Home | History | Annotate | Line # | Download | only in client
nfs_clrpcops.c revision 1.1
      1 /*	$NetBSD: nfs_clrpcops.c,v 1.1 2013/09/30 07:19:18 dholland Exp $	*/
      2 /*-
      3  * Copyright (c) 1989, 1993
      4  *	The Regents of the University of California.  All rights reserved.
      5  *
      6  * This code is derived from software contributed to Berkeley by
      7  * Rick Macklem at The University of Guelph.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 4. Neither the name of the University nor the names of its contributors
     18  *    may be used to endorse or promote products derived from this software
     19  *    without specific prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     31  * SUCH DAMAGE.
     32  *
     33  */
     34 
     35 #include <sys/cdefs.h>
     36 /* __FBSDID("FreeBSD: head/sys/fs/nfsclient/nfs_clrpcops.c 245977 2013-01-27 09:34:25Z kib "); */
     37 __RCSID("$NetBSD: nfs_clrpcops.c,v 1.1 2013/09/30 07:19:18 dholland Exp $");
     38 
     39 /*
     40  * Rpc op calls, generally called from the vnode op calls or through the
     41  * buffer cache, for NFS v2, 3 and 4.
     42  * These do not normally make any changes to vnode arguments or use
     43  * structures that might change between the VFS variants. The returned
     44  * arguments are all at the end, after the NFSPROC_T *p one.
     45  */
     46 
     47 #ifndef APPLEKEXT
     48 #include "opt_inet6.h"
     49 
     50 #include <fs/nfs/nfsport.h>
     51 
     52 /*
     53  * Global variables
     54  */
     55 extern int nfs_numnfscbd;
     56 extern struct timeval nfsboottime;
     57 extern u_int32_t newnfs_false, newnfs_true;
     58 extern nfstype nfsv34_type[9];
     59 extern int nfsrv_useacl;
     60 extern char nfsv4_callbackaddr[INET6_ADDRSTRLEN];
     61 extern int nfscl_debuglevel;
     62 NFSCLSTATEMUTEX;
     63 int nfstest_outofseq = 0;
     64 int nfscl_assumeposixlocks = 1;
     65 int nfscl_enablecallb = 0;
     66 short nfsv4_cbport = NFSV4_CBPORT;
     67 int nfstest_openallsetattr = 0;
     68 #endif	/* !APPLEKEXT */
     69 
     70 #define	DIRHDSIZ	(sizeof (struct dirent) - (MAXNAMLEN + 1))
     71 
     72 /*
     73  * nfscl_getsameserver() can return one of three values:
     74  * NFSDSP_USETHISSESSION - Use this session for the DS.
     75  * NFSDSP_SEQTHISSESSION - Use the nfsclds_sequence field of this dsp for new
     76  *     session.
     77  * NFSDSP_NOTFOUND - No matching server was found.
     78  */
     79 enum nfsclds_state {
     80 	NFSDSP_USETHISSESSION = 0,
     81 	NFSDSP_SEQTHISSESSION = 1,
     82 	NFSDSP_NOTFOUND = 2,
     83 };
     84 
     85 static int nfsrpc_setattrrpc(vnode_t , struct vattr *, nfsv4stateid_t *,
     86     struct ucred *, NFSPROC_T *, struct nfsvattr *, int *, void *);
     87 static int nfsrpc_readrpc(vnode_t , struct uio *, struct ucred *,
     88     nfsv4stateid_t *, NFSPROC_T *, struct nfsvattr *, int *, void *);
     89 static int nfsrpc_writerpc(vnode_t , struct uio *, int *, int *,
     90     struct ucred *, nfsv4stateid_t *, NFSPROC_T *, struct nfsvattr *, int *,
     91     void *);
     92 static int nfsrpc_createv23(vnode_t , char *, int, struct vattr *,
     93     nfsquad_t, int, struct ucred *, NFSPROC_T *, struct nfsvattr *,
     94     struct nfsvattr *, struct nfsfh **, int *, int *, void *);
     95 static int nfsrpc_createv4(vnode_t , char *, int, struct vattr *,
     96     nfsquad_t, int, struct nfsclowner *, struct nfscldeleg **, struct ucred *,
     97     NFSPROC_T *, struct nfsvattr *, struct nfsvattr *, struct nfsfh **, int *,
     98     int *, void *, int *);
     99 static int nfsrpc_locku(struct nfsrv_descript *, struct nfsmount *,
    100     struct nfscllockowner *, u_int64_t, u_int64_t,
    101     u_int32_t, struct ucred *, NFSPROC_T *, int);
    102 static int nfsrpc_setaclrpc(vnode_t, struct ucred *, NFSPROC_T *,
    103     struct acl *, nfsv4stateid_t *, void *);
    104 static int nfsrpc_getlayout(struct nfsmount *, vnode_t, struct nfsfh *, int,
    105     uint32_t *, nfsv4stateid_t *, uint64_t, struct nfscllayout **,
    106     struct ucred *, NFSPROC_T *);
    107 static int nfsrpc_fillsa(struct nfsmount *, struct sockaddr_storage *,
    108     struct nfsclds **, NFSPROC_T *);
    109 static void nfscl_initsessionslots(struct nfsclsession *);
    110 static int nfscl_doflayoutio(vnode_t, struct uio *, int *, int *, int *,
    111     nfsv4stateid_t *, int, struct nfscldevinfo *, struct nfscllayout *,
    112     struct nfsclflayout *, uint64_t, uint64_t, struct ucred *, NFSPROC_T *);
    113 static int nfsrpc_readds(vnode_t, struct uio *, nfsv4stateid_t *, int *,
    114     struct nfsclds *, uint64_t, int, struct nfsfh *, struct ucred *,
    115     NFSPROC_T *);
    116 static int nfsrpc_writeds(vnode_t, struct uio *, int *, int *,
    117     nfsv4stateid_t *, struct nfsclds *, uint64_t, int,
    118     struct nfsfh *, int, struct ucred *, NFSPROC_T *);
    119 static enum nfsclds_state nfscl_getsameserver(struct nfsmount *,
    120     struct nfsclds *, struct nfsclds **);
    121 #ifdef notyet
    122 static int nfsrpc_commitds(vnode_t, uint64_t, int, struct nfsclds *,
    123     struct nfsfh *, struct ucred *, NFSPROC_T *, void *);
    124 #endif
    125 
    126 /*
    127  * nfs null call from vfs.
    128  */
    129 APPLESTATIC int
    130 nfsrpc_null(vnode_t vp, struct ucred *cred, NFSPROC_T *p)
    131 {
    132 	int error;
    133 	struct nfsrv_descript nfsd, *nd = &nfsd;
    134 
    135 	NFSCL_REQSTART(nd, NFSPROC_NULL, vp);
    136 	error = nfscl_request(nd, vp, p, cred, NULL);
    137 	if (nd->nd_repstat && !error)
    138 		error = nd->nd_repstat;
    139 	mbuf_freem(nd->nd_mrep);
    140 	return (error);
    141 }
    142 
    143 /*
    144  * nfs access rpc op.
    145  * For nfs version 3 and 4, use the access rpc to check accessibility. If file
    146  * modes are changed on the server, accesses might still fail later.
    147  */
    148 APPLESTATIC int
    149 nfsrpc_access(vnode_t vp, int acmode, struct ucred *cred,
    150     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp)
    151 {
    152 	int error;
    153 	u_int32_t mode, rmode;
    154 
    155 	if (acmode & VREAD)
    156 		mode = NFSACCESS_READ;
    157 	else
    158 		mode = 0;
    159 	if (vnode_vtype(vp) == VDIR) {
    160 		if (acmode & VWRITE)
    161 			mode |= (NFSACCESS_MODIFY | NFSACCESS_EXTEND |
    162 				 NFSACCESS_DELETE);
    163 		if (acmode & VEXEC)
    164 			mode |= NFSACCESS_LOOKUP;
    165 	} else {
    166 		if (acmode & VWRITE)
    167 			mode |= (NFSACCESS_MODIFY | NFSACCESS_EXTEND);
    168 		if (acmode & VEXEC)
    169 			mode |= NFSACCESS_EXECUTE;
    170 	}
    171 
    172 	/*
    173 	 * Now, just call nfsrpc_accessrpc() to do the actual RPC.
    174 	 */
    175 	error = nfsrpc_accessrpc(vp, mode, cred, p, nap, attrflagp, &rmode,
    176 	    NULL);
    177 
    178 	/*
    179 	 * The NFS V3 spec does not clarify whether or not
    180 	 * the returned access bits can be a superset of
    181 	 * the ones requested, so...
    182 	 */
    183 	if (!error && (rmode & mode) != mode)
    184 		error = EACCES;
    185 	return (error);
    186 }
    187 
    188 /*
    189  * The actual rpc, separated out for Darwin.
    190  */
    191 APPLESTATIC int
    192 nfsrpc_accessrpc(vnode_t vp, u_int32_t mode, struct ucred *cred,
    193     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, u_int32_t *rmodep,
    194     void *stuff)
    195 {
    196 	u_int32_t *tl;
    197 	u_int32_t supported, rmode;
    198 	int error;
    199 	struct nfsrv_descript nfsd, *nd = &nfsd;
    200 	nfsattrbit_t attrbits;
    201 
    202 	*attrflagp = 0;
    203 	supported = mode;
    204 	NFSCL_REQSTART(nd, NFSPROC_ACCESS, vp);
    205 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    206 	*tl = txdr_unsigned(mode);
    207 	if (nd->nd_flag & ND_NFSV4) {
    208 		/*
    209 		 * And do a Getattr op.
    210 		 */
    211 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    212 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
    213 		NFSGETATTR_ATTRBIT(&attrbits);
    214 		(void) nfsrv_putattrbit(nd, &attrbits);
    215 	}
    216 	error = nfscl_request(nd, vp, p, cred, stuff);
    217 	if (error)
    218 		return (error);
    219 	if (nd->nd_flag & ND_NFSV3) {
    220 		error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
    221 		if (error)
    222 			goto nfsmout;
    223 	}
    224 	if (!nd->nd_repstat) {
    225 		if (nd->nd_flag & ND_NFSV4) {
    226 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
    227 			supported = fxdr_unsigned(u_int32_t, *tl++);
    228 		} else {
    229 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
    230 		}
    231 		rmode = fxdr_unsigned(u_int32_t, *tl);
    232 		if (nd->nd_flag & ND_NFSV4)
    233 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
    234 
    235 		/*
    236 		 * It's not obvious what should be done about
    237 		 * unsupported access modes. For now, be paranoid
    238 		 * and clear the unsupported ones.
    239 		 */
    240 		rmode &= supported;
    241 		*rmodep = rmode;
    242 	} else
    243 		error = nd->nd_repstat;
    244 nfsmout:
    245 	mbuf_freem(nd->nd_mrep);
    246 	return (error);
    247 }
    248 
    249 /*
    250  * nfs open rpc
    251  */
    252 APPLESTATIC int
    253 nfsrpc_open(vnode_t vp, int amode, struct ucred *cred, NFSPROC_T *p)
    254 {
    255 	struct nfsclopen *op;
    256 	struct nfscldeleg *dp;
    257 	struct nfsfh *nfhp;
    258 	struct nfsnode *np = VTONFS(vp);
    259 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
    260 	u_int32_t mode, clidrev;
    261 	int ret, newone, error, expireret = 0, retrycnt;
    262 
    263 	/*
    264 	 * For NFSv4, Open Ops are only done on Regular Files.
    265 	 */
    266 	if (vnode_vtype(vp) != VREG)
    267 		return (0);
    268 	mode = 0;
    269 	if (amode & FREAD)
    270 		mode |= NFSV4OPEN_ACCESSREAD;
    271 	if (amode & FWRITE)
    272 		mode |= NFSV4OPEN_ACCESSWRITE;
    273 	nfhp = np->n_fhp;
    274 
    275 	retrycnt = 0;
    276 #ifdef notdef
    277 { char name[100]; int namel;
    278 namel = (np->n_v4->n4_namelen < 100) ? np->n_v4->n4_namelen : 99;
    279 bcopy(NFS4NODENAME(np->n_v4), name, namel);
    280 name[namel] = '\0';
    281 printf("rpcopen p=0x%x name=%s",p->p_pid,name);
    282 if (nfhp->nfh_len > 0) printf(" fh=0x%x\n",nfhp->nfh_fh[12]);
    283 else printf(" fhl=0\n");
    284 }
    285 #endif
    286 	do {
    287 	    dp = NULL;
    288 	    error = nfscl_open(vp, nfhp->nfh_fh, nfhp->nfh_len, mode, 1,
    289 		cred, p, NULL, &op, &newone, &ret, 1);
    290 	    if (error) {
    291 		return (error);
    292 	    }
    293 	    if (nmp->nm_clp != NULL)
    294 		clidrev = nmp->nm_clp->nfsc_clientidrev;
    295 	    else
    296 		clidrev = 0;
    297 	    if (ret == NFSCLOPEN_DOOPEN) {
    298 		if (np->n_v4 != NULL) {
    299 			error = nfsrpc_openrpc(nmp, vp, np->n_v4->n4_data,
    300 			   np->n_v4->n4_fhlen, np->n_fhp->nfh_fh,
    301 			   np->n_fhp->nfh_len, mode, op,
    302 			   NFS4NODENAME(np->n_v4), np->n_v4->n4_namelen, &dp,
    303 			   0, 0x0, cred, p, 0, 0);
    304 			if (dp != NULL) {
    305 #ifdef APPLE
    306 				OSBitAndAtomic((int32_t)~NDELEGMOD, (UInt32 *)&np->n_flag);
    307 #else
    308 				NFSLOCKNODE(np);
    309 				np->n_flag &= ~NDELEGMOD;
    310 				/*
    311 				 * Invalidate the attribute cache, so that
    312 				 * attributes that pre-date the issue of a
    313 				 * delegation are not cached, since the
    314 				 * cached attributes will remain valid while
    315 				 * the delegation is held.
    316 				 */
    317 				NFSINVALATTRCACHE(np);
    318 				NFSUNLOCKNODE(np);
    319 #endif
    320 				(void) nfscl_deleg(nmp->nm_mountp,
    321 				    op->nfso_own->nfsow_clp,
    322 				    nfhp->nfh_fh, nfhp->nfh_len, cred, p, &dp);
    323 			}
    324 		} else {
    325 			error = EIO;
    326 		}
    327 		newnfs_copyincred(cred, &op->nfso_cred);
    328 	    } else if (ret == NFSCLOPEN_SETCRED)
    329 		/*
    330 		 * This is a new local open on a delegation. It needs
    331 		 * to have credentials so that an open can be done
    332 		 * against the server during recovery.
    333 		 */
    334 		newnfs_copyincred(cred, &op->nfso_cred);
    335 
    336 	    /*
    337 	     * nfso_opencnt is the count of how many VOP_OPEN()s have
    338 	     * been done on this Open successfully and a VOP_CLOSE()
    339 	     * is expected for each of these.
    340 	     * If error is non-zero, don't increment it, since the Open
    341 	     * hasn't succeeded yet.
    342 	     */
    343 	    if (!error)
    344 		op->nfso_opencnt++;
    345 	    nfscl_openrelease(op, error, newone);
    346 	    if (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
    347 		error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
    348 		error == NFSERR_BADSESSION) {
    349 		(void) nfs_catnap(PZERO, error, "nfs_open");
    350 	    } else if ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID)
    351 		&& clidrev != 0) {
    352 		expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
    353 		retrycnt++;
    354 	    }
    355 	} while (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
    356 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
    357 	    error == NFSERR_BADSESSION ||
    358 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
    359 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
    360 	if (error && retrycnt >= 4)
    361 		error = EIO;
    362 	return (error);
    363 }
    364 
    365 /*
    366  * the actual open rpc
    367  */
    368 APPLESTATIC int
    369 nfsrpc_openrpc(struct nfsmount *nmp, vnode_t vp, u_int8_t *nfhp, int fhlen,
    370     u_int8_t *newfhp, int newfhlen, u_int32_t mode, struct nfsclopen *op,
    371     u_int8_t *name, int namelen, struct nfscldeleg **dpp,
    372     int reclaim, u_int32_t delegtype, struct ucred *cred, NFSPROC_T *p,
    373     int syscred, int recursed)
    374 {
    375 	u_int32_t *tl;
    376 	struct nfsrv_descript nfsd, *nd = &nfsd;
    377 	struct nfscldeleg *dp, *ndp = NULL;
    378 	struct nfsvattr nfsva;
    379 	u_int32_t rflags, deleg;
    380 	nfsattrbit_t attrbits;
    381 	int error, ret, acesize, limitby;
    382 
    383 	dp = *dpp;
    384 	*dpp = NULL;
    385 	nfscl_reqstart(nd, NFSPROC_OPEN, nmp, nfhp, fhlen, NULL, NULL);
    386 	NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
    387 	*tl++ = txdr_unsigned(op->nfso_own->nfsow_seqid);
    388 	*tl++ = txdr_unsigned(mode & NFSV4OPEN_ACCESSBOTH);
    389 	*tl++ = txdr_unsigned((mode >> NFSLCK_SHIFT) & NFSV4OPEN_DENYBOTH);
    390 	*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
    391 	*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
    392 	(void) nfsm_strtom(nd, op->nfso_own->nfsow_owner, NFSV4CL_LOCKNAMELEN);
    393 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
    394 	*tl++ = txdr_unsigned(NFSV4OPEN_NOCREATE);
    395 	if (reclaim) {
    396 		*tl = txdr_unsigned(NFSV4OPEN_CLAIMPREVIOUS);
    397 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    398 		*tl = txdr_unsigned(delegtype);
    399 	} else {
    400 		if (dp != NULL) {
    401 			*tl = txdr_unsigned(NFSV4OPEN_CLAIMDELEGATECUR);
    402 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
    403 			if (NFSHASNFSV4N(nmp))
    404 				*tl++ = 0;
    405 			else
    406 				*tl++ = dp->nfsdl_stateid.seqid;
    407 			*tl++ = dp->nfsdl_stateid.other[0];
    408 			*tl++ = dp->nfsdl_stateid.other[1];
    409 			*tl = dp->nfsdl_stateid.other[2];
    410 		} else {
    411 			*tl = txdr_unsigned(NFSV4OPEN_CLAIMNULL);
    412 		}
    413 		(void) nfsm_strtom(nd, name, namelen);
    414 	}
    415 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    416 	*tl = txdr_unsigned(NFSV4OP_GETATTR);
    417 	NFSZERO_ATTRBIT(&attrbits);
    418 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
    419 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFY);
    420 	(void) nfsrv_putattrbit(nd, &attrbits);
    421 	if (syscred)
    422 		nd->nd_flag |= ND_USEGSSNAME;
    423 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, vp, p, cred,
    424 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    425 	if (error)
    426 		return (error);
    427 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
    428 	if (!nd->nd_repstat) {
    429 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
    430 		    6 * NFSX_UNSIGNED);
    431 		op->nfso_stateid.seqid = *tl++;
    432 		op->nfso_stateid.other[0] = *tl++;
    433 		op->nfso_stateid.other[1] = *tl++;
    434 		op->nfso_stateid.other[2] = *tl;
    435 		rflags = fxdr_unsigned(u_int32_t, *(tl + 6));
    436 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
    437 		if (error)
    438 			goto nfsmout;
    439 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
    440 		deleg = fxdr_unsigned(u_int32_t, *tl);
    441 		if (deleg == NFSV4OPEN_DELEGATEREAD ||
    442 		    deleg == NFSV4OPEN_DELEGATEWRITE) {
    443 			if (!(op->nfso_own->nfsow_clp->nfsc_flags &
    444 			      NFSCLFLAGS_FIRSTDELEG))
    445 				op->nfso_own->nfsow_clp->nfsc_flags |=
    446 				  (NFSCLFLAGS_FIRSTDELEG | NFSCLFLAGS_GOTDELEG);
    447 			MALLOC(ndp, struct nfscldeleg *,
    448 			    sizeof (struct nfscldeleg) + newfhlen,
    449 			    M_NFSCLDELEG, M_WAITOK);
    450 			LIST_INIT(&ndp->nfsdl_owner);
    451 			LIST_INIT(&ndp->nfsdl_lock);
    452 			ndp->nfsdl_clp = op->nfso_own->nfsow_clp;
    453 			ndp->nfsdl_fhlen = newfhlen;
    454 			NFSBCOPY(newfhp, ndp->nfsdl_fh, newfhlen);
    455 			newnfs_copyincred(cred, &ndp->nfsdl_cred);
    456 			nfscl_lockinit(&ndp->nfsdl_rwlock);
    457 			NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
    458 			    NFSX_UNSIGNED);
    459 			ndp->nfsdl_stateid.seqid = *tl++;
    460 			ndp->nfsdl_stateid.other[0] = *tl++;
    461 			ndp->nfsdl_stateid.other[1] = *tl++;
    462 			ndp->nfsdl_stateid.other[2] = *tl++;
    463 			ret = fxdr_unsigned(int, *tl);
    464 			if (deleg == NFSV4OPEN_DELEGATEWRITE) {
    465 				ndp->nfsdl_flags = NFSCLDL_WRITE;
    466 				/*
    467 				 * Indicates how much the file can grow.
    468 				 */
    469 				NFSM_DISSECT(tl, u_int32_t *,
    470 				    3 * NFSX_UNSIGNED);
    471 				limitby = fxdr_unsigned(int, *tl++);
    472 				switch (limitby) {
    473 				case NFSV4OPEN_LIMITSIZE:
    474 					ndp->nfsdl_sizelimit = fxdr_hyper(tl);
    475 					break;
    476 				case NFSV4OPEN_LIMITBLOCKS:
    477 					ndp->nfsdl_sizelimit =
    478 					    fxdr_unsigned(u_int64_t, *tl++);
    479 					ndp->nfsdl_sizelimit *=
    480 					    fxdr_unsigned(u_int64_t, *tl);
    481 					break;
    482 				default:
    483 					error = NFSERR_BADXDR;
    484 					goto nfsmout;
    485 				};
    486 			} else {
    487 				ndp->nfsdl_flags = NFSCLDL_READ;
    488 			}
    489 			if (ret)
    490 				ndp->nfsdl_flags |= NFSCLDL_RECALL;
    491 			error = nfsrv_dissectace(nd, &ndp->nfsdl_ace, &ret,
    492 			    &acesize, p);
    493 			if (error)
    494 				goto nfsmout;
    495 		} else if (deleg != NFSV4OPEN_DELEGATENONE) {
    496 			error = NFSERR_BADXDR;
    497 			goto nfsmout;
    498 		}
    499 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
    500 		error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
    501 		    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
    502 		    NULL, NULL, NULL, p, cred);
    503 		if (error)
    504 			goto nfsmout;
    505 		if (ndp != NULL) {
    506 			ndp->nfsdl_change = nfsva.na_filerev;
    507 			ndp->nfsdl_modtime = nfsva.na_mtime;
    508 			ndp->nfsdl_flags |= NFSCLDL_MODTIMESET;
    509 		}
    510 		if (!reclaim && (rflags & NFSV4OPEN_RESULTCONFIRM)) {
    511 		    do {
    512 			ret = nfsrpc_openconfirm(vp, newfhp, newfhlen, op,
    513 			    cred, p);
    514 			if (ret == NFSERR_DELAY)
    515 			    (void) nfs_catnap(PZERO, ret, "nfs_open");
    516 		    } while (ret == NFSERR_DELAY);
    517 		    error = ret;
    518 		}
    519 		if ((rflags & NFSV4OPEN_LOCKTYPEPOSIX) ||
    520 		    nfscl_assumeposixlocks)
    521 		    op->nfso_posixlock = 1;
    522 		else
    523 		    op->nfso_posixlock = 0;
    524 
    525 		/*
    526 		 * If the server is handing out delegations, but we didn't
    527 		 * get one because an OpenConfirm was required, try the
    528 		 * Open again, to get a delegation. This is a harmless no-op,
    529 		 * from a server's point of view.
    530 		 */
    531 		if (!reclaim && (rflags & NFSV4OPEN_RESULTCONFIRM) &&
    532 		    (op->nfso_own->nfsow_clp->nfsc_flags & NFSCLFLAGS_GOTDELEG)
    533 		    && !error && dp == NULL && ndp == NULL && !recursed) {
    534 		    do {
    535 			ret = nfsrpc_openrpc(nmp, vp, nfhp, fhlen, newfhp,
    536 			    newfhlen, mode, op, name, namelen, &ndp, 0, 0x0,
    537 			    cred, p, syscred, 1);
    538 			if (ret == NFSERR_DELAY)
    539 			    (void) nfs_catnap(PZERO, ret, "nfs_open2");
    540 		    } while (ret == NFSERR_DELAY);
    541 		    if (ret) {
    542 			if (ndp != NULL)
    543 				FREE((caddr_t)ndp, M_NFSCLDELEG);
    544 			if (ret == NFSERR_STALECLIENTID ||
    545 			    ret == NFSERR_STALEDONTRECOVER ||
    546 			    ret == NFSERR_BADSESSION)
    547 				error = ret;
    548 		    }
    549 		}
    550 	}
    551 	if (nd->nd_repstat != 0 && error == 0)
    552 		error = nd->nd_repstat;
    553 	if (error == NFSERR_STALECLIENTID || error == NFSERR_BADSESSION)
    554 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
    555 nfsmout:
    556 	if (!error)
    557 		*dpp = ndp;
    558 	else if (ndp != NULL)
    559 		FREE((caddr_t)ndp, M_NFSCLDELEG);
    560 	mbuf_freem(nd->nd_mrep);
    561 	return (error);
    562 }
    563 
    564 /*
    565  * open downgrade rpc
    566  */
    567 APPLESTATIC int
    568 nfsrpc_opendowngrade(vnode_t vp, u_int32_t mode, struct nfsclopen *op,
    569     struct ucred *cred, NFSPROC_T *p)
    570 {
    571 	u_int32_t *tl;
    572 	struct nfsrv_descript nfsd, *nd = &nfsd;
    573 	int error;
    574 
    575 	NFSCL_REQSTART(nd, NFSPROC_OPENDOWNGRADE, vp);
    576 	NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 3 * NFSX_UNSIGNED);
    577 	if (NFSHASNFSV4N(VFSTONFS(vnode_mount(vp))))
    578 		*tl++ = 0;
    579 	else
    580 		*tl++ = op->nfso_stateid.seqid;
    581 	*tl++ = op->nfso_stateid.other[0];
    582 	*tl++ = op->nfso_stateid.other[1];
    583 	*tl++ = op->nfso_stateid.other[2];
    584 	*tl++ = txdr_unsigned(op->nfso_own->nfsow_seqid);
    585 	*tl++ = txdr_unsigned(mode & NFSV4OPEN_ACCESSBOTH);
    586 	*tl = txdr_unsigned((mode >> NFSLCK_SHIFT) & NFSV4OPEN_DENYBOTH);
    587 	error = nfscl_request(nd, vp, p, cred, NULL);
    588 	if (error)
    589 		return (error);
    590 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
    591 	if (!nd->nd_repstat) {
    592 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
    593 		op->nfso_stateid.seqid = *tl++;
    594 		op->nfso_stateid.other[0] = *tl++;
    595 		op->nfso_stateid.other[1] = *tl++;
    596 		op->nfso_stateid.other[2] = *tl;
    597 	}
    598 	if (nd->nd_repstat && error == 0)
    599 		error = nd->nd_repstat;
    600 	if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
    601 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
    602 nfsmout:
    603 	mbuf_freem(nd->nd_mrep);
    604 	return (error);
    605 }
    606 
    607 /*
    608  * V4 Close operation.
    609  */
    610 APPLESTATIC int
    611 nfsrpc_close(vnode_t vp, int doclose, NFSPROC_T *p)
    612 {
    613 	struct nfsclclient *clp;
    614 	int error;
    615 
    616 	if (vnode_vtype(vp) != VREG)
    617 		return (0);
    618 	if (doclose)
    619 		error = nfscl_doclose(vp, &clp, p);
    620 	else
    621 		error = nfscl_getclose(vp, &clp);
    622 	if (error)
    623 		return (error);
    624 
    625 	nfscl_clientrelease(clp);
    626 	return (0);
    627 }
    628 
    629 /*
    630  * Close the open.
    631  */
    632 APPLESTATIC void
    633 nfsrpc_doclose(struct nfsmount *nmp, struct nfsclopen *op, NFSPROC_T *p)
    634 {
    635 	struct nfsrv_descript nfsd, *nd = &nfsd;
    636 	struct nfscllockowner *lp, *nlp;
    637 	struct nfscllock *lop, *nlop;
    638 	struct ucred *tcred;
    639 	u_int64_t off = 0, len = 0;
    640 	u_int32_t type = NFSV4LOCKT_READ;
    641 	int error, do_unlock, trycnt;
    642 
    643 	tcred = newnfs_getcred();
    644 	newnfs_copycred(&op->nfso_cred, tcred);
    645 	/*
    646 	 * (Theoretically this could be done in the same
    647 	 *  compound as the close, but having multiple
    648 	 *  sequenced Ops in the same compound might be
    649 	 *  too scary for some servers.)
    650 	 */
    651 	if (op->nfso_posixlock) {
    652 		off = 0;
    653 		len = NFS64BITSSET;
    654 		type = NFSV4LOCKT_READ;
    655 	}
    656 
    657 	/*
    658 	 * Since this function is only called from VOP_INACTIVE(), no
    659 	 * other thread will be manipulating this Open. As such, the
    660 	 * lock lists are not being changed by other threads, so it should
    661 	 * be safe to do this without locking.
    662 	 */
    663 	LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
    664 		do_unlock = 1;
    665 		LIST_FOREACH_SAFE(lop, &lp->nfsl_lock, nfslo_list, nlop) {
    666 			if (op->nfso_posixlock == 0) {
    667 				off = lop->nfslo_first;
    668 				len = lop->nfslo_end - lop->nfslo_first;
    669 				if (lop->nfslo_type == F_WRLCK)
    670 					type = NFSV4LOCKT_WRITE;
    671 				else
    672 					type = NFSV4LOCKT_READ;
    673 			}
    674 			if (do_unlock) {
    675 				trycnt = 0;
    676 				do {
    677 					error = nfsrpc_locku(nd, nmp, lp, off,
    678 					    len, type, tcred, p, 0);
    679 					if ((nd->nd_repstat == NFSERR_GRACE ||
    680 					    nd->nd_repstat == NFSERR_DELAY) &&
    681 					    error == 0)
    682 						(void) nfs_catnap(PZERO,
    683 						    (int)nd->nd_repstat,
    684 						    "nfs_close");
    685 				} while ((nd->nd_repstat == NFSERR_GRACE ||
    686 				    nd->nd_repstat == NFSERR_DELAY) &&
    687 				    error == 0 && trycnt++ < 5);
    688 				if (op->nfso_posixlock)
    689 					do_unlock = 0;
    690 			}
    691 			nfscl_freelock(lop, 0);
    692 		}
    693 		/*
    694 		 * Do a ReleaseLockOwner.
    695 		 * The lock owner name nfsl_owner may be used by other opens for
    696 		 * other files but the lock_owner4 name that nfsrpc_rellockown()
    697 		 * puts on the wire has the file handle for this file appended
    698 		 * to it, so it can be done now.
    699 		 */
    700 		(void)nfsrpc_rellockown(nmp, lp, lp->nfsl_open->nfso_fh,
    701 		    lp->nfsl_open->nfso_fhlen, tcred, p);
    702 	}
    703 
    704 	/*
    705 	 * There could be other Opens for different files on the same
    706 	 * OpenOwner, so locking is required.
    707 	 */
    708 	NFSLOCKCLSTATE();
    709 	nfscl_lockexcl(&op->nfso_own->nfsow_rwlock, NFSCLSTATEMUTEXPTR);
    710 	NFSUNLOCKCLSTATE();
    711 	do {
    712 		error = nfscl_tryclose(op, tcred, nmp, p);
    713 		if (error == NFSERR_GRACE)
    714 			(void) nfs_catnap(PZERO, error, "nfs_close");
    715 	} while (error == NFSERR_GRACE);
    716 	NFSLOCKCLSTATE();
    717 	nfscl_lockunlock(&op->nfso_own->nfsow_rwlock);
    718 
    719 	LIST_FOREACH_SAFE(lp, &op->nfso_lock, nfsl_list, nlp)
    720 		nfscl_freelockowner(lp, 0);
    721 	nfscl_freeopen(op, 0);
    722 	NFSUNLOCKCLSTATE();
    723 	NFSFREECRED(tcred);
    724 }
    725 
    726 /*
    727  * The actual Close RPC.
    728  */
    729 APPLESTATIC int
    730 nfsrpc_closerpc(struct nfsrv_descript *nd, struct nfsmount *nmp,
    731     struct nfsclopen *op, struct ucred *cred, NFSPROC_T *p,
    732     int syscred)
    733 {
    734 	u_int32_t *tl;
    735 	int error;
    736 
    737 	nfscl_reqstart(nd, NFSPROC_CLOSE, nmp, op->nfso_fh,
    738 	    op->nfso_fhlen, NULL, NULL);
    739 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
    740 	*tl++ = txdr_unsigned(op->nfso_own->nfsow_seqid);
    741 	if (NFSHASNFSV4N(nmp))
    742 		*tl++ = 0;
    743 	else
    744 		*tl++ = op->nfso_stateid.seqid;
    745 	*tl++ = op->nfso_stateid.other[0];
    746 	*tl++ = op->nfso_stateid.other[1];
    747 	*tl = op->nfso_stateid.other[2];
    748 	if (syscred)
    749 		nd->nd_flag |= ND_USEGSSNAME;
    750 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
    751 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    752 	if (error)
    753 		return (error);
    754 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
    755 	if (nd->nd_repstat == 0)
    756 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
    757 	error = nd->nd_repstat;
    758 	if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
    759 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
    760 nfsmout:
    761 	mbuf_freem(nd->nd_mrep);
    762 	return (error);
    763 }
    764 
    765 /*
    766  * V4 Open Confirm RPC.
    767  */
    768 APPLESTATIC int
    769 nfsrpc_openconfirm(vnode_t vp, u_int8_t *nfhp, int fhlen,
    770     struct nfsclopen *op, struct ucred *cred, NFSPROC_T *p)
    771 {
    772 	u_int32_t *tl;
    773 	struct nfsrv_descript nfsd, *nd = &nfsd;
    774 	struct nfsmount *nmp;
    775 	int error;
    776 
    777 	nmp = VFSTONFS(vnode_mount(vp));
    778 	if (NFSHASNFSV4N(nmp))
    779 		return (0);		/* No confirmation for NFSv4.1. */
    780 	nfscl_reqstart(nd, NFSPROC_OPENCONFIRM, nmp, nfhp, fhlen, NULL, NULL);
    781 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
    782 	*tl++ = op->nfso_stateid.seqid;
    783 	*tl++ = op->nfso_stateid.other[0];
    784 	*tl++ = op->nfso_stateid.other[1];
    785 	*tl++ = op->nfso_stateid.other[2];
    786 	*tl = txdr_unsigned(op->nfso_own->nfsow_seqid);
    787 	error = nfscl_request(nd, vp, p, cred, NULL);
    788 	if (error)
    789 		return (error);
    790 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
    791 	if (!nd->nd_repstat) {
    792 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
    793 		op->nfso_stateid.seqid = *tl++;
    794 		op->nfso_stateid.other[0] = *tl++;
    795 		op->nfso_stateid.other[1] = *tl++;
    796 		op->nfso_stateid.other[2] = *tl;
    797 	}
    798 	error = nd->nd_repstat;
    799 	if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
    800 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
    801 nfsmout:
    802 	mbuf_freem(nd->nd_mrep);
    803 	return (error);
    804 }
    805 
    806 /*
    807  * Do the setclientid and setclientid confirm RPCs. Called from nfs_statfs()
    808  * when a mount has just occurred and when the server replies NFSERR_EXPIRED.
    809  */
    810 APPLESTATIC int
    811 nfsrpc_setclient(struct nfsmount *nmp, struct nfsclclient *clp, int reclaim,
    812     struct ucred *cred, NFSPROC_T *p)
    813 {
    814 	u_int32_t *tl;
    815 	struct nfsrv_descript nfsd;
    816 	struct nfsrv_descript *nd = &nfsd;
    817 	nfsattrbit_t attrbits;
    818 	u_int8_t *cp = NULL, *cp2, addr[INET6_ADDRSTRLEN + 9];
    819 	u_short port;
    820 	int error, isinet6 = 0, callblen;
    821 	nfsquad_t confirm;
    822 	u_int32_t lease;
    823 	static u_int32_t rev = 0;
    824 	struct nfsclds *dsp, *ndsp, *tdsp;
    825 
    826 	if (nfsboottime.tv_sec == 0)
    827 		NFSSETBOOTTIME(nfsboottime);
    828 	clp->nfsc_rev = rev++;
    829 	if (NFSHASNFSV4N(nmp)) {
    830 		error = nfsrpc_exchangeid(nmp, clp, &nmp->nm_sockreq,
    831 		    NFSV4EXCH_USEPNFSMDS | NFSV4EXCH_USENONPNFS, &dsp, cred, p);
    832 		NFSCL_DEBUG(1, "aft exch=%d\n", error);
    833 		if (error == 0) {
    834 			error = nfsrpc_createsession(nmp, &dsp->nfsclds_sess,
    835 			    &nmp->nm_sockreq,
    836 			    dsp->nfsclds_sess.nfsess_sequenceid, 1, cred, p);
    837 			if (error == 0) {
    838 				NFSLOCKMNT(nmp);
    839 				TAILQ_FOREACH_SAFE(tdsp, &nmp->nm_sess,
    840 				    nfsclds_list, ndsp)
    841 					nfscl_freenfsclds(tdsp);
    842 				TAILQ_INIT(&nmp->nm_sess);
    843 				TAILQ_INSERT_HEAD(&nmp->nm_sess, dsp,
    844 				    nfsclds_list);
    845 				NFSUNLOCKMNT(nmp);
    846 			} else
    847 				nfscl_freenfsclds(dsp);
    848 			NFSCL_DEBUG(1, "aft createsess=%d\n", error);
    849 		}
    850 		if (error == 0 && reclaim == 0) {
    851 			error = nfsrpc_reclaimcomplete(nmp, cred, p);
    852 			NFSCL_DEBUG(1, "aft reclaimcomp=%d\n", error);
    853 			if (error == NFSERR_COMPLETEALREADY ||
    854 			    error == NFSERR_NOTSUPP)
    855 				/* Ignore this error. */
    856 				error = 0;
    857 		}
    858 		return (error);
    859 	}
    860 
    861 	/*
    862 	 * Allocate a single session structure for NFSv4.0, because some of
    863 	 * the fields are used by NFSv4.0 although it doesn't do a session.
    864 	 */
    865 	dsp = malloc(sizeof(struct nfsclds), M_NFSCLDS, M_WAITOK | M_ZERO);
    866 	mtx_init(&dsp->nfsclds_mtx, "nfsds", NULL, MTX_DEF);
    867 	mtx_init(&dsp->nfsclds_sess.nfsess_mtx, "nfssession", NULL, MTX_DEF);
    868 	NFSLOCKMNT(nmp);
    869 	TAILQ_INSERT_HEAD(&nmp->nm_sess, dsp, nfsclds_list);
    870 	NFSUNLOCKMNT(nmp);
    871 
    872 	nfscl_reqstart(nd, NFSPROC_SETCLIENTID, nmp, NULL, 0, NULL, NULL);
    873 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
    874 	*tl++ = txdr_unsigned(nfsboottime.tv_sec);
    875 	*tl = txdr_unsigned(clp->nfsc_rev);
    876 	(void) nfsm_strtom(nd, clp->nfsc_id, clp->nfsc_idlen);
    877 
    878 	/*
    879 	 * set up the callback address
    880 	 */
    881 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    882 	*tl = txdr_unsigned(NFS_CALLBCKPROG);
    883 	callblen = strlen(nfsv4_callbackaddr);
    884 	if (callblen == 0)
    885 		cp = nfscl_getmyip(nmp, &isinet6);
    886 	if (nfscl_enablecallb && nfs_numnfscbd > 0 &&
    887 	    (callblen > 0 || cp != NULL)) {
    888 		port = htons(nfsv4_cbport);
    889 		cp2 = (u_int8_t *)&port;
    890 #ifdef INET6
    891 		if ((callblen > 0 &&
    892 		     strchr(nfsv4_callbackaddr, ':')) || isinet6) {
    893 			char ip6buf[INET6_ADDRSTRLEN], *ip6add;
    894 
    895 			(void) nfsm_strtom(nd, "tcp6", 4);
    896 			if (callblen == 0) {
    897 				ip6_sprintf(ip6buf, (struct in6_addr *)cp);
    898 				ip6add = ip6buf;
    899 			} else {
    900 				ip6add = nfsv4_callbackaddr;
    901 			}
    902 			snprintf(addr, INET6_ADDRSTRLEN + 9, "%s.%d.%d",
    903 			    ip6add, cp2[0], cp2[1]);
    904 		} else
    905 #endif
    906 		{
    907 			(void) nfsm_strtom(nd, "tcp", 3);
    908 			if (callblen == 0)
    909 				snprintf(addr, INET6_ADDRSTRLEN + 9,
    910 				    "%d.%d.%d.%d.%d.%d", cp[0], cp[1],
    911 				    cp[2], cp[3], cp2[0], cp2[1]);
    912 			else
    913 				snprintf(addr, INET6_ADDRSTRLEN + 9,
    914 				    "%s.%d.%d", nfsv4_callbackaddr,
    915 				    cp2[0], cp2[1]);
    916 		}
    917 		(void) nfsm_strtom(nd, addr, strlen(addr));
    918 	} else {
    919 		(void) nfsm_strtom(nd, "tcp", 3);
    920 		(void) nfsm_strtom(nd, "0.0.0.0.0.0", 11);
    921 	}
    922 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    923 	*tl = txdr_unsigned(clp->nfsc_cbident);
    924 	nd->nd_flag |= ND_USEGSSNAME;
    925 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
    926 		NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    927 	if (error)
    928 		return (error);
    929 	if (nd->nd_repstat == 0) {
    930 	    NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
    931 	    NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0] = *tl++;
    932 	    NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1] = *tl++;
    933 	    confirm.lval[0] = *tl++;
    934 	    confirm.lval[1] = *tl;
    935 	    mbuf_freem(nd->nd_mrep);
    936 	    nd->nd_mrep = NULL;
    937 
    938 	    /*
    939 	     * and confirm it.
    940 	     */
    941 	    nfscl_reqstart(nd, NFSPROC_SETCLIENTIDCFRM, nmp, NULL, 0, NULL,
    942 		NULL);
    943 	    NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
    944 	    *tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
    945 	    *tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
    946 	    *tl++ = confirm.lval[0];
    947 	    *tl = confirm.lval[1];
    948 	    nd->nd_flag |= ND_USEGSSNAME;
    949 	    error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p,
    950 		cred, NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    951 	    if (error)
    952 		return (error);
    953 	    mbuf_freem(nd->nd_mrep);
    954 	    nd->nd_mrep = NULL;
    955 	    if (nd->nd_repstat == 0) {
    956 		nfscl_reqstart(nd, NFSPROC_GETATTR, nmp, nmp->nm_fh,
    957 		    nmp->nm_fhsize, NULL, NULL);
    958 		NFSZERO_ATTRBIT(&attrbits);
    959 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_LEASETIME);
    960 		(void) nfsrv_putattrbit(nd, &attrbits);
    961 		nd->nd_flag |= ND_USEGSSNAME;
    962 		error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p,
    963 		    cred, NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    964 		if (error)
    965 		    return (error);
    966 		if (nd->nd_repstat == 0) {
    967 		    error = nfsv4_loadattr(nd, NULL, NULL, NULL, NULL, 0, NULL,
    968 			NULL, NULL, NULL, NULL, 0, NULL, &lease, NULL, p, cred);
    969 		    if (error)
    970 			goto nfsmout;
    971 		    clp->nfsc_renew = NFSCL_RENEW(lease);
    972 		    clp->nfsc_expire = NFSD_MONOSEC + clp->nfsc_renew;
    973 		    clp->nfsc_clientidrev++;
    974 		    if (clp->nfsc_clientidrev == 0)
    975 			clp->nfsc_clientidrev++;
    976 		}
    977 	    }
    978 	}
    979 	error = nd->nd_repstat;
    980 nfsmout:
    981 	mbuf_freem(nd->nd_mrep);
    982 	return (error);
    983 }
    984 
    985 /*
    986  * nfs getattr call.
    987  */
    988 APPLESTATIC int
    989 nfsrpc_getattr(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
    990     struct nfsvattr *nap, void *stuff)
    991 {
    992 	struct nfsrv_descript nfsd, *nd = &nfsd;
    993 	int error;
    994 	nfsattrbit_t attrbits;
    995 
    996 	NFSCL_REQSTART(nd, NFSPROC_GETATTR, vp);
    997 	if (nd->nd_flag & ND_NFSV4) {
    998 		NFSGETATTR_ATTRBIT(&attrbits);
    999 		(void) nfsrv_putattrbit(nd, &attrbits);
   1000 	}
   1001 	error = nfscl_request(nd, vp, p, cred, stuff);
   1002 	if (error)
   1003 		return (error);
   1004 	if (!nd->nd_repstat)
   1005 		error = nfsm_loadattr(nd, nap);
   1006 	else
   1007 		error = nd->nd_repstat;
   1008 	mbuf_freem(nd->nd_mrep);
   1009 	return (error);
   1010 }
   1011 
   1012 /*
   1013  * nfs getattr call with non-vnode arguemnts.
   1014  */
   1015 APPLESTATIC int
   1016 nfsrpc_getattrnovp(struct nfsmount *nmp, u_int8_t *fhp, int fhlen, int syscred,
   1017     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, u_int64_t *xidp,
   1018     uint32_t *leasep)
   1019 {
   1020 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1021 	int error, vers = NFS_VER2;
   1022 	nfsattrbit_t attrbits;
   1023 
   1024 	nfscl_reqstart(nd, NFSPROC_GETATTR, nmp, fhp, fhlen, NULL, NULL);
   1025 	if (nd->nd_flag & ND_NFSV4) {
   1026 		vers = NFS_VER4;
   1027 		NFSGETATTR_ATTRBIT(&attrbits);
   1028 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_LEASETIME);
   1029 		(void) nfsrv_putattrbit(nd, &attrbits);
   1030 	} else if (nd->nd_flag & ND_NFSV3) {
   1031 		vers = NFS_VER3;
   1032 	}
   1033 	if (syscred)
   1034 		nd->nd_flag |= ND_USEGSSNAME;
   1035 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   1036 	    NFS_PROG, vers, NULL, 1, xidp, NULL);
   1037 	if (error)
   1038 		return (error);
   1039 	if (nd->nd_repstat == 0) {
   1040 		if ((nd->nd_flag & ND_NFSV4) != 0)
   1041 			error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0,
   1042 			    NULL, NULL, NULL, NULL, NULL, 0, NULL, leasep, NULL,
   1043 			    NULL, NULL);
   1044 		else
   1045 			error = nfsm_loadattr(nd, nap);
   1046 	} else
   1047 		error = nd->nd_repstat;
   1048 	mbuf_freem(nd->nd_mrep);
   1049 	return (error);
   1050 }
   1051 
   1052 /*
   1053  * Do an nfs setattr operation.
   1054  */
   1055 APPLESTATIC int
   1056 nfsrpc_setattr(vnode_t vp, struct vattr *vap, NFSACL_T *aclp,
   1057     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *rnap, int *attrflagp,
   1058     void *stuff)
   1059 {
   1060 	int error, expireret = 0, openerr, retrycnt;
   1061 	u_int32_t clidrev = 0, mode;
   1062 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1063 	struct nfsfh *nfhp;
   1064 	nfsv4stateid_t stateid;
   1065 	void *lckp;
   1066 
   1067 	if (nmp->nm_clp != NULL)
   1068 		clidrev = nmp->nm_clp->nfsc_clientidrev;
   1069 	if (vap != NULL && NFSATTRISSET(u_quad_t, vap, va_size))
   1070 		mode = NFSV4OPEN_ACCESSWRITE;
   1071 	else
   1072 		mode = NFSV4OPEN_ACCESSREAD;
   1073 	retrycnt = 0;
   1074 	do {
   1075 		lckp = NULL;
   1076 		openerr = 1;
   1077 		if (NFSHASNFSV4(nmp)) {
   1078 			nfhp = VTONFS(vp)->n_fhp;
   1079 			error = nfscl_getstateid(vp, nfhp->nfh_fh,
   1080 			    nfhp->nfh_len, mode, 0, cred, p, &stateid, &lckp);
   1081 			if (error && vnode_vtype(vp) == VREG &&
   1082 			    (mode == NFSV4OPEN_ACCESSWRITE ||
   1083 			     nfstest_openallsetattr)) {
   1084 				/*
   1085 				 * No Open stateid, so try and open the file
   1086 				 * now.
   1087 				 */
   1088 				if (mode == NFSV4OPEN_ACCESSWRITE)
   1089 					openerr = nfsrpc_open(vp, FWRITE, cred,
   1090 					    p);
   1091 				else
   1092 					openerr = nfsrpc_open(vp, FREAD, cred,
   1093 					    p);
   1094 				if (!openerr)
   1095 					(void) nfscl_getstateid(vp,
   1096 					    nfhp->nfh_fh, nfhp->nfh_len,
   1097 					    mode, 0, cred, p, &stateid, &lckp);
   1098 			}
   1099 		}
   1100 		if (vap != NULL)
   1101 			error = nfsrpc_setattrrpc(vp, vap, &stateid, cred, p,
   1102 			    rnap, attrflagp, stuff);
   1103 		else
   1104 			error = nfsrpc_setaclrpc(vp, cred, p, aclp, &stateid,
   1105 			    stuff);
   1106 		if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
   1107 			nfscl_initiate_recovery(nmp->nm_clp);
   1108 		if (lckp != NULL)
   1109 			nfscl_lockderef(lckp);
   1110 		if (!openerr)
   1111 			(void) nfsrpc_close(vp, 0, p);
   1112 		if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1113 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1114 		    error == NFSERR_OLDSTATEID || error == NFSERR_BADSESSION) {
   1115 			(void) nfs_catnap(PZERO, error, "nfs_setattr");
   1116 		} else if ((error == NFSERR_EXPIRED ||
   1117 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
   1118 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   1119 		}
   1120 		retrycnt++;
   1121 	} while (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1122 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1123 	    error == NFSERR_BADSESSION ||
   1124 	    (error == NFSERR_OLDSTATEID && retrycnt < 20) ||
   1125 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   1126 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
   1127 	if (error && retrycnt >= 4)
   1128 		error = EIO;
   1129 	return (error);
   1130 }
   1131 
   1132 static int
   1133 nfsrpc_setattrrpc(vnode_t vp, struct vattr *vap,
   1134     nfsv4stateid_t *stateidp, struct ucred *cred, NFSPROC_T *p,
   1135     struct nfsvattr *rnap, int *attrflagp, void *stuff)
   1136 {
   1137 	u_int32_t *tl;
   1138 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1139 	int error;
   1140 	nfsattrbit_t attrbits;
   1141 
   1142 	*attrflagp = 0;
   1143 	NFSCL_REQSTART(nd, NFSPROC_SETATTR, vp);
   1144 	if (nd->nd_flag & ND_NFSV4)
   1145 		nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
   1146 	vap->va_type = vnode_vtype(vp);
   1147 	nfscl_fillsattr(nd, vap, vp, NFSSATTR_FULL, 0);
   1148 	if (nd->nd_flag & ND_NFSV3) {
   1149 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1150 		*tl = newnfs_false;
   1151 	} else if (nd->nd_flag & ND_NFSV4) {
   1152 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1153 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1154 		NFSGETATTR_ATTRBIT(&attrbits);
   1155 		(void) nfsrv_putattrbit(nd, &attrbits);
   1156 	}
   1157 	error = nfscl_request(nd, vp, p, cred, stuff);
   1158 	if (error)
   1159 		return (error);
   1160 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
   1161 		error = nfscl_wcc_data(nd, vp, rnap, attrflagp, NULL, stuff);
   1162 	if ((nd->nd_flag & ND_NFSV4) && !error)
   1163 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
   1164 	if (!(nd->nd_flag & ND_NFSV3) && !nd->nd_repstat && !error)
   1165 		error = nfscl_postop_attr(nd, rnap, attrflagp, stuff);
   1166 	mbuf_freem(nd->nd_mrep);
   1167 	if (nd->nd_repstat && !error)
   1168 		error = nd->nd_repstat;
   1169 	return (error);
   1170 }
   1171 
   1172 /*
   1173  * nfs lookup rpc
   1174  */
   1175 APPLESTATIC int
   1176 nfsrpc_lookup(vnode_t dvp, char *name, int len, struct ucred *cred,
   1177     NFSPROC_T *p, struct nfsvattr *dnap, struct nfsvattr *nap,
   1178     struct nfsfh **nfhpp, int *attrflagp, int *dattrflagp, void *stuff)
   1179 {
   1180 	u_int32_t *tl;
   1181 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1182 	struct nfsmount *nmp;
   1183 	struct nfsnode *np;
   1184 	struct nfsfh *nfhp;
   1185 	nfsattrbit_t attrbits;
   1186 	int error = 0, lookupp = 0;
   1187 
   1188 	*attrflagp = 0;
   1189 	*dattrflagp = 0;
   1190 	if (vnode_vtype(dvp) != VDIR)
   1191 		return (ENOTDIR);
   1192 	nmp = VFSTONFS(vnode_mount(dvp));
   1193 	if (len > NFS_MAXNAMLEN)
   1194 		return (ENAMETOOLONG);
   1195 	if (NFSHASNFSV4(nmp) && len == 1 &&
   1196 		name[0] == '.') {
   1197 		/*
   1198 		 * Just return the current dir's fh.
   1199 		 */
   1200 		np = VTONFS(dvp);
   1201 		MALLOC(nfhp, struct nfsfh *, sizeof (struct nfsfh) +
   1202 			np->n_fhp->nfh_len, M_NFSFH, M_WAITOK);
   1203 		nfhp->nfh_len = np->n_fhp->nfh_len;
   1204 		NFSBCOPY(np->n_fhp->nfh_fh, nfhp->nfh_fh, nfhp->nfh_len);
   1205 		*nfhpp = nfhp;
   1206 		return (0);
   1207 	}
   1208 	if (NFSHASNFSV4(nmp) && len == 2 &&
   1209 		name[0] == '.' && name[1] == '.') {
   1210 		lookupp = 1;
   1211 		NFSCL_REQSTART(nd, NFSPROC_LOOKUPP, dvp);
   1212 	} else {
   1213 		NFSCL_REQSTART(nd, NFSPROC_LOOKUP, dvp);
   1214 		(void) nfsm_strtom(nd, name, len);
   1215 	}
   1216 	if (nd->nd_flag & ND_NFSV4) {
   1217 		NFSGETATTR_ATTRBIT(&attrbits);
   1218 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1219 		*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   1220 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1221 		(void) nfsrv_putattrbit(nd, &attrbits);
   1222 	}
   1223 	error = nfscl_request(nd, dvp, p, cred, stuff);
   1224 	if (error)
   1225 		return (error);
   1226 	if (nd->nd_repstat) {
   1227 		/*
   1228 		 * When an NFSv4 Lookupp returns ENOENT, it means that
   1229 		 * the lookup is at the root of an fs, so return this dir.
   1230 		 */
   1231 		if (nd->nd_repstat == NFSERR_NOENT && lookupp) {
   1232 		    np = VTONFS(dvp);
   1233 		    MALLOC(nfhp, struct nfsfh *, sizeof (struct nfsfh) +
   1234 			np->n_fhp->nfh_len, M_NFSFH, M_WAITOK);
   1235 		    nfhp->nfh_len = np->n_fhp->nfh_len;
   1236 		    NFSBCOPY(np->n_fhp->nfh_fh, nfhp->nfh_fh, nfhp->nfh_len);
   1237 		    *nfhpp = nfhp;
   1238 		    mbuf_freem(nd->nd_mrep);
   1239 		    return (0);
   1240 		}
   1241 		if (nd->nd_flag & ND_NFSV3)
   1242 		    error = nfscl_postop_attr(nd, dnap, dattrflagp, stuff);
   1243 		goto nfsmout;
   1244 	}
   1245 	if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4) {
   1246 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1247 		if (*(tl + 1)) {
   1248 			nd->nd_flag |= ND_NOMOREDATA;
   1249 			goto nfsmout;
   1250 		}
   1251 	}
   1252 	error = nfsm_getfh(nd, nfhpp);
   1253 	if (error)
   1254 		goto nfsmout;
   1255 
   1256 	error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   1257 	if ((nd->nd_flag & ND_NFSV3) && !error)
   1258 		error = nfscl_postop_attr(nd, dnap, dattrflagp, stuff);
   1259 nfsmout:
   1260 	mbuf_freem(nd->nd_mrep);
   1261 	if (!error && nd->nd_repstat)
   1262 		error = nd->nd_repstat;
   1263 	return (error);
   1264 }
   1265 
   1266 /*
   1267  * Do a readlink rpc.
   1268  */
   1269 APPLESTATIC int
   1270 nfsrpc_readlink(vnode_t vp, struct uio *uiop, struct ucred *cred,
   1271     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   1272 {
   1273 	u_int32_t *tl;
   1274 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1275 	struct nfsnode *np = VTONFS(vp);
   1276 	nfsattrbit_t attrbits;
   1277 	int error, len, cangetattr = 1;
   1278 
   1279 	*attrflagp = 0;
   1280 	NFSCL_REQSTART(nd, NFSPROC_READLINK, vp);
   1281 	if (nd->nd_flag & ND_NFSV4) {
   1282 		/*
   1283 		 * And do a Getattr op.
   1284 		 */
   1285 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1286 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1287 		NFSGETATTR_ATTRBIT(&attrbits);
   1288 		(void) nfsrv_putattrbit(nd, &attrbits);
   1289 	}
   1290 	error = nfscl_request(nd, vp, p, cred, stuff);
   1291 	if (error)
   1292 		return (error);
   1293 	if (nd->nd_flag & ND_NFSV3)
   1294 		error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   1295 	if (!nd->nd_repstat && !error) {
   1296 		NFSM_STRSIZ(len, NFS_MAXPATHLEN);
   1297 		/*
   1298 		 * This seems weird to me, but must have been added to
   1299 		 * FreeBSD for some reason. The only thing I can think of
   1300 		 * is that there was/is some server that replies with
   1301 		 * more link data than it should?
   1302 		 */
   1303 		if (len == NFS_MAXPATHLEN) {
   1304 			NFSLOCKNODE(np);
   1305 			if (np->n_size > 0 && np->n_size < NFS_MAXPATHLEN) {
   1306 				len = np->n_size;
   1307 				cangetattr = 0;
   1308 			}
   1309 			NFSUNLOCKNODE(np);
   1310 		}
   1311 		error = nfsm_mbufuio(nd, uiop, len);
   1312 		if ((nd->nd_flag & ND_NFSV4) && !error && cangetattr)
   1313 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   1314 	}
   1315 	if (nd->nd_repstat && !error)
   1316 		error = nd->nd_repstat;
   1317 nfsmout:
   1318 	mbuf_freem(nd->nd_mrep);
   1319 	return (error);
   1320 }
   1321 
   1322 /*
   1323  * Read operation.
   1324  */
   1325 APPLESTATIC int
   1326 nfsrpc_read(vnode_t vp, struct uio *uiop, struct ucred *cred,
   1327     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   1328 {
   1329 	int error, expireret = 0, retrycnt;
   1330 	u_int32_t clidrev = 0;
   1331 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1332 	struct nfsnode *np = VTONFS(vp);
   1333 	struct ucred *newcred;
   1334 	struct nfsfh *nfhp = NULL;
   1335 	nfsv4stateid_t stateid;
   1336 	void *lckp;
   1337 
   1338 	if (nmp->nm_clp != NULL)
   1339 		clidrev = nmp->nm_clp->nfsc_clientidrev;
   1340 	newcred = cred;
   1341 	if (NFSHASNFSV4(nmp)) {
   1342 		nfhp = np->n_fhp;
   1343 		newcred = NFSNEWCRED(cred);
   1344 	}
   1345 	retrycnt = 0;
   1346 	do {
   1347 		lckp = NULL;
   1348 		if (NFSHASNFSV4(nmp))
   1349 			(void)nfscl_getstateid(vp, nfhp->nfh_fh, nfhp->nfh_len,
   1350 			    NFSV4OPEN_ACCESSREAD, 0, newcred, p, &stateid,
   1351 			    &lckp);
   1352 		error = nfsrpc_readrpc(vp, uiop, newcred, &stateid, p, nap,
   1353 		    attrflagp, stuff);
   1354 		if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
   1355 			nfscl_initiate_recovery(nmp->nm_clp);
   1356 		if (lckp != NULL)
   1357 			nfscl_lockderef(lckp);
   1358 		if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1359 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1360 		    error == NFSERR_OLDSTATEID || error == NFSERR_BADSESSION) {
   1361 			(void) nfs_catnap(PZERO, error, "nfs_read");
   1362 		} else if ((error == NFSERR_EXPIRED ||
   1363 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
   1364 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   1365 		}
   1366 		retrycnt++;
   1367 	} while (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1368 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1369 	    error == NFSERR_BADSESSION ||
   1370 	    (error == NFSERR_OLDSTATEID && retrycnt < 20) ||
   1371 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   1372 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
   1373 	if (error && retrycnt >= 4)
   1374 		error = EIO;
   1375 	if (NFSHASNFSV4(nmp))
   1376 		NFSFREECRED(newcred);
   1377 	return (error);
   1378 }
   1379 
   1380 /*
   1381  * The actual read RPC.
   1382  */
   1383 static int
   1384 nfsrpc_readrpc(vnode_t vp, struct uio *uiop, struct ucred *cred,
   1385     nfsv4stateid_t *stateidp, NFSPROC_T *p, struct nfsvattr *nap,
   1386     int *attrflagp, void *stuff)
   1387 {
   1388 	u_int32_t *tl;
   1389 	int error = 0, len, retlen, tsiz, eof = 0;
   1390 	struct nfsrv_descript nfsd;
   1391 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1392 	struct nfsrv_descript *nd = &nfsd;
   1393 	int rsize;
   1394 	off_t tmp_off;
   1395 
   1396 	*attrflagp = 0;
   1397 	tsiz = uio_uio_resid(uiop);
   1398 	tmp_off = uiop->uio_offset + tsiz;
   1399 	NFSLOCKMNT(nmp);
   1400 	if (tmp_off > nmp->nm_maxfilesize || tmp_off < uiop->uio_offset) {
   1401 		NFSUNLOCKMNT(nmp);
   1402 		return (EFBIG);
   1403 	}
   1404 	rsize = nmp->nm_rsize;
   1405 	NFSUNLOCKMNT(nmp);
   1406 	nd->nd_mrep = NULL;
   1407 	while (tsiz > 0) {
   1408 		*attrflagp = 0;
   1409 		len = (tsiz > rsize) ? rsize : tsiz;
   1410 		NFSCL_REQSTART(nd, NFSPROC_READ, vp);
   1411 		if (nd->nd_flag & ND_NFSV4)
   1412 			nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
   1413 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED * 3);
   1414 		if (nd->nd_flag & ND_NFSV2) {
   1415 			*tl++ = txdr_unsigned(uiop->uio_offset);
   1416 			*tl++ = txdr_unsigned(len);
   1417 			*tl = 0;
   1418 		} else {
   1419 			txdr_hyper(uiop->uio_offset, tl);
   1420 			*(tl + 2) = txdr_unsigned(len);
   1421 		}
   1422 		/*
   1423 		 * Since I can't do a Getattr for NFSv4 for Write, there
   1424 		 * doesn't seem any point in doing one here, either.
   1425 		 * (See the comment in nfsrpc_writerpc() for more info.)
   1426 		 */
   1427 		error = nfscl_request(nd, vp, p, cred, stuff);
   1428 		if (error)
   1429 			return (error);
   1430 		if (nd->nd_flag & ND_NFSV3) {
   1431 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   1432 		} else if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV2)) {
   1433 			error = nfsm_loadattr(nd, nap);
   1434 			if (!error)
   1435 				*attrflagp = 1;
   1436 		}
   1437 		if (nd->nd_repstat || error) {
   1438 			if (!error)
   1439 				error = nd->nd_repstat;
   1440 			goto nfsmout;
   1441 		}
   1442 		if (nd->nd_flag & ND_NFSV3) {
   1443 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1444 			eof = fxdr_unsigned(int, *(tl + 1));
   1445 		} else if (nd->nd_flag & ND_NFSV4) {
   1446 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   1447 			eof = fxdr_unsigned(int, *tl);
   1448 		}
   1449 		NFSM_STRSIZ(retlen, len);
   1450 		error = nfsm_mbufuio(nd, uiop, retlen);
   1451 		if (error)
   1452 			goto nfsmout;
   1453 		mbuf_freem(nd->nd_mrep);
   1454 		nd->nd_mrep = NULL;
   1455 		tsiz -= retlen;
   1456 		if (!(nd->nd_flag & ND_NFSV2)) {
   1457 			if (eof || retlen == 0)
   1458 				tsiz = 0;
   1459 		} else if (retlen < len)
   1460 			tsiz = 0;
   1461 	}
   1462 	return (0);
   1463 nfsmout:
   1464 	if (nd->nd_mrep != NULL)
   1465 		mbuf_freem(nd->nd_mrep);
   1466 	return (error);
   1467 }
   1468 
   1469 /*
   1470  * nfs write operation
   1471  * When called_from_strategy != 0, it should return EIO for an error that
   1472  * indicates recovery is in progress, so that the buffer will be left
   1473  * dirty and be written back to the server later. If it loops around,
   1474  * the recovery thread could get stuck waiting for the buffer and recovery
   1475  * will then deadlock.
   1476  */
   1477 APPLESTATIC int
   1478 nfsrpc_write(vnode_t vp, struct uio *uiop, int *iomode, int *must_commit,
   1479     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   1480     void *stuff, int called_from_strategy)
   1481 {
   1482 	int error, expireret = 0, retrycnt, nostateid;
   1483 	u_int32_t clidrev = 0;
   1484 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1485 	struct nfsnode *np = VTONFS(vp);
   1486 	struct ucred *newcred;
   1487 	struct nfsfh *nfhp = NULL;
   1488 	nfsv4stateid_t stateid;
   1489 	void *lckp;
   1490 
   1491 	*must_commit = 0;
   1492 	if (nmp->nm_clp != NULL)
   1493 		clidrev = nmp->nm_clp->nfsc_clientidrev;
   1494 	newcred = cred;
   1495 	if (NFSHASNFSV4(nmp)) {
   1496 		newcred = NFSNEWCRED(cred);
   1497 		nfhp = np->n_fhp;
   1498 	}
   1499 	retrycnt = 0;
   1500 	do {
   1501 		lckp = NULL;
   1502 		nostateid = 0;
   1503 		if (NFSHASNFSV4(nmp)) {
   1504 			(void)nfscl_getstateid(vp, nfhp->nfh_fh, nfhp->nfh_len,
   1505 			    NFSV4OPEN_ACCESSWRITE, 0, newcred, p, &stateid,
   1506 			    &lckp);
   1507 			if (stateid.other[0] == 0 && stateid.other[1] == 0 &&
   1508 			    stateid.other[2] == 0) {
   1509 				nostateid = 1;
   1510 				NFSCL_DEBUG(1, "stateid0 in write\n");
   1511 			}
   1512 		}
   1513 
   1514 		/*
   1515 		 * If there is no stateid for NFSv4, it means this is an
   1516 		 * extraneous write after close. Basically a poorly
   1517 		 * implemented buffer cache. Just don't do the write.
   1518 		 */
   1519 		if (nostateid)
   1520 			error = 0;
   1521 		else
   1522 			error = nfsrpc_writerpc(vp, uiop, iomode, must_commit,
   1523 			    newcred, &stateid, p, nap, attrflagp, stuff);
   1524 		if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
   1525 			nfscl_initiate_recovery(nmp->nm_clp);
   1526 		if (lckp != NULL)
   1527 			nfscl_lockderef(lckp);
   1528 		if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1529 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1530 		    error == NFSERR_OLDSTATEID || error == NFSERR_BADSESSION) {
   1531 			(void) nfs_catnap(PZERO, error, "nfs_write");
   1532 		} else if ((error == NFSERR_EXPIRED ||
   1533 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
   1534 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   1535 		}
   1536 		retrycnt++;
   1537 	} while (error == NFSERR_GRACE || error == NFSERR_DELAY ||
   1538 	    ((error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION ||
   1539 	      error == NFSERR_STALEDONTRECOVER) && called_from_strategy == 0) ||
   1540 	    (error == NFSERR_OLDSTATEID && retrycnt < 20) ||
   1541 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   1542 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
   1543 	if (error != 0 && (retrycnt >= 4 ||
   1544 	    ((error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION ||
   1545 	      error == NFSERR_STALEDONTRECOVER) && called_from_strategy != 0)))
   1546 		error = EIO;
   1547 	if (NFSHASNFSV4(nmp))
   1548 		NFSFREECRED(newcred);
   1549 	return (error);
   1550 }
   1551 
   1552 /*
   1553  * The actual write RPC.
   1554  */
   1555 static int
   1556 nfsrpc_writerpc(vnode_t vp, struct uio *uiop, int *iomode,
   1557     int *must_commit, struct ucred *cred, nfsv4stateid_t *stateidp,
   1558     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   1559 {
   1560 	u_int32_t *tl;
   1561 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1562 	struct nfsnode *np = VTONFS(vp);
   1563 	int error = 0, len, tsiz, rlen, commit, committed = NFSWRITE_FILESYNC;
   1564 	int wccflag = 0, wsize;
   1565 	int32_t backup;
   1566 	struct nfsrv_descript nfsd;
   1567 	struct nfsrv_descript *nd = &nfsd;
   1568 	nfsattrbit_t attrbits;
   1569 	off_t tmp_off;
   1570 
   1571 	KASSERT(uiop->uio_iovcnt == 1, ("nfs: writerpc iovcnt > 1"));
   1572 	*attrflagp = 0;
   1573 	tsiz = uio_uio_resid(uiop);
   1574 	tmp_off = uiop->uio_offset + tsiz;
   1575 	NFSLOCKMNT(nmp);
   1576 	if (tmp_off > nmp->nm_maxfilesize || tmp_off < uiop->uio_offset) {
   1577 		NFSUNLOCKMNT(nmp);
   1578 		return (EFBIG);
   1579 	}
   1580 	wsize = nmp->nm_wsize;
   1581 	NFSUNLOCKMNT(nmp);
   1582 	nd->nd_mrep = NULL;	/* NFSv2 sometimes does a write with */
   1583 	nd->nd_repstat = 0;	/* uio_resid == 0, so the while is not done */
   1584 	while (tsiz > 0) {
   1585 		*attrflagp = 0;
   1586 		len = (tsiz > wsize) ? wsize : tsiz;
   1587 		NFSCL_REQSTART(nd, NFSPROC_WRITE, vp);
   1588 		if (nd->nd_flag & ND_NFSV4) {
   1589 			nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
   1590 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER+2*NFSX_UNSIGNED);
   1591 			txdr_hyper(uiop->uio_offset, tl);
   1592 			tl += 2;
   1593 			*tl++ = txdr_unsigned(*iomode);
   1594 			*tl = txdr_unsigned(len);
   1595 		} else if (nd->nd_flag & ND_NFSV3) {
   1596 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER+3*NFSX_UNSIGNED);
   1597 			txdr_hyper(uiop->uio_offset, tl);
   1598 			tl += 2;
   1599 			*tl++ = txdr_unsigned(len);
   1600 			*tl++ = txdr_unsigned(*iomode);
   1601 			*tl = txdr_unsigned(len);
   1602 		} else {
   1603 			u_int32_t x;
   1604 
   1605 			NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
   1606 			/*
   1607 			 * Not sure why someone changed this, since the
   1608 			 * RFC clearly states that "beginoffset" and
   1609 			 * "totalcount" are ignored, but it wouldn't
   1610 			 * surprise me if there's a busted server out there.
   1611 			 */
   1612 			/* Set both "begin" and "current" to non-garbage. */
   1613 			x = txdr_unsigned((u_int32_t)uiop->uio_offset);
   1614 			*tl++ = x;      /* "begin offset" */
   1615 			*tl++ = x;      /* "current offset" */
   1616 			x = txdr_unsigned(len);
   1617 			*tl++ = x;      /* total to this offset */
   1618 			*tl = x;        /* size of this write */
   1619 
   1620 		}
   1621 		nfsm_uiombuf(nd, uiop, len);
   1622 		/*
   1623 		 * Although it is tempting to do a normal Getattr Op in the
   1624 		 * NFSv4 compound, the result can be a nearly hung client
   1625 		 * system if the Getattr asks for Owner and/or OwnerGroup.
   1626 		 * It occurs when the client can't map either the Owner or
   1627 		 * Owner_group name in the Getattr reply to a uid/gid. When
   1628 		 * there is a cache miss, the kernel does an upcall to the
   1629 		 * nfsuserd. Then, it can try and read the local /etc/passwd
   1630 		 * or /etc/group file. It can then block in getnewbuf(),
   1631 		 * waiting for dirty writes to be pushed to the NFS server.
   1632 		 * The only reason this doesn't result in a complete
   1633 		 * deadlock, is that the upcall times out and allows
   1634 		 * the write to complete. However, progress is so slow
   1635 		 * that it might just as well be deadlocked.
   1636 		 * As such, we get the rest of the attributes, but not
   1637 		 * Owner or Owner_group.
   1638 		 * nb: nfscl_loadattrcache() needs to be told that these
   1639 		 *     partial attributes from a write rpc are being
   1640 		 *     passed in, via a argument flag.
   1641 		 */
   1642 		if (nd->nd_flag & ND_NFSV4) {
   1643 			NFSWRITEGETATTR_ATTRBIT(&attrbits);
   1644 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1645 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1646 			(void) nfsrv_putattrbit(nd, &attrbits);
   1647 		}
   1648 		error = nfscl_request(nd, vp, p, cred, stuff);
   1649 		if (error)
   1650 			return (error);
   1651 		if (nd->nd_repstat) {
   1652 			/*
   1653 			 * In case the rpc gets retried, roll
   1654 			 * the uio fileds changed by nfsm_uiombuf()
   1655 			 * back.
   1656 			 */
   1657 			uiop->uio_offset -= len;
   1658 			uio_uio_resid_add(uiop, len);
   1659 			uio_iov_base_add(uiop, -len);
   1660 			uio_iov_len_add(uiop, len);
   1661 		}
   1662 		if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
   1663 			error = nfscl_wcc_data(nd, vp, nap, attrflagp,
   1664 			    &wccflag, stuff);
   1665 			if (error)
   1666 				goto nfsmout;
   1667 		}
   1668 		if (!nd->nd_repstat) {
   1669 			if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
   1670 				NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED
   1671 					+ NFSX_VERF);
   1672 				rlen = fxdr_unsigned(int, *tl++);
   1673 				if (rlen == 0) {
   1674 					error = NFSERR_IO;
   1675 					goto nfsmout;
   1676 				} else if (rlen < len) {
   1677 					backup = len - rlen;
   1678 					uio_iov_base_add(uiop, -(backup));
   1679 					uio_iov_len_add(uiop, backup);
   1680 					uiop->uio_offset -= backup;
   1681 					uio_uio_resid_add(uiop, backup);
   1682 					len = rlen;
   1683 				}
   1684 				commit = fxdr_unsigned(int, *tl++);
   1685 
   1686 				/*
   1687 				 * Return the lowest committment level
   1688 				 * obtained by any of the RPCs.
   1689 				 */
   1690 				if (committed == NFSWRITE_FILESYNC)
   1691 					committed = commit;
   1692 				else if (committed == NFSWRITE_DATASYNC &&
   1693 					commit == NFSWRITE_UNSTABLE)
   1694 					committed = commit;
   1695 				NFSLOCKMNT(nmp);
   1696 				if (!NFSHASWRITEVERF(nmp)) {
   1697 					NFSBCOPY((caddr_t)tl,
   1698 					    (caddr_t)&nmp->nm_verf[0],
   1699 					    NFSX_VERF);
   1700 					NFSSETWRITEVERF(nmp);
   1701 	    			} else if (NFSBCMP(tl, nmp->nm_verf,
   1702 				    NFSX_VERF)) {
   1703 					*must_commit = 1;
   1704 					NFSBCOPY(tl, nmp->nm_verf, NFSX_VERF);
   1705 				}
   1706 				NFSUNLOCKMNT(nmp);
   1707 			}
   1708 			if (nd->nd_flag & ND_NFSV4)
   1709 				NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1710 			if (nd->nd_flag & (ND_NFSV2 | ND_NFSV4)) {
   1711 				error = nfsm_loadattr(nd, nap);
   1712 				if (!error)
   1713 					*attrflagp = NFS_LATTR_NOSHRINK;
   1714 			}
   1715 		} else {
   1716 			error = nd->nd_repstat;
   1717 		}
   1718 		if (error)
   1719 			goto nfsmout;
   1720 		NFSWRITERPC_SETTIME(wccflag, np, (nd->nd_flag & ND_NFSV4));
   1721 		mbuf_freem(nd->nd_mrep);
   1722 		nd->nd_mrep = NULL;
   1723 		tsiz -= len;
   1724 	}
   1725 nfsmout:
   1726 	if (nd->nd_mrep != NULL)
   1727 		mbuf_freem(nd->nd_mrep);
   1728 	*iomode = committed;
   1729 	if (nd->nd_repstat && !error)
   1730 		error = nd->nd_repstat;
   1731 	return (error);
   1732 }
   1733 
   1734 /*
   1735  * nfs mknod rpc
   1736  * For NFS v2 this is a kludge. Use a create rpc but with the IFMT bits of the
   1737  * mode set to specify the file type and the size field for rdev.
   1738  */
   1739 APPLESTATIC int
   1740 nfsrpc_mknod(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   1741     u_int32_t rdev, enum vtype vtyp, struct ucred *cred, NFSPROC_T *p,
   1742     struct nfsvattr *dnap, struct nfsvattr *nnap, struct nfsfh **nfhpp,
   1743     int *attrflagp, int *dattrflagp, void *dstuff)
   1744 {
   1745 	u_int32_t *tl;
   1746 	int error = 0;
   1747 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1748 	nfsattrbit_t attrbits;
   1749 
   1750 	*nfhpp = NULL;
   1751 	*attrflagp = 0;
   1752 	*dattrflagp = 0;
   1753 	if (namelen > NFS_MAXNAMLEN)
   1754 		return (ENAMETOOLONG);
   1755 	NFSCL_REQSTART(nd, NFSPROC_MKNOD, dvp);
   1756 	if (nd->nd_flag & ND_NFSV4) {
   1757 		if (vtyp == VBLK || vtyp == VCHR) {
   1758 			NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
   1759 			*tl++ = vtonfsv34_type(vtyp);
   1760 			*tl++ = txdr_unsigned(NFSMAJOR(rdev));
   1761 			*tl = txdr_unsigned(NFSMINOR(rdev));
   1762 		} else {
   1763 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1764 			*tl = vtonfsv34_type(vtyp);
   1765 		}
   1766 	}
   1767 	(void) nfsm_strtom(nd, name, namelen);
   1768 	if (nd->nd_flag & ND_NFSV3) {
   1769 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1770 		*tl = vtonfsv34_type(vtyp);
   1771 	}
   1772 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
   1773 		nfscl_fillsattr(nd, vap, dvp, 0, 0);
   1774 	if ((nd->nd_flag & ND_NFSV3) &&
   1775 	    (vtyp == VCHR || vtyp == VBLK)) {
   1776 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1777 		*tl++ = txdr_unsigned(NFSMAJOR(rdev));
   1778 		*tl = txdr_unsigned(NFSMINOR(rdev));
   1779 	}
   1780 	if (nd->nd_flag & ND_NFSV4) {
   1781 		NFSGETATTR_ATTRBIT(&attrbits);
   1782 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1783 		*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   1784 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1785 		(void) nfsrv_putattrbit(nd, &attrbits);
   1786 	}
   1787 	if (nd->nd_flag & ND_NFSV2)
   1788 		nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZERDEV, rdev);
   1789 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   1790 	if (error)
   1791 		return (error);
   1792 	if (nd->nd_flag & ND_NFSV4)
   1793 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   1794 	if (!nd->nd_repstat) {
   1795 		if (nd->nd_flag & ND_NFSV4) {
   1796 			NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
   1797 			error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
   1798 			if (error)
   1799 				goto nfsmout;
   1800 		}
   1801 		error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   1802 		if (error)
   1803 			goto nfsmout;
   1804 	}
   1805 	if (nd->nd_flag & ND_NFSV3)
   1806 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   1807 	if (!error && nd->nd_repstat)
   1808 		error = nd->nd_repstat;
   1809 nfsmout:
   1810 	mbuf_freem(nd->nd_mrep);
   1811 	return (error);
   1812 }
   1813 
   1814 /*
   1815  * nfs file create call
   1816  * Mostly just call the approriate routine. (I separated out v4, so that
   1817  * error recovery wouldn't be as difficult.)
   1818  */
   1819 APPLESTATIC int
   1820 nfsrpc_create(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   1821     nfsquad_t cverf, int fmode, struct ucred *cred, NFSPROC_T *p,
   1822     struct nfsvattr *dnap, struct nfsvattr *nnap, struct nfsfh **nfhpp,
   1823     int *attrflagp, int *dattrflagp, void *dstuff)
   1824 {
   1825 	int error = 0, newone, expireret = 0, retrycnt, unlocked;
   1826 	struct nfsclowner *owp;
   1827 	struct nfscldeleg *dp;
   1828 	struct nfsmount *nmp = VFSTONFS(vnode_mount(dvp));
   1829 	u_int32_t clidrev;
   1830 
   1831 	if (NFSHASNFSV4(nmp)) {
   1832 	    retrycnt = 0;
   1833 	    do {
   1834 		dp = NULL;
   1835 		error = nfscl_open(dvp, NULL, 0, (NFSV4OPEN_ACCESSWRITE |
   1836 		    NFSV4OPEN_ACCESSREAD), 0, cred, p, &owp, NULL, &newone,
   1837 		    NULL, 1);
   1838 		if (error)
   1839 			return (error);
   1840 		if (nmp->nm_clp != NULL)
   1841 			clidrev = nmp->nm_clp->nfsc_clientidrev;
   1842 		else
   1843 			clidrev = 0;
   1844 		error = nfsrpc_createv4(dvp, name, namelen, vap, cverf, fmode,
   1845 		  owp, &dp, cred, p, dnap, nnap, nfhpp, attrflagp, dattrflagp,
   1846 		  dstuff, &unlocked);
   1847 		/*
   1848 		 * There is no need to invalidate cached attributes here,
   1849 		 * since new post-delegation issue attributes are always
   1850 		 * returned by nfsrpc_createv4() and these will update the
   1851 		 * attribute cache.
   1852 		 */
   1853 		if (dp != NULL)
   1854 			(void) nfscl_deleg(nmp->nm_mountp, owp->nfsow_clp,
   1855 			    (*nfhpp)->nfh_fh, (*nfhpp)->nfh_len, cred, p, &dp);
   1856 		nfscl_ownerrelease(owp, error, newone, unlocked);
   1857 		if (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
   1858 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1859 		    error == NFSERR_BADSESSION) {
   1860 			(void) nfs_catnap(PZERO, error, "nfs_open");
   1861 		} else if ((error == NFSERR_EXPIRED ||
   1862 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
   1863 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   1864 			retrycnt++;
   1865 		}
   1866 	    } while (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
   1867 		error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1868 		error == NFSERR_BADSESSION ||
   1869 		((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   1870 		 expireret == 0 && clidrev != 0 && retrycnt < 4));
   1871 	    if (error && retrycnt >= 4)
   1872 		    error = EIO;
   1873 	} else {
   1874 		error = nfsrpc_createv23(dvp, name, namelen, vap, cverf,
   1875 		    fmode, cred, p, dnap, nnap, nfhpp, attrflagp, dattrflagp,
   1876 		    dstuff);
   1877 	}
   1878 	return (error);
   1879 }
   1880 
   1881 /*
   1882  * The create rpc for v2 and 3.
   1883  */
   1884 static int
   1885 nfsrpc_createv23(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   1886     nfsquad_t cverf, int fmode, struct ucred *cred, NFSPROC_T *p,
   1887     struct nfsvattr *dnap, struct nfsvattr *nnap, struct nfsfh **nfhpp,
   1888     int *attrflagp, int *dattrflagp, void *dstuff)
   1889 {
   1890 	u_int32_t *tl;
   1891 	int error = 0;
   1892 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1893 
   1894 	*nfhpp = NULL;
   1895 	*attrflagp = 0;
   1896 	*dattrflagp = 0;
   1897 	if (namelen > NFS_MAXNAMLEN)
   1898 		return (ENAMETOOLONG);
   1899 	NFSCL_REQSTART(nd, NFSPROC_CREATE, dvp);
   1900 	(void) nfsm_strtom(nd, name, namelen);
   1901 	if (nd->nd_flag & ND_NFSV3) {
   1902 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1903 		if (fmode & O_EXCL) {
   1904 			*tl = txdr_unsigned(NFSCREATE_EXCLUSIVE);
   1905 			NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
   1906 			*tl++ = cverf.lval[0];
   1907 			*tl = cverf.lval[1];
   1908 		} else {
   1909 			*tl = txdr_unsigned(NFSCREATE_UNCHECKED);
   1910 			nfscl_fillsattr(nd, vap, dvp, 0, 0);
   1911 		}
   1912 	} else {
   1913 		nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZE0, 0);
   1914 	}
   1915 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   1916 	if (error)
   1917 		return (error);
   1918 	if (nd->nd_repstat == 0) {
   1919 		error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   1920 		if (error)
   1921 			goto nfsmout;
   1922 	}
   1923 	if (nd->nd_flag & ND_NFSV3)
   1924 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   1925 	if (nd->nd_repstat != 0 && error == 0)
   1926 		error = nd->nd_repstat;
   1927 nfsmout:
   1928 	mbuf_freem(nd->nd_mrep);
   1929 	return (error);
   1930 }
   1931 
   1932 static int
   1933 nfsrpc_createv4(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   1934     nfsquad_t cverf, int fmode, struct nfsclowner *owp, struct nfscldeleg **dpp,
   1935     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
   1936     struct nfsvattr *nnap, struct nfsfh **nfhpp, int *attrflagp,
   1937     int *dattrflagp, void *dstuff, int *unlockedp)
   1938 {
   1939 	u_int32_t *tl;
   1940 	int error = 0, deleg, newone, ret, acesize, limitby;
   1941 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1942 	struct nfsclopen *op;
   1943 	struct nfscldeleg *dp = NULL;
   1944 	struct nfsnode *np;
   1945 	struct nfsfh *nfhp;
   1946 	nfsattrbit_t attrbits;
   1947 	nfsv4stateid_t stateid;
   1948 	u_int32_t rflags;
   1949 	struct nfsmount *nmp;
   1950 
   1951 	nmp = VFSTONFS(dvp->v_mount);
   1952 	*unlockedp = 0;
   1953 	*nfhpp = NULL;
   1954 	*dpp = NULL;
   1955 	*attrflagp = 0;
   1956 	*dattrflagp = 0;
   1957 	if (namelen > NFS_MAXNAMLEN)
   1958 		return (ENAMETOOLONG);
   1959 	NFSCL_REQSTART(nd, NFSPROC_CREATE, dvp);
   1960 	/*
   1961 	 * For V4, this is actually an Open op.
   1962 	 */
   1963 	NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
   1964 	*tl++ = txdr_unsigned(owp->nfsow_seqid);
   1965 	*tl++ = txdr_unsigned(NFSV4OPEN_ACCESSWRITE |
   1966 	    NFSV4OPEN_ACCESSREAD);
   1967 	*tl++ = txdr_unsigned(NFSV4OPEN_DENYNONE);
   1968 	*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   1969 	*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   1970 	(void) nfsm_strtom(nd, owp->nfsow_owner, NFSV4CL_LOCKNAMELEN);
   1971 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1972 	*tl++ = txdr_unsigned(NFSV4OPEN_CREATE);
   1973 	if (fmode & O_EXCL) {
   1974 		if (NFSHASNFSV4N(nmp)) {
   1975 			if (NFSHASSESSPERSIST(nmp)) {
   1976 				/* Use GUARDED for persistent sessions. */
   1977 				*tl = txdr_unsigned(NFSCREATE_GUARDED);
   1978 				nfscl_fillsattr(nd, vap, dvp, 0, 0);
   1979 			} else {
   1980 				/* Otherwise, use EXCLUSIVE4_1. */
   1981 				*tl = txdr_unsigned(NFSCREATE_EXCLUSIVE41);
   1982 				NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
   1983 				*tl++ = cverf.lval[0];
   1984 				*tl = cverf.lval[1];
   1985 				nfscl_fillsattr(nd, vap, dvp, 0, 0);
   1986 			}
   1987 		} else {
   1988 			/* NFSv4.0 */
   1989 			*tl = txdr_unsigned(NFSCREATE_EXCLUSIVE);
   1990 			NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
   1991 			*tl++ = cverf.lval[0];
   1992 			*tl = cverf.lval[1];
   1993 		}
   1994 	} else {
   1995 		*tl = txdr_unsigned(NFSCREATE_UNCHECKED);
   1996 		nfscl_fillsattr(nd, vap, dvp, 0, 0);
   1997 	}
   1998 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1999 	*tl = txdr_unsigned(NFSV4OPEN_CLAIMNULL);
   2000 	(void) nfsm_strtom(nd, name, namelen);
   2001 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2002 	*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   2003 	*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2004 	NFSGETATTR_ATTRBIT(&attrbits);
   2005 	(void) nfsrv_putattrbit(nd, &attrbits);
   2006 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2007 	if (error)
   2008 		return (error);
   2009 	error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2010 	if (error)
   2011 		goto nfsmout;
   2012 	NFSCL_INCRSEQID(owp->nfsow_seqid, nd);
   2013 	if (nd->nd_repstat == 0) {
   2014 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
   2015 		    6 * NFSX_UNSIGNED);
   2016 		stateid.seqid = *tl++;
   2017 		stateid.other[0] = *tl++;
   2018 		stateid.other[1] = *tl++;
   2019 		stateid.other[2] = *tl;
   2020 		rflags = fxdr_unsigned(u_int32_t, *(tl + 6));
   2021 		(void) nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
   2022 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   2023 		deleg = fxdr_unsigned(int, *tl);
   2024 		if (deleg == NFSV4OPEN_DELEGATEREAD ||
   2025 		    deleg == NFSV4OPEN_DELEGATEWRITE) {
   2026 			if (!(owp->nfsow_clp->nfsc_flags &
   2027 			      NFSCLFLAGS_FIRSTDELEG))
   2028 				owp->nfsow_clp->nfsc_flags |=
   2029 				  (NFSCLFLAGS_FIRSTDELEG | NFSCLFLAGS_GOTDELEG);
   2030 			MALLOC(dp, struct nfscldeleg *,
   2031 			    sizeof (struct nfscldeleg) + NFSX_V4FHMAX,
   2032 			    M_NFSCLDELEG, M_WAITOK);
   2033 			LIST_INIT(&dp->nfsdl_owner);
   2034 			LIST_INIT(&dp->nfsdl_lock);
   2035 			dp->nfsdl_clp = owp->nfsow_clp;
   2036 			newnfs_copyincred(cred, &dp->nfsdl_cred);
   2037 			nfscl_lockinit(&dp->nfsdl_rwlock);
   2038 			NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
   2039 			    NFSX_UNSIGNED);
   2040 			dp->nfsdl_stateid.seqid = *tl++;
   2041 			dp->nfsdl_stateid.other[0] = *tl++;
   2042 			dp->nfsdl_stateid.other[1] = *tl++;
   2043 			dp->nfsdl_stateid.other[2] = *tl++;
   2044 			ret = fxdr_unsigned(int, *tl);
   2045 			if (deleg == NFSV4OPEN_DELEGATEWRITE) {
   2046 				dp->nfsdl_flags = NFSCLDL_WRITE;
   2047 				/*
   2048 				 * Indicates how much the file can grow.
   2049 				 */
   2050 				NFSM_DISSECT(tl, u_int32_t *,
   2051 				    3 * NFSX_UNSIGNED);
   2052 				limitby = fxdr_unsigned(int, *tl++);
   2053 				switch (limitby) {
   2054 				case NFSV4OPEN_LIMITSIZE:
   2055 					dp->nfsdl_sizelimit = fxdr_hyper(tl);
   2056 					break;
   2057 				case NFSV4OPEN_LIMITBLOCKS:
   2058 					dp->nfsdl_sizelimit =
   2059 					    fxdr_unsigned(u_int64_t, *tl++);
   2060 					dp->nfsdl_sizelimit *=
   2061 					    fxdr_unsigned(u_int64_t, *tl);
   2062 					break;
   2063 				default:
   2064 					error = NFSERR_BADXDR;
   2065 					goto nfsmout;
   2066 				};
   2067 			} else {
   2068 				dp->nfsdl_flags = NFSCLDL_READ;
   2069 			}
   2070 			if (ret)
   2071 				dp->nfsdl_flags |= NFSCLDL_RECALL;
   2072 			error = nfsrv_dissectace(nd, &dp->nfsdl_ace, &ret,
   2073 			    &acesize, p);
   2074 			if (error)
   2075 				goto nfsmout;
   2076 		} else if (deleg != NFSV4OPEN_DELEGATENONE) {
   2077 			error = NFSERR_BADXDR;
   2078 			goto nfsmout;
   2079 		}
   2080 		error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   2081 		if (error)
   2082 			goto nfsmout;
   2083 		if (dp != NULL && *attrflagp) {
   2084 			dp->nfsdl_change = nnap->na_filerev;
   2085 			dp->nfsdl_modtime = nnap->na_mtime;
   2086 			dp->nfsdl_flags |= NFSCLDL_MODTIMESET;
   2087 		}
   2088 		/*
   2089 		 * We can now complete the Open state.
   2090 		 */
   2091 		nfhp = *nfhpp;
   2092 		if (dp != NULL) {
   2093 			dp->nfsdl_fhlen = nfhp->nfh_len;
   2094 			NFSBCOPY(nfhp->nfh_fh, dp->nfsdl_fh, nfhp->nfh_len);
   2095 		}
   2096 		/*
   2097 		 * Get an Open structure that will be
   2098 		 * attached to the OpenOwner, acquired already.
   2099 		 */
   2100 		error = nfscl_open(dvp, nfhp->nfh_fh, nfhp->nfh_len,
   2101 		    (NFSV4OPEN_ACCESSWRITE | NFSV4OPEN_ACCESSREAD), 0,
   2102 		    cred, p, NULL, &op, &newone, NULL, 0);
   2103 		if (error)
   2104 			goto nfsmout;
   2105 		op->nfso_stateid = stateid;
   2106 		newnfs_copyincred(cred, &op->nfso_cred);
   2107 		if ((rflags & NFSV4OPEN_RESULTCONFIRM)) {
   2108 		    do {
   2109 			ret = nfsrpc_openconfirm(dvp, nfhp->nfh_fh,
   2110 			    nfhp->nfh_len, op, cred, p);
   2111 			if (ret == NFSERR_DELAY)
   2112 			    (void) nfs_catnap(PZERO, ret, "nfs_create");
   2113 		    } while (ret == NFSERR_DELAY);
   2114 		    error = ret;
   2115 		}
   2116 
   2117 		/*
   2118 		 * If the server is handing out delegations, but we didn't
   2119 		 * get one because an OpenConfirm was required, try the
   2120 		 * Open again, to get a delegation. This is a harmless no-op,
   2121 		 * from a server's point of view.
   2122 		 */
   2123 		if ((rflags & NFSV4OPEN_RESULTCONFIRM) &&
   2124 		    (owp->nfsow_clp->nfsc_flags & NFSCLFLAGS_GOTDELEG) &&
   2125 		    !error && dp == NULL) {
   2126 		    np = VTONFS(dvp);
   2127 		    do {
   2128 			ret = nfsrpc_openrpc(VFSTONFS(vnode_mount(dvp)), dvp,
   2129 			    np->n_fhp->nfh_fh, np->n_fhp->nfh_len,
   2130 			    nfhp->nfh_fh, nfhp->nfh_len,
   2131 			    (NFSV4OPEN_ACCESSWRITE | NFSV4OPEN_ACCESSREAD), op,
   2132 			    name, namelen, &dp, 0, 0x0, cred, p, 0, 1);
   2133 			if (ret == NFSERR_DELAY)
   2134 			    (void) nfs_catnap(PZERO, ret, "nfs_crt2");
   2135 		    } while (ret == NFSERR_DELAY);
   2136 		    if (ret) {
   2137 			if (dp != NULL)
   2138 				FREE((caddr_t)dp, M_NFSCLDELEG);
   2139 			if (ret == NFSERR_STALECLIENTID ||
   2140 			    ret == NFSERR_STALEDONTRECOVER ||
   2141 			    ret == NFSERR_BADSESSION)
   2142 				error = ret;
   2143 		    }
   2144 		}
   2145 		nfscl_openrelease(op, error, newone);
   2146 		*unlockedp = 1;
   2147 	}
   2148 	if (nd->nd_repstat != 0 && error == 0)
   2149 		error = nd->nd_repstat;
   2150 	if (error == NFSERR_STALECLIENTID || error == NFSERR_BADSESSION)
   2151 		nfscl_initiate_recovery(owp->nfsow_clp);
   2152 nfsmout:
   2153 	if (!error)
   2154 		*dpp = dp;
   2155 	else if (dp != NULL)
   2156 		FREE((caddr_t)dp, M_NFSCLDELEG);
   2157 	mbuf_freem(nd->nd_mrep);
   2158 	return (error);
   2159 }
   2160 
   2161 /*
   2162  * Nfs remove rpc
   2163  */
   2164 APPLESTATIC int
   2165 nfsrpc_remove(vnode_t dvp, char *name, int namelen, vnode_t vp,
   2166     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap, int *dattrflagp,
   2167     void *dstuff)
   2168 {
   2169 	u_int32_t *tl;
   2170 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2171 	struct nfsnode *np;
   2172 	struct nfsmount *nmp;
   2173 	nfsv4stateid_t dstateid;
   2174 	int error, ret = 0, i;
   2175 
   2176 	*dattrflagp = 0;
   2177 	if (namelen > NFS_MAXNAMLEN)
   2178 		return (ENAMETOOLONG);
   2179 	nmp = VFSTONFS(vnode_mount(dvp));
   2180 tryagain:
   2181 	if (NFSHASNFSV4(nmp) && ret == 0) {
   2182 		ret = nfscl_removedeleg(vp, p, &dstateid);
   2183 		if (ret == 1) {
   2184 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGREMOVE, vp);
   2185 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID +
   2186 			    NFSX_UNSIGNED);
   2187 			if (NFSHASNFSV4N(nmp))
   2188 				*tl++ = 0;
   2189 			else
   2190 				*tl++ = dstateid.seqid;
   2191 			*tl++ = dstateid.other[0];
   2192 			*tl++ = dstateid.other[1];
   2193 			*tl++ = dstateid.other[2];
   2194 			*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2195 			np = VTONFS(dvp);
   2196 			(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh,
   2197 			    np->n_fhp->nfh_len, 0);
   2198 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2199 			*tl = txdr_unsigned(NFSV4OP_REMOVE);
   2200 		}
   2201 	} else {
   2202 		ret = 0;
   2203 	}
   2204 	if (ret == 0)
   2205 		NFSCL_REQSTART(nd, NFSPROC_REMOVE, dvp);
   2206 	(void) nfsm_strtom(nd, name, namelen);
   2207 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2208 	if (error)
   2209 		return (error);
   2210 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
   2211 		/* For NFSv4, parse out any Delereturn replies. */
   2212 		if (ret > 0 && nd->nd_repstat != 0 &&
   2213 		    (nd->nd_flag & ND_NOMOREDATA)) {
   2214 			/*
   2215 			 * If the Delegreturn failed, try again without
   2216 			 * it. The server will Recall, as required.
   2217 			 */
   2218 			mbuf_freem(nd->nd_mrep);
   2219 			goto tryagain;
   2220 		}
   2221 		for (i = 0; i < (ret * 2); i++) {
   2222 			if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) ==
   2223 			    ND_NFSV4) {
   2224 			    NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2225 			    if (*(tl + 1))
   2226 				nd->nd_flag |= ND_NOMOREDATA;
   2227 			}
   2228 		}
   2229 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2230 	}
   2231 	if (nd->nd_repstat && !error)
   2232 		error = nd->nd_repstat;
   2233 nfsmout:
   2234 	mbuf_freem(nd->nd_mrep);
   2235 	return (error);
   2236 }
   2237 
   2238 /*
   2239  * Do an nfs rename rpc.
   2240  */
   2241 APPLESTATIC int
   2242 nfsrpc_rename(vnode_t fdvp, vnode_t fvp, char *fnameptr, int fnamelen,
   2243     vnode_t tdvp, vnode_t tvp, char *tnameptr, int tnamelen, struct ucred *cred,
   2244     NFSPROC_T *p, struct nfsvattr *fnap, struct nfsvattr *tnap,
   2245     int *fattrflagp, int *tattrflagp, void *fstuff, void *tstuff)
   2246 {
   2247 	u_int32_t *tl;
   2248 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2249 	struct nfsmount *nmp;
   2250 	struct nfsnode *np;
   2251 	nfsattrbit_t attrbits;
   2252 	nfsv4stateid_t fdstateid, tdstateid;
   2253 	int error = 0, ret = 0, gottd = 0, gotfd = 0, i;
   2254 
   2255 	*fattrflagp = 0;
   2256 	*tattrflagp = 0;
   2257 	nmp = VFSTONFS(vnode_mount(fdvp));
   2258 	if (fnamelen > NFS_MAXNAMLEN || tnamelen > NFS_MAXNAMLEN)
   2259 		return (ENAMETOOLONG);
   2260 tryagain:
   2261 	if (NFSHASNFSV4(nmp) && ret == 0) {
   2262 		ret = nfscl_renamedeleg(fvp, &fdstateid, &gotfd, tvp,
   2263 		    &tdstateid, &gottd, p);
   2264 		if (gotfd && gottd) {
   2265 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGRENAME2, fvp);
   2266 		} else if (gotfd) {
   2267 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGRENAME1, fvp);
   2268 		} else if (gottd) {
   2269 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGRENAME1, tvp);
   2270 		}
   2271 		if (gotfd) {
   2272 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
   2273 			if (NFSHASNFSV4N(nmp))
   2274 				*tl++ = 0;
   2275 			else
   2276 				*tl++ = fdstateid.seqid;
   2277 			*tl++ = fdstateid.other[0];
   2278 			*tl++ = fdstateid.other[1];
   2279 			*tl = fdstateid.other[2];
   2280 			if (gottd) {
   2281 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2282 				*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2283 				np = VTONFS(tvp);
   2284 				(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh,
   2285 				    np->n_fhp->nfh_len, 0);
   2286 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2287 				*tl = txdr_unsigned(NFSV4OP_DELEGRETURN);
   2288 			}
   2289 		}
   2290 		if (gottd) {
   2291 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
   2292 			if (NFSHASNFSV4N(nmp))
   2293 				*tl++ = 0;
   2294 			else
   2295 				*tl++ = tdstateid.seqid;
   2296 			*tl++ = tdstateid.other[0];
   2297 			*tl++ = tdstateid.other[1];
   2298 			*tl = tdstateid.other[2];
   2299 		}
   2300 		if (ret > 0) {
   2301 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2302 			*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2303 			np = VTONFS(fdvp);
   2304 			(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh,
   2305 			    np->n_fhp->nfh_len, 0);
   2306 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2307 			*tl = txdr_unsigned(NFSV4OP_SAVEFH);
   2308 		}
   2309 	} else {
   2310 		ret = 0;
   2311 	}
   2312 	if (ret == 0)
   2313 		NFSCL_REQSTART(nd, NFSPROC_RENAME, fdvp);
   2314 	if (nd->nd_flag & ND_NFSV4) {
   2315 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2316 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2317 		NFSWCCATTR_ATTRBIT(&attrbits);
   2318 		(void) nfsrv_putattrbit(nd, &attrbits);
   2319 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2320 		*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2321 		(void) nfsm_fhtom(nd, VTONFS(tdvp)->n_fhp->nfh_fh,
   2322 		    VTONFS(tdvp)->n_fhp->nfh_len, 0);
   2323 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2324 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2325 		(void) nfsrv_putattrbit(nd, &attrbits);
   2326 		nd->nd_flag |= ND_V4WCCATTR;
   2327 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2328 		*tl = txdr_unsigned(NFSV4OP_RENAME);
   2329 	}
   2330 	(void) nfsm_strtom(nd, fnameptr, fnamelen);
   2331 	if (!(nd->nd_flag & ND_NFSV4))
   2332 		(void) nfsm_fhtom(nd, VTONFS(tdvp)->n_fhp->nfh_fh,
   2333 			VTONFS(tdvp)->n_fhp->nfh_len, 0);
   2334 	(void) nfsm_strtom(nd, tnameptr, tnamelen);
   2335 	error = nfscl_request(nd, fdvp, p, cred, fstuff);
   2336 	if (error)
   2337 		return (error);
   2338 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
   2339 		/* For NFSv4, parse out any Delereturn replies. */
   2340 		if (ret > 0 && nd->nd_repstat != 0 &&
   2341 		    (nd->nd_flag & ND_NOMOREDATA)) {
   2342 			/*
   2343 			 * If the Delegreturn failed, try again without
   2344 			 * it. The server will Recall, as required.
   2345 			 */
   2346 			mbuf_freem(nd->nd_mrep);
   2347 			goto tryagain;
   2348 		}
   2349 		for (i = 0; i < (ret * 2); i++) {
   2350 			if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) ==
   2351 			    ND_NFSV4) {
   2352 			    NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2353 			    if (*(tl + 1)) {
   2354 				if (i == 0 && ret > 1) {
   2355 				    /*
   2356 				     * If the Delegreturn failed, try again
   2357 				     * without it. The server will Recall, as
   2358 				     * required.
   2359 				     * If ret > 1, the first iteration of this
   2360 				     * loop is the second DelegReturn result.
   2361 				     */
   2362 				    mbuf_freem(nd->nd_mrep);
   2363 				    goto tryagain;
   2364 				} else {
   2365 				    nd->nd_flag |= ND_NOMOREDATA;
   2366 				}
   2367 			    }
   2368 			}
   2369 		}
   2370 		/* Now, the first wcc attribute reply. */
   2371 		if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4) {
   2372 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2373 			if (*(tl + 1))
   2374 				nd->nd_flag |= ND_NOMOREDATA;
   2375 		}
   2376 		error = nfscl_wcc_data(nd, fdvp, fnap, fattrflagp, NULL,
   2377 		    fstuff);
   2378 		/* and the second wcc attribute reply. */
   2379 		if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4 &&
   2380 		    !error) {
   2381 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2382 			if (*(tl + 1))
   2383 				nd->nd_flag |= ND_NOMOREDATA;
   2384 		}
   2385 		if (!error)
   2386 			error = nfscl_wcc_data(nd, tdvp, tnap, tattrflagp,
   2387 			    NULL, tstuff);
   2388 	}
   2389 	if (nd->nd_repstat && !error)
   2390 		error = nd->nd_repstat;
   2391 nfsmout:
   2392 	mbuf_freem(nd->nd_mrep);
   2393 	return (error);
   2394 }
   2395 
   2396 /*
   2397  * nfs hard link create rpc
   2398  */
   2399 APPLESTATIC int
   2400 nfsrpc_link(vnode_t dvp, vnode_t vp, char *name, int namelen,
   2401     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
   2402     struct nfsvattr *nap, int *attrflagp, int *dattrflagp, void *dstuff)
   2403 {
   2404 	u_int32_t *tl;
   2405 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2406 	nfsattrbit_t attrbits;
   2407 	int error = 0;
   2408 
   2409 	*attrflagp = 0;
   2410 	*dattrflagp = 0;
   2411 	if (namelen > NFS_MAXNAMLEN)
   2412 		return (ENAMETOOLONG);
   2413 	NFSCL_REQSTART(nd, NFSPROC_LINK, vp);
   2414 	if (nd->nd_flag & ND_NFSV4) {
   2415 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2416 		*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2417 	}
   2418 	(void) nfsm_fhtom(nd, VTONFS(dvp)->n_fhp->nfh_fh,
   2419 		VTONFS(dvp)->n_fhp->nfh_len, 0);
   2420 	if (nd->nd_flag & ND_NFSV4) {
   2421 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2422 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2423 		NFSWCCATTR_ATTRBIT(&attrbits);
   2424 		(void) nfsrv_putattrbit(nd, &attrbits);
   2425 		nd->nd_flag |= ND_V4WCCATTR;
   2426 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2427 		*tl = txdr_unsigned(NFSV4OP_LINK);
   2428 	}
   2429 	(void) nfsm_strtom(nd, name, namelen);
   2430 	error = nfscl_request(nd, vp, p, cred, dstuff);
   2431 	if (error)
   2432 		return (error);
   2433 	if (nd->nd_flag & ND_NFSV3) {
   2434 		error = nfscl_postop_attr(nd, nap, attrflagp, dstuff);
   2435 		if (!error)
   2436 			error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp,
   2437 			    NULL, dstuff);
   2438 	} else if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4) {
   2439 		/*
   2440 		 * First, parse out the PutFH and Getattr result.
   2441 		 */
   2442 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2443 		if (!(*(tl + 1)))
   2444 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2445 		if (*(tl + 1))
   2446 			nd->nd_flag |= ND_NOMOREDATA;
   2447 		/*
   2448 		 * Get the pre-op attributes.
   2449 		 */
   2450 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2451 	}
   2452 	if (nd->nd_repstat && !error)
   2453 		error = nd->nd_repstat;
   2454 nfsmout:
   2455 	mbuf_freem(nd->nd_mrep);
   2456 	return (error);
   2457 }
   2458 
   2459 /*
   2460  * nfs symbolic link create rpc
   2461  */
   2462 APPLESTATIC int
   2463 nfsrpc_symlink(vnode_t dvp, char *name, int namelen, char *target,
   2464     struct vattr *vap, struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
   2465     struct nfsvattr *nnap, struct nfsfh **nfhpp, int *attrflagp,
   2466     int *dattrflagp, void *dstuff)
   2467 {
   2468 	u_int32_t *tl;
   2469 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2470 	struct nfsmount *nmp;
   2471 	int slen, error = 0;
   2472 
   2473 	*nfhpp = NULL;
   2474 	*attrflagp = 0;
   2475 	*dattrflagp = 0;
   2476 	nmp = VFSTONFS(vnode_mount(dvp));
   2477 	slen = strlen(target);
   2478 	if (slen > NFS_MAXPATHLEN || namelen > NFS_MAXNAMLEN)
   2479 		return (ENAMETOOLONG);
   2480 	NFSCL_REQSTART(nd, NFSPROC_SYMLINK, dvp);
   2481 	if (nd->nd_flag & ND_NFSV4) {
   2482 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2483 		*tl = txdr_unsigned(NFLNK);
   2484 		(void) nfsm_strtom(nd, target, slen);
   2485 	}
   2486 	(void) nfsm_strtom(nd, name, namelen);
   2487 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
   2488 		nfscl_fillsattr(nd, vap, dvp, 0, 0);
   2489 	if (!(nd->nd_flag & ND_NFSV4))
   2490 		(void) nfsm_strtom(nd, target, slen);
   2491 	if (nd->nd_flag & ND_NFSV2)
   2492 		nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZENEG1, 0);
   2493 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2494 	if (error)
   2495 		return (error);
   2496 	if (nd->nd_flag & ND_NFSV4)
   2497 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2498 	if ((nd->nd_flag & ND_NFSV3) && !error) {
   2499 		if (!nd->nd_repstat)
   2500 			error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   2501 		if (!error)
   2502 			error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp,
   2503 			    NULL, dstuff);
   2504 	}
   2505 	if (nd->nd_repstat && !error)
   2506 		error = nd->nd_repstat;
   2507 	mbuf_freem(nd->nd_mrep);
   2508 	/*
   2509 	 * Kludge: Map EEXIST => 0 assuming that it is a reply to a retry.
   2510 	 */
   2511 	if (error == EEXIST)
   2512 		error = 0;
   2513 	return (error);
   2514 }
   2515 
   2516 /*
   2517  * nfs make dir rpc
   2518  */
   2519 APPLESTATIC int
   2520 nfsrpc_mkdir(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   2521     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
   2522     struct nfsvattr *nnap, struct nfsfh **nfhpp, int *attrflagp,
   2523     int *dattrflagp, void *dstuff)
   2524 {
   2525 	u_int32_t *tl;
   2526 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2527 	nfsattrbit_t attrbits;
   2528 	int error = 0;
   2529 
   2530 	*nfhpp = NULL;
   2531 	*attrflagp = 0;
   2532 	*dattrflagp = 0;
   2533 	if (namelen > NFS_MAXNAMLEN)
   2534 		return (ENAMETOOLONG);
   2535 	NFSCL_REQSTART(nd, NFSPROC_MKDIR, dvp);
   2536 	if (nd->nd_flag & ND_NFSV4) {
   2537 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2538 		*tl = txdr_unsigned(NFDIR);
   2539 	}
   2540 	(void) nfsm_strtom(nd, name, namelen);
   2541 	nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZENEG1, 0);
   2542 	if (nd->nd_flag & ND_NFSV4) {
   2543 		NFSGETATTR_ATTRBIT(&attrbits);
   2544 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2545 		*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   2546 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2547 		(void) nfsrv_putattrbit(nd, &attrbits);
   2548 	}
   2549 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2550 	if (error)
   2551 		return (error);
   2552 	if (nd->nd_flag & ND_NFSV4)
   2553 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2554 	if (!nd->nd_repstat && !error) {
   2555 		if (nd->nd_flag & ND_NFSV4) {
   2556 			NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
   2557 			error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
   2558 		}
   2559 		if (!error)
   2560 			error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   2561 	}
   2562 	if ((nd->nd_flag & ND_NFSV3) && !error)
   2563 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2564 	if (nd->nd_repstat && !error)
   2565 		error = nd->nd_repstat;
   2566 nfsmout:
   2567 	mbuf_freem(nd->nd_mrep);
   2568 	/*
   2569 	 * Kludge: Map EEXIST => 0 assuming that you have a reply to a retry.
   2570 	 */
   2571 	if (error == EEXIST)
   2572 		error = 0;
   2573 	return (error);
   2574 }
   2575 
   2576 /*
   2577  * nfs remove directory call
   2578  */
   2579 APPLESTATIC int
   2580 nfsrpc_rmdir(vnode_t dvp, char *name, int namelen, struct ucred *cred,
   2581     NFSPROC_T *p, struct nfsvattr *dnap, int *dattrflagp, void *dstuff)
   2582 {
   2583 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2584 	int error = 0;
   2585 
   2586 	*dattrflagp = 0;
   2587 	if (namelen > NFS_MAXNAMLEN)
   2588 		return (ENAMETOOLONG);
   2589 	NFSCL_REQSTART(nd, NFSPROC_RMDIR, dvp);
   2590 	(void) nfsm_strtom(nd, name, namelen);
   2591 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2592 	if (error)
   2593 		return (error);
   2594 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
   2595 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2596 	if (nd->nd_repstat && !error)
   2597 		error = nd->nd_repstat;
   2598 	mbuf_freem(nd->nd_mrep);
   2599 	/*
   2600 	 * Kludge: Map ENOENT => 0 assuming that you have a reply to a retry.
   2601 	 */
   2602 	if (error == ENOENT)
   2603 		error = 0;
   2604 	return (error);
   2605 }
   2606 
   2607 /*
   2608  * Readdir rpc.
   2609  * Always returns with either uio_resid unchanged, if you are at the
   2610  * end of the directory, or uio_resid == 0, with all DIRBLKSIZ chunks
   2611  * filled in.
   2612  * I felt this would allow caching of directory blocks more easily
   2613  * than returning a pertially filled block.
   2614  * Directory offset cookies:
   2615  * Oh my, what to do with them...
   2616  * I can think of three ways to deal with them:
   2617  * 1 - have the layer above these RPCs maintain a map between logical
   2618  *     directory byte offsets and the NFS directory offset cookies
   2619  * 2 - pass the opaque directory offset cookies up into userland
   2620  *     and let the libc functions deal with them, via the system call
   2621  * 3 - return them to userland in the "struct dirent", so future versions
   2622  *     of libc can use them and do whatever is necessary to amke things work
   2623  *     above these rpc calls, in the meantime
   2624  * For now, I do #3 by "hiding" the directory offset cookies after the
   2625  * d_name field in struct dirent. This is space inside d_reclen that
   2626  * will be ignored by anything that doesn't know about them.
   2627  * The directory offset cookies are filled in as the last 8 bytes of
   2628  * each directory entry, after d_name. Someday, the userland libc
   2629  * functions may be able to use these. In the meantime, it satisfies
   2630  * OpenBSD's requirements for cookies being returned.
   2631  * If expects the directory offset cookie for the read to be in uio_offset
   2632  * and returns the one for the next entry after this directory block in
   2633  * there, as well.
   2634  */
   2635 APPLESTATIC int
   2636 nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep,
   2637     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   2638     int *eofp, void *stuff)
   2639 {
   2640 	int len, left;
   2641 	struct dirent *dp = NULL;
   2642 	u_int32_t *tl;
   2643 	nfsquad_t cookie, ncookie;
   2644 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   2645 	struct nfsnode *dnp = VTONFS(vp);
   2646 	struct nfsvattr nfsva;
   2647 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2648 	int error = 0, tlen, more_dirs = 1, blksiz = 0, bigenough = 1;
   2649 	int reqsize, tryformoredirs = 1, readsize, eof = 0, gotmnton = 0;
   2650 	long dotfileid, dotdotfileid = 0;
   2651 	u_int32_t fakefileno = 0xffffffff, rderr;
   2652 	char *cp;
   2653 	nfsattrbit_t attrbits, dattrbits;
   2654 	u_int32_t *tl2 = NULL;
   2655 	size_t tresid;
   2656 
   2657 	KASSERT(uiop->uio_iovcnt == 1 &&
   2658 	    (uio_uio_resid(uiop) & (DIRBLKSIZ - 1)) == 0,
   2659 	    ("nfs readdirrpc bad uio"));
   2660 
   2661 	/*
   2662 	 * There is no point in reading a lot more than uio_resid, however
   2663 	 * adding one additional DIRBLKSIZ makes sense. Since uio_resid
   2664 	 * and nm_readdirsize are both exact multiples of DIRBLKSIZ, this
   2665 	 * will never make readsize > nm_readdirsize.
   2666 	 */
   2667 	readsize = nmp->nm_readdirsize;
   2668 	if (readsize > uio_uio_resid(uiop))
   2669 		readsize = uio_uio_resid(uiop) + DIRBLKSIZ;
   2670 
   2671 	*attrflagp = 0;
   2672 	if (eofp)
   2673 		*eofp = 0;
   2674 	tresid = uio_uio_resid(uiop);
   2675 	cookie.lval[0] = cookiep->nfsuquad[0];
   2676 	cookie.lval[1] = cookiep->nfsuquad[1];
   2677 	nd->nd_mrep = NULL;
   2678 
   2679 	/*
   2680 	 * For NFSv4, first create the "." and ".." entries.
   2681 	 */
   2682 	if (NFSHASNFSV4(nmp)) {
   2683 		reqsize = 6 * NFSX_UNSIGNED;
   2684 		NFSGETATTR_ATTRBIT(&dattrbits);
   2685 		NFSZERO_ATTRBIT(&attrbits);
   2686 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FILEID);
   2687 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TYPE);
   2688 		if (NFSISSET_ATTRBIT(&dnp->n_vattr.na_suppattr,
   2689 		    NFSATTRBIT_MOUNTEDONFILEID)) {
   2690 			NFSSETBIT_ATTRBIT(&attrbits,
   2691 			    NFSATTRBIT_MOUNTEDONFILEID);
   2692 			gotmnton = 1;
   2693 		} else {
   2694 			/*
   2695 			 * Must fake it. Use the fileno, except when the
   2696 			 * fsid is != to that of the directory. For that
   2697 			 * case, generate a fake fileno that is not the same.
   2698 			 */
   2699 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FSID);
   2700 			gotmnton = 0;
   2701 		}
   2702 
   2703 		/*
   2704 		 * Joy, oh joy. For V4 we get to hand craft '.' and '..'.
   2705 		 */
   2706 		if (uiop->uio_offset == 0) {
   2707 #if defined(__FreeBSD_version) && __FreeBSD_version >= 800000
   2708 			error = VOP_GETATTR(vp, &nfsva.na_vattr, cred);
   2709 #else
   2710 			error = VOP_GETATTR(vp, &nfsva.na_vattr, cred, p);
   2711 #endif
   2712 			if (error)
   2713 			    return (error);
   2714 			dotfileid = nfsva.na_fileid;
   2715 			NFSCL_REQSTART(nd, NFSPROC_LOOKUPP, vp);
   2716 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2717 			*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   2718 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2719 			(void) nfsrv_putattrbit(nd, &attrbits);
   2720 			error = nfscl_request(nd, vp, p, cred, stuff);
   2721 			if (error)
   2722 			    return (error);
   2723 			if (nd->nd_repstat == 0) {
   2724 			    NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   2725 			    len = fxdr_unsigned(int, *(tl + 2));
   2726 			    if (len > 0 && len <= NFSX_V4FHMAX)
   2727 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
   2728 			    else
   2729 				error = EPERM;
   2730 			    if (!error) {
   2731 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
   2732 				nfsva.na_mntonfileno = 0xffffffff;
   2733 				error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
   2734 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
   2735 				    NULL, NULL, NULL, p, cred);
   2736 				if (error) {
   2737 				    dotdotfileid = dotfileid;
   2738 				} else if (gotmnton) {
   2739 				    if (nfsva.na_mntonfileno != 0xffffffff)
   2740 					dotdotfileid = nfsva.na_mntonfileno;
   2741 				    else
   2742 					dotdotfileid = nfsva.na_fileid;
   2743 				} else if (nfsva.na_filesid[0] ==
   2744 				    dnp->n_vattr.na_filesid[0] &&
   2745 				    nfsva.na_filesid[1] ==
   2746 				    dnp->n_vattr.na_filesid[1]) {
   2747 				    dotdotfileid = nfsva.na_fileid;
   2748 				} else {
   2749 				    do {
   2750 					fakefileno--;
   2751 				    } while (fakefileno ==
   2752 					nfsva.na_fileid);
   2753 				    dotdotfileid = fakefileno;
   2754 				}
   2755 			    }
   2756 			} else if (nd->nd_repstat == NFSERR_NOENT) {
   2757 			    /*
   2758 			     * Lookupp returns NFSERR_NOENT when we are
   2759 			     * at the root, so just use the current dir.
   2760 			     */
   2761 			    nd->nd_repstat = 0;
   2762 			    dotdotfileid = dotfileid;
   2763 			} else {
   2764 			    error = nd->nd_repstat;
   2765 			}
   2766 			mbuf_freem(nd->nd_mrep);
   2767 			if (error)
   2768 			    return (error);
   2769 			nd->nd_mrep = NULL;
   2770 			dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
   2771 			dp->d_type = DT_DIR;
   2772 			dp->d_fileno = dotfileid;
   2773 			dp->d_namlen = 1;
   2774 			dp->d_name[0] = '.';
   2775 			dp->d_name[1] = '\0';
   2776 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
   2777 			/*
   2778 			 * Just make these offset cookie 0.
   2779 			 */
   2780 			tl = (u_int32_t *)&dp->d_name[4];
   2781 			*tl++ = 0;
   2782 			*tl = 0;
   2783 			blksiz += dp->d_reclen;
   2784 			uio_uio_resid_add(uiop, -(dp->d_reclen));
   2785 			uiop->uio_offset += dp->d_reclen;
   2786 			uio_iov_base_add(uiop, dp->d_reclen);
   2787 			uio_iov_len_add(uiop, -(dp->d_reclen));
   2788 			dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
   2789 			dp->d_type = DT_DIR;
   2790 			dp->d_fileno = dotdotfileid;
   2791 			dp->d_namlen = 2;
   2792 			dp->d_name[0] = '.';
   2793 			dp->d_name[1] = '.';
   2794 			dp->d_name[2] = '\0';
   2795 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
   2796 			/*
   2797 			 * Just make these offset cookie 0.
   2798 			 */
   2799 			tl = (u_int32_t *)&dp->d_name[4];
   2800 			*tl++ = 0;
   2801 			*tl = 0;
   2802 			blksiz += dp->d_reclen;
   2803 			uio_uio_resid_add(uiop, -(dp->d_reclen));
   2804 			uiop->uio_offset += dp->d_reclen;
   2805 			uio_iov_base_add(uiop, dp->d_reclen);
   2806 			uio_iov_len_add(uiop, -(dp->d_reclen));
   2807 		}
   2808 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_RDATTRERROR);
   2809 	} else {
   2810 		reqsize = 5 * NFSX_UNSIGNED;
   2811 	}
   2812 
   2813 
   2814 	/*
   2815 	 * Loop around doing readdir rpc's of size readsize.
   2816 	 * The stopping criteria is EOF or buffer full.
   2817 	 */
   2818 	while (more_dirs && bigenough) {
   2819 		*attrflagp = 0;
   2820 		NFSCL_REQSTART(nd, NFSPROC_READDIR, vp);
   2821 		if (nd->nd_flag & ND_NFSV2) {
   2822 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2823 			*tl++ = cookie.lval[1];
   2824 			*tl = txdr_unsigned(readsize);
   2825 		} else {
   2826 			NFSM_BUILD(tl, u_int32_t *, reqsize);
   2827 			*tl++ = cookie.lval[0];
   2828 			*tl++ = cookie.lval[1];
   2829 			if (cookie.qval == 0) {
   2830 				*tl++ = 0;
   2831 				*tl++ = 0;
   2832 			} else {
   2833 				NFSLOCKNODE(dnp);
   2834 				*tl++ = dnp->n_cookieverf.nfsuquad[0];
   2835 				*tl++ = dnp->n_cookieverf.nfsuquad[1];
   2836 				NFSUNLOCKNODE(dnp);
   2837 			}
   2838 			if (nd->nd_flag & ND_NFSV4) {
   2839 				*tl++ = txdr_unsigned(readsize);
   2840 				*tl = txdr_unsigned(readsize);
   2841 				(void) nfsrv_putattrbit(nd, &attrbits);
   2842 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2843 				*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2844 				(void) nfsrv_putattrbit(nd, &dattrbits);
   2845 			} else {
   2846 				*tl = txdr_unsigned(readsize);
   2847 			}
   2848 		}
   2849 		error = nfscl_request(nd, vp, p, cred, stuff);
   2850 		if (error)
   2851 			return (error);
   2852 		if (!(nd->nd_flag & ND_NFSV2)) {
   2853 			if (nd->nd_flag & ND_NFSV3)
   2854 				error = nfscl_postop_attr(nd, nap, attrflagp,
   2855 				    stuff);
   2856 			if (!nd->nd_repstat && !error) {
   2857 				NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
   2858 				NFSLOCKNODE(dnp);
   2859 				dnp->n_cookieverf.nfsuquad[0] = *tl++;
   2860 				dnp->n_cookieverf.nfsuquad[1] = *tl;
   2861 				NFSUNLOCKNODE(dnp);
   2862 			}
   2863 		}
   2864 		if (nd->nd_repstat || error) {
   2865 			if (!error)
   2866 				error = nd->nd_repstat;
   2867 			goto nfsmout;
   2868 		}
   2869 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   2870 		more_dirs = fxdr_unsigned(int, *tl);
   2871 		if (!more_dirs)
   2872 			tryformoredirs = 0;
   2873 
   2874 		/* loop thru the dir entries, doctoring them to 4bsd form */
   2875 		while (more_dirs && bigenough) {
   2876 			if (nd->nd_flag & ND_NFSV4) {
   2877 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   2878 				ncookie.lval[0] = *tl++;
   2879 				ncookie.lval[1] = *tl++;
   2880 				len = fxdr_unsigned(int, *tl);
   2881 			} else if (nd->nd_flag & ND_NFSV3) {
   2882 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   2883 				nfsva.na_fileid = fxdr_hyper(tl);
   2884 				tl += 2;
   2885 				len = fxdr_unsigned(int, *tl);
   2886 			} else {
   2887 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
   2888 				nfsva.na_fileid =
   2889 				    fxdr_unsigned(long, *tl++);
   2890 				len = fxdr_unsigned(int, *tl);
   2891 			}
   2892 			if (len <= 0 || len > NFS_MAXNAMLEN) {
   2893 				error = EBADRPC;
   2894 				goto nfsmout;
   2895 			}
   2896 			tlen = NFSM_RNDUP(len);
   2897 			if (tlen == len)
   2898 				tlen += 4;  /* To ensure null termination */
   2899 			left = DIRBLKSIZ - blksiz;
   2900 			if ((int)(tlen + DIRHDSIZ + NFSX_HYPER) > left) {
   2901 				dp->d_reclen += left;
   2902 				uio_iov_base_add(uiop, left);
   2903 				uio_iov_len_add(uiop, -(left));
   2904 				uio_uio_resid_add(uiop, -(left));
   2905 				uiop->uio_offset += left;
   2906 				blksiz = 0;
   2907 			}
   2908 			if ((int)(tlen + DIRHDSIZ + NFSX_HYPER) > uio_uio_resid(uiop))
   2909 				bigenough = 0;
   2910 			if (bigenough) {
   2911 				dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
   2912 				dp->d_namlen = len;
   2913 				dp->d_reclen = tlen + DIRHDSIZ + NFSX_HYPER;
   2914 				dp->d_type = DT_UNKNOWN;
   2915 				blksiz += dp->d_reclen;
   2916 				if (blksiz == DIRBLKSIZ)
   2917 					blksiz = 0;
   2918 				uio_uio_resid_add(uiop, -(DIRHDSIZ));
   2919 				uiop->uio_offset += DIRHDSIZ;
   2920 				uio_iov_base_add(uiop, DIRHDSIZ);
   2921 				uio_iov_len_add(uiop, -(DIRHDSIZ));
   2922 				error = nfsm_mbufuio(nd, uiop, len);
   2923 				if (error)
   2924 					goto nfsmout;
   2925 				cp = CAST_DOWN(caddr_t, uio_iov_base(uiop));
   2926 				tlen -= len;
   2927 				*cp = '\0';	/* null terminate */
   2928 				cp += tlen;	/* points to cookie storage */
   2929 				tl2 = (u_int32_t *)cp;
   2930 				uio_iov_base_add(uiop, (tlen + NFSX_HYPER));
   2931 				uio_iov_len_add(uiop, -(tlen + NFSX_HYPER));
   2932 				uio_uio_resid_add(uiop, -(tlen + NFSX_HYPER));
   2933 				uiop->uio_offset += (tlen + NFSX_HYPER);
   2934 			} else {
   2935 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
   2936 				if (error)
   2937 					goto nfsmout;
   2938 			}
   2939 			if (nd->nd_flag & ND_NFSV4) {
   2940 				rderr = 0;
   2941 				nfsva.na_mntonfileno = 0xffffffff;
   2942 				error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
   2943 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
   2944 				    NULL, NULL, &rderr, p, cred);
   2945 				if (error)
   2946 					goto nfsmout;
   2947 				NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   2948 			} else if (nd->nd_flag & ND_NFSV3) {
   2949 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   2950 				ncookie.lval[0] = *tl++;
   2951 				ncookie.lval[1] = *tl++;
   2952 			} else {
   2953 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
   2954 				ncookie.lval[0] = 0;
   2955 				ncookie.lval[1] = *tl++;
   2956 			}
   2957 			if (bigenough) {
   2958 			    if (nd->nd_flag & ND_NFSV4) {
   2959 				if (rderr) {
   2960 				    dp->d_fileno = 0;
   2961 				} else {
   2962 				    if (gotmnton) {
   2963 					if (nfsva.na_mntonfileno != 0xffffffff)
   2964 					    dp->d_fileno = nfsva.na_mntonfileno;
   2965 					else
   2966 					    dp->d_fileno = nfsva.na_fileid;
   2967 				    } else if (nfsva.na_filesid[0] ==
   2968 					dnp->n_vattr.na_filesid[0] &&
   2969 					nfsva.na_filesid[1] ==
   2970 					dnp->n_vattr.na_filesid[1]) {
   2971 					dp->d_fileno = nfsva.na_fileid;
   2972 				    } else {
   2973 					do {
   2974 					    fakefileno--;
   2975 					} while (fakefileno ==
   2976 					    nfsva.na_fileid);
   2977 					dp->d_fileno = fakefileno;
   2978 				    }
   2979 				    dp->d_type = vtonfs_dtype(nfsva.na_type);
   2980 				}
   2981 			    } else {
   2982 				dp->d_fileno = nfsva.na_fileid;
   2983 			    }
   2984 			    *tl2++ = cookiep->nfsuquad[0] = cookie.lval[0] =
   2985 				ncookie.lval[0];
   2986 			    *tl2 = cookiep->nfsuquad[1] = cookie.lval[1] =
   2987 				ncookie.lval[1];
   2988 			}
   2989 			more_dirs = fxdr_unsigned(int, *tl);
   2990 		}
   2991 		/*
   2992 		 * If at end of rpc data, get the eof boolean
   2993 		 */
   2994 		if (!more_dirs) {
   2995 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   2996 			eof = fxdr_unsigned(int, *tl);
   2997 			if (tryformoredirs)
   2998 				more_dirs = !eof;
   2999 			if (nd->nd_flag & ND_NFSV4) {
   3000 				error = nfscl_postop_attr(nd, nap, attrflagp,
   3001 				    stuff);
   3002 				if (error)
   3003 					goto nfsmout;
   3004 			}
   3005 		}
   3006 		mbuf_freem(nd->nd_mrep);
   3007 		nd->nd_mrep = NULL;
   3008 	}
   3009 	/*
   3010 	 * Fill last record, iff any, out to a multiple of DIRBLKSIZ
   3011 	 * by increasing d_reclen for the last record.
   3012 	 */
   3013 	if (blksiz > 0) {
   3014 		left = DIRBLKSIZ - blksiz;
   3015 		dp->d_reclen += left;
   3016 		uio_iov_base_add(uiop, left);
   3017 		uio_iov_len_add(uiop, -(left));
   3018 		uio_uio_resid_add(uiop, -(left));
   3019 		uiop->uio_offset += left;
   3020 	}
   3021 
   3022 	/*
   3023 	 * If returning no data, assume end of file.
   3024 	 * If not bigenough, return not end of file, since you aren't
   3025 	 *    returning all the data
   3026 	 * Otherwise, return the eof flag from the server.
   3027 	 */
   3028 	if (eofp) {
   3029 		if (tresid == ((size_t)(uio_uio_resid(uiop))))
   3030 			*eofp = 1;
   3031 		else if (!bigenough)
   3032 			*eofp = 0;
   3033 		else
   3034 			*eofp = eof;
   3035 	}
   3036 
   3037 	/*
   3038 	 * Add extra empty records to any remaining DIRBLKSIZ chunks.
   3039 	 */
   3040 	while (uio_uio_resid(uiop) > 0 && ((size_t)(uio_uio_resid(uiop))) != tresid) {
   3041 		dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
   3042 		dp->d_type = DT_UNKNOWN;
   3043 		dp->d_fileno = 0;
   3044 		dp->d_namlen = 0;
   3045 		dp->d_name[0] = '\0';
   3046 		tl = (u_int32_t *)&dp->d_name[4];
   3047 		*tl++ = cookie.lval[0];
   3048 		*tl = cookie.lval[1];
   3049 		dp->d_reclen = DIRBLKSIZ;
   3050 		uio_iov_base_add(uiop, DIRBLKSIZ);
   3051 		uio_iov_len_add(uiop, -(DIRBLKSIZ));
   3052 		uio_uio_resid_add(uiop, -(DIRBLKSIZ));
   3053 		uiop->uio_offset += DIRBLKSIZ;
   3054 	}
   3055 
   3056 nfsmout:
   3057 	if (nd->nd_mrep != NULL)
   3058 		mbuf_freem(nd->nd_mrep);
   3059 	return (error);
   3060 }
   3061 
   3062 #ifndef APPLE
   3063 /*
   3064  * NFS V3 readdir plus RPC. Used in place of nfsrpc_readdir().
   3065  * (Also used for NFS V4 when mount flag set.)
   3066  * (ditto above w.r.t. multiple of DIRBLKSIZ, etc.)
   3067  */
   3068 APPLESTATIC int
   3069 nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep,
   3070     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   3071     int *eofp, void *stuff)
   3072 {
   3073 	int len, left;
   3074 	struct dirent *dp = NULL;
   3075 	u_int32_t *tl;
   3076 	vnode_t newvp = NULLVP;
   3077 	struct nfsrv_descript nfsd, *nd = &nfsd;
   3078 	struct nameidata nami, *ndp = &nami;
   3079 	struct componentname *cnp = &ndp->ni_cnd;
   3080 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   3081 	struct nfsnode *dnp = VTONFS(vp), *np;
   3082 	struct nfsvattr nfsva;
   3083 	struct nfsfh *nfhp;
   3084 	nfsquad_t cookie, ncookie;
   3085 	int error = 0, tlen, more_dirs = 1, blksiz = 0, bigenough = 1;
   3086 	int attrflag, tryformoredirs = 1, eof = 0, gotmnton = 0;
   3087 	int isdotdot = 0, unlocknewvp = 0;
   3088 	long dotfileid, dotdotfileid = 0, fileno = 0;
   3089 	char *cp;
   3090 	nfsattrbit_t attrbits, dattrbits;
   3091 	size_t tresid;
   3092 	u_int32_t *tl2 = NULL, fakefileno = 0xffffffff, rderr;
   3093 	struct timespec dctime;
   3094 
   3095 	KASSERT(uiop->uio_iovcnt == 1 &&
   3096 	    (uio_uio_resid(uiop) & (DIRBLKSIZ - 1)) == 0,
   3097 	    ("nfs readdirplusrpc bad uio"));
   3098 	timespecclear(&dctime);
   3099 	*attrflagp = 0;
   3100 	if (eofp != NULL)
   3101 		*eofp = 0;
   3102 	ndp->ni_dvp = vp;
   3103 	nd->nd_mrep = NULL;
   3104 	cookie.lval[0] = cookiep->nfsuquad[0];
   3105 	cookie.lval[1] = cookiep->nfsuquad[1];
   3106 	tresid = uio_uio_resid(uiop);
   3107 
   3108 	/*
   3109 	 * For NFSv4, first create the "." and ".." entries.
   3110 	 */
   3111 	if (NFSHASNFSV4(nmp)) {
   3112 		NFSGETATTR_ATTRBIT(&dattrbits);
   3113 		NFSZERO_ATTRBIT(&attrbits);
   3114 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FILEID);
   3115 		if (NFSISSET_ATTRBIT(&dnp->n_vattr.na_suppattr,
   3116 		    NFSATTRBIT_MOUNTEDONFILEID)) {
   3117 			NFSSETBIT_ATTRBIT(&attrbits,
   3118 			    NFSATTRBIT_MOUNTEDONFILEID);
   3119 			gotmnton = 1;
   3120 		} else {
   3121 			/*
   3122 			 * Must fake it. Use the fileno, except when the
   3123 			 * fsid is != to that of the directory. For that
   3124 			 * case, generate a fake fileno that is not the same.
   3125 			 */
   3126 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FSID);
   3127 			gotmnton = 0;
   3128 		}
   3129 
   3130 		/*
   3131 		 * Joy, oh joy. For V4 we get to hand craft '.' and '..'.
   3132 		 */
   3133 		if (uiop->uio_offset == 0) {
   3134 #if defined(__FreeBSD_version) && __FreeBSD_version >= 800000
   3135 			error = VOP_GETATTR(vp, &nfsva.na_vattr, cred);
   3136 #else
   3137 			error = VOP_GETATTR(vp, &nfsva.na_vattr, cred, p);
   3138 #endif
   3139 			if (error)
   3140 			    return (error);
   3141 			dctime = nfsva.na_ctime;
   3142 			dotfileid = nfsva.na_fileid;
   3143 			NFSCL_REQSTART(nd, NFSPROC_LOOKUPP, vp);
   3144 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   3145 			*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   3146 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
   3147 			(void) nfsrv_putattrbit(nd, &attrbits);
   3148 			error = nfscl_request(nd, vp, p, cred, stuff);
   3149 			if (error)
   3150 			    return (error);
   3151 			if (nd->nd_repstat == 0) {
   3152 			    NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   3153 			    len = fxdr_unsigned(int, *(tl + 2));
   3154 			    if (len > 0 && len <= NFSX_V4FHMAX)
   3155 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
   3156 			    else
   3157 				error = EPERM;
   3158 			    if (!error) {
   3159 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
   3160 				nfsva.na_mntonfileno = 0xffffffff;
   3161 				error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
   3162 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
   3163 				    NULL, NULL, NULL, p, cred);
   3164 				if (error) {
   3165 				    dotdotfileid = dotfileid;
   3166 				} else if (gotmnton) {
   3167 				    if (nfsva.na_mntonfileno != 0xffffffff)
   3168 					dotdotfileid = nfsva.na_mntonfileno;
   3169 				    else
   3170 					dotdotfileid = nfsva.na_fileid;
   3171 				} else if (nfsva.na_filesid[0] ==
   3172 				    dnp->n_vattr.na_filesid[0] &&
   3173 				    nfsva.na_filesid[1] ==
   3174 				    dnp->n_vattr.na_filesid[1]) {
   3175 				    dotdotfileid = nfsva.na_fileid;
   3176 				} else {
   3177 				    do {
   3178 					fakefileno--;
   3179 				    } while (fakefileno ==
   3180 					nfsva.na_fileid);
   3181 				    dotdotfileid = fakefileno;
   3182 				}
   3183 			    }
   3184 			} else if (nd->nd_repstat == NFSERR_NOENT) {
   3185 			    /*
   3186 			     * Lookupp returns NFSERR_NOENT when we are
   3187 			     * at the root, so just use the current dir.
   3188 			     */
   3189 			    nd->nd_repstat = 0;
   3190 			    dotdotfileid = dotfileid;
   3191 			} else {
   3192 			    error = nd->nd_repstat;
   3193 			}
   3194 			mbuf_freem(nd->nd_mrep);
   3195 			if (error)
   3196 			    return (error);
   3197 			nd->nd_mrep = NULL;
   3198 			dp = (struct dirent *)uio_iov_base(uiop);
   3199 			dp->d_type = DT_DIR;
   3200 			dp->d_fileno = dotfileid;
   3201 			dp->d_namlen = 1;
   3202 			dp->d_name[0] = '.';
   3203 			dp->d_name[1] = '\0';
   3204 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
   3205 			/*
   3206 			 * Just make these offset cookie 0.
   3207 			 */
   3208 			tl = (u_int32_t *)&dp->d_name[4];
   3209 			*tl++ = 0;
   3210 			*tl = 0;
   3211 			blksiz += dp->d_reclen;
   3212 			uio_uio_resid_add(uiop, -(dp->d_reclen));
   3213 			uiop->uio_offset += dp->d_reclen;
   3214 			uio_iov_base_add(uiop, dp->d_reclen);
   3215 			uio_iov_len_add(uiop, -(dp->d_reclen));
   3216 			dp = (struct dirent *)uio_iov_base(uiop);
   3217 			dp->d_type = DT_DIR;
   3218 			dp->d_fileno = dotdotfileid;
   3219 			dp->d_namlen = 2;
   3220 			dp->d_name[0] = '.';
   3221 			dp->d_name[1] = '.';
   3222 			dp->d_name[2] = '\0';
   3223 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
   3224 			/*
   3225 			 * Just make these offset cookie 0.
   3226 			 */
   3227 			tl = (u_int32_t *)&dp->d_name[4];
   3228 			*tl++ = 0;
   3229 			*tl = 0;
   3230 			blksiz += dp->d_reclen;
   3231 			uio_uio_resid_add(uiop, -(dp->d_reclen));
   3232 			uiop->uio_offset += dp->d_reclen;
   3233 			uio_iov_base_add(uiop, dp->d_reclen);
   3234 			uio_iov_len_add(uiop, -(dp->d_reclen));
   3235 		}
   3236 		NFSREADDIRPLUS_ATTRBIT(&attrbits);
   3237 		if (gotmnton)
   3238 			NFSSETBIT_ATTRBIT(&attrbits,
   3239 			    NFSATTRBIT_MOUNTEDONFILEID);
   3240 	}
   3241 
   3242 	/*
   3243 	 * Loop around doing readdir rpc's of size nm_readdirsize.
   3244 	 * The stopping criteria is EOF or buffer full.
   3245 	 */
   3246 	while (more_dirs && bigenough) {
   3247 		*attrflagp = 0;
   3248 		NFSCL_REQSTART(nd, NFSPROC_READDIRPLUS, vp);
   3249  		NFSM_BUILD(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
   3250 		*tl++ = cookie.lval[0];
   3251 		*tl++ = cookie.lval[1];
   3252 		if (cookie.qval == 0) {
   3253 			*tl++ = 0;
   3254 			*tl++ = 0;
   3255 		} else {
   3256 			NFSLOCKNODE(dnp);
   3257 			*tl++ = dnp->n_cookieverf.nfsuquad[0];
   3258 			*tl++ = dnp->n_cookieverf.nfsuquad[1];
   3259 			NFSUNLOCKNODE(dnp);
   3260 		}
   3261 		*tl++ = txdr_unsigned(nmp->nm_readdirsize);
   3262 		*tl = txdr_unsigned(nmp->nm_readdirsize);
   3263 		if (nd->nd_flag & ND_NFSV4) {
   3264 			(void) nfsrv_putattrbit(nd, &attrbits);
   3265 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   3266 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
   3267 			(void) nfsrv_putattrbit(nd, &dattrbits);
   3268 		}
   3269 		error = nfscl_request(nd, vp, p, cred, stuff);
   3270 		if (error)
   3271 			return (error);
   3272 		if (nd->nd_flag & ND_NFSV3)
   3273 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   3274 		if (nd->nd_repstat || error) {
   3275 			if (!error)
   3276 				error = nd->nd_repstat;
   3277 			goto nfsmout;
   3278 		}
   3279 		if ((nd->nd_flag & ND_NFSV3) != 0 && *attrflagp != 0)
   3280 			dctime = nap->na_ctime;
   3281 		NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
   3282 		NFSLOCKNODE(dnp);
   3283 		dnp->n_cookieverf.nfsuquad[0] = *tl++;
   3284 		dnp->n_cookieverf.nfsuquad[1] = *tl++;
   3285 		NFSUNLOCKNODE(dnp);
   3286 		more_dirs = fxdr_unsigned(int, *tl);
   3287 		if (!more_dirs)
   3288 			tryformoredirs = 0;
   3289 
   3290 		/* loop thru the dir entries, doctoring them to 4bsd form */
   3291 		while (more_dirs && bigenough) {
   3292 			NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
   3293 			if (nd->nd_flag & ND_NFSV4) {
   3294 				ncookie.lval[0] = *tl++;
   3295 				ncookie.lval[1] = *tl++;
   3296 			} else {
   3297 				fileno = fxdr_unsigned(long, *++tl);
   3298 				tl++;
   3299 			}
   3300 			len = fxdr_unsigned(int, *tl);
   3301 			if (len <= 0 || len > NFS_MAXNAMLEN) {
   3302 				error = EBADRPC;
   3303 				goto nfsmout;
   3304 			}
   3305 			tlen = NFSM_RNDUP(len);
   3306 			if (tlen == len)
   3307 				tlen += 4;  /* To ensure null termination */
   3308 			left = DIRBLKSIZ - blksiz;
   3309 			if ((tlen + DIRHDSIZ + NFSX_HYPER) > left) {
   3310 				dp->d_reclen += left;
   3311 				uio_iov_base_add(uiop, left);
   3312 				uio_iov_len_add(uiop, -(left));
   3313 				uio_uio_resid_add(uiop, -(left));
   3314 				uiop->uio_offset += left;
   3315 				blksiz = 0;
   3316 			}
   3317 			if ((tlen + DIRHDSIZ + NFSX_HYPER) > uio_uio_resid(uiop))
   3318 				bigenough = 0;
   3319 			if (bigenough) {
   3320 				dp = (struct dirent *)uio_iov_base(uiop);
   3321 				dp->d_namlen = len;
   3322 				dp->d_reclen = tlen + DIRHDSIZ + NFSX_HYPER;
   3323 				dp->d_type = DT_UNKNOWN;
   3324 				blksiz += dp->d_reclen;
   3325 				if (blksiz == DIRBLKSIZ)
   3326 					blksiz = 0;
   3327 				uio_uio_resid_add(uiop, -(DIRHDSIZ));
   3328 				uiop->uio_offset += DIRHDSIZ;
   3329 				uio_iov_base_add(uiop, DIRHDSIZ);
   3330 				uio_iov_len_add(uiop, -(DIRHDSIZ));
   3331 				cnp->cn_nameptr = uio_iov_base(uiop);
   3332 				cnp->cn_namelen = len;
   3333 				NFSCNHASHZERO(cnp);
   3334 				error = nfsm_mbufuio(nd, uiop, len);
   3335 				if (error)
   3336 					goto nfsmout;
   3337 				cp = uio_iov_base(uiop);
   3338 				tlen -= len;
   3339 				*cp = '\0';
   3340 				cp += tlen;	/* points to cookie storage */
   3341 				tl2 = (u_int32_t *)cp;
   3342 				if (len == 2 && cnp->cn_nameptr[0] == '.' &&
   3343 				    cnp->cn_nameptr[1] == '.')
   3344 					isdotdot = 1;
   3345 				else
   3346 					isdotdot = 0;
   3347 				uio_iov_base_add(uiop, (tlen + NFSX_HYPER));
   3348 				uio_iov_len_add(uiop, -(tlen + NFSX_HYPER));
   3349 				uio_uio_resid_add(uiop, -(tlen + NFSX_HYPER));
   3350 				uiop->uio_offset += (tlen + NFSX_HYPER);
   3351 			} else {
   3352 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
   3353 				if (error)
   3354 					goto nfsmout;
   3355 			}
   3356 			nfhp = NULL;
   3357 			if (nd->nd_flag & ND_NFSV3) {
   3358 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   3359 				ncookie.lval[0] = *tl++;
   3360 				ncookie.lval[1] = *tl++;
   3361 				attrflag = fxdr_unsigned(int, *tl);
   3362 				if (attrflag) {
   3363 				  error = nfsm_loadattr(nd, &nfsva);
   3364 				  if (error)
   3365 					goto nfsmout;
   3366 				}
   3367 				NFSM_DISSECT(tl,u_int32_t *,NFSX_UNSIGNED);
   3368 				if (*tl) {
   3369 					error = nfsm_getfh(nd, &nfhp);
   3370 					if (error)
   3371 					    goto nfsmout;
   3372 				}
   3373 				if (!attrflag && nfhp != NULL) {
   3374 					FREE((caddr_t)nfhp, M_NFSFH);
   3375 					nfhp = NULL;
   3376 				}
   3377 			} else {
   3378 				rderr = 0;
   3379 				nfsva.na_mntonfileno = 0xffffffff;
   3380 				error = nfsv4_loadattr(nd, NULL, &nfsva, &nfhp,
   3381 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
   3382 				    NULL, NULL, &rderr, p, cred);
   3383 				if (error)
   3384 					goto nfsmout;
   3385 			}
   3386 
   3387 			if (bigenough) {
   3388 			    if (nd->nd_flag & ND_NFSV4) {
   3389 				if (rderr) {
   3390 				    dp->d_fileno = 0;
   3391 				} else if (gotmnton) {
   3392 				    if (nfsva.na_mntonfileno != 0xffffffff)
   3393 					dp->d_fileno = nfsva.na_mntonfileno;
   3394 				    else
   3395 					dp->d_fileno = nfsva.na_fileid;
   3396 				} else if (nfsva.na_filesid[0] ==
   3397 				    dnp->n_vattr.na_filesid[0] &&
   3398 				    nfsva.na_filesid[1] ==
   3399 				    dnp->n_vattr.na_filesid[1]) {
   3400 				    dp->d_fileno = nfsva.na_fileid;
   3401 				} else {
   3402 				    do {
   3403 					fakefileno--;
   3404 				    } while (fakefileno ==
   3405 					nfsva.na_fileid);
   3406 				    dp->d_fileno = fakefileno;
   3407 				}
   3408 			    } else {
   3409 				dp->d_fileno = fileno;
   3410 			    }
   3411 			    *tl2++ = cookiep->nfsuquad[0] = cookie.lval[0] =
   3412 				ncookie.lval[0];
   3413 			    *tl2 = cookiep->nfsuquad[1] = cookie.lval[1] =
   3414 				ncookie.lval[1];
   3415 
   3416 			    if (nfhp != NULL) {
   3417 				if (NFSRV_CMPFH(nfhp->nfh_fh, nfhp->nfh_len,
   3418 				    dnp->n_fhp->nfh_fh, dnp->n_fhp->nfh_len)) {
   3419 				    VREF(vp);
   3420 				    newvp = vp;
   3421 				    unlocknewvp = 0;
   3422 				    FREE((caddr_t)nfhp, M_NFSFH);
   3423 				    np = dnp;
   3424 				} else if (isdotdot != 0) {
   3425 				    /*
   3426 				     * Skip doing a nfscl_nget() call for "..".
   3427 				     * There's a race between acquiring the nfs
   3428 				     * node here and lookups that look for the
   3429 				     * directory being read (in the parent).
   3430 				     * It would try to get a lock on ".." here,
   3431 				     * owning the lock on the directory being
   3432 				     * read. Lookup will hold the lock on ".."
   3433 				     * and try to acquire the lock on the
   3434 				     * directory being read.
   3435 				     * If the directory is unlocked/relocked,
   3436 				     * then there is a LOR with the buflock
   3437 				     * vp is relocked.
   3438 				     */
   3439 				    free(nfhp, M_NFSFH);
   3440 				} else {
   3441 				    error = nfscl_nget(vnode_mount(vp), vp,
   3442 				      nfhp, cnp, p, &np, NULL, LK_EXCLUSIVE);
   3443 				    if (!error) {
   3444 					newvp = NFSTOV(np);
   3445 					unlocknewvp = 1;
   3446 				    }
   3447 				}
   3448 				nfhp = NULL;
   3449 				if (newvp != NULLVP) {
   3450 				    error = nfscl_loadattrcache(&newvp,
   3451 					&nfsva, NULL, NULL, 0, 0);
   3452 				    if (error) {
   3453 					if (unlocknewvp)
   3454 					    vput(newvp);
   3455 					else
   3456 					    vrele(newvp);
   3457 					goto nfsmout;
   3458 				    }
   3459 				    dp->d_type =
   3460 					vtonfs_dtype(np->n_vattr.na_type);
   3461 				    ndp->ni_vp = newvp;
   3462 				    NFSCNHASH(cnp, HASHINIT);
   3463 				    if (cnp->cn_namelen <= NCHNAMLEN &&
   3464 					(newvp->v_type != VDIR ||
   3465 					 dctime.tv_sec != 0)) {
   3466 					cache_enter_time(ndp->ni_dvp,
   3467 					    ndp->ni_vp, cnp,
   3468 					    &nfsva.na_ctime,
   3469 					    newvp->v_type != VDIR ? NULL :
   3470 					    &dctime);
   3471 				    }
   3472 				    if (unlocknewvp)
   3473 					vput(newvp);
   3474 				    else
   3475 					vrele(newvp);
   3476 				    newvp = NULLVP;
   3477 				}
   3478 			    }
   3479 			} else if (nfhp != NULL) {
   3480 			    FREE((caddr_t)nfhp, M_NFSFH);
   3481 			}
   3482 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   3483 			more_dirs = fxdr_unsigned(int, *tl);
   3484 		}
   3485 		/*
   3486 		 * If at end of rpc data, get the eof boolean
   3487 		 */
   3488 		if (!more_dirs) {
   3489 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   3490 			eof = fxdr_unsigned(int, *tl);
   3491 			if (tryformoredirs)
   3492 				more_dirs = !eof;
   3493 			if (nd->nd_flag & ND_NFSV4) {
   3494 				error = nfscl_postop_attr(nd, nap, attrflagp,
   3495 				    stuff);
   3496 				if (error)
   3497 					goto nfsmout;
   3498 			}
   3499 		}
   3500 		mbuf_freem(nd->nd_mrep);
   3501 		nd->nd_mrep = NULL;
   3502 	}
   3503 	/*
   3504 	 * Fill last record, iff any, out to a multiple of DIRBLKSIZ
   3505 	 * by increasing d_reclen for the last record.
   3506 	 */
   3507 	if (blksiz > 0) {
   3508 		left = DIRBLKSIZ - blksiz;
   3509 		dp->d_reclen += left;
   3510 		uio_iov_base_add(uiop, left);
   3511 		uio_iov_len_add(uiop, -(left));
   3512 		uio_uio_resid_add(uiop, -(left));
   3513 		uiop->uio_offset += left;
   3514 	}
   3515 
   3516 	/*
   3517 	 * If returning no data, assume end of file.
   3518 	 * If not bigenough, return not end of file, since you aren't
   3519 	 *    returning all the data
   3520 	 * Otherwise, return the eof flag from the server.
   3521 	 */
   3522 	if (eofp != NULL) {
   3523 		if (tresid == uio_uio_resid(uiop))
   3524 			*eofp = 1;
   3525 		else if (!bigenough)
   3526 			*eofp = 0;
   3527 		else
   3528 			*eofp = eof;
   3529 	}
   3530 
   3531 	/*
   3532 	 * Add extra empty records to any remaining DIRBLKSIZ chunks.
   3533 	 */
   3534 	while (uio_uio_resid(uiop) > 0 && uio_uio_resid(uiop) != tresid) {
   3535 		dp = (struct dirent *)uio_iov_base(uiop);
   3536 		dp->d_type = DT_UNKNOWN;
   3537 		dp->d_fileno = 0;
   3538 		dp->d_namlen = 0;
   3539 		dp->d_name[0] = '\0';
   3540 		tl = (u_int32_t *)&dp->d_name[4];
   3541 		*tl++ = cookie.lval[0];
   3542 		*tl = cookie.lval[1];
   3543 		dp->d_reclen = DIRBLKSIZ;
   3544 		uio_iov_base_add(uiop, DIRBLKSIZ);
   3545 		uio_iov_len_add(uiop, -(DIRBLKSIZ));
   3546 		uio_uio_resid_add(uiop, -(DIRBLKSIZ));
   3547 		uiop->uio_offset += DIRBLKSIZ;
   3548 	}
   3549 
   3550 nfsmout:
   3551 	if (nd->nd_mrep != NULL)
   3552 		mbuf_freem(nd->nd_mrep);
   3553 	return (error);
   3554 }
   3555 #endif	/* !APPLE */
   3556 
   3557 /*
   3558  * Nfs commit rpc
   3559  */
   3560 APPLESTATIC int
   3561 nfsrpc_commit(vnode_t vp, u_quad_t offset, int cnt, struct ucred *cred,
   3562     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   3563 {
   3564 	u_int32_t *tl;
   3565 	struct nfsrv_descript nfsd, *nd = &nfsd;
   3566 	nfsattrbit_t attrbits;
   3567 	int error;
   3568 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   3569 
   3570 	*attrflagp = 0;
   3571 	NFSCL_REQSTART(nd, NFSPROC_COMMIT, vp);
   3572 	NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
   3573 	txdr_hyper(offset, tl);
   3574 	tl += 2;
   3575 	*tl = txdr_unsigned(cnt);
   3576 	if (nd->nd_flag & ND_NFSV4) {
   3577 		/*
   3578 		 * And do a Getattr op.
   3579 		 */
   3580 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   3581 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   3582 		NFSGETATTR_ATTRBIT(&attrbits);
   3583 		(void) nfsrv_putattrbit(nd, &attrbits);
   3584 	}
   3585 	error = nfscl_request(nd, vp, p, cred, stuff);
   3586 	if (error)
   3587 		return (error);
   3588 	error = nfscl_wcc_data(nd, vp, nap, attrflagp, NULL, stuff);
   3589 	if (!error && !nd->nd_repstat) {
   3590 		NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
   3591 		NFSLOCKMNT(nmp);
   3592 		if (NFSBCMP(nmp->nm_verf, tl, NFSX_VERF)) {
   3593 			NFSBCOPY(tl, nmp->nm_verf, NFSX_VERF);
   3594 			nd->nd_repstat = NFSERR_STALEWRITEVERF;
   3595 		}
   3596 		NFSUNLOCKMNT(nmp);
   3597 		if (nd->nd_flag & ND_NFSV4)
   3598 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   3599 	}
   3600 nfsmout:
   3601 	if (!error && nd->nd_repstat)
   3602 		error = nd->nd_repstat;
   3603 	mbuf_freem(nd->nd_mrep);
   3604 	return (error);
   3605 }
   3606 
   3607 /*
   3608  * NFS byte range lock rpc.
   3609  * (Mostly just calls one of the three lower level RPC routines.)
   3610  */
   3611 APPLESTATIC int
   3612 nfsrpc_advlock(vnode_t vp, off_t size, int op, struct flock *fl,
   3613     int reclaim, struct ucred *cred, NFSPROC_T *p, void *id, int flags)
   3614 {
   3615 	struct nfscllockowner *lp;
   3616 	struct nfsclclient *clp;
   3617 	struct nfsfh *nfhp;
   3618 	struct nfsrv_descript nfsd, *nd = &nfsd;
   3619 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   3620 	u_int64_t off, len;
   3621 	off_t start, end;
   3622 	u_int32_t clidrev = 0;
   3623 	int error = 0, newone = 0, expireret = 0, retrycnt, donelocally;
   3624 	int callcnt, dorpc;
   3625 
   3626 	/*
   3627 	 * Convert the flock structure into a start and end and do POSIX
   3628 	 * bounds checking.
   3629 	 */
   3630 	switch (fl->l_whence) {
   3631 	case SEEK_SET:
   3632 	case SEEK_CUR:
   3633 		/*
   3634 		 * Caller is responsible for adding any necessary offset
   3635 		 * when SEEK_CUR is used.
   3636 		 */
   3637 		start = fl->l_start;
   3638 		off = fl->l_start;
   3639 		break;
   3640 	case SEEK_END:
   3641 		start = size + fl->l_start;
   3642 		off = size + fl->l_start;
   3643 		break;
   3644 	default:
   3645 		return (EINVAL);
   3646 	};
   3647 	if (start < 0)
   3648 		return (EINVAL);
   3649 	if (fl->l_len != 0) {
   3650 		end = start + fl->l_len - 1;
   3651 		if (end < start)
   3652 			return (EINVAL);
   3653 	}
   3654 
   3655 	len = fl->l_len;
   3656 	if (len == 0)
   3657 		len = NFS64BITSSET;
   3658 	retrycnt = 0;
   3659 	do {
   3660 	    nd->nd_repstat = 0;
   3661 	    if (op == F_GETLK) {
   3662 		error = nfscl_getcl(vnode_mount(vp), cred, p, 1, &clp);
   3663 		if (error)
   3664 			return (error);
   3665 		error = nfscl_lockt(vp, clp, off, len, fl, p, id, flags);
   3666 		if (!error) {
   3667 			clidrev = clp->nfsc_clientidrev;
   3668 			error = nfsrpc_lockt(nd, vp, clp, off, len, fl, cred,
   3669 			    p, id, flags);
   3670 		} else if (error == -1) {
   3671 			error = 0;
   3672 		}
   3673 		nfscl_clientrelease(clp);
   3674 	    } else if (op == F_UNLCK && fl->l_type == F_UNLCK) {
   3675 		/*
   3676 		 * We must loop around for all lockowner cases.
   3677 		 */
   3678 		callcnt = 0;
   3679 		error = nfscl_getcl(vnode_mount(vp), cred, p, 1, &clp);
   3680 		if (error)
   3681 			return (error);
   3682 		do {
   3683 		    error = nfscl_relbytelock(vp, off, len, cred, p, callcnt,
   3684 			clp, id, flags, &lp, &dorpc);
   3685 		    /*
   3686 		     * If it returns a NULL lp, we're done.
   3687 		     */
   3688 		    if (lp == NULL) {
   3689 			if (callcnt == 0)
   3690 			    nfscl_clientrelease(clp);
   3691 			else
   3692 			    nfscl_releasealllocks(clp, vp, p, id, flags);
   3693 			return (error);
   3694 		    }
   3695 		    if (nmp->nm_clp != NULL)
   3696 			clidrev = nmp->nm_clp->nfsc_clientidrev;
   3697 		    else
   3698 			clidrev = 0;
   3699 		    /*
   3700 		     * If the server doesn't support Posix lock semantics,
   3701 		     * only allow locks on the entire file, since it won't
   3702 		     * handle overlapping byte ranges.
   3703 		     * There might still be a problem when a lock
   3704 		     * upgrade/downgrade (read<->write) occurs, since the
   3705 		     * server "might" expect an unlock first?
   3706 		     */
   3707 		    if (dorpc && (lp->nfsl_open->nfso_posixlock ||
   3708 			(off == 0 && len == NFS64BITSSET))) {
   3709 			/*
   3710 			 * Since the lock records will go away, we must
   3711 			 * wait for grace and delay here.
   3712 			 */
   3713 			do {
   3714 			    error = nfsrpc_locku(nd, nmp, lp, off, len,
   3715 				NFSV4LOCKT_READ, cred, p, 0);
   3716 			    if ((nd->nd_repstat == NFSERR_GRACE ||
   3717 				 nd->nd_repstat == NFSERR_DELAY) &&
   3718 				error == 0)
   3719 				(void) nfs_catnap(PZERO, (int)nd->nd_repstat,
   3720 				    "nfs_advlock");
   3721 			} while ((nd->nd_repstat == NFSERR_GRACE ||
   3722 			    nd->nd_repstat == NFSERR_DELAY) && error == 0);
   3723 		    }
   3724 		    callcnt++;
   3725 		} while (error == 0 && nd->nd_repstat == 0);
   3726 		nfscl_releasealllocks(clp, vp, p, id, flags);
   3727 	    } else if (op == F_SETLK) {
   3728 		error = nfscl_getbytelock(vp, off, len, fl->l_type, cred, p,
   3729 		    NULL, 0, id, flags, NULL, NULL, &lp, &newone, &donelocally);
   3730 		if (error || donelocally) {
   3731 			return (error);
   3732 		}
   3733 		if (nmp->nm_clp != NULL)
   3734 			clidrev = nmp->nm_clp->nfsc_clientidrev;
   3735 		else
   3736 			clidrev = 0;
   3737 		nfhp = VTONFS(vp)->n_fhp;
   3738 		if (!lp->nfsl_open->nfso_posixlock &&
   3739 		    (off != 0 || len != NFS64BITSSET)) {
   3740 			error = EINVAL;
   3741 		} else {
   3742 			error = nfsrpc_lock(nd, nmp, vp, nfhp->nfh_fh,
   3743 			    nfhp->nfh_len, lp, newone, reclaim, off,
   3744 			    len, fl->l_type, cred, p, 0);
   3745 		}
   3746 		if (!error)
   3747 			error = nd->nd_repstat;
   3748 		nfscl_lockrelease(lp, error, newone);
   3749 	    } else {
   3750 		error = EINVAL;
   3751 	    }
   3752 	    if (!error)
   3753 	        error = nd->nd_repstat;
   3754 	    if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   3755 		error == NFSERR_STALEDONTRECOVER ||
   3756 		error == NFSERR_STALECLIENTID || error == NFSERR_DELAY ||
   3757 		error == NFSERR_BADSESSION) {
   3758 		(void) nfs_catnap(PZERO, error, "nfs_advlock");
   3759 	    } else if ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID)
   3760 		&& clidrev != 0) {
   3761 		expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   3762 		retrycnt++;
   3763 	    }
   3764 	} while (error == NFSERR_GRACE ||
   3765 	    error == NFSERR_STALECLIENTID || error == NFSERR_DELAY ||
   3766 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_STALESTATEID ||
   3767 	    error == NFSERR_BADSESSION ||
   3768 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   3769 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
   3770 	if (error && retrycnt >= 4)
   3771 		error = EIO;
   3772 	return (error);
   3773 }
   3774 
   3775 /*
   3776  * The lower level routine for the LockT case.
   3777  */
   3778 APPLESTATIC int
   3779 nfsrpc_lockt(struct nfsrv_descript *nd, vnode_t vp,
   3780     struct nfsclclient *clp, u_int64_t off, u_int64_t len, struct flock *fl,
   3781     struct ucred *cred, NFSPROC_T *p, void *id, int flags)
   3782 {
   3783 	u_int32_t *tl;
   3784 	int error, type, size;
   3785 	uint8_t own[NFSV4CL_LOCKNAMELEN + NFSX_V4FHMAX];
   3786 	struct nfsnode *np;
   3787 	struct nfsmount *nmp;
   3788 
   3789 	nmp = VFSTONFS(vp->v_mount);
   3790 	NFSCL_REQSTART(nd, NFSPROC_LOCKT, vp);
   3791 	NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
   3792 	if (fl->l_type == F_RDLCK)
   3793 		*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
   3794 	else
   3795 		*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
   3796 	txdr_hyper(off, tl);
   3797 	tl += 2;
   3798 	txdr_hyper(len, tl);
   3799 	tl += 2;
   3800 	*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   3801 	*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   3802 	nfscl_filllockowner(id, own, flags);
   3803 	np = VTONFS(vp);
   3804 	NFSBCOPY(np->n_fhp->nfh_fh, &own[NFSV4CL_LOCKNAMELEN],
   3805 	    np->n_fhp->nfh_len);
   3806 	(void)nfsm_strtom(nd, own, NFSV4CL_LOCKNAMELEN + np->n_fhp->nfh_len);
   3807 	error = nfscl_request(nd, vp, p, cred, NULL);
   3808 	if (error)
   3809 		return (error);
   3810 	if (nd->nd_repstat == 0) {
   3811 		fl->l_type = F_UNLCK;
   3812 	} else if (nd->nd_repstat == NFSERR_DENIED) {
   3813 		nd->nd_repstat = 0;
   3814 		fl->l_whence = SEEK_SET;
   3815 		NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
   3816 		fl->l_start = fxdr_hyper(tl);
   3817 		tl += 2;
   3818 		len = fxdr_hyper(tl);
   3819 		tl += 2;
   3820 		if (len == NFS64BITSSET)
   3821 			fl->l_len = 0;
   3822 		else
   3823 			fl->l_len = len;
   3824 		type = fxdr_unsigned(int, *tl++);
   3825 		if (type == NFSV4LOCKT_WRITE)
   3826 			fl->l_type = F_WRLCK;
   3827 		else
   3828 			fl->l_type = F_RDLCK;
   3829 		/*
   3830 		 * XXX For now, I have no idea what to do with the
   3831 		 * conflicting lock_owner, so I'll just set the pid == 0
   3832 		 * and skip over the lock_owner.
   3833 		 */
   3834 		fl->l_pid = (pid_t)0;
   3835 		tl += 2;
   3836 		size = fxdr_unsigned(int, *tl);
   3837 		if (size < 0 || size > NFSV4_OPAQUELIMIT)
   3838 			error = EBADRPC;
   3839 		if (!error)
   3840 			error = nfsm_advance(nd, NFSM_RNDUP(size), -1);
   3841 	} else if (nd->nd_repstat == NFSERR_STALECLIENTID ||
   3842 	    nd->nd_repstat == NFSERR_BADSESSION)
   3843 		nfscl_initiate_recovery(clp);
   3844 nfsmout:
   3845 	mbuf_freem(nd->nd_mrep);
   3846 	return (error);
   3847 }
   3848 
   3849 /*
   3850  * Lower level function that performs the LockU RPC.
   3851  */
   3852 static int
   3853 nfsrpc_locku(struct nfsrv_descript *nd, struct nfsmount *nmp,
   3854     struct nfscllockowner *lp, u_int64_t off, u_int64_t len,
   3855     u_int32_t type, struct ucred *cred, NFSPROC_T *p, int syscred)
   3856 {
   3857 	u_int32_t *tl;
   3858 	int error;
   3859 
   3860 	nfscl_reqstart(nd, NFSPROC_LOCKU, nmp, lp->nfsl_open->nfso_fh,
   3861 	    lp->nfsl_open->nfso_fhlen, NULL, NULL);
   3862 	NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 6 * NFSX_UNSIGNED);
   3863 	*tl++ = txdr_unsigned(type);
   3864 	*tl = txdr_unsigned(lp->nfsl_seqid);
   3865 	if (nfstest_outofseq &&
   3866 	    (arc4random() % nfstest_outofseq) == 0)
   3867 		*tl = txdr_unsigned(lp->nfsl_seqid + 1);
   3868 	tl++;
   3869 	if (NFSHASNFSV4N(nmp))
   3870 		*tl++ = 0;
   3871 	else
   3872 		*tl++ = lp->nfsl_stateid.seqid;
   3873 	*tl++ = lp->nfsl_stateid.other[0];
   3874 	*tl++ = lp->nfsl_stateid.other[1];
   3875 	*tl++ = lp->nfsl_stateid.other[2];
   3876 	txdr_hyper(off, tl);
   3877 	tl += 2;
   3878 	txdr_hyper(len, tl);
   3879 	if (syscred)
   3880 		nd->nd_flag |= ND_USEGSSNAME;
   3881 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   3882 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   3883 	NFSCL_INCRSEQID(lp->nfsl_seqid, nd);
   3884 	if (error)
   3885 		return (error);
   3886 	if (nd->nd_repstat == 0) {
   3887 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
   3888 		lp->nfsl_stateid.seqid = *tl++;
   3889 		lp->nfsl_stateid.other[0] = *tl++;
   3890 		lp->nfsl_stateid.other[1] = *tl++;
   3891 		lp->nfsl_stateid.other[2] = *tl;
   3892 	} else if (nd->nd_repstat == NFSERR_STALESTATEID ||
   3893 	    nd->nd_repstat == NFSERR_BADSESSION)
   3894 		nfscl_initiate_recovery(lp->nfsl_open->nfso_own->nfsow_clp);
   3895 nfsmout:
   3896 	mbuf_freem(nd->nd_mrep);
   3897 	return (error);
   3898 }
   3899 
   3900 /*
   3901  * The actual Lock RPC.
   3902  */
   3903 APPLESTATIC int
   3904 nfsrpc_lock(struct nfsrv_descript *nd, struct nfsmount *nmp, vnode_t vp,
   3905     u_int8_t *nfhp, int fhlen, struct nfscllockowner *lp, int newone,
   3906     int reclaim, u_int64_t off, u_int64_t len, short type, struct ucred *cred,
   3907     NFSPROC_T *p, int syscred)
   3908 {
   3909 	u_int32_t *tl;
   3910 	int error, size;
   3911 	uint8_t own[NFSV4CL_LOCKNAMELEN + NFSX_V4FHMAX];
   3912 
   3913 	nfscl_reqstart(nd, NFSPROC_LOCK, nmp, nfhp, fhlen, NULL, NULL);
   3914 	NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
   3915 	if (type == F_RDLCK)
   3916 		*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
   3917 	else
   3918 		*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
   3919 	*tl++ = txdr_unsigned(reclaim);
   3920 	txdr_hyper(off, tl);
   3921 	tl += 2;
   3922 	txdr_hyper(len, tl);
   3923 	tl += 2;
   3924 	if (newone) {
   3925 	    *tl = newnfs_true;
   3926 	    NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID +
   3927 		2 * NFSX_UNSIGNED + NFSX_HYPER);
   3928 	    *tl++ = txdr_unsigned(lp->nfsl_open->nfso_own->nfsow_seqid);
   3929 	    if (NFSHASNFSV4N(nmp))
   3930 		*tl++ = 0;
   3931 	    else
   3932 		*tl++ = lp->nfsl_open->nfso_stateid.seqid;
   3933 	    *tl++ = lp->nfsl_open->nfso_stateid.other[0];
   3934 	    *tl++ = lp->nfsl_open->nfso_stateid.other[1];
   3935 	    *tl++ = lp->nfsl_open->nfso_stateid.other[2];
   3936 	    *tl++ = txdr_unsigned(lp->nfsl_seqid);
   3937 	    *tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   3938 	    *tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   3939 	    NFSBCOPY(lp->nfsl_owner, own, NFSV4CL_LOCKNAMELEN);
   3940 	    NFSBCOPY(nfhp, &own[NFSV4CL_LOCKNAMELEN], fhlen);
   3941 	    (void)nfsm_strtom(nd, own, NFSV4CL_LOCKNAMELEN + fhlen);
   3942 	} else {
   3943 	    *tl = newnfs_false;
   3944 	    NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
   3945 	    if (NFSHASNFSV4N(nmp))
   3946 		*tl++ = 0;
   3947 	    else
   3948 		*tl++ = lp->nfsl_stateid.seqid;
   3949 	    *tl++ = lp->nfsl_stateid.other[0];
   3950 	    *tl++ = lp->nfsl_stateid.other[1];
   3951 	    *tl++ = lp->nfsl_stateid.other[2];
   3952 	    *tl = txdr_unsigned(lp->nfsl_seqid);
   3953 	    if (nfstest_outofseq &&
   3954 		(arc4random() % nfstest_outofseq) == 0)
   3955 		    *tl = txdr_unsigned(lp->nfsl_seqid + 1);
   3956 	}
   3957 	if (syscred)
   3958 		nd->nd_flag |= ND_USEGSSNAME;
   3959 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, vp, p, cred,
   3960 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   3961 	if (error)
   3962 		return (error);
   3963 	if (newone)
   3964 	    NFSCL_INCRSEQID(lp->nfsl_open->nfso_own->nfsow_seqid, nd);
   3965 	NFSCL_INCRSEQID(lp->nfsl_seqid, nd);
   3966 	if (nd->nd_repstat == 0) {
   3967 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
   3968 		lp->nfsl_stateid.seqid = *tl++;
   3969 		lp->nfsl_stateid.other[0] = *tl++;
   3970 		lp->nfsl_stateid.other[1] = *tl++;
   3971 		lp->nfsl_stateid.other[2] = *tl;
   3972 	} else if (nd->nd_repstat == NFSERR_DENIED) {
   3973 		NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
   3974 		size = fxdr_unsigned(int, *(tl + 7));
   3975 		if (size < 0 || size > NFSV4_OPAQUELIMIT)
   3976 			error = EBADRPC;
   3977 		if (!error)
   3978 			error = nfsm_advance(nd, NFSM_RNDUP(size), -1);
   3979 	} else if (nd->nd_repstat == NFSERR_STALESTATEID ||
   3980 	    nd->nd_repstat == NFSERR_BADSESSION)
   3981 		nfscl_initiate_recovery(lp->nfsl_open->nfso_own->nfsow_clp);
   3982 nfsmout:
   3983 	mbuf_freem(nd->nd_mrep);
   3984 	return (error);
   3985 }
   3986 
   3987 /*
   3988  * nfs statfs rpc
   3989  * (always called with the vp for the mount point)
   3990  */
   3991 APPLESTATIC int
   3992 nfsrpc_statfs(vnode_t vp, struct nfsstatfs *sbp, struct nfsfsinfo *fsp,
   3993     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   3994     void *stuff)
   3995 {
   3996 	u_int32_t *tl = NULL;
   3997 	struct nfsrv_descript nfsd, *nd = &nfsd;
   3998 	struct nfsmount *nmp;
   3999 	nfsattrbit_t attrbits;
   4000 	int error;
   4001 
   4002 	*attrflagp = 0;
   4003 	nmp = VFSTONFS(vnode_mount(vp));
   4004 	if (NFSHASNFSV4(nmp)) {
   4005 		/*
   4006 		 * For V4, you actually do a getattr.
   4007 		 */
   4008 		NFSCL_REQSTART(nd, NFSPROC_GETATTR, vp);
   4009 		NFSSTATFS_GETATTRBIT(&attrbits);
   4010 		(void) nfsrv_putattrbit(nd, &attrbits);
   4011 		nd->nd_flag |= ND_USEGSSNAME;
   4012 		error = nfscl_request(nd, vp, p, cred, stuff);
   4013 		if (error)
   4014 			return (error);
   4015 		if (nd->nd_repstat == 0) {
   4016 			error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0,
   4017 			    NULL, NULL, sbp, fsp, NULL, 0, NULL, NULL, NULL, p,
   4018 			    cred);
   4019 			if (!error) {
   4020 				nmp->nm_fsid[0] = nap->na_filesid[0];
   4021 				nmp->nm_fsid[1] = nap->na_filesid[1];
   4022 				NFSSETHASSETFSID(nmp);
   4023 				*attrflagp = 1;
   4024 			}
   4025 		} else {
   4026 			error = nd->nd_repstat;
   4027 		}
   4028 		if (error)
   4029 			goto nfsmout;
   4030 	} else {
   4031 		NFSCL_REQSTART(nd, NFSPROC_FSSTAT, vp);
   4032 		error = nfscl_request(nd, vp, p, cred, stuff);
   4033 		if (error)
   4034 			return (error);
   4035 		if (nd->nd_flag & ND_NFSV3) {
   4036 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   4037 			if (error)
   4038 				goto nfsmout;
   4039 		}
   4040 		if (nd->nd_repstat) {
   4041 			error = nd->nd_repstat;
   4042 			goto nfsmout;
   4043 		}
   4044 		NFSM_DISSECT(tl, u_int32_t *,
   4045 		    NFSX_STATFS(nd->nd_flag & ND_NFSV3));
   4046 	}
   4047 	if (NFSHASNFSV3(nmp)) {
   4048 		sbp->sf_tbytes = fxdr_hyper(tl); tl += 2;
   4049 		sbp->sf_fbytes = fxdr_hyper(tl); tl += 2;
   4050 		sbp->sf_abytes = fxdr_hyper(tl); tl += 2;
   4051 		sbp->sf_tfiles = fxdr_hyper(tl); tl += 2;
   4052 		sbp->sf_ffiles = fxdr_hyper(tl); tl += 2;
   4053 		sbp->sf_afiles = fxdr_hyper(tl); tl += 2;
   4054 		sbp->sf_invarsec = fxdr_unsigned(u_int32_t, *tl);
   4055 	} else if (NFSHASNFSV4(nmp) == 0) {
   4056 		sbp->sf_tsize = fxdr_unsigned(u_int32_t, *tl++);
   4057 		sbp->sf_bsize = fxdr_unsigned(u_int32_t, *tl++);
   4058 		sbp->sf_blocks = fxdr_unsigned(u_int32_t, *tl++);
   4059 		sbp->sf_bfree = fxdr_unsigned(u_int32_t, *tl++);
   4060 		sbp->sf_bavail = fxdr_unsigned(u_int32_t, *tl);
   4061 	}
   4062 nfsmout:
   4063 	mbuf_freem(nd->nd_mrep);
   4064 	return (error);
   4065 }
   4066 
   4067 /*
   4068  * nfs pathconf rpc
   4069  */
   4070 APPLESTATIC int
   4071 nfsrpc_pathconf(vnode_t vp, struct nfsv3_pathconf *pc,
   4072     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   4073     void *stuff)
   4074 {
   4075 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4076 	struct nfsmount *nmp;
   4077 	u_int32_t *tl;
   4078 	nfsattrbit_t attrbits;
   4079 	int error;
   4080 
   4081 	*attrflagp = 0;
   4082 	nmp = VFSTONFS(vnode_mount(vp));
   4083 	if (NFSHASNFSV4(nmp)) {
   4084 		/*
   4085 		 * For V4, you actually do a getattr.
   4086 		 */
   4087 		NFSCL_REQSTART(nd, NFSPROC_GETATTR, vp);
   4088 		NFSPATHCONF_GETATTRBIT(&attrbits);
   4089 		(void) nfsrv_putattrbit(nd, &attrbits);
   4090 		nd->nd_flag |= ND_USEGSSNAME;
   4091 		error = nfscl_request(nd, vp, p, cred, stuff);
   4092 		if (error)
   4093 			return (error);
   4094 		if (nd->nd_repstat == 0) {
   4095 			error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0,
   4096 			    pc, NULL, NULL, NULL, NULL, 0, NULL, NULL, NULL, p,
   4097 			    cred);
   4098 			if (!error)
   4099 				*attrflagp = 1;
   4100 		} else {
   4101 			error = nd->nd_repstat;
   4102 		}
   4103 	} else {
   4104 		NFSCL_REQSTART(nd, NFSPROC_PATHCONF, vp);
   4105 		error = nfscl_request(nd, vp, p, cred, stuff);
   4106 		if (error)
   4107 			return (error);
   4108 		error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   4109 		if (nd->nd_repstat && !error)
   4110 			error = nd->nd_repstat;
   4111 		if (!error) {
   4112 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V3PATHCONF);
   4113 			pc->pc_linkmax = fxdr_unsigned(u_int32_t, *tl++);
   4114 			pc->pc_namemax = fxdr_unsigned(u_int32_t, *tl++);
   4115 			pc->pc_notrunc = fxdr_unsigned(u_int32_t, *tl++);
   4116 			pc->pc_chownrestricted =
   4117 			    fxdr_unsigned(u_int32_t, *tl++);
   4118 			pc->pc_caseinsensitive =
   4119 			    fxdr_unsigned(u_int32_t, *tl++);
   4120 			pc->pc_casepreserving = fxdr_unsigned(u_int32_t, *tl);
   4121 		}
   4122 	}
   4123 nfsmout:
   4124 	mbuf_freem(nd->nd_mrep);
   4125 	return (error);
   4126 }
   4127 
   4128 /*
   4129  * nfs version 3 fsinfo rpc call
   4130  */
   4131 APPLESTATIC int
   4132 nfsrpc_fsinfo(vnode_t vp, struct nfsfsinfo *fsp, struct ucred *cred,
   4133     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   4134 {
   4135 	u_int32_t *tl;
   4136 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4137 	int error;
   4138 
   4139 	*attrflagp = 0;
   4140 	NFSCL_REQSTART(nd, NFSPROC_FSINFO, vp);
   4141 	error = nfscl_request(nd, vp, p, cred, stuff);
   4142 	if (error)
   4143 		return (error);
   4144 	error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   4145 	if (nd->nd_repstat && !error)
   4146 		error = nd->nd_repstat;
   4147 	if (!error) {
   4148 		NFSM_DISSECT(tl, u_int32_t *, NFSX_V3FSINFO);
   4149 		fsp->fs_rtmax = fxdr_unsigned(u_int32_t, *tl++);
   4150 		fsp->fs_rtpref = fxdr_unsigned(u_int32_t, *tl++);
   4151 		fsp->fs_rtmult = fxdr_unsigned(u_int32_t, *tl++);
   4152 		fsp->fs_wtmax = fxdr_unsigned(u_int32_t, *tl++);
   4153 		fsp->fs_wtpref = fxdr_unsigned(u_int32_t, *tl++);
   4154 		fsp->fs_wtmult = fxdr_unsigned(u_int32_t, *tl++);
   4155 		fsp->fs_dtpref = fxdr_unsigned(u_int32_t, *tl++);
   4156 		fsp->fs_maxfilesize = fxdr_hyper(tl);
   4157 		tl += 2;
   4158 		fxdr_nfsv3time(tl, &fsp->fs_timedelta);
   4159 		tl += 2;
   4160 		fsp->fs_properties = fxdr_unsigned(u_int32_t, *tl);
   4161 	}
   4162 nfsmout:
   4163 	mbuf_freem(nd->nd_mrep);
   4164 	return (error);
   4165 }
   4166 
   4167 /*
   4168  * This function performs the Renew RPC.
   4169  */
   4170 APPLESTATIC int
   4171 nfsrpc_renew(struct nfsclclient *clp, struct nfsclds *dsp, struct ucred *cred,
   4172     NFSPROC_T *p)
   4173 {
   4174 	u_int32_t *tl;
   4175 	struct nfsrv_descript nfsd;
   4176 	struct nfsrv_descript *nd = &nfsd;
   4177 	struct nfsmount *nmp;
   4178 	int error;
   4179 	struct nfssockreq *nrp;
   4180 
   4181 	nmp = clp->nfsc_nmp;
   4182 	if (nmp == NULL)
   4183 		return (0);
   4184 	nfscl_reqstart(nd, NFSPROC_RENEW, nmp, NULL, 0, NULL,
   4185 	    &dsp->nfsclds_sess);
   4186 	if (!NFSHASNFSV4N(nmp)) {
   4187 		/* NFSv4.1 just uses a Sequence Op and not a Renew. */
   4188 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   4189 		*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   4190 		*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   4191 	}
   4192 	nrp = dsp->nfsclds_sockp;
   4193 	if (nrp == NULL)
   4194 		/* If NULL, use the MDS socket. */
   4195 		nrp = &nmp->nm_sockreq;
   4196 	nd->nd_flag |= ND_USEGSSNAME;
   4197 	error = newnfs_request(nd, nmp, NULL, nrp, NULL, p, cred,
   4198 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, &dsp->nfsclds_sess);
   4199 	if (error)
   4200 		return (error);
   4201 	error = nd->nd_repstat;
   4202 	mbuf_freem(nd->nd_mrep);
   4203 	return (error);
   4204 }
   4205 
   4206 /*
   4207  * This function performs the Releaselockowner RPC.
   4208  */
   4209 APPLESTATIC int
   4210 nfsrpc_rellockown(struct nfsmount *nmp, struct nfscllockowner *lp,
   4211     uint8_t *fh, int fhlen, struct ucred *cred, NFSPROC_T *p)
   4212 {
   4213 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4214 	u_int32_t *tl;
   4215 	int error;
   4216 	uint8_t own[NFSV4CL_LOCKNAMELEN + NFSX_V4FHMAX];
   4217 
   4218 	if (NFSHASNFSV4N(nmp)) {
   4219 		/* For NFSv4.1, do a FreeStateID. */
   4220 		nfscl_reqstart(nd, NFSPROC_FREESTATEID, nmp, NULL, 0, NULL,
   4221 		    NULL);
   4222 		nfsm_stateidtom(nd, &lp->nfsl_stateid, NFSSTATEID_PUTSTATEID);
   4223 	} else {
   4224 		nfscl_reqstart(nd, NFSPROC_RELEASELCKOWN, nmp, NULL, 0, NULL,
   4225 		    NULL);
   4226 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   4227 		*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   4228 		*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   4229 		NFSBCOPY(lp->nfsl_owner, own, NFSV4CL_LOCKNAMELEN);
   4230 		NFSBCOPY(fh, &own[NFSV4CL_LOCKNAMELEN], fhlen);
   4231 		(void)nfsm_strtom(nd, own, NFSV4CL_LOCKNAMELEN + fhlen);
   4232 	}
   4233 	nd->nd_flag |= ND_USEGSSNAME;
   4234 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4235 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4236 	if (error)
   4237 		return (error);
   4238 	error = nd->nd_repstat;
   4239 	mbuf_freem(nd->nd_mrep);
   4240 	return (error);
   4241 }
   4242 
   4243 /*
   4244  * This function performs the Compound to get the mount pt FH.
   4245  */
   4246 APPLESTATIC int
   4247 nfsrpc_getdirpath(struct nfsmount *nmp, u_char *dirpath, struct ucred *cred,
   4248     NFSPROC_T *p)
   4249 {
   4250 	u_int32_t *tl;
   4251 	struct nfsrv_descript nfsd;
   4252 	struct nfsrv_descript *nd = &nfsd;
   4253 	u_char *cp, *cp2;
   4254 	int error, cnt, len, setnil;
   4255 	u_int32_t *opcntp;
   4256 
   4257 	nfscl_reqstart(nd, NFSPROC_PUTROOTFH, nmp, NULL, 0, &opcntp, NULL);
   4258 	cp = dirpath;
   4259 	cnt = 0;
   4260 	do {
   4261 		setnil = 0;
   4262 		while (*cp == '/')
   4263 			cp++;
   4264 		cp2 = cp;
   4265 		while (*cp2 != '\0' && *cp2 != '/')
   4266 			cp2++;
   4267 		if (*cp2 == '/') {
   4268 			setnil = 1;
   4269 			*cp2 = '\0';
   4270 		}
   4271 		if (cp2 != cp) {
   4272 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   4273 			*tl = txdr_unsigned(NFSV4OP_LOOKUP);
   4274 			nfsm_strtom(nd, cp, strlen(cp));
   4275 			cnt++;
   4276 		}
   4277 		if (setnil)
   4278 			*cp2++ = '/';
   4279 		cp = cp2;
   4280 	} while (*cp != '\0');
   4281 	if (NFSHASNFSV4N(nmp))
   4282 		/* Has a Sequence Op done by nfscl_reqstart(). */
   4283 		*opcntp = txdr_unsigned(3 + cnt);
   4284 	else
   4285 		*opcntp = txdr_unsigned(2 + cnt);
   4286 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   4287 	*tl = txdr_unsigned(NFSV4OP_GETFH);
   4288 	nd->nd_flag |= ND_USEGSSNAME;
   4289 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4290 		NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4291 	if (error)
   4292 		return (error);
   4293 	if (nd->nd_repstat == 0) {
   4294 		NFSM_DISSECT(tl, u_int32_t *, (3 + 2 * cnt) * NFSX_UNSIGNED);
   4295 		tl += (2 + 2 * cnt);
   4296 		if ((len = fxdr_unsigned(int, *tl)) <= 0 ||
   4297 			len > NFSX_FHMAX) {
   4298 			nd->nd_repstat = NFSERR_BADXDR;
   4299 		} else {
   4300 			nd->nd_repstat = nfsrv_mtostr(nd, nmp->nm_fh, len);
   4301 			if (nd->nd_repstat == 0)
   4302 				nmp->nm_fhsize = len;
   4303 		}
   4304 	}
   4305 	error = nd->nd_repstat;
   4306 nfsmout:
   4307 	mbuf_freem(nd->nd_mrep);
   4308 	return (error);
   4309 }
   4310 
   4311 /*
   4312  * This function performs the Delegreturn RPC.
   4313  */
   4314 APPLESTATIC int
   4315 nfsrpc_delegreturn(struct nfscldeleg *dp, struct ucred *cred,
   4316     struct nfsmount *nmp, NFSPROC_T *p, int syscred)
   4317 {
   4318 	u_int32_t *tl;
   4319 	struct nfsrv_descript nfsd;
   4320 	struct nfsrv_descript *nd = &nfsd;
   4321 	int error;
   4322 
   4323 	nfscl_reqstart(nd, NFSPROC_DELEGRETURN, nmp, dp->nfsdl_fh,
   4324 	    dp->nfsdl_fhlen, NULL, NULL);
   4325 	NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
   4326 	if (NFSHASNFSV4N(nmp))
   4327 		*tl++ = 0;
   4328 	else
   4329 		*tl++ = dp->nfsdl_stateid.seqid;
   4330 	*tl++ = dp->nfsdl_stateid.other[0];
   4331 	*tl++ = dp->nfsdl_stateid.other[1];
   4332 	*tl = dp->nfsdl_stateid.other[2];
   4333 	if (syscred)
   4334 		nd->nd_flag |= ND_USEGSSNAME;
   4335 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4336 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4337 	if (error)
   4338 		return (error);
   4339 	error = nd->nd_repstat;
   4340 	mbuf_freem(nd->nd_mrep);
   4341 	return (error);
   4342 }
   4343 
   4344 /*
   4345  * nfs getacl call.
   4346  */
   4347 APPLESTATIC int
   4348 nfsrpc_getacl(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
   4349     struct acl *aclp, void *stuff)
   4350 {
   4351 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4352 	int error;
   4353 	nfsattrbit_t attrbits;
   4354 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   4355 
   4356 	if (nfsrv_useacl == 0 || !NFSHASNFSV4(nmp))
   4357 		return (EOPNOTSUPP);
   4358 	NFSCL_REQSTART(nd, NFSPROC_GETACL, vp);
   4359 	NFSZERO_ATTRBIT(&attrbits);
   4360 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_ACL);
   4361 	(void) nfsrv_putattrbit(nd, &attrbits);
   4362 	error = nfscl_request(nd, vp, p, cred, stuff);
   4363 	if (error)
   4364 		return (error);
   4365 	if (!nd->nd_repstat)
   4366 		error = nfsv4_loadattr(nd, vp, NULL, NULL, NULL, 0, NULL,
   4367 		    NULL, NULL, NULL, aclp, 0, NULL, NULL, NULL, p, cred);
   4368 	else
   4369 		error = nd->nd_repstat;
   4370 	mbuf_freem(nd->nd_mrep);
   4371 	return (error);
   4372 }
   4373 
   4374 /*
   4375  * nfs setacl call.
   4376  */
   4377 APPLESTATIC int
   4378 nfsrpc_setacl(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
   4379     struct acl *aclp, void *stuff)
   4380 {
   4381 	int error;
   4382 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   4383 
   4384 	if (nfsrv_useacl == 0 || !NFSHASNFSV4(nmp))
   4385 		return (EOPNOTSUPP);
   4386 	error = nfsrpc_setattr(vp, NULL, aclp, cred, p, NULL, NULL, stuff);
   4387 	return (error);
   4388 }
   4389 
   4390 /*
   4391  * nfs setacl call.
   4392  */
   4393 static int
   4394 nfsrpc_setaclrpc(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
   4395     struct acl *aclp, nfsv4stateid_t *stateidp, void *stuff)
   4396 {
   4397 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4398 	int error;
   4399 	nfsattrbit_t attrbits;
   4400 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   4401 
   4402 	if (!NFSHASNFSV4(nmp))
   4403 		return (EOPNOTSUPP);
   4404 	NFSCL_REQSTART(nd, NFSPROC_SETACL, vp);
   4405 	nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
   4406 	NFSZERO_ATTRBIT(&attrbits);
   4407 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_ACL);
   4408 	(void) nfsv4_fillattr(nd, vnode_mount(vp), vp, aclp, NULL, NULL, 0,
   4409 	    &attrbits, NULL, NULL, 0, 0, 0, 0, (uint64_t)0);
   4410 	error = nfscl_request(nd, vp, p, cred, stuff);
   4411 	if (error)
   4412 		return (error);
   4413 	/* Don't care about the pre/postop attributes */
   4414 	mbuf_freem(nd->nd_mrep);
   4415 	return (nd->nd_repstat);
   4416 }
   4417 
   4418 /*
   4419  * Do the NFSv4.1 Exchange ID.
   4420  */
   4421 int
   4422 nfsrpc_exchangeid(struct nfsmount *nmp, struct nfsclclient *clp,
   4423     struct nfssockreq *nrp, uint32_t exchflags, struct nfsclds **dspp,
   4424     struct ucred *cred, NFSPROC_T *p)
   4425 {
   4426 	uint32_t *tl, v41flags;
   4427 	struct nfsrv_descript nfsd;
   4428 	struct nfsrv_descript *nd = &nfsd;
   4429 	struct nfsclds *dsp;
   4430 	struct timespec verstime;
   4431 	int error, len;
   4432 
   4433 	*dspp = NULL;
   4434 	nfscl_reqstart(nd, NFSPROC_EXCHANGEID, nmp, NULL, 0, NULL, NULL);
   4435 	NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
   4436 	*tl++ = txdr_unsigned(nfsboottime.tv_sec);	/* Client owner */
   4437 	*tl = txdr_unsigned(clp->nfsc_rev);
   4438 	(void) nfsm_strtom(nd, clp->nfsc_id, clp->nfsc_idlen);
   4439 
   4440 	NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
   4441 	*tl++ = txdr_unsigned(exchflags);
   4442 	*tl++ = txdr_unsigned(NFSV4EXCH_SP4NONE);
   4443 
   4444 	/* Set the implementation id4 */
   4445 	*tl = txdr_unsigned(1);
   4446 	(void) nfsm_strtom(nd, "freebsd.org", strlen("freebsd.org"));
   4447 	(void) nfsm_strtom(nd, version, strlen(version));
   4448 	NFSM_BUILD(tl, uint32_t *, NFSX_V4TIME);
   4449 	verstime.tv_sec = 1293840000;		/* Jan 1, 2011 */
   4450 	verstime.tv_nsec = 0;
   4451 	txdr_nfsv4time(&verstime, tl);
   4452 	nd->nd_flag |= ND_USEGSSNAME;
   4453 	error = newnfs_request(nd, nmp, NULL, nrp, NULL, p, cred,
   4454 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4455 	NFSCL_DEBUG(1, "exchangeid err=%d reps=%d\n", error,
   4456 	    (int)nd->nd_repstat);
   4457 	if (error != 0)
   4458 		return (error);
   4459 	if (nd->nd_repstat == 0) {
   4460 		NFSM_DISSECT(tl, uint32_t *, 6 * NFSX_UNSIGNED + NFSX_HYPER);
   4461 		len = fxdr_unsigned(int, *(tl + 7));
   4462 		if (len < 0 || len > NFSV4_OPAQUELIMIT) {
   4463 			error = NFSERR_BADXDR;
   4464 			goto nfsmout;
   4465 		}
   4466 		dsp = malloc(sizeof(struct nfsclds) + len, M_NFSCLDS,
   4467 		    M_WAITOK | M_ZERO);
   4468 		dsp->nfsclds_expire = NFSD_MONOSEC + clp->nfsc_renew;
   4469 		dsp->nfsclds_servownlen = len;
   4470 		dsp->nfsclds_sess.nfsess_clientid.lval[0] = *tl++;
   4471 		dsp->nfsclds_sess.nfsess_clientid.lval[1] = *tl++;
   4472 		dsp->nfsclds_sess.nfsess_sequenceid =
   4473 		    fxdr_unsigned(uint32_t, *tl++);
   4474 		v41flags = fxdr_unsigned(uint32_t, *tl);
   4475 		if ((v41flags & NFSV4EXCH_USEPNFSMDS) != 0 &&
   4476 		    NFSHASPNFSOPT(nmp)) {
   4477 			NFSCL_DEBUG(1, "set PNFS\n");
   4478 			NFSLOCKMNT(nmp);
   4479 			nmp->nm_state |= NFSSTA_PNFS;
   4480 			NFSUNLOCKMNT(nmp);
   4481 			dsp->nfsclds_flags |= NFSCLDS_MDS;
   4482 		}
   4483 		if ((v41flags & NFSV4EXCH_USEPNFSDS) != 0)
   4484 			dsp->nfsclds_flags |= NFSCLDS_DS;
   4485 		if (len > 0)
   4486 			nd->nd_repstat = nfsrv_mtostr(nd,
   4487 			    dsp->nfsclds_serverown, len);
   4488 		if (nd->nd_repstat == 0) {
   4489 			mtx_init(&dsp->nfsclds_mtx, "nfsds", NULL, MTX_DEF);
   4490 			mtx_init(&dsp->nfsclds_sess.nfsess_mtx, "nfssession",
   4491 			    NULL, MTX_DEF);
   4492 			nfscl_initsessionslots(&dsp->nfsclds_sess);
   4493 			*dspp = dsp;
   4494 		} else
   4495 			free(dsp, M_NFSCLDS);
   4496 	}
   4497 	error = nd->nd_repstat;
   4498 nfsmout:
   4499 	mbuf_freem(nd->nd_mrep);
   4500 	return (error);
   4501 }
   4502 
   4503 /*
   4504  * Do the NFSv4.1 Create Session.
   4505  */
   4506 int
   4507 nfsrpc_createsession(struct nfsmount *nmp, struct nfsclsession *sep,
   4508     struct nfssockreq *nrp, uint32_t sequenceid, int mds, struct ucred *cred,
   4509     NFSPROC_T *p)
   4510 {
   4511 	uint32_t crflags, *tl;
   4512 	struct nfsrv_descript nfsd;
   4513 	struct nfsrv_descript *nd = &nfsd;
   4514 	int error, irdcnt;
   4515 
   4516 	nfscl_reqstart(nd, NFSPROC_CREATESESSION, nmp, NULL, 0, NULL, NULL);
   4517 	NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED);
   4518 	*tl++ = sep->nfsess_clientid.lval[0];
   4519 	*tl++ = sep->nfsess_clientid.lval[1];
   4520 	*tl++ = txdr_unsigned(sequenceid);
   4521 	crflags = (NFSMNT_RDONLY(nmp->nm_mountp) ? 0 : NFSV4CRSESS_PERSIST);
   4522 	if (nfscl_enablecallb != 0 && nfs_numnfscbd > 0)
   4523 		crflags |= NFSV4CRSESS_CONNBACKCHAN;
   4524 	*tl = txdr_unsigned(crflags);
   4525 
   4526 	/* Fill in fore channel attributes. */
   4527 	NFSM_BUILD(tl, uint32_t *, 7 * NFSX_UNSIGNED);
   4528 	*tl++ = 0;				/* Header pad size */
   4529 	*tl++ = txdr_unsigned(100000);		/* Max request size */
   4530 	*tl++ = txdr_unsigned(100000);		/* Max response size */
   4531 	*tl++ = txdr_unsigned(4096);		/* Max response size cached */
   4532 	*tl++ = txdr_unsigned(20);		/* Max operations */
   4533 	*tl++ = txdr_unsigned(64);		/* Max slots */
   4534 	*tl = 0;				/* No rdma ird */
   4535 
   4536 	/* Fill in back channel attributes. */
   4537 	NFSM_BUILD(tl, uint32_t *, 7 * NFSX_UNSIGNED);
   4538 	*tl++ = 0;				/* Header pad size */
   4539 	*tl++ = txdr_unsigned(10000);		/* Max request size */
   4540 	*tl++ = txdr_unsigned(10000);		/* Max response size */
   4541 	*tl++ = txdr_unsigned(4096);		/* Max response size cached */
   4542 	*tl++ = txdr_unsigned(4);		/* Max operations */
   4543 	*tl++ = txdr_unsigned(NFSV4_CBSLOTS);	/* Max slots */
   4544 	*tl = 0;				/* No rdma ird */
   4545 
   4546 	NFSM_BUILD(tl, uint32_t *, 8 * NFSX_UNSIGNED);
   4547 	*tl++ = txdr_unsigned(NFS_CALLBCKPROG);	/* Call back prog # */
   4548 
   4549 	/* Allow AUTH_SYS callbacks as uid, gid == 0. */
   4550 	*tl++ = txdr_unsigned(1);		/* Auth_sys only */
   4551 	*tl++ = txdr_unsigned(AUTH_SYS);	/* AUTH_SYS type */
   4552 	*tl++ = txdr_unsigned(nfsboottime.tv_sec); /* time stamp */
   4553 	*tl++ = 0;				/* Null machine name */
   4554 	*tl++ = 0;				/* Uid == 0 */
   4555 	*tl++ = 0;				/* Gid == 0 */
   4556 	*tl = 0;				/* No additional gids */
   4557 	nd->nd_flag |= ND_USEGSSNAME;
   4558 	error = newnfs_request(nd, nmp, NULL, nrp, NULL, p, cred, NFS_PROG,
   4559 	    NFS_VER4, NULL, 1, NULL, NULL);
   4560 	if (error != 0)
   4561 		return (error);
   4562 	if (nd->nd_repstat == 0) {
   4563 		NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID +
   4564 		    2 * NFSX_UNSIGNED);
   4565 		bcopy(tl, sep->nfsess_sessionid, NFSX_V4SESSIONID);
   4566 		tl += NFSX_V4SESSIONID / NFSX_UNSIGNED;
   4567 		sep->nfsess_sequenceid = fxdr_unsigned(uint32_t, *tl++);
   4568 		crflags = fxdr_unsigned(uint32_t, *tl);
   4569 		if ((crflags & NFSV4CRSESS_PERSIST) != 0 && mds != 0) {
   4570 			NFSLOCKMNT(nmp);
   4571 			nmp->nm_state |= NFSSTA_SESSPERSIST;
   4572 			NFSUNLOCKMNT(nmp);
   4573 		}
   4574 
   4575 		/* Get the fore channel slot count. */
   4576 		NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
   4577 		tl += 3;		/* Skip the other counts. */
   4578 		sep->nfsess_maxcache = fxdr_unsigned(int, *tl++);
   4579 		tl++;
   4580 		sep->nfsess_foreslots = fxdr_unsigned(uint16_t, *tl++);
   4581 		NFSCL_DEBUG(4, "fore slots=%d\n", (int)sep->nfsess_foreslots);
   4582 		irdcnt = fxdr_unsigned(int, *tl);
   4583 		if (irdcnt > 0)
   4584 			NFSM_DISSECT(tl, uint32_t *, irdcnt * NFSX_UNSIGNED);
   4585 
   4586 		/* and the back channel slot count. */
   4587 		NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
   4588 		tl += 5;
   4589 		sep->nfsess_backslots = fxdr_unsigned(uint16_t, *tl);
   4590 		NFSCL_DEBUG(4, "back slots=%d\n", (int)sep->nfsess_backslots);
   4591 	}
   4592 	error = nd->nd_repstat;
   4593 nfsmout:
   4594 	mbuf_freem(nd->nd_mrep);
   4595 	return (error);
   4596 }
   4597 
   4598 /*
   4599  * Do the NFSv4.1 Destroy Session.
   4600  */
   4601 int
   4602 nfsrpc_destroysession(struct nfsmount *nmp, struct nfsclclient *clp,
   4603     struct ucred *cred, NFSPROC_T *p)
   4604 {
   4605 	uint32_t *tl;
   4606 	struct nfsrv_descript nfsd;
   4607 	struct nfsrv_descript *nd = &nfsd;
   4608 	int error;
   4609 
   4610 	nfscl_reqstart(nd, NFSPROC_DESTROYSESSION, nmp, NULL, 0, NULL, NULL);
   4611 	NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
   4612 	bcopy(NFSMNT_MDSSESSION(nmp)->nfsess_sessionid, tl, NFSX_V4SESSIONID);
   4613 	nd->nd_flag |= ND_USEGSSNAME;
   4614 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4615 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4616 	if (error != 0)
   4617 		return (error);
   4618 	error = nd->nd_repstat;
   4619 	mbuf_freem(nd->nd_mrep);
   4620 	return (error);
   4621 }
   4622 
   4623 /*
   4624  * Do the NFSv4.1 Destroy Client.
   4625  */
   4626 int
   4627 nfsrpc_destroyclient(struct nfsmount *nmp, struct nfsclclient *clp,
   4628     struct ucred *cred, NFSPROC_T *p)
   4629 {
   4630 	uint32_t *tl;
   4631 	struct nfsrv_descript nfsd;
   4632 	struct nfsrv_descript *nd = &nfsd;
   4633 	int error;
   4634 
   4635 	nfscl_reqstart(nd, NFSPROC_DESTROYCLIENT, nmp, NULL, 0, NULL, NULL);
   4636 	NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
   4637 	*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   4638 	*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   4639 	nd->nd_flag |= ND_USEGSSNAME;
   4640 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4641 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4642 	if (error != 0)
   4643 		return (error);
   4644 	error = nd->nd_repstat;
   4645 	mbuf_freem(nd->nd_mrep);
   4646 	return (error);
   4647 }
   4648 
   4649 /*
   4650  * Do the NFSv4.1 LayoutGet.
   4651  */
   4652 int
   4653 nfsrpc_layoutget(struct nfsmount *nmp, uint8_t *fhp, int fhlen, int iomode,
   4654     uint64_t offset, uint64_t len, uint64_t minlen, int layoutlen,
   4655     nfsv4stateid_t *stateidp, int *retonclosep, struct nfsclflayouthead *flhp,
   4656     struct ucred *cred, NFSPROC_T *p, void *stuff)
   4657 {
   4658 	uint32_t *tl;
   4659 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4660 	struct nfsfh *nfhp;
   4661 	struct nfsclflayout *flp, *prevflp, *tflp;
   4662 	int cnt, error, gotiomode, fhcnt, nfhlen, i, j;
   4663 	uint8_t *cp;
   4664 	uint64_t retlen;
   4665 
   4666 	flp = NULL;
   4667 	gotiomode = -1;
   4668 	nfscl_reqstart(nd, NFSPROC_LAYOUTGET, nmp, fhp, fhlen, NULL, NULL);
   4669 	NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + 3 * NFSX_HYPER +
   4670 	    NFSX_STATEID);
   4671 	*tl++ = newnfs_false;		/* Don't signal availability. */
   4672 	*tl++ = txdr_unsigned(NFSLAYOUT_NFSV4_1_FILES);
   4673 	*tl++ = txdr_unsigned(iomode);
   4674 	txdr_hyper(offset, tl);
   4675 	tl += 2;
   4676 	txdr_hyper(len, tl);
   4677 	tl += 2;
   4678 	txdr_hyper(minlen, tl);
   4679 	tl += 2;
   4680 	*tl++ = txdr_unsigned(stateidp->seqid);
   4681 	NFSCL_DEBUG(4, "layget seq=%d\n", (int)stateidp->seqid);
   4682 	*tl++ = stateidp->other[0];
   4683 	*tl++ = stateidp->other[1];
   4684 	*tl++ = stateidp->other[2];
   4685 	*tl = txdr_unsigned(layoutlen);
   4686 	nd->nd_flag |= ND_USEGSSNAME;
   4687 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4688 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4689 	if (error != 0)
   4690 		return (error);
   4691 	if (nd->nd_repstat == 0) {
   4692 		NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED + NFSX_STATEID);
   4693 		if (*tl++ != 0)
   4694 			*retonclosep = 1;
   4695 		else
   4696 			*retonclosep = 0;
   4697 		stateidp->seqid = fxdr_unsigned(uint32_t, *tl++);
   4698 		NFSCL_DEBUG(4, "retoncls=%d stseq=%d\n", *retonclosep,
   4699 		    (int)stateidp->seqid);
   4700 		stateidp->other[0] = *tl++;
   4701 		stateidp->other[1] = *tl++;
   4702 		stateidp->other[2] = *tl++;
   4703 		cnt = fxdr_unsigned(int, *tl);
   4704 		NFSCL_DEBUG(4, "layg cnt=%d\n", cnt);
   4705 		if (cnt <= 0 || cnt > 10000) {
   4706 			/* Don't accept more than 10000 layouts in reply. */
   4707 			error = NFSERR_BADXDR;
   4708 			goto nfsmout;
   4709 		}
   4710 		for (i = 0; i < cnt; i++) {
   4711 			/* Dissect all the way to the file handle cnt. */
   4712 			NFSM_DISSECT(tl, uint32_t *, 3 * NFSX_HYPER +
   4713 			    6 * NFSX_UNSIGNED + NFSX_V4DEVICEID);
   4714 			fhcnt = fxdr_unsigned(int, *(tl + 11 +
   4715 			    NFSX_V4DEVICEID / NFSX_UNSIGNED));
   4716 			NFSCL_DEBUG(4, "fhcnt=%d\n", fhcnt);
   4717 			if (fhcnt < 0 || fhcnt > 100) {
   4718 				/* Don't accept more than 100 file handles. */
   4719 				error = NFSERR_BADXDR;
   4720 				goto nfsmout;
   4721 			}
   4722 			if (fhcnt > 1)
   4723 				flp = malloc(sizeof(*flp) + (fhcnt - 1) *
   4724 				    sizeof(struct nfsfh *),
   4725 				    M_NFSFLAYOUT, M_WAITOK);
   4726 			else
   4727 				flp = malloc(sizeof(*flp),
   4728 				    M_NFSFLAYOUT, M_WAITOK);
   4729 			flp->nfsfl_flags = 0;
   4730 			flp->nfsfl_fhcnt = 0;
   4731 			flp->nfsfl_devp = NULL;
   4732 			flp->nfsfl_off = fxdr_hyper(tl); tl += 2;
   4733 			retlen = fxdr_hyper(tl); tl += 2;
   4734 			if (flp->nfsfl_off + retlen < flp->nfsfl_off)
   4735 				flp->nfsfl_end = UINT64_MAX - flp->nfsfl_off;
   4736 			else
   4737 				flp->nfsfl_end = flp->nfsfl_off + retlen;
   4738 			flp->nfsfl_iomode = fxdr_unsigned(int, *tl++);
   4739 			if (gotiomode == -1)
   4740 				gotiomode = flp->nfsfl_iomode;
   4741 			NFSCL_DEBUG(4, "layg reqiom=%d retiom=%d\n", iomode,
   4742 			    (int)flp->nfsfl_iomode);
   4743 			if (fxdr_unsigned(int, *tl++) !=
   4744 			    NFSLAYOUT_NFSV4_1_FILES) {
   4745 				printf("NFSv4.1: got non-files layout\n");
   4746 				error = NFSERR_BADXDR;
   4747 				goto nfsmout;
   4748 			}
   4749 			NFSBCOPY(++tl, flp->nfsfl_dev, NFSX_V4DEVICEID);
   4750 			tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
   4751 			flp->nfsfl_util = fxdr_unsigned(uint32_t, *tl++);
   4752 			NFSCL_DEBUG(4, "flutil=0x%x\n", flp->nfsfl_util);
   4753 			flp->nfsfl_stripe1 = fxdr_unsigned(uint32_t, *tl++);
   4754 			flp->nfsfl_patoff = fxdr_hyper(tl); tl += 2;
   4755 			if (fxdr_unsigned(int, *tl) != fhcnt) {
   4756 				printf("EEK! bad fhcnt\n");
   4757 				error = NFSERR_BADXDR;
   4758 				goto nfsmout;
   4759 			}
   4760 			for (j = 0; j < fhcnt; j++) {
   4761 				NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   4762 				nfhlen = fxdr_unsigned(int, *tl);
   4763 				if (nfhlen <= 0 || nfhlen > NFSX_V4FHMAX) {
   4764 					error = NFSERR_BADXDR;
   4765 					goto nfsmout;
   4766 				}
   4767 				nfhp = malloc(sizeof(*nfhp) + nfhlen - 1,
   4768 				    M_NFSFH, M_WAITOK);
   4769 				flp->nfsfl_fh[j] = nfhp;
   4770 				flp->nfsfl_fhcnt++;
   4771 				nfhp->nfh_len = nfhlen;
   4772 				NFSM_DISSECT(cp, uint8_t *, NFSM_RNDUP(nfhlen));
   4773 				NFSBCOPY(cp, nfhp->nfh_fh, nfhlen);
   4774 			}
   4775 			if (flp->nfsfl_iomode == gotiomode) {
   4776 				/* Keep the list in increasing offset order. */
   4777 				tflp = LIST_FIRST(flhp);
   4778 				prevflp = NULL;
   4779 				while (tflp != NULL &&
   4780 				    tflp->nfsfl_off < flp->nfsfl_off) {
   4781 					prevflp = tflp;
   4782 					tflp = LIST_NEXT(tflp, nfsfl_list);
   4783 				}
   4784 				if (prevflp == NULL)
   4785 					LIST_INSERT_HEAD(flhp, flp, nfsfl_list);
   4786 				else
   4787 					LIST_INSERT_AFTER(prevflp, flp,
   4788 					    nfsfl_list);
   4789 			} else {
   4790 				printf("nfscl_layoutget(): got wrong iomode\n");
   4791 				nfscl_freeflayout(flp);
   4792 			}
   4793 			flp = NULL;
   4794 		}
   4795 	}
   4796 	if (nd->nd_repstat != 0 && error == 0)
   4797 		error = nd->nd_repstat;
   4798 nfsmout:
   4799 	if (error != 0 && flp != NULL)
   4800 		nfscl_freeflayout(flp);
   4801 	mbuf_freem(nd->nd_mrep);
   4802 	return (error);
   4803 }
   4804 
   4805 /*
   4806  * Do the NFSv4.1 Get Device Info.
   4807  */
   4808 int
   4809 nfsrpc_getdeviceinfo(struct nfsmount *nmp, uint8_t *deviceid, int layouttype,
   4810     uint32_t *notifybitsp, struct nfscldevinfo **ndip, struct ucred *cred,
   4811     NFSPROC_T *p)
   4812 {
   4813 	uint32_t cnt, *tl;
   4814 	struct nfsrv_descript nfsd;
   4815 	struct nfsrv_descript *nd = &nfsd;
   4816 	struct sockaddr_storage ss;
   4817 	struct nfsclds *dsp = NULL, **dspp;
   4818 	struct nfscldevinfo *ndi;
   4819 	int addrcnt, bitcnt, error, i, isudp, j, pos, safilled, stripecnt;
   4820 	uint8_t stripeindex;
   4821 
   4822 	*ndip = NULL;
   4823 	ndi = NULL;
   4824 	nfscl_reqstart(nd, NFSPROC_GETDEVICEINFO, nmp, NULL, 0, NULL, NULL);
   4825 	NFSM_BUILD(tl, uint32_t *, NFSX_V4DEVICEID + 3 * NFSX_UNSIGNED);
   4826 	NFSBCOPY(deviceid, tl, NFSX_V4DEVICEID);
   4827 	tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
   4828 	*tl++ = txdr_unsigned(layouttype);
   4829 	*tl++ = txdr_unsigned(100000);
   4830 	if (notifybitsp != NULL && *notifybitsp != 0) {
   4831 		*tl = txdr_unsigned(1);		/* One word of bits. */
   4832 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
   4833 		*tl = txdr_unsigned(*notifybitsp);
   4834 	} else
   4835 		*tl = txdr_unsigned(0);
   4836 	nd->nd_flag |= ND_USEGSSNAME;
   4837 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4838 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4839 	if (error != 0)
   4840 		return (error);
   4841 	if (nd->nd_repstat == 0) {
   4842 		NFSM_DISSECT(tl, uint32_t *, 3 * NFSX_UNSIGNED);
   4843 		if (layouttype != fxdr_unsigned(int, *tl++))
   4844 			printf("EEK! devinfo layout type not same!\n");
   4845 		stripecnt = fxdr_unsigned(int, *++tl);
   4846 		NFSCL_DEBUG(4, "stripecnt=%d\n", stripecnt);
   4847 		if (stripecnt < 1 || stripecnt > 4096) {
   4848 			printf("NFS devinfo stripecnt %d: out of range\n",
   4849 			    stripecnt);
   4850 			error = NFSERR_BADXDR;
   4851 			goto nfsmout;
   4852 		}
   4853 		NFSM_DISSECT(tl, uint32_t *, (stripecnt + 1) * NFSX_UNSIGNED);
   4854 		addrcnt = fxdr_unsigned(int, *(tl + stripecnt));
   4855 		NFSCL_DEBUG(4, "addrcnt=%d\n", addrcnt);
   4856 		if (addrcnt < 1 || addrcnt > 128) {
   4857 			printf("NFS devinfo addrcnt %d: out of range\n",
   4858 			    addrcnt);
   4859 			error = NFSERR_BADXDR;
   4860 			goto nfsmout;
   4861 		}
   4862 
   4863 		/*
   4864 		 * Now we know how many stripe indices and addresses, so
   4865 		 * we can allocate the structure the correct size.
   4866 		 */
   4867 		i = (stripecnt * sizeof(uint8_t)) / sizeof(struct nfsclds *)
   4868 		    + 1;
   4869 		NFSCL_DEBUG(4, "stripeindices=%d\n", i);
   4870 		ndi = malloc(sizeof(*ndi) + (addrcnt + i) *
   4871 		    sizeof(struct nfsclds *), M_NFSDEVINFO, M_WAITOK | M_ZERO);
   4872 		NFSBCOPY(deviceid, ndi->nfsdi_deviceid, NFSX_V4DEVICEID);
   4873 		ndi->nfsdi_refcnt = 0;
   4874 		ndi->nfsdi_stripecnt = stripecnt;
   4875 		ndi->nfsdi_addrcnt = addrcnt;
   4876 		/* Fill in the stripe indices. */
   4877 		for (i = 0; i < stripecnt; i++) {
   4878 			stripeindex = fxdr_unsigned(uint8_t, *tl++);
   4879 			NFSCL_DEBUG(4, "stripeind=%d\n", stripeindex);
   4880 			if (stripeindex >= addrcnt) {
   4881 				printf("NFS devinfo stripeindex %d: too big\n",
   4882 				    (int)stripeindex);
   4883 				error = NFSERR_BADXDR;
   4884 				goto nfsmout;
   4885 			}
   4886 			nfsfldi_setstripeindex(ndi, i, stripeindex);
   4887 		}
   4888 
   4889 		/* Now, dissect the server address(es). */
   4890 		safilled = 0;
   4891 		for (i = 0; i < addrcnt; i++) {
   4892 			NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   4893 			cnt = fxdr_unsigned(uint32_t, *tl);
   4894 			if (cnt == 0) {
   4895 				printf("NFS devinfo 0 len addrlist\n");
   4896 				error = NFSERR_BADXDR;
   4897 				goto nfsmout;
   4898 			}
   4899 			dspp = nfsfldi_addr(ndi, i);
   4900 			pos = arc4random() % cnt;	/* Choose one. */
   4901 			safilled = 0;
   4902 			for (j = 0; j < cnt; j++) {
   4903 				error = nfsv4_getipaddr(nd, &ss, &isudp);
   4904 				if (error != 0 && error != EPERM) {
   4905 					error = NFSERR_BADXDR;
   4906 					goto nfsmout;
   4907 				}
   4908 				if (error == 0 && isudp == 0) {
   4909 					/*
   4910 					 * The algorithm is:
   4911 					 * - use "pos" entry if it is of the
   4912 					 *   same af_family or none of them
   4913 					 *   is of the same af_family
   4914 					 * else
   4915 					 * - use the first one of the same
   4916 					 *   af_family.
   4917 					 */
   4918 					if ((safilled == 0 && ss.ss_family ==
   4919 					     nmp->nm_nam->sa_family) ||
   4920 					    (j == pos &&
   4921 					     (safilled == 0 || ss.ss_family ==
   4922 					      nmp->nm_nam->sa_family)) ||
   4923 					    (safilled == 1 && ss.ss_family ==
   4924 					     nmp->nm_nam->sa_family)) {
   4925 						error = nfsrpc_fillsa(nmp, &ss,
   4926 						    &dsp, p);
   4927 						if (error == 0) {
   4928 							*dspp = dsp;
   4929 							if (ss.ss_family ==
   4930 							 nmp->nm_nam->sa_family)
   4931 								safilled = 2;
   4932 							else
   4933 								safilled = 1;
   4934 						}
   4935 					}
   4936 				}
   4937 			}
   4938 			if (safilled == 0)
   4939 				break;
   4940 		}
   4941 
   4942 		/* And the notify bits. */
   4943 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   4944 		if (safilled != 0) {
   4945 			bitcnt = fxdr_unsigned(int, *tl);
   4946 			if (bitcnt > 0) {
   4947 				NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   4948 				if (notifybitsp != NULL)
   4949 					*notifybitsp =
   4950 					    fxdr_unsigned(uint32_t, *tl);
   4951 			}
   4952 			*ndip = ndi;
   4953 		} else
   4954 			error = EPERM;
   4955 	}
   4956 	if (nd->nd_repstat != 0)
   4957 		error = nd->nd_repstat;
   4958 nfsmout:
   4959 	if (error != 0 && ndi != NULL)
   4960 		nfscl_freedevinfo(ndi);
   4961 	mbuf_freem(nd->nd_mrep);
   4962 	return (error);
   4963 }
   4964 
   4965 /*
   4966  * Do the NFSv4.1 LayoutCommit.
   4967  */
   4968 int
   4969 nfsrpc_layoutcommit(struct nfsmount *nmp, uint8_t *fh, int fhlen, int reclaim,
   4970     uint64_t off, uint64_t len, uint64_t lastbyte, nfsv4stateid_t *stateidp,
   4971     int layouttype, int layoutupdatecnt, uint8_t *layp, struct ucred *cred,
   4972     NFSPROC_T *p, void *stuff)
   4973 {
   4974 	uint32_t *tl;
   4975 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4976 	int error, outcnt, i;
   4977 	uint8_t *cp;
   4978 
   4979 	nfscl_reqstart(nd, NFSPROC_LAYOUTCOMMIT, nmp, fh, fhlen, NULL, NULL);
   4980 	NFSM_BUILD(tl, uint32_t *, 5 * NFSX_UNSIGNED + 3 * NFSX_HYPER +
   4981 	    NFSX_STATEID);
   4982 	txdr_hyper(off, tl);
   4983 	tl += 2;
   4984 	txdr_hyper(len, tl);
   4985 	tl += 2;
   4986 	if (reclaim != 0)
   4987 		*tl++ = newnfs_true;
   4988 	else
   4989 		*tl++ = newnfs_false;
   4990 	*tl++ = txdr_unsigned(stateidp->seqid);
   4991 	*tl++ = stateidp->other[0];
   4992 	*tl++ = stateidp->other[1];
   4993 	*tl++ = stateidp->other[2];
   4994 	*tl++ = newnfs_true;
   4995 	if (lastbyte < off)
   4996 		lastbyte = off;
   4997 	else if (lastbyte >= (off + len))
   4998 		lastbyte = off + len - 1;
   4999 	txdr_hyper(lastbyte, tl);
   5000 	tl += 2;
   5001 	*tl++ = newnfs_false;
   5002 	*tl++ = txdr_unsigned(layouttype);
   5003 	*tl = txdr_unsigned(layoutupdatecnt);
   5004 	if (layoutupdatecnt > 0) {
   5005 		KASSERT(layouttype != NFSLAYOUT_NFSV4_1_FILES,
   5006 		    ("Must be nil for Files Layout"));
   5007 		outcnt = NFSM_RNDUP(layoutupdatecnt);
   5008 		NFSM_BUILD(cp, uint8_t *, outcnt);
   5009 		NFSBCOPY(layp, cp, layoutupdatecnt);
   5010 		cp += layoutupdatecnt;
   5011 		for (i = 0; i < (outcnt - layoutupdatecnt); i++)
   5012 			*cp++ = 0x0;
   5013 	}
   5014 	nd->nd_flag |= ND_USEGSSNAME;
   5015 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   5016 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   5017 	if (error != 0)
   5018 		return (error);
   5019 	error = nd->nd_repstat;
   5020 	mbuf_freem(nd->nd_mrep);
   5021 	return (error);
   5022 }
   5023 
   5024 /*
   5025  * Do the NFSv4.1 LayoutReturn.
   5026  */
   5027 int
   5028 nfsrpc_layoutreturn(struct nfsmount *nmp, uint8_t *fh, int fhlen, int reclaim,
   5029     int layouttype, uint32_t iomode, int layoutreturn, uint64_t offset,
   5030     uint64_t len, nfsv4stateid_t *stateidp, int layoutcnt, uint32_t *layp,
   5031     struct ucred *cred, NFSPROC_T *p, void *stuff)
   5032 {
   5033 	uint32_t *tl;
   5034 	struct nfsrv_descript nfsd, *nd = &nfsd;
   5035 	int error, outcnt, i;
   5036 	uint8_t *cp;
   5037 
   5038 	nfscl_reqstart(nd, NFSPROC_LAYOUTRETURN, nmp, fh, fhlen, NULL, NULL);
   5039 	NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED);
   5040 	if (reclaim != 0)
   5041 		*tl++ = newnfs_true;
   5042 	else
   5043 		*tl++ = newnfs_false;
   5044 	*tl++ = txdr_unsigned(layouttype);
   5045 	*tl++ = txdr_unsigned(iomode);
   5046 	*tl = txdr_unsigned(layoutreturn);
   5047 	if (layoutreturn == NFSLAYOUTRETURN_FILE) {
   5048 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
   5049 		    NFSX_UNSIGNED);
   5050 		txdr_hyper(offset, tl);
   5051 		tl += 2;
   5052 		txdr_hyper(len, tl);
   5053 		tl += 2;
   5054 		NFSCL_DEBUG(4, "layoutret stseq=%d\n", (int)stateidp->seqid);
   5055 		*tl++ = txdr_unsigned(stateidp->seqid);
   5056 		*tl++ = stateidp->other[0];
   5057 		*tl++ = stateidp->other[1];
   5058 		*tl++ = stateidp->other[2];
   5059 		*tl = txdr_unsigned(layoutcnt);
   5060 		if (layoutcnt > 0) {
   5061 			outcnt = NFSM_RNDUP(layoutcnt);
   5062 			NFSM_BUILD(cp, uint8_t *, outcnt);
   5063 			NFSBCOPY(layp, cp, layoutcnt);
   5064 			cp += layoutcnt;
   5065 			for (i = 0; i < (outcnt - layoutcnt); i++)
   5066 				*cp++ = 0x0;
   5067 		}
   5068 	}
   5069 	nd->nd_flag |= ND_USEGSSNAME;
   5070 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   5071 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   5072 	if (error != 0)
   5073 		return (error);
   5074 	if (nd->nd_repstat == 0) {
   5075 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   5076 		if (*tl != 0) {
   5077 			NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
   5078 			stateidp->seqid = fxdr_unsigned(uint32_t, *tl++);
   5079 			stateidp->other[0] = *tl++;
   5080 			stateidp->other[1] = *tl++;
   5081 			stateidp->other[2] = *tl;
   5082 		}
   5083 	} else
   5084 		error = nd->nd_repstat;
   5085 nfsmout:
   5086 	mbuf_freem(nd->nd_mrep);
   5087 	return (error);
   5088 }
   5089 
   5090 /*
   5091  * Acquire a layout and devinfo, if possible. The caller must have acquired
   5092  * a reference count on the nfsclclient structure before calling this.
   5093  * Return the layout in lypp with a reference count on it, if successful.
   5094  */
   5095 static int
   5096 nfsrpc_getlayout(struct nfsmount *nmp, vnode_t vp, struct nfsfh *nfhp,
   5097     int iomode, uint32_t *notifybitsp, nfsv4stateid_t *stateidp, uint64_t off,
   5098     struct nfscllayout **lypp, struct ucred *cred, NFSPROC_T *p)
   5099 {
   5100 	struct nfscllayout *lyp;
   5101 	struct nfsclflayout *flp, *tflp;
   5102 	struct nfscldevinfo *dip;
   5103 	struct nfsclflayouthead flh;
   5104 	int error = 0, islocked, layoutlen, recalled, retonclose;
   5105 	nfsv4stateid_t stateid;
   5106 
   5107 	*lypp = NULL;
   5108 	/*
   5109 	 * If lyp is returned non-NULL, there will be a refcnt (shared lock)
   5110 	 * on it, iff flp != NULL or a lock (exclusive lock) on it iff
   5111 	 * flp == NULL.
   5112 	 */
   5113 	lyp = nfscl_getlayout(nmp->nm_clp, nfhp->nfh_fh, nfhp->nfh_len,
   5114 	    off, &flp, &recalled);
   5115 	islocked = 0;
   5116 	if (lyp == NULL || flp == NULL) {
   5117 		if (recalled != 0)
   5118 			return (EIO);
   5119 		LIST_INIT(&flh);
   5120 		layoutlen = NFSMNT_MDSSESSION(nmp)->nfsess_maxcache -
   5121 		    (NFSX_STATEID + 3 * NFSX_UNSIGNED);
   5122 		if (lyp == NULL) {
   5123 			stateid.seqid = 0;
   5124 			stateid.other[0] = stateidp->other[0];
   5125 			stateid.other[1] = stateidp->other[1];
   5126 			stateid.other[2] = stateidp->other[2];
   5127 			error = nfsrpc_layoutget(nmp, nfhp->nfh_fh,
   5128 			    nfhp->nfh_len, iomode, (uint64_t)0, INT64_MAX,
   5129 			    (uint64_t)0, layoutlen, &stateid, &retonclose,
   5130 			    &flh, cred, p, NULL);
   5131 		} else {
   5132 			islocked = 1;
   5133 			stateid.seqid = lyp->nfsly_stateid.seqid;
   5134 			stateid.other[0] = lyp->nfsly_stateid.other[0];
   5135 			stateid.other[1] = lyp->nfsly_stateid.other[1];
   5136 			stateid.other[2] = lyp->nfsly_stateid.other[2];
   5137 			error = nfsrpc_layoutget(nmp, nfhp->nfh_fh,
   5138 			    nfhp->nfh_len, iomode, off, INT64_MAX,
   5139 			    (uint64_t)0, layoutlen, &stateid, &retonclose,
   5140 			    &flh, cred, p, NULL);
   5141 		}
   5142 		if (error == 0)
   5143 			LIST_FOREACH(tflp, &flh, nfsfl_list) {
   5144 				error = nfscl_adddevinfo(nmp, NULL, tflp);
   5145 				if (error != 0) {
   5146 					error = nfsrpc_getdeviceinfo(nmp,
   5147 					    tflp->nfsfl_dev,
   5148 					    NFSLAYOUT_NFSV4_1_FILES,
   5149 					    notifybitsp, &dip, cred, p);
   5150 					if (error != 0)
   5151 						break;
   5152 					error = nfscl_adddevinfo(nmp, dip,
   5153 					    tflp);
   5154 					if (error != 0)
   5155 						printf(
   5156 						    "getlayout: cannot add\n");
   5157 				}
   5158 			}
   5159 		if (error == 0) {
   5160 			/*
   5161 			 * nfscl_layout() always returns with the nfsly_lock
   5162 			 * set to a refcnt (shared lock).
   5163 			 */
   5164 			error = nfscl_layout(nmp, vp, nfhp->nfh_fh,
   5165 			    nfhp->nfh_len, &stateid, retonclose, &flh, &lyp,
   5166 			    cred, p);
   5167 			if (error == 0)
   5168 				*lypp = lyp;
   5169 		} else if (islocked != 0)
   5170 			nfsv4_unlock(&lyp->nfsly_lock, 0);
   5171 	} else
   5172 		*lypp = lyp;
   5173 	return (error);
   5174 }
   5175 
   5176 /*
   5177  * Do a TCP connection plus exchange id and create session.
   5178  * If successful, a "struct nfsclds" is linked into the list for the
   5179  * mount point and a pointer to it is returned.
   5180  */
   5181 static int
   5182 nfsrpc_fillsa(struct nfsmount *nmp, struct sockaddr_storage *ssp,
   5183     struct nfsclds **dspp, NFSPROC_T *p)
   5184 {
   5185 	struct sockaddr_in *msad, *sad, *ssd;
   5186 	struct sockaddr_in6 *msad6, *sad6, *ssd6;
   5187 	struct nfsclclient *clp;
   5188 	struct nfssockreq *nrp;
   5189 	struct nfsclds *dsp, *tdsp;
   5190 	int error;
   5191 	enum nfsclds_state retv;
   5192 	uint32_t sequenceid;
   5193 
   5194 	KASSERT(nmp->nm_sockreq.nr_cred != NULL,
   5195 	    ("nfsrpc_fillsa: NULL nr_cred"));
   5196 	NFSLOCKCLSTATE();
   5197 	clp = nmp->nm_clp;
   5198 	NFSUNLOCKCLSTATE();
   5199 	if (clp == NULL)
   5200 		return (EPERM);
   5201 	if (ssp->ss_family == AF_INET) {
   5202 		ssd = (struct sockaddr_in *)ssp;
   5203 		NFSLOCKMNT(nmp);
   5204 
   5205 		/*
   5206 		 * Check to see if we already have a session for this
   5207 		 * address that is usable for a DS.
   5208 		 * Note that the MDS's address is in a different place
   5209 		 * than the sessions already acquired for DS's.
   5210 		 */
   5211 		msad = (struct sockaddr_in *)nmp->nm_sockreq.nr_nam;
   5212 		tdsp = TAILQ_FIRST(&nmp->nm_sess);
   5213 		while (tdsp != NULL) {
   5214 			if (msad != NULL && msad->sin_family == AF_INET &&
   5215 			    ssd->sin_addr.s_addr == msad->sin_addr.s_addr &&
   5216 			    ssd->sin_port == msad->sin_port &&
   5217 			    (tdsp->nfsclds_flags & NFSCLDS_DS) != 0) {
   5218 				*dspp = tdsp;
   5219 				NFSUNLOCKMNT(nmp);
   5220 				NFSCL_DEBUG(4, "fnd same addr\n");
   5221 				return (0);
   5222 			}
   5223 			tdsp = TAILQ_NEXT(tdsp, nfsclds_list);
   5224 			if (tdsp != NULL && tdsp->nfsclds_sockp != NULL)
   5225 				msad = (struct sockaddr_in *)
   5226 				    tdsp->nfsclds_sockp->nr_nam;
   5227 			else
   5228 				msad = NULL;
   5229 		}
   5230 		NFSUNLOCKMNT(nmp);
   5231 
   5232 		/* No IP address match, so look for new/trunked one. */
   5233 		sad = malloc(sizeof(*sad), M_SONAME, M_WAITOK | M_ZERO);
   5234 		sad->sin_len = sizeof(*sad);
   5235 		sad->sin_family = AF_INET;
   5236 		sad->sin_port = ssd->sin_port;
   5237 		sad->sin_addr.s_addr = ssd->sin_addr.s_addr;
   5238 		nrp = malloc(sizeof(*nrp), M_NFSSOCKREQ, M_WAITOK | M_ZERO);
   5239 		nrp->nr_nam = (struct sockaddr *)sad;
   5240 	} else if (ssp->ss_family == AF_INET6) {
   5241 		ssd6 = (struct sockaddr_in6 *)ssp;
   5242 		NFSLOCKMNT(nmp);
   5243 
   5244 		/*
   5245 		 * Check to see if we already have a session for this
   5246 		 * address that is usable for a DS.
   5247 		 * Note that the MDS's address is in a different place
   5248 		 * than the sessions already acquired for DS's.
   5249 		 */
   5250 		msad6 = (struct sockaddr_in6 *)nmp->nm_sockreq.nr_nam;
   5251 		tdsp = TAILQ_FIRST(&nmp->nm_sess);
   5252 		while (tdsp != NULL) {
   5253 			if (msad6 != NULL && msad6->sin6_family == AF_INET6 &&
   5254 			    IN6_ARE_ADDR_EQUAL(&ssd6->sin6_addr,
   5255 			    &msad6->sin6_addr) &&
   5256 			    ssd6->sin6_port == msad6->sin6_port &&
   5257 			    (tdsp->nfsclds_flags & NFSCLDS_DS) != 0) {
   5258 				*dspp = tdsp;
   5259 				NFSUNLOCKMNT(nmp);
   5260 				return (0);
   5261 			}
   5262 			tdsp = TAILQ_NEXT(tdsp, nfsclds_list);
   5263 			if (tdsp != NULL && tdsp->nfsclds_sockp != NULL)
   5264 				msad6 = (struct sockaddr_in6 *)
   5265 				    tdsp->nfsclds_sockp->nr_nam;
   5266 			else
   5267 				msad6 = NULL;
   5268 		}
   5269 		NFSUNLOCKMNT(nmp);
   5270 
   5271 		/* No IP address match, so look for new/trunked one. */
   5272 		sad6 = malloc(sizeof(*sad6), M_SONAME, M_WAITOK | M_ZERO);
   5273 		sad6->sin6_len = sizeof(*sad6);
   5274 		sad6->sin6_family = AF_INET6;
   5275 		sad6->sin6_port = ssd6->sin6_port;
   5276 		NFSBCOPY(&ssd6->sin6_addr, &sad6->sin6_addr,
   5277 		    sizeof(struct in6_addr));
   5278 		nrp = malloc(sizeof(*nrp), M_NFSSOCKREQ, M_WAITOK | M_ZERO);
   5279 		nrp->nr_nam = (struct sockaddr *)sad6;
   5280 	} else
   5281 		return (EPERM);
   5282 
   5283 	nrp->nr_sotype = SOCK_STREAM;
   5284 	mtx_init(&nrp->nr_mtx, "nfssock", NULL, MTX_DEF);
   5285 	nrp->nr_prog = NFS_PROG;
   5286 	nrp->nr_vers = NFS_VER4;
   5287 
   5288 	/*
   5289 	 * Use the credentials that were used for the mount, which are
   5290 	 * in nmp->nm_sockreq.nr_cred for newnfs_connect() etc.
   5291 	 * Ref. counting the credentials with crhold() is probably not
   5292 	 * necessary, since nm_sockreq.nr_cred won't be crfree()'d until
   5293 	 * unmount, but I did it anyhow.
   5294 	 */
   5295 	nrp->nr_cred = crhold(nmp->nm_sockreq.nr_cred);
   5296 	error = newnfs_connect(nmp, nrp, NULL, p, 0);
   5297 	NFSCL_DEBUG(3, "DS connect=%d\n", error);
   5298 
   5299 	/* Now, do the exchangeid and create session. */
   5300 	if (error == 0)
   5301 		error = nfsrpc_exchangeid(nmp, clp, nrp, NFSV4EXCH_USEPNFSDS,
   5302 		    &dsp, nrp->nr_cred, p);
   5303 	NFSCL_DEBUG(3, "DS exchangeid=%d\n", error);
   5304 	if (error == 0) {
   5305 		dsp->nfsclds_sockp = nrp;
   5306 		NFSLOCKMNT(nmp);
   5307 		retv = nfscl_getsameserver(nmp, dsp, &tdsp);
   5308 		NFSCL_DEBUG(3, "getsame ret=%d\n", retv);
   5309 		if (retv == NFSDSP_USETHISSESSION) {
   5310 			NFSUNLOCKMNT(nmp);
   5311 			/*
   5312 			 * If there is already a session for this server,
   5313 			 * use it.
   5314 			 */
   5315 			(void)newnfs_disconnect(nrp);
   5316 			nfscl_freenfsclds(dsp);
   5317 			*dspp = tdsp;
   5318 			return (0);
   5319 		}
   5320 		if (retv == NFSDSP_SEQTHISSESSION)
   5321 			sequenceid = tdsp->nfsclds_sess.nfsess_sequenceid;
   5322 		else
   5323 			sequenceid = dsp->nfsclds_sess.nfsess_sequenceid;
   5324 		NFSUNLOCKMNT(nmp);
   5325 		error = nfsrpc_createsession(nmp, &dsp->nfsclds_sess,
   5326 		    nrp, sequenceid, 0, nrp->nr_cred, p);
   5327 		NFSCL_DEBUG(3, "DS createsess=%d\n", error);
   5328 	} else {
   5329 		NFSFREECRED(nrp->nr_cred);
   5330 		NFSFREEMUTEX(&nrp->nr_mtx);
   5331 		free(nrp->nr_nam, M_SONAME);
   5332 		free(nrp, M_NFSSOCKREQ);
   5333 	}
   5334 	if (error == 0) {
   5335 		NFSCL_DEBUG(3, "add DS session\n");
   5336 		/*
   5337 		 * Put it at the end of the list. That way the list
   5338 		 * is ordered by when the entry was added. This matters
   5339 		 * since the one done first is the one that should be
   5340 		 * used for sequencid'ing any subsequent create sessions.
   5341 		 */
   5342 		NFSLOCKMNT(nmp);
   5343 		TAILQ_INSERT_TAIL(&nmp->nm_sess, dsp, nfsclds_list);
   5344 		NFSUNLOCKMNT(nmp);
   5345 		*dspp = dsp;
   5346 	} else if (dsp != NULL)
   5347 		nfscl_freenfsclds(dsp);
   5348 	return (error);
   5349 }
   5350 
   5351 /*
   5352  * Do the NFSv4.1 Reclaim Complete.
   5353  */
   5354 int
   5355 nfsrpc_reclaimcomplete(struct nfsmount *nmp, struct ucred *cred, NFSPROC_T *p)
   5356 {
   5357 	uint32_t *tl;
   5358 	struct nfsrv_descript nfsd;
   5359 	struct nfsrv_descript *nd = &nfsd;
   5360 	int error;
   5361 
   5362 	nfscl_reqstart(nd, NFSPROC_RECLAIMCOMPL, nmp, NULL, 0, NULL, NULL);
   5363 	NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
   5364 	*tl = newnfs_false;
   5365 	nd->nd_flag |= ND_USEGSSNAME;
   5366 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   5367 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   5368 	if (error != 0)
   5369 		return (error);
   5370 	error = nd->nd_repstat;
   5371 	mbuf_freem(nd->nd_mrep);
   5372 	return (error);
   5373 }
   5374 
   5375 /*
   5376  * Initialize the slot tables for a session.
   5377  */
   5378 static void
   5379 nfscl_initsessionslots(struct nfsclsession *sep)
   5380 {
   5381 	int i;
   5382 
   5383 	for (i = 0; i < NFSV4_CBSLOTS; i++) {
   5384 		if (sep->nfsess_cbslots[i].nfssl_reply != NULL)
   5385 			m_freem(sep->nfsess_cbslots[i].nfssl_reply);
   5386 		NFSBZERO(&sep->nfsess_cbslots[i], sizeof(struct nfsslot));
   5387 	}
   5388 	for (i = 0; i < 64; i++)
   5389 		sep->nfsess_slotseq[i] = 0;
   5390 	sep->nfsess_slots = 0;
   5391 }
   5392 
   5393 /*
   5394  * Called to try and do an I/O operation via an NFSv4.1 Data Server (DS).
   5395  */
   5396 int
   5397 nfscl_doiods(vnode_t vp, struct uio *uiop, int *iomode, int *must_commit,
   5398     uint32_t rwaccess, struct ucred *cred, NFSPROC_T *p)
   5399 {
   5400 	struct nfsnode *np = VTONFS(vp);
   5401 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   5402 	struct nfscllayout *layp;
   5403 	struct nfscldevinfo *dip;
   5404 	struct nfsclflayout *rflp;
   5405 	nfsv4stateid_t stateid;
   5406 	struct ucred *newcred;
   5407 	uint64_t lastbyte, len, off, oresid, xfer;
   5408 	int eof, error, iolaymode, recalled;
   5409 	void *lckp;
   5410 
   5411 	if (!NFSHASPNFS(nmp) || nfscl_enablecallb == 0 || nfs_numnfscbd == 0 ||
   5412 	    (np->n_flag & NNOLAYOUT) != 0)
   5413 		return (EIO);
   5414 	/* Now, get a reference cnt on the clientid for this mount. */
   5415 	if (nfscl_getref(nmp) == 0)
   5416 		return (EIO);
   5417 
   5418 	/* Find an appropriate stateid. */
   5419 	newcred = NFSNEWCRED(cred);
   5420 	error = nfscl_getstateid(vp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len,
   5421 	    rwaccess, 1, newcred, p, &stateid, &lckp);
   5422 	if (error != 0) {
   5423 		NFSFREECRED(newcred);
   5424 		nfscl_relref(nmp);
   5425 		return (error);
   5426 	}
   5427 	/* Search for a layout for this file. */
   5428 	off = uiop->uio_offset;
   5429 	layp = nfscl_getlayout(nmp->nm_clp, np->n_fhp->nfh_fh,
   5430 	    np->n_fhp->nfh_len, off, &rflp, &recalled);
   5431 	if (layp == NULL || rflp == NULL) {
   5432 		if (recalled != 0) {
   5433 			NFSFREECRED(newcred);
   5434 			nfscl_relref(nmp);
   5435 			return (EIO);
   5436 		}
   5437 		if (layp != NULL) {
   5438 			nfscl_rellayout(layp, (rflp == NULL) ? 1 : 0);
   5439 			layp = NULL;
   5440 		}
   5441 		/* Try and get a Layout, if it is supported. */
   5442 		if (rwaccess == NFSV4OPEN_ACCESSWRITE ||
   5443 		    (np->n_flag & NWRITEOPENED) != 0)
   5444 			iolaymode = NFSLAYOUTIOMODE_RW;
   5445 		else
   5446 			iolaymode = NFSLAYOUTIOMODE_READ;
   5447 		error = nfsrpc_getlayout(nmp, vp, np->n_fhp, iolaymode,
   5448 		    NULL, &stateid, off, &layp, newcred, p);
   5449 		if (error != 0) {
   5450 			NFSLOCKNODE(np);
   5451 			np->n_flag |= NNOLAYOUT;
   5452 			NFSUNLOCKNODE(np);
   5453 			if (lckp != NULL)
   5454 				nfscl_lockderef(lckp);
   5455 			NFSFREECRED(newcred);
   5456 			if (layp != NULL)
   5457 				nfscl_rellayout(layp, 0);
   5458 			nfscl_relref(nmp);
   5459 			return (error);
   5460 		}
   5461 	}
   5462 
   5463 	/*
   5464 	 * Loop around finding a layout that works for the first part of
   5465 	 * this I/O operation, and then call the function that actually
   5466 	 * does the RPC.
   5467 	 */
   5468 	eof = 0;
   5469 	len = (uint64_t)uiop->uio_resid;
   5470 	while (len > 0 && error == 0 && eof == 0) {
   5471 		off = uiop->uio_offset;
   5472 		error = nfscl_findlayoutforio(layp, off, rwaccess, &rflp);
   5473 		if (error == 0) {
   5474 			oresid = xfer = (uint64_t)uiop->uio_resid;
   5475 			if (xfer > (rflp->nfsfl_end - rflp->nfsfl_off))
   5476 				xfer = rflp->nfsfl_end - rflp->nfsfl_off;
   5477 			dip = nfscl_getdevinfo(nmp->nm_clp, rflp->nfsfl_dev,
   5478 			    rflp->nfsfl_devp);
   5479 			if (dip != NULL) {
   5480 				error = nfscl_doflayoutio(vp, uiop, iomode,
   5481 				    must_commit, &eof, &stateid, rwaccess, dip,
   5482 				    layp, rflp, off, xfer, newcred, p);
   5483 				nfscl_reldevinfo(dip);
   5484 				lastbyte = off + xfer - 1;
   5485 				if (error == 0) {
   5486 					NFSLOCKCLSTATE();
   5487 					if (lastbyte > layp->nfsly_lastbyte)
   5488 						layp->nfsly_lastbyte = lastbyte;
   5489 					NFSUNLOCKCLSTATE();
   5490 				}
   5491 			} else
   5492 				error = EIO;
   5493 			if (error == 0)
   5494 				len -= (oresid - (uint64_t)uiop->uio_resid);
   5495 		}
   5496 	}
   5497 	if (lckp != NULL)
   5498 		nfscl_lockderef(lckp);
   5499 	NFSFREECRED(newcred);
   5500 	nfscl_rellayout(layp, 0);
   5501 	nfscl_relref(nmp);
   5502 	return (error);
   5503 }
   5504 
   5505 /*
   5506  * Find a file layout that will handle the first bytes of the requested
   5507  * range and return the information from it needed to to the I/O operation.
   5508  */
   5509 int
   5510 nfscl_findlayoutforio(struct nfscllayout *lyp, uint64_t off, uint32_t rwaccess,
   5511     struct nfsclflayout **retflpp)
   5512 {
   5513 	struct nfsclflayout *flp, *nflp, *rflp;
   5514 	uint32_t rw;
   5515 
   5516 	rflp = NULL;
   5517 	rw = rwaccess;
   5518 	/* For reading, do the Read list first and then the Write list. */
   5519 	do {
   5520 		if (rw == NFSV4OPEN_ACCESSREAD)
   5521 			flp = LIST_FIRST(&lyp->nfsly_flayread);
   5522 		else
   5523 			flp = LIST_FIRST(&lyp->nfsly_flayrw);
   5524 		while (flp != NULL) {
   5525 			nflp = LIST_NEXT(flp, nfsfl_list);
   5526 			if (flp->nfsfl_off > off)
   5527 				break;
   5528 			if (flp->nfsfl_end > off &&
   5529 			    (rflp == NULL || rflp->nfsfl_end < flp->nfsfl_end))
   5530 				rflp = flp;
   5531 			flp = nflp;
   5532 		}
   5533 		if (rw == NFSV4OPEN_ACCESSREAD)
   5534 			rw = NFSV4OPEN_ACCESSWRITE;
   5535 		else
   5536 			rw = 0;
   5537 	} while (rw != 0);
   5538 	if (rflp != NULL) {
   5539 		/* This one covers the most bytes starting at off. */
   5540 		*retflpp = rflp;
   5541 		return (0);
   5542 	}
   5543 	return (EIO);
   5544 }
   5545 
   5546 /*
   5547  * Do I/O using an NFSv4.1 file layout.
   5548  */
   5549 static int
   5550 nfscl_doflayoutio(vnode_t vp, struct uio *uiop, int *iomode, int *must_commit,
   5551     int *eofp, nfsv4stateid_t *stateidp, int rwflag, struct nfscldevinfo *dp,
   5552     struct nfscllayout *lyp, struct nfsclflayout *flp, uint64_t off,
   5553     uint64_t len, struct ucred *cred, NFSPROC_T *p)
   5554 {
   5555 	uint64_t io_off, rel_off, stripe_unit_size, transfer, xfer;
   5556 	int commit_thru_mds, error = 0, stripe_index, stripe_pos;
   5557 	struct nfsnode *np;
   5558 	struct nfsfh *fhp;
   5559 	struct nfsclds **dspp;
   5560 
   5561 	np = VTONFS(vp);
   5562 	rel_off = off - flp->nfsfl_patoff;
   5563 	stripe_unit_size = (flp->nfsfl_util >> 6) & 0x3ffffff;
   5564 	stripe_pos = (rel_off / stripe_unit_size + flp->nfsfl_stripe1) %
   5565 	    dp->nfsdi_stripecnt;
   5566 	transfer = stripe_unit_size - (rel_off % stripe_unit_size);
   5567 
   5568 	/* Loop around, doing I/O for each stripe unit. */
   5569 	while (len > 0 && error == 0) {
   5570 		stripe_index = nfsfldi_stripeindex(dp, stripe_pos);
   5571 		dspp = nfsfldi_addr(dp, stripe_index);
   5572 		if (len > transfer)
   5573 			xfer = transfer;
   5574 		else
   5575 			xfer = len;
   5576 		if ((flp->nfsfl_util & NFSFLAYUTIL_DENSE) != 0) {
   5577 			/* Dense layout. */
   5578 			if (stripe_pos >= flp->nfsfl_fhcnt)
   5579 				return (EIO);
   5580 			fhp = flp->nfsfl_fh[stripe_pos];
   5581 			io_off = (rel_off / (stripe_unit_size *
   5582 			    dp->nfsdi_stripecnt)) * stripe_unit_size +
   5583 			    rel_off % stripe_unit_size;
   5584 		} else {
   5585 			/* Sparse layout. */
   5586 			if (flp->nfsfl_fhcnt > 1) {
   5587 				if (stripe_index >= flp->nfsfl_fhcnt)
   5588 					return (EIO);
   5589 				fhp = flp->nfsfl_fh[stripe_index];
   5590 			} else if (flp->nfsfl_fhcnt == 1)
   5591 				fhp = flp->nfsfl_fh[0];
   5592 			else
   5593 				fhp = np->n_fhp;
   5594 			io_off = off;
   5595 		}
   5596 		if ((flp->nfsfl_util & NFSFLAYUTIL_COMMIT_THRU_MDS) != 0)
   5597 			commit_thru_mds = 1;
   5598 		else
   5599 			commit_thru_mds = 0;
   5600 		if (rwflag == FREAD)
   5601 			error = nfsrpc_readds(vp, uiop, stateidp, eofp, *dspp,
   5602 			    io_off, xfer, fhp, cred, p);
   5603 		else {
   5604 			error = nfsrpc_writeds(vp, uiop, iomode, must_commit,
   5605 			    stateidp, *dspp, io_off, xfer, fhp, commit_thru_mds,
   5606 			    cred, p);
   5607 			if (error == 0) {
   5608 				NFSLOCKCLSTATE();
   5609 				lyp->nfsly_flags |= NFSLY_WRITTEN;
   5610 				NFSUNLOCKCLSTATE();
   5611 			}
   5612 		}
   5613 		if (error == 0) {
   5614 			transfer = stripe_unit_size;
   5615 			stripe_pos = (stripe_pos + 1) % dp->nfsdi_stripecnt;
   5616 			len -= xfer;
   5617 			off += xfer;
   5618 		}
   5619 	}
   5620 	return (error);
   5621 }
   5622 
   5623 /*
   5624  * The actual read RPC done to a DS.
   5625  */
   5626 static int
   5627 nfsrpc_readds(vnode_t vp, struct uio *uiop, nfsv4stateid_t *stateidp, int *eofp,
   5628     struct nfsclds *dsp, uint64_t io_off, int len, struct nfsfh *fhp,
   5629     struct ucred *cred, NFSPROC_T *p)
   5630 {
   5631 	uint32_t *tl;
   5632 	int error, retlen;
   5633 	struct nfsrv_descript nfsd;
   5634 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   5635 	struct nfsrv_descript *nd = &nfsd;
   5636 	struct nfssockreq *nrp;
   5637 
   5638 	nd->nd_mrep = NULL;
   5639 	nfscl_reqstart(nd, NFSPROC_READDS, nmp, fhp->nfh_fh, fhp->nfh_len,
   5640 	    NULL, &dsp->nfsclds_sess);
   5641 	nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSEQIDZERO);
   5642 	NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED * 3);
   5643 	txdr_hyper(io_off, tl);
   5644 	*(tl + 2) = txdr_unsigned(len);
   5645 	nrp = dsp->nfsclds_sockp;
   5646 	if (nrp == NULL)
   5647 		/* If NULL, use the MDS socket. */
   5648 		nrp = &nmp->nm_sockreq;
   5649 	error = newnfs_request(nd, nmp, NULL, nrp, vp, p, cred,
   5650 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, &dsp->nfsclds_sess);
   5651 	if (error != 0)
   5652 		return (error);
   5653 	if (nd->nd_repstat != 0) {
   5654 		error = nd->nd_repstat;
   5655 		goto nfsmout;
   5656 	}
   5657 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   5658 	*eofp = fxdr_unsigned(int, *tl);
   5659 	NFSM_STRSIZ(retlen, len);
   5660 	error = nfsm_mbufuio(nd, uiop, retlen);
   5661 nfsmout:
   5662 	if (nd->nd_mrep != NULL)
   5663 		mbuf_freem(nd->nd_mrep);
   5664 	return (error);
   5665 }
   5666 
   5667 /*
   5668  * The actual write RPC done to a DS.
   5669  */
   5670 static int
   5671 nfsrpc_writeds(vnode_t vp, struct uio *uiop, int *iomode, int *must_commit,
   5672     nfsv4stateid_t *stateidp, struct nfsclds *dsp, uint64_t io_off, int len,
   5673     struct nfsfh *fhp, int commit_thru_mds, struct ucred *cred, NFSPROC_T *p)
   5674 {
   5675 	uint32_t *tl;
   5676 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   5677 	int error, rlen, commit, committed = NFSWRITE_FILESYNC;
   5678 	int32_t backup;
   5679 	struct nfsrv_descript nfsd;
   5680 	struct nfsrv_descript *nd = &nfsd;
   5681 	struct nfssockreq *nrp;
   5682 
   5683 	KASSERT(uiop->uio_iovcnt == 1, ("nfs: writerpc iovcnt > 1"));
   5684 	nd->nd_mrep = NULL;
   5685 	nfscl_reqstart(nd, NFSPROC_WRITEDS, nmp, fhp->nfh_fh, fhp->nfh_len,
   5686 	    NULL, &dsp->nfsclds_sess);
   5687 	nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSEQIDZERO);
   5688 	NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + 2 * NFSX_UNSIGNED);
   5689 	txdr_hyper(io_off, tl);
   5690 	tl += 2;
   5691 	*tl++ = txdr_unsigned(*iomode);
   5692 	*tl = txdr_unsigned(len);
   5693 	nfsm_uiombuf(nd, uiop, len);
   5694 	nrp = dsp->nfsclds_sockp;
   5695 	if (nrp == NULL)
   5696 		/* If NULL, use the MDS socket. */
   5697 		nrp = &nmp->nm_sockreq;
   5698 	error = newnfs_request(nd, nmp, NULL, nrp, vp, p, cred,
   5699 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, &dsp->nfsclds_sess);
   5700 	if (error != 0)
   5701 		return (error);
   5702 	if (nd->nd_repstat != 0) {
   5703 		/*
   5704 		 * In case the rpc gets retried, roll
   5705 		 * the uio fileds changed by nfsm_uiombuf()
   5706 		 * back.
   5707 		 */
   5708 		uiop->uio_offset -= len;
   5709 		uio_uio_resid_add(uiop, len);
   5710 		uio_iov_base_add(uiop, -len);
   5711 		uio_iov_len_add(uiop, len);
   5712 		error = nd->nd_repstat;
   5713 	} else {
   5714 		NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED + NFSX_VERF);
   5715 		rlen = fxdr_unsigned(int, *tl++);
   5716 		if (rlen == 0) {
   5717 			error = NFSERR_IO;
   5718 			goto nfsmout;
   5719 		} else if (rlen < len) {
   5720 			backup = len - rlen;
   5721 			uio_iov_base_add(uiop, -(backup));
   5722 			uio_iov_len_add(uiop, backup);
   5723 			uiop->uio_offset -= backup;
   5724 			uio_uio_resid_add(uiop, backup);
   5725 			len = rlen;
   5726 		}
   5727 		commit = fxdr_unsigned(int, *tl++);
   5728 
   5729 		/*
   5730 		 * Return the lowest committment level
   5731 		 * obtained by any of the RPCs.
   5732 		 */
   5733 		if (committed == NFSWRITE_FILESYNC)
   5734 			committed = commit;
   5735 		else if (committed == NFSWRITE_DATASYNC &&
   5736 		    commit == NFSWRITE_UNSTABLE)
   5737 			committed = commit;
   5738 		if (commit_thru_mds != 0) {
   5739 			NFSLOCKMNT(nmp);
   5740 			if (!NFSHASWRITEVERF(nmp)) {
   5741 				NFSBCOPY(tl, nmp->nm_verf, NFSX_VERF);
   5742 				NFSSETWRITEVERF(nmp);
   5743 	    		} else if (NFSBCMP(tl, nmp->nm_verf, NFSX_VERF)) {
   5744 				*must_commit = 1;
   5745 				NFSBCOPY(tl, nmp->nm_verf, NFSX_VERF);
   5746 			}
   5747 			NFSUNLOCKMNT(nmp);
   5748 		} else {
   5749 			NFSLOCKDS(dsp);
   5750 			if ((dsp->nfsclds_flags & NFSCLDS_HASWRITEVERF) == 0) {
   5751 				NFSBCOPY(tl, dsp->nfsclds_verf, NFSX_VERF);
   5752 				dsp->nfsclds_flags |= NFSCLDS_HASWRITEVERF;
   5753 			} else if (NFSBCMP(tl, dsp->nfsclds_verf, NFSX_VERF)) {
   5754 				*must_commit = 1;
   5755 				NFSBCOPY(tl, dsp->nfsclds_verf, NFSX_VERF);
   5756 			}
   5757 			NFSUNLOCKDS(dsp);
   5758 		}
   5759 	}
   5760 nfsmout:
   5761 	if (nd->nd_mrep != NULL)
   5762 		mbuf_freem(nd->nd_mrep);
   5763 	*iomode = committed;
   5764 	if (nd->nd_repstat != 0 && error == 0)
   5765 		error = nd->nd_repstat;
   5766 	return (error);
   5767 }
   5768 
   5769 /*
   5770  * Free up the nfsclds structure.
   5771  */
   5772 void
   5773 nfscl_freenfsclds(struct nfsclds *dsp)
   5774 {
   5775 	int i;
   5776 
   5777 	if (dsp == NULL)
   5778 		return;
   5779 	if (dsp->nfsclds_sockp != NULL) {
   5780 		NFSFREECRED(dsp->nfsclds_sockp->nr_cred);
   5781 		NFSFREEMUTEX(&dsp->nfsclds_sockp->nr_mtx);
   5782 		free(dsp->nfsclds_sockp->nr_nam, M_SONAME);
   5783 		free(dsp->nfsclds_sockp, M_NFSSOCKREQ);
   5784 	}
   5785 	NFSFREEMUTEX(&dsp->nfsclds_mtx);
   5786 	NFSFREEMUTEX(&dsp->nfsclds_sess.nfsess_mtx);
   5787 	for (i = 0; i < NFSV4_CBSLOTS; i++) {
   5788 		if (dsp->nfsclds_sess.nfsess_cbslots[i].nfssl_reply != NULL)
   5789 			m_freem(
   5790 			    dsp->nfsclds_sess.nfsess_cbslots[i].nfssl_reply);
   5791 	}
   5792 	free(dsp, M_NFSCLDS);
   5793 }
   5794 
   5795 static enum nfsclds_state
   5796 nfscl_getsameserver(struct nfsmount *nmp, struct nfsclds *newdsp,
   5797     struct nfsclds **retdspp)
   5798 {
   5799 	struct nfsclds *dsp, *cur_dsp;
   5800 
   5801 	/*
   5802 	 * Search the list of nfsclds structures for one with the same
   5803 	 * server.
   5804 	 */
   5805 	cur_dsp = NULL;
   5806 	TAILQ_FOREACH(dsp, &nmp->nm_sess, nfsclds_list) {
   5807 		if (dsp->nfsclds_servownlen == newdsp->nfsclds_servownlen &&
   5808 		    dsp->nfsclds_servownlen != 0 &&
   5809 		    !NFSBCMP(dsp->nfsclds_serverown, newdsp->nfsclds_serverown,
   5810 		    dsp->nfsclds_servownlen)) {
   5811 			NFSCL_DEBUG(4, "fnd same fdsp=%p dsp=%p flg=0x%x\n",
   5812 			    TAILQ_FIRST(&nmp->nm_sess), dsp,
   5813 			    dsp->nfsclds_flags);
   5814 			/* Server major id matches. */
   5815 			if ((dsp->nfsclds_flags & NFSCLDS_DS) != 0) {
   5816 				*retdspp = dsp;
   5817 				return (NFSDSP_USETHISSESSION);
   5818 			}
   5819 
   5820 			/*
   5821 			 * Note the first match, so it can be used for
   5822 			 * sequence'ing new sessions.
   5823 			 */
   5824 			if (cur_dsp == NULL)
   5825 				cur_dsp = dsp;
   5826 		}
   5827 	}
   5828 	if (cur_dsp != NULL) {
   5829 		*retdspp = cur_dsp;
   5830 		return (NFSDSP_SEQTHISSESSION);
   5831 	}
   5832 	return (NFSDSP_NOTFOUND);
   5833 }
   5834 
   5835 #ifdef notyet
   5836 /*
   5837  * NFS commit rpc to a DS.
   5838  */
   5839 static int
   5840 nfsrpc_commitds(vnode_t vp, uint64_t offset, int cnt, struct nfsclds *dsp,
   5841     struct nfsfh *fhp, struct ucred *cred, NFSPROC_T *p, void *stuff)
   5842 {
   5843 	uint32_t *tl;
   5844 	struct nfsrv_descript nfsd, *nd = &nfsd;
   5845 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   5846 	struct nfssockreq *nrp;
   5847 	int error;
   5848 
   5849 	nfscl_reqstart(nd, NFSPROC_COMMITDS, nmp, fhp->nfh_fh, fhp->nfh_len,
   5850 	    NULL, &dsp->nfsclds_sess);
   5851 	NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
   5852 	txdr_hyper(offset, tl);
   5853 	tl += 2;
   5854 	*tl = txdr_unsigned(cnt);
   5855 	nrp = dsp->nfsclds_sockp;
   5856 	if (nrp == NULL)
   5857 		/* If NULL, use the MDS socket. */
   5858 		nrp = &nmp->nm_sockreq;
   5859 	error = newnfs_request(nd, nmp, NULL, nrp, vp, p, cred,
   5860 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, &dsp->nfsclds_sess);
   5861 	if (error)
   5862 		return (error);
   5863 	if (nd->nd_repstat == 0) {
   5864 		NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
   5865 		NFSLOCKDS(dsp);
   5866 		if (NFSBCMP(tl, dsp->nfsclds_verf, NFSX_VERF)) {
   5867 			NFSBCOPY(tl, dsp->nfsclds_verf, NFSX_VERF);
   5868 			error = NFSERR_STALEWRITEVERF;
   5869 		}
   5870 		NFSUNLOCKDS(dsp);
   5871 	}
   5872 nfsmout:
   5873 	if (error == 0 && nd->nd_repstat != 0)
   5874 		error = nd->nd_repstat;
   5875 	mbuf_freem(nd->nd_mrep);
   5876 	return (error);
   5877 }
   5878 #endif
   5879 
   5880