1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  *
  25  *      Copyright (c) 1983,1984,1985,1986,1987,1988,1989  AT&T.
  26  *      All rights reserved.
  27  */
  28 
  29 /*
  30  * Node hash implementation initially borrowed from NFS (nfs_subr.c)
  31  * but then heavily modified. It's no longer an array of hash lists,
  32  * but an AVL tree per mount point.  More on this below.
  33  */
  34 
  35 #include <sys/param.h>
  36 #include <sys/systm.h>
  37 #include <sys/time.h>
  38 #include <sys/vnode.h>
  39 #include <sys/bitmap.h>
  40 #include <sys/dnlc.h>
  41 #include <sys/kmem.h>
  42 #include <sys/sunddi.h>
  43 #include <sys/sysmacros.h>
  44 
  45 #include <netsmb/smb_osdep.h>
  46 
  47 #include <netsmb/smb.h>
  48 #include <netsmb/smb_conn.h>
  49 #include <netsmb/smb_subr.h>
  50 #include <netsmb/smb_rq.h>
  51 
  52 #include <smbfs/smbfs.h>
  53 #include <smbfs/smbfs_node.h>
  54 #include <smbfs/smbfs_subr.h>
  55 
  56 /*
  57  * The AVL trees (now per-mount) allow finding an smbfs node by its
  58  * full remote path name.  It also allows easy traversal of all nodes
  59  * below (path wise) any given node.  A reader/writer lock for each
  60  * (per mount) AVL tree is used to control access and to synchronize
  61  * lookups, additions, and deletions from that AVL tree.
  62  *
  63  * Previously, this code use a global array of hash chains, each with
  64  * its own rwlock.  A few struct members, functions, and comments may
  65  * still refer to a "hash", and those should all now be considered to
  66  * refer to the per-mount AVL tree that replaced the old hash chains.
  67  * (i.e. member smi_hash_lk, function sn_hashfind, etc.)
  68  *
  69  * The smbnode freelist is organized as a doubly linked list with
  70  * a head pointer.  Additions and deletions are synchronized via
  71  * a single mutex.
  72  *
  73  * In order to add an smbnode to the free list, it must be linked into
  74  * the mount's AVL tree and the exclusive lock for the AVL must be held.
  75  * If an smbnode is not linked into the AVL tree, then it is destroyed
  76  * because it represents no valuable information that can be reused
  77  * about the file.  The exclusive lock for the AVL tree must be held
  78  * in order to prevent a lookup in the AVL tree from finding the
  79  * smbnode and using it and assuming that the smbnode is not on the
  80  * freelist.  The lookup in the AVL tree will have the AVL tree lock
  81  * held, either exclusive or shared.
  82  *
  83  * The vnode reference count for each smbnode is not allowed to drop
  84  * below 1.  This prevents external entities, such as the VM
  85  * subsystem, from acquiring references to vnodes already on the
  86  * freelist and then trying to place them back on the freelist
  87  * when their reference is released.  This means that the when an
  88  * smbnode is looked up in the AVL tree, then either the smbnode
  89  * is removed from the freelist and that reference is tranfered to
  90  * the new reference or the vnode reference count must be incremented
  91  * accordingly.  The mutex for the freelist must be held in order to
  92  * accurately test to see if the smbnode is on the freelist or not.
  93  * The AVL tree lock might be held shared and it is possible that
  94  * two different threads may race to remove the smbnode from the
  95  * freelist.  This race can be resolved by holding the mutex for the
  96  * freelist.  Please note that the mutex for the freelist does not
  97  * need to held if the smbnode is not on the freelist.  It can not be
  98  * placed on the freelist due to the requirement that the thread
  99  * putting the smbnode on the freelist must hold the exclusive lock
 100  * for the AVL tree and the thread doing the lookup in the AVL tree
 101  * is holding either a shared or exclusive lock for the AVL tree.
 102  *
 103  * The lock ordering is:
 104  *
 105  *      AVL tree lock -> vnode lock
 106  *      AVL tree lock -> freelist lock
 107  */
 108 
 109 static kmutex_t smbfreelist_lock;
 110 static smbnode_t *smbfreelist = NULL;
 111 static ulong_t  smbnodenew = 0;
 112 long    nsmbnode = 0;
 113 
 114 static struct kmem_cache *smbnode_cache;
 115 
 116 static const vsecattr_t smbfs_vsa0 = { 0 };
 117 
 118 /*
 119  * Mutex to protect the following variables:
 120  *      smbfs_major
 121  *      smbfs_minor
 122  */
 123 kmutex_t smbfs_minor_lock;
 124 int smbfs_major;
 125 int smbfs_minor;
 126 
 127 /* See smbfs_node_findcreate() */
 128 struct smbfattr smbfs_fattr0;
 129 
 130 /*
 131  * Local functions.
 132  * SN for Smb Node
 133  */
 134 static void sn_rmfree(smbnode_t *);
 135 static void sn_inactive(smbnode_t *);
 136 static void sn_addhash_locked(smbnode_t *, avl_index_t);
 137 static void sn_rmhash_locked(smbnode_t *);
 138 static void sn_destroy_node(smbnode_t *);
 139 void smbfs_kmem_reclaim(void *cdrarg);
 140 
 141 static smbnode_t *
 142 sn_hashfind(smbmntinfo_t *, const char *, int, avl_index_t *);
 143 
 144 static smbnode_t *
 145 make_smbnode(smbmntinfo_t *, const char *, int, int *);
 146 
 147 /*
 148  * Free the resources associated with an smbnode.
 149  * Note: This is different from smbfs_inactive
 150  *
 151  * NFS: nfs_subr.c:rinactive
 152  */
 153 static void
 154 sn_inactive(smbnode_t *np)
 155 {
 156         vsecattr_t      ovsa;
 157         cred_t          *oldcr;
 158         char            *orpath;
 159         int             orplen;
 160 
 161         /*
 162          * Flush and invalidate all pages (todo)
 163          * Free any held credentials and caches...
 164          * etc.  (See NFS code)
 165          */
 166         mutex_enter(&np->r_statelock);
 167 
 168         ovsa = np->r_secattr;
 169         np->r_secattr = smbfs_vsa0;
 170         np->r_sectime = 0;
 171 
 172         oldcr = np->r_cred;
 173         np->r_cred = NULL;
 174 
 175         orpath = np->n_rpath;
 176         orplen = np->n_rplen;
 177         np->n_rpath = NULL;
 178         np->n_rplen = 0;
 179 
 180         mutex_exit(&np->r_statelock);
 181 
 182         if (ovsa.vsa_aclentp != NULL)
 183                 kmem_free(ovsa.vsa_aclentp, ovsa.vsa_aclentsz);
 184 
 185         if (oldcr != NULL)
 186                 crfree(oldcr);
 187 
 188         if (orpath != NULL)
 189                 kmem_free(orpath, orplen + 1);
 190 }
 191 
 192 /*
 193  * Find and optionally create an smbnode for the passed
 194  * mountinfo, directory, separator, and name.  If the
 195  * desired smbnode already exists, return a reference.
 196  * If the file attributes pointer is non-null, the node
 197  * is created if necessary and linked into the AVL tree.
 198  *
 199  * Callers that need a node created but don't have the
 200  * real attributes pass smbfs_fattr0 to force creation.
 201  *
 202  * Note: make_smbnode() may upgrade the "hash" lock to exclusive.
 203  *
 204  * NFS: nfs_subr.c:makenfsnode
 205  */
 206 smbnode_t *
 207 smbfs_node_findcreate(
 208         smbmntinfo_t *mi,
 209         const char *dirnm,
 210         int dirlen,
 211         const char *name,
 212         int nmlen,
 213         char sep,
 214         struct smbfattr *fap)
 215 {
 216         char tmpbuf[256];
 217         size_t rpalloc;
 218         char *p, *rpath;
 219         int rplen;
 220         smbnode_t *np;
 221         vnode_t *vp;
 222         int newnode;
 223 
 224         /*
 225          * Build the search string, either in tmpbuf or
 226          * in allocated memory if larger than tmpbuf.
 227          */
 228         rplen = dirlen;
 229         if (sep != '\0')
 230                 rplen++;
 231         rplen += nmlen;
 232         if (rplen < sizeof (tmpbuf)) {
 233                 /* use tmpbuf */
 234                 rpalloc = 0;
 235                 rpath = tmpbuf;
 236         } else {
 237                 rpalloc = rplen + 1;
 238                 rpath = kmem_alloc(rpalloc, KM_SLEEP);
 239         }
 240         p = rpath;
 241         bcopy(dirnm, p, dirlen);
 242         p += dirlen;
 243         if (sep != '\0')
 244                 *p++ = sep;
 245         if (name != NULL) {
 246                 bcopy(name, p, nmlen);
 247                 p += nmlen;
 248         }
 249         ASSERT(p == rpath + rplen);
 250 
 251         /*
 252          * Find or create a node with this path.
 253          */
 254         rw_enter(&mi->smi_hash_lk, RW_READER);
 255         if (fap == NULL)
 256                 np = sn_hashfind(mi, rpath, rplen, NULL);
 257         else
 258                 np = make_smbnode(mi, rpath, rplen, &newnode);
 259         rw_exit(&mi->smi_hash_lk);
 260 
 261         if (rpalloc)
 262                 kmem_free(rpath, rpalloc);
 263 
 264         if (fap == NULL) {
 265                 /*
 266                  * Caller is "just looking" (no create)
 267                  * so np may or may not be NULL here.
 268                  * Either way, we're done.
 269                  */
 270                 return (np);
 271         }
 272 
 273         /*
 274          * We should have a node, possibly created.
 275          * Do we have (real) attributes to apply?
 276          */
 277         ASSERT(np != NULL);
 278         if (fap == &smbfs_fattr0)
 279                 return (np);
 280 
 281         /*
 282          * Apply the given attributes to this node,
 283          * dealing with any cache impact, etc.
 284          */
 285         vp = SMBTOV(np);
 286         if (!newnode) {
 287                 /*
 288                  * Found an existing node.
 289                  * Maybe purge caches...
 290                  */
 291                 smbfs_cache_check(vp, fap);
 292         }
 293         smbfs_attrcache_fa(vp, fap);
 294 
 295         /*
 296          * Note NFS sets vp->v_type here, assuming it
 297          * can never change for the life of a node.
 298          * We allow v_type to change, and set it in
 299          * smbfs_attrcache().  Also: mode, uid, gid
 300          */
 301         return (np);
 302 }
 303 
 304 /*
 305  * NFS: nfs_subr.c:rtablehash
 306  * We use smbfs_hash().
 307  */
 308 
 309 /*
 310  * Find or create an smbnode.
 311  * NFS: nfs_subr.c:make_rnode
 312  */
 313 static smbnode_t *
 314 make_smbnode(
 315         smbmntinfo_t *mi,
 316         const char *rpath,
 317         int rplen,
 318         int *newnode)
 319 {
 320         smbnode_t *np;
 321         smbnode_t *tnp;
 322         vnode_t *vp;
 323         vfs_t *vfsp;
 324         avl_index_t where;
 325         char *new_rpath = NULL;
 326 
 327         ASSERT(RW_READ_HELD(&mi->smi_hash_lk));
 328         vfsp = mi->smi_vfsp;
 329 
 330 start:
 331         np = sn_hashfind(mi, rpath, rplen, NULL);
 332         if (np != NULL) {
 333                 *newnode = 0;
 334                 return (np);
 335         }
 336 
 337         /* Note: will retake this lock below. */
 338         rw_exit(&mi->smi_hash_lk);
 339 
 340         /*
 341          * see if we can find something on the freelist
 342          */
 343         mutex_enter(&smbfreelist_lock);
 344         if (smbfreelist != NULL && smbnodenew >= nsmbnode) {
 345                 np = smbfreelist;
 346                 sn_rmfree(np);
 347                 mutex_exit(&smbfreelist_lock);
 348 
 349                 vp = SMBTOV(np);
 350 
 351                 if (np->r_flags & RHASHED) {
 352                         smbmntinfo_t *tmp_mi = np->n_mount;
 353                         ASSERT(tmp_mi != NULL);
 354                         rw_enter(&tmp_mi->smi_hash_lk, RW_WRITER);
 355                         mutex_enter(&vp->v_lock);
 356                         if (vp->v_count > 1) {
 357                                 vp->v_count--;
 358                                 mutex_exit(&vp->v_lock);
 359                                 rw_exit(&tmp_mi->smi_hash_lk);
 360                                 /* start over */
 361                                 rw_enter(&mi->smi_hash_lk, RW_READER);
 362                                 goto start;
 363                         }
 364                         mutex_exit(&vp->v_lock);
 365                         sn_rmhash_locked(np);
 366                         rw_exit(&tmp_mi->smi_hash_lk);
 367                 }
 368 
 369                 sn_inactive(np);
 370 
 371                 mutex_enter(&vp->v_lock);
 372                 if (vp->v_count > 1) {
 373                         vp->v_count--;
 374                         mutex_exit(&vp->v_lock);
 375                         rw_enter(&mi->smi_hash_lk, RW_READER);
 376                         goto start;
 377                 }
 378                 mutex_exit(&vp->v_lock);
 379                 vn_invalid(vp);
 380                 /*
 381                  * destroy old locks before bzero'ing and
 382                  * recreating the locks below.
 383                  */
 384                 smbfs_rw_destroy(&np->r_rwlock);
 385                 smbfs_rw_destroy(&np->r_lkserlock);
 386                 mutex_destroy(&np->r_statelock);
 387                 cv_destroy(&np->r_cv);
 388                 /*
 389                  * Make sure that if smbnode is recycled then
 390                  * VFS count is decremented properly before
 391                  * reuse.
 392                  */
 393                 VFS_RELE(vp->v_vfsp);
 394                 vn_reinit(vp);
 395         } else {
 396                 /*
 397                  * allocate and initialize a new smbnode
 398                  */
 399                 vnode_t *new_vp;
 400 
 401                 mutex_exit(&smbfreelist_lock);
 402 
 403                 np = kmem_cache_alloc(smbnode_cache, KM_SLEEP);
 404                 new_vp = vn_alloc(KM_SLEEP);
 405 
 406                 atomic_inc_ulong((ulong_t *)&smbnodenew);
 407                 vp = new_vp;
 408         }
 409 
 410         /*
 411          * Allocate and copy the rpath we'll need below.
 412          */
 413         new_rpath = kmem_alloc(rplen + 1, KM_SLEEP);
 414         bcopy(rpath, new_rpath, rplen);
 415         new_rpath[rplen] = '\0';
 416 
 417         /* Initialize smbnode_t */
 418         bzero(np, sizeof (*np));
 419 
 420         smbfs_rw_init(&np->r_rwlock, NULL, RW_DEFAULT, NULL);
 421         smbfs_rw_init(&np->r_lkserlock, NULL, RW_DEFAULT, NULL);
 422         mutex_init(&np->r_statelock, NULL, MUTEX_DEFAULT, NULL);
 423         cv_init(&np->r_cv, NULL, CV_DEFAULT, NULL);
 424         /* cv_init(&np->r_commit.c_cv, NULL, CV_DEFAULT, NULL); */
 425 
 426         np->r_vnode = vp;
 427         np->n_mount = mi;
 428 
 429         np->n_fid = SMB_FID_UNUSED;
 430         np->n_uid = mi->smi_uid;
 431         np->n_gid = mi->smi_gid;
 432         /* Leave attributes "stale." */
 433 
 434 #if 0 /* XXX dircache */
 435         /*
 436          * We don't know if it's a directory yet.
 437          * Let the caller do this?  XXX
 438          */
 439         avl_create(&np->r_dir, compar, sizeof (rddir_cache),
 440             offsetof(rddir_cache, tree));
 441 #endif
 442 
 443         /* Now fill in the vnode. */
 444         vn_setops(vp, smbfs_vnodeops);
 445         vp->v_data = (caddr_t)np;
 446         VFS_HOLD(vfsp);
 447         vp->v_vfsp = vfsp;
 448         vp->v_type = VNON;
 449 
 450         /*
 451          * We entered with mi->smi_hash_lk held (reader).
 452          * Retake it now, (as the writer).
 453          * Will return with it held.
 454          */
 455         rw_enter(&mi->smi_hash_lk, RW_WRITER);
 456 
 457         /*
 458          * There is a race condition where someone else
 459          * may alloc the smbnode while no locks are held,
 460          * so check again and recover if found.
 461          */
 462         tnp = sn_hashfind(mi, rpath, rplen, &where);
 463         if (tnp != NULL) {
 464                 /*
 465                  * Lost the race.  Put the node we were building
 466                  * on the free list and return the one we found.
 467                  */
 468                 rw_exit(&mi->smi_hash_lk);
 469                 kmem_free(new_rpath, rplen + 1);
 470                 smbfs_addfree(np);
 471                 rw_enter(&mi->smi_hash_lk, RW_READER);
 472                 *newnode = 0;
 473                 return (tnp);
 474         }
 475 
 476         /*
 477          * Hash search identifies nodes by the remote path
 478          * (n_rpath) so fill that in now, before linking
 479          * this node into the node cache (AVL tree).
 480          */
 481         np->n_rpath = new_rpath;
 482         np->n_rplen = rplen;
 483         np->n_ino = smbfs_gethash(new_rpath, rplen);
 484 
 485         sn_addhash_locked(np, where);
 486         *newnode = 1;
 487         return (np);
 488 }
 489 
 490 /*
 491  * smbfs_addfree
 492  * Put an smbnode on the free list, or destroy it immediately
 493  * if it offers no value were it to be reclaimed later.  Also
 494  * destroy immediately when we have too many smbnodes, etc.
 495  *
 496  * Normally called by smbfs_inactive, but also
 497  * called in here during cleanup operations.
 498  *
 499  * NFS: nfs_subr.c:rp_addfree
 500  */
 501 void
 502 smbfs_addfree(smbnode_t *np)
 503 {
 504         vnode_t *vp;
 505         struct vfs *vfsp;
 506         smbmntinfo_t *mi;
 507 
 508         ASSERT(np->r_freef == NULL && np->r_freeb == NULL);
 509 
 510         vp = SMBTOV(np);
 511         ASSERT(vp->v_count >= 1);
 512 
 513         vfsp = vp->v_vfsp;
 514         mi = VFTOSMI(vfsp);
 515 
 516         /*
 517          * If there are no more references to this smbnode and:
 518          * we have too many smbnodes allocated, or if the node
 519          * is no longer accessible via the AVL tree (!RHASHED),
 520          * or an i/o error occurred while writing to the file,
 521          * or it's part of an unmounted FS, then try to destroy
 522          * it instead of putting it on the smbnode freelist.
 523          */
 524         if (np->r_count == 0 && (
 525             (np->r_flags & RHASHED) == 0 ||
 526             (np->r_error != 0) ||
 527             (vfsp->vfs_flag & VFS_UNMOUNTED) ||
 528             (smbnodenew > nsmbnode))) {
 529 
 530                 /* Try to destroy this node. */
 531 
 532                 if (np->r_flags & RHASHED) {
 533                         rw_enter(&mi->smi_hash_lk, RW_WRITER);
 534                         mutex_enter(&vp->v_lock);
 535                         if (vp->v_count > 1) {
 536                                 vp->v_count--;
 537                                 mutex_exit(&vp->v_lock);
 538                                 rw_exit(&mi->smi_hash_lk);
 539                                 return;
 540                                 /*
 541                                  * Will get another call later,
 542                                  * via smbfs_inactive.
 543                                  */
 544                         }
 545                         mutex_exit(&vp->v_lock);
 546                         sn_rmhash_locked(np);
 547                         rw_exit(&mi->smi_hash_lk);
 548                 }
 549 
 550                 sn_inactive(np);
 551 
 552                 /*
 553                  * Recheck the vnode reference count.  We need to
 554                  * make sure that another reference has not been
 555                  * acquired while we were not holding v_lock.  The
 556                  * smbnode is not in the smbnode "hash" AVL tree, so
 557                  * the only way for a reference to have been acquired
 558                  * is for a VOP_PUTPAGE because the smbnode was marked
 559                  * with RDIRTY or for a modified page.  This vnode
 560                  * reference may have been acquired before our call
 561                  * to sn_inactive.  The i/o may have been completed,
 562                  * thus allowing sn_inactive to complete, but the
 563                  * reference to the vnode may not have been released
 564                  * yet.  In any case, the smbnode can not be destroyed
 565                  * until the other references to this vnode have been
 566                  * released.  The other references will take care of
 567                  * either destroying the smbnode or placing it on the
 568                  * smbnode freelist.  If there are no other references,
 569                  * then the smbnode may be safely destroyed.
 570                  */
 571                 mutex_enter(&vp->v_lock);
 572                 if (vp->v_count > 1) {
 573                         vp->v_count--;
 574                         mutex_exit(&vp->v_lock);
 575                         return;
 576                 }
 577                 mutex_exit(&vp->v_lock);
 578 
 579                 sn_destroy_node(np);
 580                 return;
 581         }
 582 
 583         /*
 584          * Lock the AVL tree and then recheck the reference count
 585          * to ensure that no other threads have acquired a reference
 586          * to indicate that the smbnode should not be placed on the
 587          * freelist.  If another reference has been acquired, then
 588          * just release this one and let the other thread complete
 589          * the processing of adding this smbnode to the freelist.
 590          */
 591         rw_enter(&mi->smi_hash_lk, RW_WRITER);
 592 
 593         mutex_enter(&vp->v_lock);
 594         if (vp->v_count > 1) {
 595                 vp->v_count--;
 596                 mutex_exit(&vp->v_lock);
 597                 rw_exit(&mi->smi_hash_lk);
 598                 return;
 599         }
 600         mutex_exit(&vp->v_lock);
 601 
 602         /*
 603          * Put this node on the free list.
 604          */
 605         mutex_enter(&smbfreelist_lock);
 606         if (smbfreelist == NULL) {
 607                 np->r_freef = np;
 608                 np->r_freeb = np;
 609                 smbfreelist = np;
 610         } else {
 611                 np->r_freef = smbfreelist;
 612                 np->r_freeb = smbfreelist->r_freeb;
 613                 smbfreelist->r_freeb->r_freef = np;
 614                 smbfreelist->r_freeb = np;
 615         }
 616         mutex_exit(&smbfreelist_lock);
 617 
 618         rw_exit(&mi->smi_hash_lk);
 619 }
 620 
 621 /*
 622  * Remove an smbnode from the free list.
 623  *
 624  * The caller must be holding smbfreelist_lock and the smbnode
 625  * must be on the freelist.
 626  *
 627  * NFS: nfs_subr.c:rp_rmfree
 628  */
 629 static void
 630 sn_rmfree(smbnode_t *np)
 631 {
 632 
 633         ASSERT(MUTEX_HELD(&smbfreelist_lock));
 634         ASSERT(np->r_freef != NULL && np->r_freeb != NULL);
 635 
 636         if (np == smbfreelist) {
 637                 smbfreelist = np->r_freef;
 638                 if (np == smbfreelist)
 639                         smbfreelist = NULL;
 640         }
 641 
 642         np->r_freeb->r_freef = np->r_freef;
 643         np->r_freef->r_freeb = np->r_freeb;
 644 
 645         np->r_freef = np->r_freeb = NULL;
 646 }
 647 
 648 /*
 649  * Put an smbnode in the "hash" AVL tree.
 650  *
 651  * The caller must be hold the rwlock as writer.
 652  *
 653  * NFS: nfs_subr.c:rp_addhash
 654  */
 655 static void
 656 sn_addhash_locked(smbnode_t *np, avl_index_t where)
 657 {
 658         smbmntinfo_t *mi = np->n_mount;
 659 
 660         ASSERT(RW_WRITE_HELD(&mi->smi_hash_lk));
 661         ASSERT(!(np->r_flags & RHASHED));
 662 
 663         avl_insert(&mi->smi_hash_avl, np, where);
 664 
 665         mutex_enter(&np->r_statelock);
 666         np->r_flags |= RHASHED;
 667         mutex_exit(&np->r_statelock);
 668 }
 669 
 670 /*
 671  * Remove an smbnode from the "hash" AVL tree.
 672  *
 673  * The caller must hold the rwlock as writer.
 674  *
 675  * NFS: nfs_subr.c:rp_rmhash_locked
 676  */
 677 static void
 678 sn_rmhash_locked(smbnode_t *np)
 679 {
 680         smbmntinfo_t *mi = np->n_mount;
 681 
 682         ASSERT(RW_WRITE_HELD(&mi->smi_hash_lk));
 683         ASSERT(np->r_flags & RHASHED);
 684 
 685         avl_remove(&mi->smi_hash_avl, np);
 686 
 687         mutex_enter(&np->r_statelock);
 688         np->r_flags &= ~RHASHED;
 689         mutex_exit(&np->r_statelock);
 690 }
 691 
 692 /*
 693  * Remove an smbnode from the "hash" AVL tree.
 694  *
 695  * The caller must not be holding the rwlock.
 696  */
 697 void
 698 smbfs_rmhash(smbnode_t *np)
 699 {
 700         smbmntinfo_t *mi = np->n_mount;
 701 
 702         rw_enter(&mi->smi_hash_lk, RW_WRITER);
 703         sn_rmhash_locked(np);
 704         rw_exit(&mi->smi_hash_lk);
 705 }
 706 
 707 /*
 708  * Lookup an smbnode by remote pathname
 709  *
 710  * The caller must be holding the AVL rwlock, either shared or exclusive.
 711  *
 712  * NFS: nfs_subr.c:rfind
 713  */
 714 static smbnode_t *
 715 sn_hashfind(
 716         smbmntinfo_t *mi,
 717         const char *rpath,
 718         int rplen,
 719         avl_index_t *pwhere) /* optional */
 720 {
 721         smbfs_node_hdr_t nhdr;
 722         smbnode_t *np;
 723         vnode_t *vp;
 724 
 725         ASSERT(RW_LOCK_HELD(&mi->smi_hash_lk));
 726 
 727         bzero(&nhdr, sizeof (nhdr));
 728         nhdr.hdr_n_rpath = (char *)rpath;
 729         nhdr.hdr_n_rplen = rplen;
 730 
 731         /* See smbfs_node_cmp below. */
 732         np = avl_find(&mi->smi_hash_avl, &nhdr, pwhere);
 733 
 734         if (np == NULL)
 735                 return (NULL);
 736 
 737         /*
 738          * Found it in the "hash" AVL tree.
 739          * Remove from free list, if necessary.
 740          */
 741         vp = SMBTOV(np);
 742         if (np->r_freef != NULL) {
 743                 mutex_enter(&smbfreelist_lock);
 744                 /*
 745                  * If the smbnode is on the freelist,
 746                  * then remove it and use that reference
 747                  * as the new reference.  Otherwise,
 748                  * need to increment the reference count.
 749                  */
 750                 if (np->r_freef != NULL) {
 751                         sn_rmfree(np);
 752                         mutex_exit(&smbfreelist_lock);
 753                 } else {
 754                         mutex_exit(&smbfreelist_lock);
 755                         VN_HOLD(vp);
 756                 }
 757         } else
 758                 VN_HOLD(vp);
 759 
 760         return (np);
 761 }
 762 
 763 static int
 764 smbfs_node_cmp(const void *va, const void *vb)
 765 {
 766         const smbfs_node_hdr_t *a = va;
 767         const smbfs_node_hdr_t *b = vb;
 768         int clen, diff;
 769 
 770         /*
 771          * Same semantics as strcmp, but does not
 772          * assume the strings are null terminated.
 773          */
 774         clen = (a->hdr_n_rplen < b->hdr_n_rplen) ?
 775             a->hdr_n_rplen : b->hdr_n_rplen;
 776         diff = strncmp(a->hdr_n_rpath, b->hdr_n_rpath, clen);
 777         if (diff < 0)
 778                 return (-1);
 779         if (diff > 0)
 780                 return (1);
 781         /* they match through clen */
 782         if (b->hdr_n_rplen > clen)
 783                 return (-1);
 784         if (a->hdr_n_rplen > clen)
 785                 return (1);
 786         return (0);
 787 }
 788 
 789 /*
 790  * Setup the "hash" AVL tree used for our node cache.
 791  * See: smbfs_mount, smbfs_destroy_table.
 792  */
 793 void
 794 smbfs_init_hash_avl(avl_tree_t *avl)
 795 {
 796         avl_create(avl, smbfs_node_cmp, sizeof (smbnode_t),
 797             offsetof(smbnode_t, r_avl_node));
 798 }
 799 
 800 /*
 801  * Invalidate the cached attributes for all nodes "under" the
 802  * passed-in node.  Note: the passed-in node is NOT affected by
 803  * this call.  This is used both for files under some directory
 804  * after the directory is deleted or renamed, and for extended
 805  * attribute files (named streams) under a plain file after that
 806  * file is renamed or deleted.
 807  *
 808  * Do this by walking the AVL tree starting at the passed in node,
 809  * and continuing while the visited nodes have a path prefix matching
 810  * the entire path of the passed-in node, and a separator just after
 811  * that matching path prefix.  Watch out for cases where the AVL tree
 812  * order may not exactly match the order of an FS walk, i.e.
 813  * consider this sequence:
 814  *      "foo"           (directory)
 815  *      "foo bar"       (name containing a space)
 816  *      "foo/bar"
 817  * The walk needs to skip "foo bar" and keep going until it finds
 818  * something that doesn't match the "foo" name prefix.
 819  */
 820 void
 821 smbfs_attrcache_prune(smbnode_t *top_np)
 822 {
 823         smbmntinfo_t *mi;
 824         smbnode_t *np;
 825         char *rpath;
 826         int rplen;
 827 
 828         mi = top_np->n_mount;
 829         rw_enter(&mi->smi_hash_lk, RW_READER);
 830 
 831         np = top_np;
 832         rpath = top_np->n_rpath;
 833         rplen = top_np->n_rplen;
 834         for (;;) {
 835                 np = avl_walk(&mi->smi_hash_avl, np, AVL_AFTER);
 836                 if (np == NULL)
 837                         break;
 838                 if (np->n_rplen < rplen)
 839                         break;
 840                 if (0 != strncmp(np->n_rpath, rpath, rplen))
 841                         break;
 842                 if (np->n_rplen > rplen && (
 843                     np->n_rpath[rplen] == ':' ||
 844                     np->n_rpath[rplen] == '\\'))
 845                         smbfs_attrcache_remove(np);
 846         }
 847 
 848         rw_exit(&mi->smi_hash_lk);
 849 }
 850 
 851 #ifdef SMB_VNODE_DEBUG
 852 int smbfs_check_table_debug = 1;
 853 #else /* SMB_VNODE_DEBUG */
 854 int smbfs_check_table_debug = 0;
 855 #endif /* SMB_VNODE_DEBUG */
 856 
 857 
 858 /*
 859  * Return 1 if there is a active vnode belonging to this vfs in the
 860  * smbnode cache.
 861  *
 862  * Several of these checks are done without holding the usual
 863  * locks.  This is safe because destroy_smbtable(), smbfs_addfree(),
 864  * etc. will redo the necessary checks before actually destroying
 865  * any smbnodes.
 866  *
 867  * NFS: nfs_subr.c:check_rtable
 868  *
 869  * Debugging changes here relative to NFS.
 870  * Relatively harmless, so left 'em in.
 871  */
 872 int
 873 smbfs_check_table(struct vfs *vfsp, smbnode_t *rtnp)
 874 {
 875         smbmntinfo_t *mi;
 876         smbnode_t *np;
 877         vnode_t *vp;
 878         int busycnt = 0;
 879 
 880         mi = VFTOSMI(vfsp);
 881         rw_enter(&mi->smi_hash_lk, RW_READER);
 882         for (np = avl_first(&mi->smi_hash_avl); np != NULL;
 883             np = avl_walk(&mi->smi_hash_avl, np, AVL_AFTER)) {
 884 
 885                 if (np == rtnp)
 886                         continue; /* skip the root */
 887                 vp = SMBTOV(np);
 888 
 889                 /* Now the 'busy' checks: */
 890                 /* Not on the free list? */
 891                 if (np->r_freef == NULL) {
 892                         SMBVDEBUG("!r_freef: node=0x%p, rpath=%s\n",
 893                             (void *)np, np->n_rpath);
 894                         busycnt++;
 895                 }
 896 
 897                 /* Has dirty pages? */
 898                 if (vn_has_cached_data(vp) &&
 899                     (np->r_flags & RDIRTY)) {
 900                         SMBVDEBUG("is dirty: node=0x%p, rpath=%s\n",
 901                             (void *)np, np->n_rpath);
 902                         busycnt++;
 903                 }
 904 
 905                 /* Other refs? (not reflected in v_count) */
 906                 if (np->r_count > 0) {
 907                         SMBVDEBUG("+r_count: node=0x%p, rpath=%s\n",
 908                             (void *)np, np->n_rpath);
 909                         busycnt++;
 910                 }
 911 
 912                 if (busycnt && !smbfs_check_table_debug)
 913                         break;
 914 
 915         }
 916         rw_exit(&mi->smi_hash_lk);
 917 
 918         return (busycnt);
 919 }
 920 
 921 /*
 922  * Destroy inactive vnodes from the AVL tree which belong to this
 923  * vfs.  It is essential that we destroy all inactive vnodes during a
 924  * forced unmount as well as during a normal unmount.
 925  *
 926  * NFS: nfs_subr.c:destroy_rtable
 927  *
 928  * In here, we're normally destrying all or most of the AVL tree,
 929  * so the natural choice is to use avl_destroy_nodes.  However,
 930  * there may be a few busy nodes that should remain in the AVL
 931  * tree when we're done.  The solution: use a temporary tree to
 932  * hold the busy nodes until we're done destroying the old tree,
 933  * then copy the temporary tree over the (now emtpy) real tree.
 934  */
 935 void
 936 smbfs_destroy_table(struct vfs *vfsp)
 937 {
 938         avl_tree_t tmp_avl;
 939         smbmntinfo_t *mi;
 940         smbnode_t *np;
 941         smbnode_t *rlist;
 942         void *v;
 943 
 944         mi = VFTOSMI(vfsp);
 945         rlist = NULL;
 946         smbfs_init_hash_avl(&tmp_avl);
 947 
 948         rw_enter(&mi->smi_hash_lk, RW_WRITER);
 949         v = NULL;
 950         while ((np = avl_destroy_nodes(&mi->smi_hash_avl, &v)) != NULL) {
 951 
 952                 mutex_enter(&smbfreelist_lock);
 953                 if (np->r_freef == NULL) {
 954                         /*
 955                          * Busy node (not on the free list).
 956                          * Will keep in the final AVL tree.
 957                          */
 958                         mutex_exit(&smbfreelist_lock);
 959                         avl_add(&tmp_avl, np);
 960                 } else {
 961                         /*
 962                          * It's on the free list.  Remove and
 963                          * arrange for it to be destroyed.
 964                          */
 965                         sn_rmfree(np);
 966                         mutex_exit(&smbfreelist_lock);
 967 
 968                         /*
 969                          * Last part of sn_rmhash_locked().
 970                          * NB: avl_destroy_nodes has already
 971                          * removed this from the "hash" AVL.
 972                          */
 973                         mutex_enter(&np->r_statelock);
 974                         np->r_flags &= ~RHASHED;
 975                         mutex_exit(&np->r_statelock);
 976 
 977                         /*
 978                          * Add to the list of nodes to destroy.
 979                          * Borrowing avl_child[0] for this list.
 980                          */
 981                         np->r_avl_node.avl_child[0] =
 982                             (struct avl_node *)rlist;
 983                         rlist = np;
 984                 }
 985         }
 986         avl_destroy(&mi->smi_hash_avl);
 987 
 988         /*
 989          * Replace the (now destroyed) "hash" AVL with the
 990          * temporary AVL, which restores the busy nodes.
 991          */
 992         mi->smi_hash_avl = tmp_avl;
 993         rw_exit(&mi->smi_hash_lk);
 994 
 995         /*
 996          * Now destroy the nodes on our temporary list (rlist).
 997          * This call to smbfs_addfree will end up destroying the
 998          * smbnode, but in a safe way with the appropriate set
 999          * of checks done.
1000          */
1001         while ((np = rlist) != NULL) {
1002                 rlist = (smbnode_t *)np->r_avl_node.avl_child[0];
1003                 smbfs_addfree(np);
1004         }
1005 }
1006 
1007 /*
1008  * This routine destroys all the resources associated with the smbnode
1009  * and then the smbnode itself.  Note: sn_inactive has been called.
1010  *
1011  * NFS: nfs_subr.c:destroy_rnode
1012  */
1013 static void
1014 sn_destroy_node(smbnode_t *np)
1015 {
1016         vnode_t *vp;
1017         vfs_t *vfsp;
1018 
1019         vp = SMBTOV(np);
1020         vfsp = vp->v_vfsp;
1021 
1022         ASSERT(vp->v_count == 1);
1023         ASSERT(np->r_count == 0);
1024         ASSERT(np->r_mapcnt == 0);
1025         ASSERT(np->r_secattr.vsa_aclentp == NULL);
1026         ASSERT(np->r_cred == NULL);
1027         ASSERT(np->n_rpath == NULL);
1028         ASSERT(!(np->r_flags & RHASHED));
1029         ASSERT(np->r_freef == NULL && np->r_freeb == NULL);
1030         atomic_dec_ulong((ulong_t *)&smbnodenew);
1031         vn_invalid(vp);
1032         vn_free(vp);
1033         kmem_cache_free(smbnode_cache, np);
1034         VFS_RELE(vfsp);
1035 }
1036 
1037 /*
1038  * Flush all vnodes in this (or every) vfs.
1039  * Used by nfs_sync and by nfs_unmount.
1040  */
1041 /*ARGSUSED*/
1042 void
1043 smbfs_rflush(struct vfs *vfsp, cred_t *cr)
1044 {
1045         /* Todo: mmap support. */
1046 }
1047 
1048 /* access cache */
1049 /* client handles */
1050 
1051 /*
1052  * initialize resources that are used by smbfs_subr.c
1053  * this is called from the _init() routine (by the way of smbfs_clntinit())
1054  *
1055  * NFS: nfs_subr.c:nfs_subrinit
1056  */
1057 int
1058 smbfs_subrinit(void)
1059 {
1060         ulong_t nsmbnode_max;
1061 
1062         /*
1063          * Allocate and initialize the smbnode cache
1064          */
1065         if (nsmbnode <= 0)
1066                 nsmbnode = ncsize; /* dnlc.h */
1067         nsmbnode_max = (ulong_t)((kmem_maxavail() >> 2) /
1068             sizeof (struct smbnode));
1069         if (nsmbnode > nsmbnode_max || (nsmbnode == 0 && ncsize == 0)) {
1070                 zcmn_err(GLOBAL_ZONEID, CE_NOTE,
1071                     "setting nsmbnode to max value of %ld", nsmbnode_max);
1072                 nsmbnode = nsmbnode_max;
1073         }
1074 
1075         smbnode_cache = kmem_cache_create("smbnode_cache", sizeof (smbnode_t),
1076             0, NULL, NULL, smbfs_kmem_reclaim, NULL, NULL, 0);
1077 
1078         /*
1079          * Initialize the various mutexes and reader/writer locks
1080          */
1081         mutex_init(&smbfreelist_lock, NULL, MUTEX_DEFAULT, NULL);
1082         mutex_init(&smbfs_minor_lock, NULL, MUTEX_DEFAULT, NULL);
1083 
1084         /*
1085          * Assign unique major number for all smbfs mounts
1086          */
1087         if ((smbfs_major = getudev()) == -1) {
1088                 zcmn_err(GLOBAL_ZONEID, CE_WARN,
1089                     "smbfs: init: can't get unique device number");
1090                 smbfs_major = 0;
1091         }
1092         smbfs_minor = 0;
1093 
1094         return (0);
1095 }
1096 
1097 /*
1098  * free smbfs hash table, etc.
1099  * NFS: nfs_subr.c:nfs_subrfini
1100  */
1101 void
1102 smbfs_subrfini(void)
1103 {
1104 
1105         /*
1106          * Destroy the smbnode cache
1107          */
1108         kmem_cache_destroy(smbnode_cache);
1109 
1110         /*
1111          * Destroy the various mutexes and reader/writer locks
1112          */
1113         mutex_destroy(&smbfreelist_lock);
1114         mutex_destroy(&smbfs_minor_lock);
1115 }
1116 
1117 /* rddir_cache ? */
1118 
1119 /*
1120  * Support functions for smbfs_kmem_reclaim
1121  */
1122 
1123 static void
1124 smbfs_node_reclaim(void)
1125 {
1126         smbmntinfo_t *mi;
1127         smbnode_t *np;
1128         vnode_t *vp;
1129 
1130         mutex_enter(&smbfreelist_lock);
1131         while ((np = smbfreelist) != NULL) {
1132                 sn_rmfree(np);
1133                 mutex_exit(&smbfreelist_lock);
1134                 if (np->r_flags & RHASHED) {
1135                         vp = SMBTOV(np);
1136                         mi = np->n_mount;
1137                         rw_enter(&mi->smi_hash_lk, RW_WRITER);
1138                         mutex_enter(&vp->v_lock);
1139                         if (vp->v_count > 1) {
1140                                 vp->v_count--;
1141                                 mutex_exit(&vp->v_lock);
1142                                 rw_exit(&mi->smi_hash_lk);
1143                                 mutex_enter(&smbfreelist_lock);
1144                                 continue;
1145                         }
1146                         mutex_exit(&vp->v_lock);
1147                         sn_rmhash_locked(np);
1148                         rw_exit(&mi->smi_hash_lk);
1149                 }
1150                 /*
1151                  * This call to smbfs_addfree will end up destroying the
1152                  * smbnode, but in a safe way with the appropriate set
1153                  * of checks done.
1154                  */
1155                 smbfs_addfree(np);
1156                 mutex_enter(&smbfreelist_lock);
1157         }
1158         mutex_exit(&smbfreelist_lock);
1159 }
1160 
1161 /*
1162  * Called by kmem_cache_alloc ask us if we could
1163  * "Please give back some memory!"
1164  *
1165  * Todo: dump nodes from the free list?
1166  */
1167 /*ARGSUSED*/
1168 void
1169 smbfs_kmem_reclaim(void *cdrarg)
1170 {
1171         smbfs_node_reclaim();
1172 }
1173 
1174 /* nfs failover stuff */
1175 /* nfs_rw_xxx - see smbfs_rwlock.c */