2841 
2842 void
2843 rfs4_state_rele(rfs4_state_t *sp)
2844 {
2845 	rw_exit(&sp->rs_finfo->rf_file_rwlock);
2846 	rfs4_dbe_rele(sp->rs_dbe);
2847 }
2848 
2849 static uint32_t
2850 deleg_hash(void *key)
2851 {
2852 	rfs4_deleg_state_t *dsp = (rfs4_deleg_state_t *)key;
2853 
2854 	return (ADDRHASH(dsp->rds_client) ^ ADDRHASH(dsp->rds_finfo));
2855 }
2856 
2857 static bool_t
2858 deleg_compare(rfs4_entry_t u_entry, void *key)
2859 {
2860 	rfs4_deleg_state_t *dsp = (rfs4_deleg_state_t *)u_entry;
2861 	rfs4_deleg_state_t *kdsp = (rfs4_deleg_state_t *)key;
2862 
2863 	return (dsp->rds_client == kdsp->rds_client &&
2864 	    dsp->rds_finfo == kdsp->rds_finfo);
2865 }
2866 
2867 static void *
2868 deleg_mkkey(rfs4_entry_t u_entry)
2869 {
2870 	return (u_entry);
2871 }
2872 
2873 static uint32_t
2874 deleg_state_hash(void *key)
2875 {
2876 	stateid_t *ip = (stateid_t *)key;
2877 
2878 	return (ip->bits.ident);
2879 }
2880 
2881 static bool_t
2882 deleg_state_compare(rfs4_entry_t u_entry, void *key)
2883 {
2884 	rfs4_deleg_state_t *dsp = (rfs4_deleg_state_t *)u_entry;
2885 	stateid_t *id = (stateid_t *)key;
2886 	bool_t rc;
2887 
2888 	if (id->bits.type != DELEGID)
2889 		return (FALSE);
2890 
2891 	rc = (dsp->rds_delegid.bits.boottime == id->bits.boottime &&
2892 	    dsp->rds_delegid.bits.ident == id->bits.ident);
2893 
2894 	return (rc);
2895 }
2896 
2897 static void *
2898 deleg_state_mkkey(rfs4_entry_t u_entry)
2899 {
2900 	rfs4_deleg_state_t *dsp = (rfs4_deleg_state_t *)u_entry;
2901 
2902 	return (&dsp->rds_delegid);
2903 }
2904 
2905 static bool_t
2906 rfs4_deleg_state_expiry(rfs4_entry_t u_entry)
2907 {
2908 	rfs4_deleg_state_t *dsp = (rfs4_deleg_state_t *)u_entry;
2909 
2910 	if (rfs4_dbe_is_invalid(dsp->rds_dbe))
2911 		return (TRUE);
2912 
2913 	if ((gethrestime_sec() - dsp->rds_client->rc_last_access
2914 	    > rfs4_lease_time)) {
2915 		rfs4_dbe_invalidate(dsp->rds_dbe);
2916 		return (TRUE);
2917 	}
2918 
2919 	return (FALSE);
2920 }
2921 
2922 static bool_t
2923 rfs4_deleg_state_create(rfs4_entry_t u_entry, void *argp)
2924 {
2925 	rfs4_deleg_state_t *dsp = (rfs4_deleg_state_t *)u_entry;
2926 	rfs4_file_t *fp = ((rfs4_deleg_state_t *)argp)->rds_finfo;
2927 	rfs4_client_t *cp = ((rfs4_deleg_state_t *)argp)->rds_client;
2928 
2929 	rfs4_dbe_hold(fp->rf_dbe);
2930 	rfs4_dbe_hold(cp->rc_dbe);
2931 
2932 	dsp->rds_delegid = get_stateid(rfs4_dbe_getid(dsp->rds_dbe));
2933 	dsp->rds_delegid.bits.type = DELEGID;
2934 	dsp->rds_finfo = fp;
2935 	dsp->rds_client = cp;
2936 	dsp->rds_dtype = OPEN_DELEGATE_NONE;
2937 
2938 	dsp->rds_time_granted = gethrestime_sec();	/* observability */
2939 	dsp->rds_time_revoked = 0;
2940 
2941 	list_link_init(&dsp->rds_node);
2942 
2943 	return (TRUE);
2944 }
2945 
2946 static void
2947 rfs4_deleg_state_destroy(rfs4_entry_t u_entry)
2948 {
2949 	rfs4_deleg_state_t *dsp = (rfs4_deleg_state_t *)u_entry;
2950 
2951 	/* return delegation if necessary */
2952 	rfs4_return_deleg(dsp, FALSE);
2953 
2954 	/* Were done with the file */
2955 	rfs4_file_rele(dsp->rds_finfo);
2956 	dsp->rds_finfo = NULL;
2957 
2958 	/* And now with the openowner */
2959 	rfs4_client_rele(dsp->rds_client);
2960 	dsp->rds_client = NULL;
2961 }
2962 
2963 rfs4_deleg_state_t *
2964 rfs4_finddeleg(rfs4_state_t *sp, bool_t *create)
2965 {
2966 	rfs4_deleg_state_t ds, *dsp;
2967 
2968 	ds.rds_client = sp->rs_owner->ro_client;
2969 	ds.rds_finfo = sp->rs_finfo;
2970 
2971 	dsp = (rfs4_deleg_state_t *)rfs4_dbsearch(rfs4_deleg_idx, &ds,
2972 	    create, &ds, RFS4_DBS_VALID);
2973 
2974 	return (dsp);
2975 }
2976 
2977 rfs4_deleg_state_t *
2978 rfs4_finddelegstate(stateid_t *id)
2979 {
2980 	rfs4_deleg_state_t *dsp;
2981 	bool_t create = FALSE;
2982 
2983 	dsp = (rfs4_deleg_state_t *)rfs4_dbsearch(rfs4_deleg_state_idx, id,
2984 	    &create, NULL, RFS4_DBS_VALID);
2985 
2986 	return (dsp);
2987 }
2988 
2989 void
2990 rfs4_deleg_state_rele(rfs4_deleg_state_t *dsp)
2991 {
2992 	rfs4_dbe_rele(dsp->rds_dbe);
2993 }
2994 
2995 void
2996 rfs4_update_lock_sequence(rfs4_lo_state_t *lsp)
2997 {
2998 
2999 	rfs4_dbe_lock(lsp->rls_dbe);
3000 
3001 	/*
3002 	 * If we are skipping sequence id checking, this means that
3003 	 * this is the first lock request and therefore the sequence
3004 	 * id does not need to be updated.  This only happens on the
3005 	 * first lock request for a lockowner
3006 	 */
3007 	if (!lsp->rls_skip_seqid_check)
3008 		lsp->rls_seqid++;
3009 
3010 	rfs4_dbe_unlock(lsp->rls_dbe);
3011 }
3012 
3013 void
3014 rfs4_update_lock_resp(rfs4_lo_state_t *lsp, nfs_resop4 *resp)
3015 {
3016 
3017 	rfs4_dbe_lock(lsp->rls_dbe);
3018 
3019 	rfs4_free_reply(&lsp->rls_reply);
3020 
3021 	rfs4_copy_reply(&lsp->rls_reply, resp);
3022 
3023 	rfs4_dbe_unlock(lsp->rls_dbe);
3024 }
3025 
3026 void
3027 rfs4_free_opens(rfs4_openowner_t *oo, bool_t invalidate,
3028     bool_t close_of_client)
3029 {
3030 	rfs4_state_t *sp;
3031 
3032 	rfs4_dbe_lock(oo->ro_dbe);
3033 
3034 	for (sp = list_head(&oo->ro_statelist); sp != NULL;
3035 	    sp = list_next(&oo->ro_statelist, sp)) {
3036 		rfs4_state_close(sp, FALSE, close_of_client, CRED());
3037 		if (invalidate == TRUE)
3038 			rfs4_dbe_invalidate(sp->rs_dbe);
3039 	}
3040 
3041 	rfs4_dbe_invalidate(oo->ro_dbe);
3042 	rfs4_dbe_unlock(oo->ro_dbe);
3043 }
3044 
3045 static uint32_t
3046 state_owner_file_hash(void *key)
3047 {
3048 	rfs4_state_t *sp = key;
3049 
3050 	return (ADDRHASH(sp->rs_owner) ^ ADDRHASH(sp->rs_finfo));
3051 }
3052 
3053 static bool_t
3054 state_owner_file_compare(rfs4_entry_t u_entry, void *key)
3055 {
3056 	rfs4_state_t *sp = (rfs4_state_t *)u_entry;
3057 	rfs4_state_t *arg = key;
3058 
3059 	if (sp->rs_closed == TRUE)
3060 		return (FALSE);
3061 
3062 	return (arg->rs_owner == sp->rs_owner && arg->rs_finfo == sp->rs_finfo);
3063 }
3064 
3065 static void *
3066 state_owner_file_mkkey(rfs4_entry_t u_entry)
3067 {
3068 	return (u_entry);
3069 }
3070 
3071 static uint32_t
3072 state_file_hash(void *key)
3073 {
3074 	return (ADDRHASH(key));
3075 }
3076 
3077 static bool_t
3078 state_file_compare(rfs4_entry_t u_entry, void *key)
3079 {
3080 	rfs4_state_t *sp = (rfs4_state_t *)u_entry;
3081 	rfs4_file_t *fp = key;
3082 
3083 	if (sp->rs_closed == TRUE)
3084 		return (FALSE);
3085 
3086 	return (fp == sp->rs_finfo);
3087 }
3088 
3089 static void *
3090 state_file_mkkey(rfs4_entry_t u_entry)
3091 {
3092 	rfs4_state_t *sp = (rfs4_state_t *)u_entry;
3093 
3094 	return (sp->rs_finfo);
3095 }
3096 
3097 rfs4_state_t *
3098 rfs4_findstate_by_owner_file(rfs4_openowner_t *oo, rfs4_file_t *fp,
3099 	bool_t *create)
3100 {
3101 	rfs4_state_t *sp;
3102 	rfs4_state_t key;
3103 
3104 	key.rs_owner = oo;
3105 	key.rs_finfo = fp;
3106 
3107 	sp = (rfs4_state_t *)rfs4_dbsearch(rfs4_state_owner_file_idx, &key,
3108 	    create, &key, RFS4_DBS_VALID);
3109 
3110 	return (sp);
3111 }
3112 
3113 /* This returns ANY state struct that refers to this file */
3114 static rfs4_state_t *
3115 rfs4_findstate_by_file(rfs4_file_t *fp)
3116 {
3117 	bool_t create = FALSE;
3118 
3119 	return ((rfs4_state_t *)rfs4_dbsearch(rfs4_state_file_idx, fp,
3120 	    &create, fp, RFS4_DBS_VALID));
3121 }
3122 
3123 static bool_t
3124 rfs4_state_expiry(rfs4_entry_t u_entry)
3125 {
3126 	rfs4_state_t *sp = (rfs4_state_t *)u_entry;
3127 
3128 	if (rfs4_dbe_is_invalid(sp->rs_dbe))
3129 		return (TRUE);
3130 
3131 	if (sp->rs_closed == TRUE &&
3132 	    ((gethrestime_sec() - rfs4_dbe_get_timerele(sp->rs_dbe))
3133 	    > rfs4_lease_time))
3134 		return (TRUE);
3135 
3136 	return ((gethrestime_sec() - sp->rs_owner->ro_client->rc_last_access
3137 	    > rfs4_lease_time));
3138 }
3139 
3140 static bool_t
3141 rfs4_state_create(rfs4_entry_t u_entry, void *argp)
3142 {
3143 	rfs4_state_t *sp = (rfs4_state_t *)u_entry;
3144 	rfs4_file_t *fp = ((rfs4_state_t *)argp)->rs_finfo;
3145 	rfs4_openowner_t *oo = ((rfs4_state_t *)argp)->rs_owner;
3146 
3147 	rfs4_dbe_hold(fp->rf_dbe);
3148 	rfs4_dbe_hold(oo->ro_dbe);
3149 	sp->rs_stateid = get_stateid(rfs4_dbe_getid(sp->rs_dbe));
3150 	sp->rs_stateid.bits.type = OPENID;
3151 	sp->rs_owner = oo;
3152 	sp->rs_finfo = fp;
3153 
3154 	list_create(&sp->rs_lostatelist, sizeof (rfs4_lo_state_t),
3155 	    offsetof(rfs4_lo_state_t, rls_node));
3156 
3157 	/* Insert state on per open owner's list */
3158 	rfs4_dbe_lock(oo->ro_dbe);
3159 	list_insert_tail(&oo->ro_statelist, sp);
3160 	rfs4_dbe_unlock(oo->ro_dbe);
3161 
3162 	return (TRUE);
3163 }
3164 
3165 static rfs4_state_t *
3166 rfs4_findstate(stateid_t *id, rfs4_dbsearch_type_t find_invalid, bool_t lock_fp)
3167 {
3168 	rfs4_state_t *sp;
3169 	bool_t create = FALSE;
3170 
3171 	sp = (rfs4_state_t *)rfs4_dbsearch(rfs4_state_idx, id,
3172 	    &create, NULL, find_invalid);
3173 	if (lock_fp == TRUE && sp != NULL)
3174 		rw_enter(&sp->rs_finfo->rf_file_rwlock, RW_READER);
3175 
3176 	return (sp);
3177 }
3178 
3179 void
3180 rfs4_state_close(rfs4_state_t *sp, bool_t lock_held, bool_t close_of_client,
3181     cred_t *cr)
3182 {
3183 	/* Remove the associated lo_state owners */
3184 	if (!lock_held)
3185 		rfs4_dbe_lock(sp->rs_dbe);
3186 
3187 	/*
3188 	 * If refcnt == 0, the dbe is about to be destroyed.
3189 	 * lock state will be released by the reaper thread.
3190 	 */
3191 
3192 	if (rfs4_dbe_refcnt(sp->rs_dbe) > 0) {
3193 		if (sp->rs_closed == FALSE) {
3194 			rfs4_release_share_lock_state(sp, cr, close_of_client);
3195 			sp->rs_closed = TRUE;
3196 		}
3197 	}
3198 
3199 	if (!lock_held)
3200 		rfs4_dbe_unlock(sp->rs_dbe);
3201 }
3202 
3203 /*
3204  * Remove all state associated with the given client.
3205  */
3206 void
3207 rfs4_client_state_remove(rfs4_client_t *cp)
3208 {
3209 	rfs4_openowner_t *oo;
3210 
3211 	rfs4_dbe_lock(cp->rc_dbe);
3212 
3213 	for (oo = list_head(&cp->rc_openownerlist); oo != NULL;
3214 	    oo = list_next(&cp->rc_openownerlist, oo)) {
3215 		rfs4_free_opens(oo, TRUE, TRUE);
3216 	}
3217 
3218 	rfs4_dbe_unlock(cp->rc_dbe);
3219 }
3220 
3221 void
3222 rfs4_client_close(rfs4_client_t *cp)
3223 {
3224 	/* Mark client as going away. */
3225 	rfs4_dbe_lock(cp->rc_dbe);
3226 	rfs4_dbe_invalidate(cp->rc_dbe);
3227 	rfs4_dbe_unlock(cp->rc_dbe);
3228 
3229 	rfs4_client_state_remove(cp);
3230 
3231 	/* Release the client */
3232 	rfs4_client_rele(cp);
3233 }
3234 
3235 nfsstat4
3236 rfs4_check_clientid(clientid4 *cp, int setclid_confirm)
3237 {
3238 	cid *cidp = (cid *) cp;
3239 
3240 	/*
3241 	 * If we are booted as a cluster node, check the embedded nodeid.
3242 	 * If it indicates that this clientid was generated on another node,
3243 	 * inform the client accordingly.
3244 	 */
3245 	if (cluster_bootflags & CLUSTER_BOOTED && foreign_clientid(cidp))
3246 		return (NFS4ERR_STALE_CLIENTID);
3247 
3248 	/*
3249 	 * If the server start time matches the time provided
3250 	 * by the client (via the clientid) and this is NOT a
3251 	 * setclientid_confirm then return EXPIRED.
3252 	 */
3253 	if (!setclid_confirm && cidp->impl_id.start_time == rfs4_start_time)
3254 		return (NFS4ERR_EXPIRED);
3255 
3256 	return (NFS4ERR_STALE_CLIENTID);
3257 }
3258 
3259 /*
3260  * This is used when a stateid has not been found amongst the
3261  * current server's state.  Check the stateid to see if it
3262  * was from this server instantiation or not.
3263  */
3264 static nfsstat4
3265 what_stateid_error(stateid_t *id, stateid_type_t type)
3266 {
3267 	/* If we are booted as a cluster node, was stateid locally generated? */
3268 	if ((cluster_bootflags & CLUSTER_BOOTED) && foreign_stateid(id))
3269 		return (NFS4ERR_STALE_STATEID);
3270 
3271 	/* If types don't match then no use checking further */
3272 	if (type != id->bits.type)
3273 		return (NFS4ERR_BAD_STATEID);
3274 
3275 	/* From a previous server instantiation, return STALE */
3276 	if (id->bits.boottime < rfs4_start_time)
3277 		return (NFS4ERR_STALE_STATEID);
3278 
3279 	/*
3280 	 * From this server but the state is most likely beyond lease
3281 	 * timeout: return NFS4ERR_EXPIRED.  However, there is the
3282 	 * case of a delegation stateid.  For delegations, there is a
3283 	 * case where the state can be removed without the client's
3284 	 * knowledge/consent: revocation.  In the case of delegation
3285 	 * revocation, the delegation state will be removed and will
3286 	 * not be found.  If the client does something like a
3287 	 * DELEGRETURN or even a READ/WRITE with a delegatoin stateid
3288 	 * that has been revoked, the server should return BAD_STATEID
3289 	 * instead of the more common EXPIRED error.
3290 	 */
3291 	if (id->bits.boottime == rfs4_start_time) {
3292 		if (type == DELEGID)
3293 			return (NFS4ERR_BAD_STATEID);
3294 		else
3295 			return (NFS4ERR_EXPIRED);
3296 	}
3297 
3298 	return (NFS4ERR_BAD_STATEID);
3299 }
3300 
3301 /*
3302  * Used later on to find the various state structs.  When called from
3303  * rfs4_check_stateid()->rfs4_get_all_state(), no file struct lock is
3304  * taken (it is not needed) and helps on the read/write path with
3305  * respect to performance.
3306  */
3307 static nfsstat4
3308 rfs4_get_state_lockit(stateid4 *stateid, rfs4_state_t **spp,
3309     rfs4_dbsearch_type_t find_invalid, bool_t lock_fp)
3310 {
3311 	stateid_t *id = (stateid_t *)stateid;
3312 	rfs4_state_t *sp;
3313 
3314 	*spp = NULL;
3315 
3316 	/* If we are booted as a cluster node, was stateid locally generated? */
3317 	if ((cluster_bootflags & CLUSTER_BOOTED) && foreign_stateid(id))
3318 		return (NFS4ERR_STALE_STATEID);
3319 
3320 	sp = rfs4_findstate(id, find_invalid, lock_fp);
3321 	if (sp == NULL) {
3322 		return (what_stateid_error(id, OPENID));
3323 	}
3324 
3325 	if (rfs4_lease_expired(sp->rs_owner->ro_client)) {
3326 		if (lock_fp == TRUE)
3327 			rfs4_state_rele(sp);
3328 		else
3329 			rfs4_state_rele_nounlock(sp);
3330 		return (NFS4ERR_EXPIRED);
3331 	}
3332 
3333 	*spp = sp;
3334 
3335 	return (NFS4_OK);
3336 }
3337 
3338 nfsstat4
3339 rfs4_get_state(stateid4 *stateid, rfs4_state_t **spp,
3340     rfs4_dbsearch_type_t find_invalid)
3341 {
3342 	return (rfs4_get_state_lockit(stateid, spp, find_invalid, TRUE));
3343 }
3344 
3345 int
3346 rfs4_check_stateid_seqid(rfs4_state_t *sp, stateid4 *stateid)
3347 {
3348 	stateid_t *id = (stateid_t *)stateid;
3349 
3350 	if (rfs4_lease_expired(sp->rs_owner->ro_client))
3351 		return (NFS4_CHECK_STATEID_EXPIRED);
3352 
3353 	/* Stateid is some time in the future - that's bad */
3354 	if (sp->rs_stateid.bits.chgseq < id->bits.chgseq)
3355 		return (NFS4_CHECK_STATEID_BAD);
3356 
3357 	if (sp->rs_stateid.bits.chgseq == id->bits.chgseq + 1)
3358 		return (NFS4_CHECK_STATEID_REPLAY);
3359 
3360 	/* Stateid is some time in the past - that's old */
3361 	if (sp->rs_stateid.bits.chgseq > id->bits.chgseq)
3362 		return (NFS4_CHECK_STATEID_OLD);
3363 
3364 	/* Caller needs to know about confirmation before closure */
3365 	if (sp->rs_owner->ro_need_confirm)
3366 		return (NFS4_CHECK_STATEID_UNCONFIRMED);
3367 
3368 	if (sp->rs_closed == TRUE)
3369 		return (NFS4_CHECK_STATEID_CLOSED);
3370 
3371 	return (NFS4_CHECK_STATEID_OKAY);
3372 }
3373 
3374 int
3375 rfs4_check_lo_stateid_seqid(rfs4_lo_state_t *lsp, stateid4 *stateid)
3376 {
3377 	stateid_t *id = (stateid_t *)stateid;
3378 
3379 	if (rfs4_lease_expired(lsp->rls_state->rs_owner->ro_client))
3380 		return (NFS4_CHECK_STATEID_EXPIRED);
3381 
3382 	/* Stateid is some time in the future - that's bad */
3383 	if (lsp->rls_lockid.bits.chgseq < id->bits.chgseq)
3384 		return (NFS4_CHECK_STATEID_BAD);
3385 
3386 	if (lsp->rls_lockid.bits.chgseq == id->bits.chgseq + 1)
3387 		return (NFS4_CHECK_STATEID_REPLAY);
3388 
3389 	/* Stateid is some time in the past - that's old */
3390 	if (lsp->rls_lockid.bits.chgseq > id->bits.chgseq)
3391 		return (NFS4_CHECK_STATEID_OLD);
3392 
3393 	if (lsp->rls_state->rs_closed == TRUE)
3394 		return (NFS4_CHECK_STATEID_CLOSED);
3395 
3396 	return (NFS4_CHECK_STATEID_OKAY);
3397 }
3398 
3399 nfsstat4
3400 rfs4_get_deleg_state(stateid4 *stateid, rfs4_deleg_state_t **dspp)
3401 {
3402 	stateid_t *id = (stateid_t *)stateid;
3403 	rfs4_deleg_state_t *dsp;
3404 
3405 	*dspp = NULL;
3406 
3407 	/* If we are booted as a cluster node, was stateid locally generated? */
3408 	if ((cluster_bootflags & CLUSTER_BOOTED) && foreign_stateid(id))
3409 		return (NFS4ERR_STALE_STATEID);
3410 
3411 	dsp = rfs4_finddelegstate(id);
3412 	if (dsp == NULL) {
3413 		return (what_stateid_error(id, DELEGID));
3414 	}
3415 
3416 	if (rfs4_lease_expired(dsp->rds_client)) {
3417 		rfs4_deleg_state_rele(dsp);
3418 		return (NFS4ERR_EXPIRED);
3419 	}
3420 
3421 	*dspp = dsp;
3422 
3423 	return (NFS4_OK);
3424 }
3425 
3426 nfsstat4
3427 rfs4_get_lo_state(stateid4 *stateid, rfs4_lo_state_t **lspp, bool_t lock_fp)
3428 {
3429 	stateid_t *id = (stateid_t *)stateid;
3430 	rfs4_lo_state_t *lsp;
3431 
3432 	*lspp = NULL;
3433 
3434 	/* If we are booted as a cluster node, was stateid locally generated? */
3435 	if ((cluster_bootflags & CLUSTER_BOOTED) && foreign_stateid(id))
3436 		return (NFS4ERR_STALE_STATEID);
3437 
3438 	lsp = rfs4_findlo_state(id, lock_fp);
3439 	if (lsp == NULL) {
3440 		return (what_stateid_error(id, LOCKID));
3441 	}
3442 
3443 	if (rfs4_lease_expired(lsp->rls_state->rs_owner->ro_client)) {
3444 		rfs4_lo_state_rele(lsp, lock_fp);
3445 		return (NFS4ERR_EXPIRED);
3446 	}
3447 
3448 	*lspp = lsp;
3449 
3450 	return (NFS4_OK);
3451 }
3452 
3453 static nfsstat4
3454 rfs4_get_all_state(stateid4 *sid, rfs4_state_t **spp,
3455     rfs4_deleg_state_t **dspp, rfs4_lo_state_t **lspp)
3456 {
3457 	rfs4_state_t *sp = NULL;
3458 	rfs4_deleg_state_t *dsp = NULL;
3459 	rfs4_lo_state_t *lsp = NULL;
3460 	stateid_t *id;
3461 	nfsstat4 status;
3462 
3463 	*spp = NULL; *dspp = NULL; *lspp = NULL;
3464 
3465 	id = (stateid_t *)sid;
3466 	switch (id->bits.type) {
3467 	case OPENID:
3468 		status = rfs4_get_state_lockit(sid, &sp, FALSE, FALSE);
3469 		break;
3470 	case DELEGID:
3471 		status = rfs4_get_deleg_state(sid, &dsp);
3472 		break;
3473 	case LOCKID:
3474 		status = rfs4_get_lo_state(sid, &lsp, FALSE);
3475 		if (status == NFS4_OK) {
3476 			sp = lsp->rls_state;
3477 			rfs4_dbe_hold(sp->rs_dbe);
3478 		}
3479 		break;
3480 	default:
3481 		status = NFS4ERR_BAD_STATEID;
3482 	}
3483 
3484 	if (status == NFS4_OK) {
3485 		*spp = sp;
3486 		*dspp = dsp;
3487 		*lspp = lsp;
3488 	}
3489 
3490 	return (status);
3491 }
3492 
3493 /*
3494  * Given the I/O mode (FREAD or FWRITE), this checks whether the
3495  * rfs4_state_t struct has access to do this operation and if so
3496  * return NFS4_OK; otherwise the proper NFSv4 error is returned.
3497  */
3498 nfsstat4
3499 rfs4_state_has_access(rfs4_state_t *sp, int mode, vnode_t *vp)
3500 {
3501 	nfsstat4 stat = NFS4_OK;
3502 	rfs4_file_t *fp;
3503 	bool_t create = FALSE;
3504 
3505 	rfs4_dbe_lock(sp->rs_dbe);
3506 	if (mode == FWRITE) {
3507 		if (!(sp->rs_share_access & OPEN4_SHARE_ACCESS_WRITE)) {
3508 			stat = NFS4ERR_OPENMODE;
3509 		}
3510 	} else if (mode == FREAD) {
3511 		if (!(sp->rs_share_access & OPEN4_SHARE_ACCESS_READ)) {
3512 			/*
3513 			 * If we have OPENed the file with DENYing access
3514 			 * to both READ and WRITE then no one else could
3515 			 * have OPENed the file, hence no conflicting READ
3516 			 * deny.  This check is merely an optimization.
3517 			 */
3518 			if (sp->rs_share_deny == OPEN4_SHARE_DENY_BOTH)
3519 				goto out;
3520 
3521 			/* Check against file struct's DENY mode */
3522 			fp = rfs4_findfile(vp, NULL, &create);
3523 			if (fp != NULL) {
3524 				int deny_read = 0;
3525 				rfs4_dbe_lock(fp->rf_dbe);
3526 				/*
3527 				 * Check if any other open owner has the file
3528 				 * OPENed with deny READ.
3529 				 */
3530 				if (sp->rs_share_deny & OPEN4_SHARE_DENY_READ)
3531 					deny_read = 1;
3532 				ASSERT(fp->rf_deny_read - deny_read >= 0);
3533 				if (fp->rf_deny_read - deny_read > 0)
3534 					stat = NFS4ERR_OPENMODE;
3535 				rfs4_dbe_unlock(fp->rf_dbe);
3536 				rfs4_file_rele(fp);
3537 			}
3538 		}
3539 	} else {
3540 		/* Illegal I/O mode */
3541 		stat = NFS4ERR_INVAL;
3542 	}
3543 out:
3544 	rfs4_dbe_unlock(sp->rs_dbe);
3545 	return (stat);
3546 }
3547 
3548 /*
3549  * Given the I/O mode (FREAD or FWRITE), the vnode, the stateid and whether
3550  * the file is being truncated, return NFS4_OK if allowed or appropriate
3551  * V4 error if not. Note NFS4ERR_DELAY will be returned and a recall on
3552  * the associated file will be done if the I/O is not consistent with any
3553  * delegation in effect on the file. Should be holding VOP_RWLOCK, either
3554  * as reader or writer as appropriate. rfs4_op_open will acquire the
3555  * VOP_RWLOCK as writer when setting up delegation. If the stateid is bad
3556  * this routine will return NFS4ERR_BAD_STATEID. In addition, through the
3557  * deleg parameter, we will return whether a write delegation is held by
3558  * the client associated with this stateid.
3559  * If the server instance associated with the relevant client is in its
3560  * grace period, return NFS4ERR_GRACE.
3561  */
3562 
3563 nfsstat4
3564 rfs4_check_stateid(int mode, vnode_t *vp,
3565     stateid4 *stateid, bool_t trunc, bool_t *deleg,
3566     bool_t do_access, caller_context_t *ct)
3567 {
3568 	rfs4_file_t *fp;
3569 	bool_t create = FALSE;
3570 	rfs4_state_t *sp;
3571 	rfs4_deleg_state_t *dsp;
3572 	rfs4_lo_state_t *lsp;
3573 	stateid_t *id = (stateid_t *)stateid;
3574 	nfsstat4 stat = NFS4_OK;
3575 
3576 	if (ct != NULL) {
3577 		ct->cc_sysid = 0;
3578 		ct->cc_pid = 0;
3579 		ct->cc_caller_id = nfs4_srv_caller_id;
3580 		ct->cc_flags = CC_DONTBLOCK;
3581 	}
3582 
3583 	if (ISSPECIAL(stateid)) {
3584 		fp = rfs4_findfile(vp, NULL, &create);
3585 		if (fp == NULL)
3586 			return (NFS4_OK);
3587 		if (fp->rf_dinfo.rd_dtype == OPEN_DELEGATE_NONE) {
3588 			rfs4_file_rele(fp);
3589 			return (NFS4_OK);
3590 		}
3591 		if (mode == FWRITE ||
3592 		    fp->rf_dinfo.rd_dtype == OPEN_DELEGATE_WRITE) {
3593 			rfs4_recall_deleg(fp, trunc, NULL);
3594 			rfs4_file_rele(fp);
3595 			return (NFS4ERR_DELAY);
3596 		}
3597 		rfs4_file_rele(fp);
3598 		return (NFS4_OK);
3599 	} else {
3600 		stat = rfs4_get_all_state(stateid, &sp, &dsp, &lsp);
3601 		if (stat != NFS4_OK)
3602 			return (stat);
3603 		if (lsp != NULL) {
3604 			/* Is associated server instance in its grace period? */
3605 			if (rfs4_clnt_in_grace(lsp->rls_locker->rl_client)) {
3606 				rfs4_lo_state_rele(lsp, FALSE);
3607 				if (sp != NULL)
3608 					rfs4_state_rele_nounlock(sp);
3609 				return (NFS4ERR_GRACE);
3610 			}
3611 			if (id->bits.type == LOCKID) {
3612 				/* Seqid in the future? - that's bad */
3613 				if (lsp->rls_lockid.bits.chgseq <
3614 				    id->bits.chgseq) {
3615 					rfs4_lo_state_rele(lsp, FALSE);
3616 					if (sp != NULL)
3617 						rfs4_state_rele_nounlock(sp);
3618 					return (NFS4ERR_BAD_STATEID);
3619 				}
3620 				/* Seqid in the past? - that's old */
3621 				if (lsp->rls_lockid.bits.chgseq >
3622 				    id->bits.chgseq) {
3623 					rfs4_lo_state_rele(lsp, FALSE);
3624 					if (sp != NULL)
3625 						rfs4_state_rele_nounlock(sp);
3626 					return (NFS4ERR_OLD_STATEID);
3627 				}
3628 				/* Ensure specified filehandle matches */
3629 				if (lsp->rls_state->rs_finfo->rf_vp != vp) {
3630 					rfs4_lo_state_rele(lsp, FALSE);
3631 					if (sp != NULL)
3632 						rfs4_state_rele_nounlock(sp);
3633 					return (NFS4ERR_BAD_STATEID);
3634 				}
3635 			}
3636 			if (ct != NULL) {
3637 				ct->cc_sysid =
3638 				    lsp->rls_locker->rl_client->rc_sysidt;
3639 				ct->cc_pid = lsp->rls_locker->rl_pid;
3640 			}
3641 			rfs4_lo_state_rele(lsp, FALSE);
3642 		}
3643 
3644 		/* Stateid provided was an "open" stateid */
3645 		if (sp != NULL) {
3646 			/* Is associated server instance in its grace period? */
3647 			if (rfs4_clnt_in_grace(sp->rs_owner->ro_client)) {
3648 				rfs4_state_rele_nounlock(sp);
3649 				return (NFS4ERR_GRACE);
3650 			}
3651 			if (id->bits.type == OPENID) {
3652 				/* Seqid in the future? - that's bad */
3653 				if (sp->rs_stateid.bits.chgseq <
3654 				    id->bits.chgseq) {
3655 					rfs4_state_rele_nounlock(sp);
3656 					return (NFS4ERR_BAD_STATEID);
3657 				}
3658 				/* Seqid in the past - that's old */
3659 				if (sp->rs_stateid.bits.chgseq >
3660 				    id->bits.chgseq) {
3661 					rfs4_state_rele_nounlock(sp);
3662 					return (NFS4ERR_OLD_STATEID);
3663 				}
3664 			}
3665 			/* Ensure specified filehandle matches */
3666 			if (sp->rs_finfo->rf_vp != vp) {
3667 				rfs4_state_rele_nounlock(sp);
3668 				return (NFS4ERR_BAD_STATEID);
3669 			}
3670 
3671 			if (sp->rs_owner->ro_need_confirm) {
3672 				rfs4_state_rele_nounlock(sp);
3673 				return (NFS4ERR_BAD_STATEID);
3674 			}
3675 
3676 			if (sp->rs_closed == TRUE) {
3677 				rfs4_state_rele_nounlock(sp);
3678 				return (NFS4ERR_OLD_STATEID);
3679 			}
3680 
3681 			if (do_access)
3682 				stat = rfs4_state_has_access(sp, mode, vp);
3683 			else
3684 				stat = NFS4_OK;
3685 
3686 			/*
3687 			 * Return whether this state has write
3688 			 * delegation if desired
3689 			 */
3690 			if (deleg && (sp->rs_finfo->rf_dinfo.rd_dtype ==
3691 			    OPEN_DELEGATE_WRITE))
3692 				*deleg = TRUE;
3693 
3694 			/*
3695 			 * We got a valid stateid, so we update the
3696 			 * lease on the client. Ideally we would like
3697 			 * to do this after the calling op succeeds,
3698 			 * but for now this will be good
3699 			 * enough. Callers of this routine are
3700 			 * currently insulated from the state stuff.
3701 			 */
3702 			rfs4_update_lease(sp->rs_owner->ro_client);
3703 
3704 			/*
3705 			 * If a delegation is present on this file and
3706 			 * this is a WRITE, then update the lastwrite
3707 			 * time to indicate that activity is present.
3708 			 */
3709 			if (sp->rs_finfo->rf_dinfo.rd_dtype ==
3710 			    OPEN_DELEGATE_WRITE &&
3711 			    mode == FWRITE) {
3712 				sp->rs_finfo->rf_dinfo.rd_time_lastwrite =
3713 				    gethrestime_sec();
3714 			}
3715 
3716 			rfs4_state_rele_nounlock(sp);
3717 
3718 			return (stat);
3719 		}
3720 
3721 		if (dsp != NULL) {
3722 			/* Is associated server instance in its grace period? */
3723 			if (rfs4_clnt_in_grace(dsp->rds_client)) {
3724 				rfs4_deleg_state_rele(dsp);
3725 				return (NFS4ERR_GRACE);
3726 			}
3727 			if (dsp->rds_delegid.bits.chgseq != id->bits.chgseq) {
3728 				rfs4_deleg_state_rele(dsp);
3729 				return (NFS4ERR_BAD_STATEID);
3730 			}
3731 
3732 			/* Ensure specified filehandle matches */
3733 			if (dsp->rds_finfo->rf_vp != vp) {
3734 				rfs4_deleg_state_rele(dsp);
3735 				return (NFS4ERR_BAD_STATEID);
3736 			}
3737 			/*
3738 			 * Return whether this state has write
3739 			 * delegation if desired
3740 			 */
3741 			if (deleg && (dsp->rds_finfo->rf_dinfo.rd_dtype ==
3742 			    OPEN_DELEGATE_WRITE))
3743 				*deleg = TRUE;
3744 
3745 			rfs4_update_lease(dsp->rds_client);
3746 
3747 			/*
3748 			 * If a delegation is present on this file and
3749 			 * this is a WRITE, then update the lastwrite
3750 			 * time to indicate that activity is present.
3751 			 */
3752 			if (dsp->rds_finfo->rf_dinfo.rd_dtype ==
3753 			    OPEN_DELEGATE_WRITE && mode == FWRITE) {
3754 				dsp->rds_finfo->rf_dinfo.rd_time_lastwrite =
3755 				    gethrestime_sec();
3756 			}
3757 
3758 			/*
3759 			 * XXX - what happens if this is a WRITE and the
3760 			 * delegation type of for READ.
3761 			 */
3762 			rfs4_deleg_state_rele(dsp);
3763 
3764 			return (stat);
3765 		}
3766 		/*
3767 		 * If we got this far, something bad happened
3768 		 */
3769 		return (NFS4ERR_BAD_STATEID);
3770 	}
3771 }
3772 
3773 
3774 /*
3775  * This is a special function in that for the file struct provided the
3776  * server wants to remove/close all current state associated with the
3777  * file.  The prime use of this would be with OP_REMOVE to force the
3778  * release of state and particularly of file locks.
3779  *
3780  * There is an assumption that there is no delegations outstanding on
3781  * this file at this point.  The caller should have waited for those
3782  * to be returned or revoked.
3783  */
3784 void
3785 rfs4_close_all_state(rfs4_file_t *fp)
3786 {
3787 	rfs4_state_t *sp;
3788 
3789 	rfs4_dbe_lock(fp->rf_dbe);
3790 
3791 #ifdef DEBUG
3792 	/* only applies when server is handing out delegations */
3793 	if (rfs4_deleg_policy != SRV_NEVER_DELEGATE)
3794 		ASSERT(fp->rf_dinfo.rd_hold_grant > 0);
3795 #endif
3796 
3797 	/* No delegations for this file */
3798 	ASSERT(list_is_empty(&fp->rf_delegstatelist));
3799 
3800 	/* Make sure that it can not be found */
3801 	rfs4_dbe_invalidate(fp->rf_dbe);
3802 
3803 	if (fp->rf_vp == NULL) {
3804 		rfs4_dbe_unlock(fp->rf_dbe);
3805 		return;
3806 	}
3807 	rfs4_dbe_unlock(fp->rf_dbe);
3808 
3809 	/*
3810 	 * Hold as writer to prevent other server threads from
3811 	 * processing requests related to the file while all state is
3812 	 * being removed.
3813 	 */
3814 	rw_enter(&fp->rf_file_rwlock, RW_WRITER);
3815 
3816 	/* Remove ALL state from the file */
3817 	while (sp = rfs4_findstate_by_file(fp)) {
3818 		rfs4_state_close(sp, FALSE, FALSE, CRED());
3819 		rfs4_state_rele_nounlock(sp);
3820 	}
3821 
3822 	/*
3823 	 * This is only safe since there are no further references to
3824 	 * the file.
3825 	 */
3826 	rfs4_dbe_lock(fp->rf_dbe);
3827 	if (fp->rf_vp) {
3828 		vnode_t *vp = fp->rf_vp;
3829 
3830 		mutex_enter(&vp->v_vsd_lock);
3831 		(void) vsd_set(vp, nfs4_srv_vkey, NULL);
3832 		mutex_exit(&vp->v_vsd_lock);
3833 		VN_RELE(vp);
3834 		fp->rf_vp = NULL;
3835 	}
3836 	rfs4_dbe_unlock(fp->rf_dbe);
3837 
3838 	/* Finally let other references to proceed */
3839 	rw_exit(&fp->rf_file_rwlock);
3840 }
3841 
3842 /*
3843  * This function is used as a target for the rfs4_dbe_walk() call
3844  * below.  The purpose of this function is to see if the
3845  * lockowner_state refers to a file that resides within the exportinfo
3846  * export.  If so, then remove the lock_owner state (file locks and
3847  * share "locks") for this object since the intent is the server is
3848  * unexporting the specified directory.  Be sure to invalidate the
3849  * object after the state has been released
3850  */
3851 static void
3852 rfs4_lo_state_walk_callout(rfs4_entry_t u_entry, void *e)
3853 {
3854 	rfs4_lo_state_t *lsp = (rfs4_lo_state_t *)u_entry;
3855 	struct exportinfo *exi = (struct exportinfo *)e;
3856 	nfs_fh4_fmt_t   fhfmt4, *exi_fhp, *finfo_fhp;
3857 	fhandle_t *efhp;
3858 
3859 	efhp = (fhandle_t *)&exi->exi_fh;
3860 	exi_fhp = (nfs_fh4_fmt_t *)&fhfmt4;
3861 
3862 	FH_TO_FMT4(efhp, exi_fhp);
3863 
3864 	finfo_fhp = (nfs_fh4_fmt_t *)lsp->rls_state->rs_finfo->
3865 	    rf_filehandle.nfs_fh4_val;
3866 
3867 	if (EQFSID(&finfo_fhp->fh4_fsid, &exi_fhp->fh4_fsid) &&
3868 	    bcmp(&finfo_fhp->fh4_xdata, &exi_fhp->fh4_xdata,
3869 	    exi_fhp->fh4_xlen) == 0) {
3870 		rfs4_state_close(lsp->rls_state, FALSE, FALSE, CRED());
3871 		rfs4_dbe_invalidate(lsp->rls_dbe);
3872 		rfs4_dbe_invalidate(lsp->rls_state->rs_dbe);
3873 	}
3874 }
3875 
3876 /*
3877  * This function is used as a target for the rfs4_dbe_walk() call
3878  * below.  The purpose of this function is to see if the state refers
3879  * to a file that resides within the exportinfo export.  If so, then
3880  * remove the open state for this object since the intent is the
3881  * server is unexporting the specified directory.  The main result for
3882  * this type of entry is to invalidate it such it will not be found in
3883  * the future.
3884  */
3885 static void
3886 rfs4_state_walk_callout(rfs4_entry_t u_entry, void *e)
3887 {
3888 	rfs4_state_t *sp = (rfs4_state_t *)u_entry;
3889 	struct exportinfo *exi = (struct exportinfo *)e;
3890 	nfs_fh4_fmt_t   fhfmt4, *exi_fhp, *finfo_fhp;
3891 	fhandle_t *efhp;
3892 
3893 	efhp = (fhandle_t *)&exi->exi_fh;
3894 	exi_fhp = (nfs_fh4_fmt_t *)&fhfmt4;
3895 
3896 	FH_TO_FMT4(efhp, exi_fhp);
3897 
3898 	finfo_fhp =
3899 	    (nfs_fh4_fmt_t *)sp->rs_finfo->rf_filehandle.nfs_fh4_val;
3900 
3901 	if (EQFSID(&finfo_fhp->fh4_fsid, &exi_fhp->fh4_fsid) &&
3902 	    bcmp(&finfo_fhp->fh4_xdata, &exi_fhp->fh4_xdata,
3903 	    exi_fhp->fh4_xlen) == 0) {
3904 		rfs4_state_close(sp, TRUE, FALSE, CRED());
3905 		rfs4_dbe_invalidate(sp->rs_dbe);
3906 	}
3907 }
3908 
3909 /*
3910  * This function is used as a target for the rfs4_dbe_walk() call
3911  * below.  The purpose of this function is to see if the state refers
3912  * to a file that resides within the exportinfo export.  If so, then
3913  * remove the deleg state for this object since the intent is the
3914  * server is unexporting the specified directory.  The main result for
3915  * this type of entry is to invalidate it such it will not be found in
3916  * the future.
3917  */
3918 static void
3919 rfs4_deleg_state_walk_callout(rfs4_entry_t u_entry, void *e)
3920 {
3921 	rfs4_deleg_state_t *dsp = (rfs4_deleg_state_t *)u_entry;
3922 	struct exportinfo *exi = (struct exportinfo *)e;
3923 	nfs_fh4_fmt_t   fhfmt4, *exi_fhp, *finfo_fhp;
3924 	fhandle_t *efhp;
3925 
3926 	efhp = (fhandle_t *)&exi->exi_fh;
3927 	exi_fhp = (nfs_fh4_fmt_t *)&fhfmt4;
3928 
3929 	FH_TO_FMT4(efhp, exi_fhp);
3930 
3931 	finfo_fhp =
3932 	    (nfs_fh4_fmt_t *)dsp->rds_finfo->rf_filehandle.nfs_fh4_val;
3933 
3934 	if (EQFSID(&finfo_fhp->fh4_fsid, &exi_fhp->fh4_fsid) &&
3935 	    bcmp(&finfo_fhp->fh4_xdata, &exi_fhp->fh4_xdata,
3936 	    exi_fhp->fh4_xlen) == 0) {
3937 		rfs4_dbe_invalidate(dsp->rds_dbe);
3938 	}
3939 }
3940 
3941 /*
3942  * This function is used as a target for the rfs4_dbe_walk() call
3943  * below.  The purpose of this function is to see if the state refers
3944  * to a file that resides within the exportinfo export.  If so, then
3945  * release vnode hold for this object since the intent is the server
3946  * is unexporting the specified directory.  Invalidation will prevent
3947  * this struct from being found in the future.
3948  */
3949 static void
3950 rfs4_file_walk_callout(rfs4_entry_t u_entry, void *e)
3951 {
3952 	rfs4_file_t *fp = (rfs4_file_t *)u_entry;
3953 	struct exportinfo *exi = (struct exportinfo *)e;
3954 	nfs_fh4_fmt_t   fhfmt4, *exi_fhp, *finfo_fhp;
3955 	fhandle_t *efhp;
3956 
3957 	efhp = (fhandle_t *)&exi->exi_fh;
3958 	exi_fhp = (nfs_fh4_fmt_t *)&fhfmt4;
3959 
3960 	FH_TO_FMT4(efhp, exi_fhp);
3961 
3962 	finfo_fhp = (nfs_fh4_fmt_t *)fp->rf_filehandle.nfs_fh4_val;
3963 
3964 	if (EQFSID(&finfo_fhp->fh4_fsid, &exi_fhp->fh4_fsid) &&
3965 	    bcmp(&finfo_fhp->fh4_xdata, &exi_fhp->fh4_xdata,
3966 	    exi_fhp->fh4_xlen) == 0) {
3967 		if (fp->rf_vp) {
3968 			vnode_t *vp = fp->rf_vp;
3969 
3970 			/*
3971 			 * don't leak monitors and remove the reference
3972 			 * put on the vnode when the delegation was granted.
3973 			 */
3974 			if (fp->rf_dinfo.rd_dtype == OPEN_DELEGATE_READ) {
3975 				(void) fem_uninstall(vp, deleg_rdops,
3976 				    (void *)fp);
3977 				vn_open_downgrade(vp, FREAD);
3978 			} else if (fp->rf_dinfo.rd_dtype ==
3979 			    OPEN_DELEGATE_WRITE) {
3980 				(void) fem_uninstall(vp, deleg_wrops,
3981 				    (void *)fp);
3982 				vn_open_downgrade(vp, FREAD|FWRITE);
3983 			}
3984 			mutex_enter(&vp->v_vsd_lock);
3985 			(void) vsd_set(vp, nfs4_srv_vkey, NULL);
3986 			mutex_exit(&vp->v_vsd_lock);
3987 			VN_RELE(vp);
3988 			fp->rf_vp = NULL;
3989 		}
3990 		rfs4_dbe_invalidate(fp->rf_dbe);
3991 	}
3992 }
3993 
3994 /*
3995  * Given a directory that is being unexported, cleanup/release all
3996  * state in the server that refers to objects residing underneath this
3997  * particular export.  The ordering of the release is important.
3998  * Lock_owner, then state and then file.
3999  */
4000 void
4001 rfs4_clean_state_exi(struct exportinfo *exi)
4002 {
4003 	mutex_enter(&rfs4_state_lock);
4004 
4005 	if (rfs4_server_state == NULL) {
4006 		mutex_exit(&rfs4_state_lock);
4007 		return;
4008 	}
4009 
4010 	rfs4_dbe_walk(rfs4_lo_state_tab, rfs4_lo_state_walk_callout, exi);
4011 	rfs4_dbe_walk(rfs4_state_tab, rfs4_state_walk_callout, exi);
4012 	rfs4_dbe_walk(rfs4_deleg_state_tab, rfs4_deleg_state_walk_callout, exi);
4013 	rfs4_dbe_walk(rfs4_file_tab, rfs4_file_walk_callout, exi);
4014 
4015 	mutex_exit(&rfs4_state_lock);
4016 }
4017