Home | History | Annotate | Line # | Download | only in client
nfs_clrpcops.c revision 1.1.1.2
      1 /*	$NetBSD: nfs_clrpcops.c,v 1.1.1.2 2016/11/18 07:49:11 pgoyette Exp $	*/
      2 /*-
      3  * Copyright (c) 1989, 1993
      4  *	The Regents of the University of California.  All rights reserved.
      5  *
      6  * This code is derived from software contributed to Berkeley by
      7  * Rick Macklem at The University of Guelph.
      8  *
      9  * Redistribution and use in source and binary forms, with or without
     10  * modification, are permitted provided that the following conditions
     11  * are met:
     12  * 1. Redistributions of source code must retain the above copyright
     13  *    notice, this list of conditions and the following disclaimer.
     14  * 2. Redistributions in binary form must reproduce the above copyright
     15  *    notice, this list of conditions and the following disclaimer in the
     16  *    documentation and/or other materials provided with the distribution.
     17  * 4. Neither the name of the University nor the names of its contributors
     18  *    may be used to endorse or promote products derived from this software
     19  *    without specific prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     31  * SUCH DAMAGE.
     32  *
     33  */
     34 
     35 #include <sys/cdefs.h>
     36 /* __FBSDID("FreeBSD: head/sys/fs/nfsclient/nfs_clrpcops.c 298788 2016-04-29 16:07:25Z pfg "); */
     37 __RCSID("$NetBSD: nfs_clrpcops.c,v 1.1.1.2 2016/11/18 07:49:11 pgoyette Exp $");
     38 
     39 /*
     40  * Rpc op calls, generally called from the vnode op calls or through the
     41  * buffer cache, for NFS v2, 3 and 4.
     42  * These do not normally make any changes to vnode arguments or use
     43  * structures that might change between the VFS variants. The returned
     44  * arguments are all at the end, after the NFSPROC_T *p one.
     45  */
     46 
     47 #ifndef APPLEKEXT
     48 #include "opt_inet6.h"
     49 
     50 #include <fs/nfs/nfsport.h>
     51 #include <sys/sysctl.h>
     52 
     53 SYSCTL_DECL(_vfs_nfs);
     54 
     55 static int	nfsignore_eexist = 0;
     56 SYSCTL_INT(_vfs_nfs, OID_AUTO, ignore_eexist, CTLFLAG_RW,
     57     &nfsignore_eexist, 0, "NFS ignore EEXIST replies for mkdir/symlink");
     58 
     59 /*
     60  * Global variables
     61  */
     62 extern int nfs_numnfscbd;
     63 extern struct timeval nfsboottime;
     64 extern u_int32_t newnfs_false, newnfs_true;
     65 extern nfstype nfsv34_type[9];
     66 extern int nfsrv_useacl;
     67 extern char nfsv4_callbackaddr[INET6_ADDRSTRLEN];
     68 extern int nfscl_debuglevel;
     69 NFSCLSTATEMUTEX;
     70 int nfstest_outofseq = 0;
     71 int nfscl_assumeposixlocks = 1;
     72 int nfscl_enablecallb = 0;
     73 short nfsv4_cbport = NFSV4_CBPORT;
     74 int nfstest_openallsetattr = 0;
     75 #endif	/* !APPLEKEXT */
     76 
     77 #define	DIRHDSIZ	(sizeof (struct dirent) - (MAXNAMLEN + 1))
     78 
     79 /*
     80  * nfscl_getsameserver() can return one of three values:
     81  * NFSDSP_USETHISSESSION - Use this session for the DS.
     82  * NFSDSP_SEQTHISSESSION - Use the nfsclds_sequence field of this dsp for new
     83  *     session.
     84  * NFSDSP_NOTFOUND - No matching server was found.
     85  */
     86 enum nfsclds_state {
     87 	NFSDSP_USETHISSESSION = 0,
     88 	NFSDSP_SEQTHISSESSION = 1,
     89 	NFSDSP_NOTFOUND = 2,
     90 };
     91 
     92 static int nfsrpc_setattrrpc(vnode_t , struct vattr *, nfsv4stateid_t *,
     93     struct ucred *, NFSPROC_T *, struct nfsvattr *, int *, void *);
     94 static int nfsrpc_readrpc(vnode_t , struct uio *, struct ucred *,
     95     nfsv4stateid_t *, NFSPROC_T *, struct nfsvattr *, int *, void *);
     96 static int nfsrpc_writerpc(vnode_t , struct uio *, int *, int *,
     97     struct ucred *, nfsv4stateid_t *, NFSPROC_T *, struct nfsvattr *, int *,
     98     void *);
     99 static int nfsrpc_createv23(vnode_t , char *, int, struct vattr *,
    100     nfsquad_t, int, struct ucred *, NFSPROC_T *, struct nfsvattr *,
    101     struct nfsvattr *, struct nfsfh **, int *, int *, void *);
    102 static int nfsrpc_createv4(vnode_t , char *, int, struct vattr *,
    103     nfsquad_t, int, struct nfsclowner *, struct nfscldeleg **, struct ucred *,
    104     NFSPROC_T *, struct nfsvattr *, struct nfsvattr *, struct nfsfh **, int *,
    105     int *, void *, int *);
    106 static int nfsrpc_locku(struct nfsrv_descript *, struct nfsmount *,
    107     struct nfscllockowner *, u_int64_t, u_int64_t,
    108     u_int32_t, struct ucred *, NFSPROC_T *, int);
    109 static int nfsrpc_setaclrpc(vnode_t, struct ucred *, NFSPROC_T *,
    110     struct acl *, nfsv4stateid_t *, void *);
    111 static int nfsrpc_getlayout(struct nfsmount *, vnode_t, struct nfsfh *, int,
    112     uint32_t *, nfsv4stateid_t *, uint64_t, struct nfscllayout **,
    113     struct ucred *, NFSPROC_T *);
    114 static int nfsrpc_fillsa(struct nfsmount *, struct sockaddr_storage *,
    115     struct nfsclds **, NFSPROC_T *);
    116 static void nfscl_initsessionslots(struct nfsclsession *);
    117 static int nfscl_doflayoutio(vnode_t, struct uio *, int *, int *, int *,
    118     nfsv4stateid_t *, int, struct nfscldevinfo *, struct nfscllayout *,
    119     struct nfsclflayout *, uint64_t, uint64_t, struct ucred *, NFSPROC_T *);
    120 static int nfsrpc_readds(vnode_t, struct uio *, nfsv4stateid_t *, int *,
    121     struct nfsclds *, uint64_t, int, struct nfsfh *, struct ucred *,
    122     NFSPROC_T *);
    123 static int nfsrpc_writeds(vnode_t, struct uio *, int *, int *,
    124     nfsv4stateid_t *, struct nfsclds *, uint64_t, int,
    125     struct nfsfh *, int, struct ucred *, NFSPROC_T *);
    126 static enum nfsclds_state nfscl_getsameserver(struct nfsmount *,
    127     struct nfsclds *, struct nfsclds **);
    128 #ifdef notyet
    129 static int nfsrpc_commitds(vnode_t, uint64_t, int, struct nfsclds *,
    130     struct nfsfh *, struct ucred *, NFSPROC_T *, void *);
    131 #endif
    132 
    133 /*
    134  * nfs null call from vfs.
    135  */
    136 APPLESTATIC int
    137 nfsrpc_null(vnode_t vp, struct ucred *cred, NFSPROC_T *p)
    138 {
    139 	int error;
    140 	struct nfsrv_descript nfsd, *nd = &nfsd;
    141 
    142 	NFSCL_REQSTART(nd, NFSPROC_NULL, vp);
    143 	error = nfscl_request(nd, vp, p, cred, NULL);
    144 	if (nd->nd_repstat && !error)
    145 		error = nd->nd_repstat;
    146 	mbuf_freem(nd->nd_mrep);
    147 	return (error);
    148 }
    149 
    150 /*
    151  * nfs access rpc op.
    152  * For nfs version 3 and 4, use the access rpc to check accessibility. If file
    153  * modes are changed on the server, accesses might still fail later.
    154  */
    155 APPLESTATIC int
    156 nfsrpc_access(vnode_t vp, int acmode, struct ucred *cred,
    157     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp)
    158 {
    159 	int error;
    160 	u_int32_t mode, rmode;
    161 
    162 	if (acmode & VREAD)
    163 		mode = NFSACCESS_READ;
    164 	else
    165 		mode = 0;
    166 	if (vnode_vtype(vp) == VDIR) {
    167 		if (acmode & VWRITE)
    168 			mode |= (NFSACCESS_MODIFY | NFSACCESS_EXTEND |
    169 				 NFSACCESS_DELETE);
    170 		if (acmode & VEXEC)
    171 			mode |= NFSACCESS_LOOKUP;
    172 	} else {
    173 		if (acmode & VWRITE)
    174 			mode |= (NFSACCESS_MODIFY | NFSACCESS_EXTEND);
    175 		if (acmode & VEXEC)
    176 			mode |= NFSACCESS_EXECUTE;
    177 	}
    178 
    179 	/*
    180 	 * Now, just call nfsrpc_accessrpc() to do the actual RPC.
    181 	 */
    182 	error = nfsrpc_accessrpc(vp, mode, cred, p, nap, attrflagp, &rmode,
    183 	    NULL);
    184 
    185 	/*
    186 	 * The NFS V3 spec does not clarify whether or not
    187 	 * the returned access bits can be a superset of
    188 	 * the ones requested, so...
    189 	 */
    190 	if (!error && (rmode & mode) != mode)
    191 		error = EACCES;
    192 	return (error);
    193 }
    194 
    195 /*
    196  * The actual rpc, separated out for Darwin.
    197  */
    198 APPLESTATIC int
    199 nfsrpc_accessrpc(vnode_t vp, u_int32_t mode, struct ucred *cred,
    200     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, u_int32_t *rmodep,
    201     void *stuff)
    202 {
    203 	u_int32_t *tl;
    204 	u_int32_t supported, rmode;
    205 	int error;
    206 	struct nfsrv_descript nfsd, *nd = &nfsd;
    207 	nfsattrbit_t attrbits;
    208 
    209 	*attrflagp = 0;
    210 	supported = mode;
    211 	NFSCL_REQSTART(nd, NFSPROC_ACCESS, vp);
    212 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    213 	*tl = txdr_unsigned(mode);
    214 	if (nd->nd_flag & ND_NFSV4) {
    215 		/*
    216 		 * And do a Getattr op.
    217 		 */
    218 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    219 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
    220 		NFSGETATTR_ATTRBIT(&attrbits);
    221 		(void) nfsrv_putattrbit(nd, &attrbits);
    222 	}
    223 	error = nfscl_request(nd, vp, p, cred, stuff);
    224 	if (error)
    225 		return (error);
    226 	if (nd->nd_flag & ND_NFSV3) {
    227 		error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
    228 		if (error)
    229 			goto nfsmout;
    230 	}
    231 	if (!nd->nd_repstat) {
    232 		if (nd->nd_flag & ND_NFSV4) {
    233 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
    234 			supported = fxdr_unsigned(u_int32_t, *tl++);
    235 		} else {
    236 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
    237 		}
    238 		rmode = fxdr_unsigned(u_int32_t, *tl);
    239 		if (nd->nd_flag & ND_NFSV4)
    240 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
    241 
    242 		/*
    243 		 * It's not obvious what should be done about
    244 		 * unsupported access modes. For now, be paranoid
    245 		 * and clear the unsupported ones.
    246 		 */
    247 		rmode &= supported;
    248 		*rmodep = rmode;
    249 	} else
    250 		error = nd->nd_repstat;
    251 nfsmout:
    252 	mbuf_freem(nd->nd_mrep);
    253 	return (error);
    254 }
    255 
    256 /*
    257  * nfs open rpc
    258  */
    259 APPLESTATIC int
    260 nfsrpc_open(vnode_t vp, int amode, struct ucred *cred, NFSPROC_T *p)
    261 {
    262 	struct nfsclopen *op;
    263 	struct nfscldeleg *dp;
    264 	struct nfsfh *nfhp;
    265 	struct nfsnode *np = VTONFS(vp);
    266 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
    267 	u_int32_t mode, clidrev;
    268 	int ret, newone, error, expireret = 0, retrycnt;
    269 
    270 	/*
    271 	 * For NFSv4, Open Ops are only done on Regular Files.
    272 	 */
    273 	if (vnode_vtype(vp) != VREG)
    274 		return (0);
    275 	mode = 0;
    276 	if (amode & FREAD)
    277 		mode |= NFSV4OPEN_ACCESSREAD;
    278 	if (amode & FWRITE)
    279 		mode |= NFSV4OPEN_ACCESSWRITE;
    280 	nfhp = np->n_fhp;
    281 
    282 	retrycnt = 0;
    283 #ifdef notdef
    284 { char name[100]; int namel;
    285 namel = (np->n_v4->n4_namelen < 100) ? np->n_v4->n4_namelen : 99;
    286 bcopy(NFS4NODENAME(np->n_v4), name, namel);
    287 name[namel] = '\0';
    288 printf("rpcopen p=0x%x name=%s",p->p_pid,name);
    289 if (nfhp->nfh_len > 0) printf(" fh=0x%x\n",nfhp->nfh_fh[12]);
    290 else printf(" fhl=0\n");
    291 }
    292 #endif
    293 	do {
    294 	    dp = NULL;
    295 	    error = nfscl_open(vp, nfhp->nfh_fh, nfhp->nfh_len, mode, 1,
    296 		cred, p, NULL, &op, &newone, &ret, 1);
    297 	    if (error) {
    298 		return (error);
    299 	    }
    300 	    if (nmp->nm_clp != NULL)
    301 		clidrev = nmp->nm_clp->nfsc_clientidrev;
    302 	    else
    303 		clidrev = 0;
    304 	    if (ret == NFSCLOPEN_DOOPEN) {
    305 		if (np->n_v4 != NULL) {
    306 			error = nfsrpc_openrpc(nmp, vp, np->n_v4->n4_data,
    307 			   np->n_v4->n4_fhlen, np->n_fhp->nfh_fh,
    308 			   np->n_fhp->nfh_len, mode, op,
    309 			   NFS4NODENAME(np->n_v4), np->n_v4->n4_namelen, &dp,
    310 			   0, 0x0, cred, p, 0, 0);
    311 			if (dp != NULL) {
    312 #ifdef APPLE
    313 				OSBitAndAtomic((int32_t)~NDELEGMOD, (UInt32 *)&np->n_flag);
    314 #else
    315 				NFSLOCKNODE(np);
    316 				np->n_flag &= ~NDELEGMOD;
    317 				/*
    318 				 * Invalidate the attribute cache, so that
    319 				 * attributes that pre-date the issue of a
    320 				 * delegation are not cached, since the
    321 				 * cached attributes will remain valid while
    322 				 * the delegation is held.
    323 				 */
    324 				NFSINVALATTRCACHE(np);
    325 				NFSUNLOCKNODE(np);
    326 #endif
    327 				(void) nfscl_deleg(nmp->nm_mountp,
    328 				    op->nfso_own->nfsow_clp,
    329 				    nfhp->nfh_fh, nfhp->nfh_len, cred, p, &dp);
    330 			}
    331 		} else {
    332 			error = EIO;
    333 		}
    334 		newnfs_copyincred(cred, &op->nfso_cred);
    335 	    } else if (ret == NFSCLOPEN_SETCRED)
    336 		/*
    337 		 * This is a new local open on a delegation. It needs
    338 		 * to have credentials so that an open can be done
    339 		 * against the server during recovery.
    340 		 */
    341 		newnfs_copyincred(cred, &op->nfso_cred);
    342 
    343 	    /*
    344 	     * nfso_opencnt is the count of how many VOP_OPEN()s have
    345 	     * been done on this Open successfully and a VOP_CLOSE()
    346 	     * is expected for each of these.
    347 	     * If error is non-zero, don't increment it, since the Open
    348 	     * hasn't succeeded yet.
    349 	     */
    350 	    if (!error)
    351 		op->nfso_opencnt++;
    352 	    nfscl_openrelease(op, error, newone);
    353 	    if (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
    354 		error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
    355 		error == NFSERR_BADSESSION) {
    356 		(void) nfs_catnap(PZERO, error, "nfs_open");
    357 	    } else if ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID)
    358 		&& clidrev != 0) {
    359 		expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
    360 		retrycnt++;
    361 	    }
    362 	} while (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
    363 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
    364 	    error == NFSERR_BADSESSION ||
    365 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
    366 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
    367 	if (error && retrycnt >= 4)
    368 		error = EIO;
    369 	return (error);
    370 }
    371 
    372 /*
    373  * the actual open rpc
    374  */
    375 APPLESTATIC int
    376 nfsrpc_openrpc(struct nfsmount *nmp, vnode_t vp, u_int8_t *nfhp, int fhlen,
    377     u_int8_t *newfhp, int newfhlen, u_int32_t mode, struct nfsclopen *op,
    378     u_int8_t *name, int namelen, struct nfscldeleg **dpp,
    379     int reclaim, u_int32_t delegtype, struct ucred *cred, NFSPROC_T *p,
    380     int syscred, int recursed)
    381 {
    382 	u_int32_t *tl;
    383 	struct nfsrv_descript nfsd, *nd = &nfsd;
    384 	struct nfscldeleg *dp, *ndp = NULL;
    385 	struct nfsvattr nfsva;
    386 	u_int32_t rflags, deleg;
    387 	nfsattrbit_t attrbits;
    388 	int error, ret, acesize, limitby;
    389 
    390 	dp = *dpp;
    391 	*dpp = NULL;
    392 	nfscl_reqstart(nd, NFSPROC_OPEN, nmp, nfhp, fhlen, NULL, NULL);
    393 	NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
    394 	*tl++ = txdr_unsigned(op->nfso_own->nfsow_seqid);
    395 	*tl++ = txdr_unsigned(mode & NFSV4OPEN_ACCESSBOTH);
    396 	*tl++ = txdr_unsigned((mode >> NFSLCK_SHIFT) & NFSV4OPEN_DENYBOTH);
    397 	*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
    398 	*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
    399 	(void) nfsm_strtom(nd, op->nfso_own->nfsow_owner, NFSV4CL_LOCKNAMELEN);
    400 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
    401 	*tl++ = txdr_unsigned(NFSV4OPEN_NOCREATE);
    402 	if (reclaim) {
    403 		*tl = txdr_unsigned(NFSV4OPEN_CLAIMPREVIOUS);
    404 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    405 		*tl = txdr_unsigned(delegtype);
    406 	} else {
    407 		if (dp != NULL) {
    408 			*tl = txdr_unsigned(NFSV4OPEN_CLAIMDELEGATECUR);
    409 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
    410 			if (NFSHASNFSV4N(nmp))
    411 				*tl++ = 0;
    412 			else
    413 				*tl++ = dp->nfsdl_stateid.seqid;
    414 			*tl++ = dp->nfsdl_stateid.other[0];
    415 			*tl++ = dp->nfsdl_stateid.other[1];
    416 			*tl = dp->nfsdl_stateid.other[2];
    417 		} else {
    418 			*tl = txdr_unsigned(NFSV4OPEN_CLAIMNULL);
    419 		}
    420 		(void) nfsm_strtom(nd, name, namelen);
    421 	}
    422 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    423 	*tl = txdr_unsigned(NFSV4OP_GETATTR);
    424 	NFSZERO_ATTRBIT(&attrbits);
    425 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
    426 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFY);
    427 	(void) nfsrv_putattrbit(nd, &attrbits);
    428 	if (syscred)
    429 		nd->nd_flag |= ND_USEGSSNAME;
    430 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, vp, p, cred,
    431 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    432 	if (error)
    433 		return (error);
    434 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
    435 	if (!nd->nd_repstat) {
    436 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
    437 		    6 * NFSX_UNSIGNED);
    438 		op->nfso_stateid.seqid = *tl++;
    439 		op->nfso_stateid.other[0] = *tl++;
    440 		op->nfso_stateid.other[1] = *tl++;
    441 		op->nfso_stateid.other[2] = *tl;
    442 		rflags = fxdr_unsigned(u_int32_t, *(tl + 6));
    443 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
    444 		if (error)
    445 			goto nfsmout;
    446 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
    447 		deleg = fxdr_unsigned(u_int32_t, *tl);
    448 		if (deleg == NFSV4OPEN_DELEGATEREAD ||
    449 		    deleg == NFSV4OPEN_DELEGATEWRITE) {
    450 			if (!(op->nfso_own->nfsow_clp->nfsc_flags &
    451 			      NFSCLFLAGS_FIRSTDELEG))
    452 				op->nfso_own->nfsow_clp->nfsc_flags |=
    453 				  (NFSCLFLAGS_FIRSTDELEG | NFSCLFLAGS_GOTDELEG);
    454 			MALLOC(ndp, struct nfscldeleg *,
    455 			    sizeof (struct nfscldeleg) + newfhlen,
    456 			    M_NFSCLDELEG, M_WAITOK);
    457 			LIST_INIT(&ndp->nfsdl_owner);
    458 			LIST_INIT(&ndp->nfsdl_lock);
    459 			ndp->nfsdl_clp = op->nfso_own->nfsow_clp;
    460 			ndp->nfsdl_fhlen = newfhlen;
    461 			NFSBCOPY(newfhp, ndp->nfsdl_fh, newfhlen);
    462 			newnfs_copyincred(cred, &ndp->nfsdl_cred);
    463 			nfscl_lockinit(&ndp->nfsdl_rwlock);
    464 			NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
    465 			    NFSX_UNSIGNED);
    466 			ndp->nfsdl_stateid.seqid = *tl++;
    467 			ndp->nfsdl_stateid.other[0] = *tl++;
    468 			ndp->nfsdl_stateid.other[1] = *tl++;
    469 			ndp->nfsdl_stateid.other[2] = *tl++;
    470 			ret = fxdr_unsigned(int, *tl);
    471 			if (deleg == NFSV4OPEN_DELEGATEWRITE) {
    472 				ndp->nfsdl_flags = NFSCLDL_WRITE;
    473 				/*
    474 				 * Indicates how much the file can grow.
    475 				 */
    476 				NFSM_DISSECT(tl, u_int32_t *,
    477 				    3 * NFSX_UNSIGNED);
    478 				limitby = fxdr_unsigned(int, *tl++);
    479 				switch (limitby) {
    480 				case NFSV4OPEN_LIMITSIZE:
    481 					ndp->nfsdl_sizelimit = fxdr_hyper(tl);
    482 					break;
    483 				case NFSV4OPEN_LIMITBLOCKS:
    484 					ndp->nfsdl_sizelimit =
    485 					    fxdr_unsigned(u_int64_t, *tl++);
    486 					ndp->nfsdl_sizelimit *=
    487 					    fxdr_unsigned(u_int64_t, *tl);
    488 					break;
    489 				default:
    490 					error = NFSERR_BADXDR;
    491 					goto nfsmout;
    492 				}
    493 			} else {
    494 				ndp->nfsdl_flags = NFSCLDL_READ;
    495 			}
    496 			if (ret)
    497 				ndp->nfsdl_flags |= NFSCLDL_RECALL;
    498 			error = nfsrv_dissectace(nd, &ndp->nfsdl_ace, &ret,
    499 			    &acesize, p);
    500 			if (error)
    501 				goto nfsmout;
    502 		} else if (deleg != NFSV4OPEN_DELEGATENONE) {
    503 			error = NFSERR_BADXDR;
    504 			goto nfsmout;
    505 		}
    506 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
    507 		error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
    508 		    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
    509 		    NULL, NULL, NULL, p, cred);
    510 		if (error)
    511 			goto nfsmout;
    512 		if (ndp != NULL) {
    513 			ndp->nfsdl_change = nfsva.na_filerev;
    514 			ndp->nfsdl_modtime = nfsva.na_mtime;
    515 			ndp->nfsdl_flags |= NFSCLDL_MODTIMESET;
    516 		}
    517 		if (!reclaim && (rflags & NFSV4OPEN_RESULTCONFIRM)) {
    518 		    do {
    519 			ret = nfsrpc_openconfirm(vp, newfhp, newfhlen, op,
    520 			    cred, p);
    521 			if (ret == NFSERR_DELAY)
    522 			    (void) nfs_catnap(PZERO, ret, "nfs_open");
    523 		    } while (ret == NFSERR_DELAY);
    524 		    error = ret;
    525 		}
    526 		if ((rflags & NFSV4OPEN_LOCKTYPEPOSIX) ||
    527 		    nfscl_assumeposixlocks)
    528 		    op->nfso_posixlock = 1;
    529 		else
    530 		    op->nfso_posixlock = 0;
    531 
    532 		/*
    533 		 * If the server is handing out delegations, but we didn't
    534 		 * get one because an OpenConfirm was required, try the
    535 		 * Open again, to get a delegation. This is a harmless no-op,
    536 		 * from a server's point of view.
    537 		 */
    538 		if (!reclaim && (rflags & NFSV4OPEN_RESULTCONFIRM) &&
    539 		    (op->nfso_own->nfsow_clp->nfsc_flags & NFSCLFLAGS_GOTDELEG)
    540 		    && !error && dp == NULL && ndp == NULL && !recursed) {
    541 		    do {
    542 			ret = nfsrpc_openrpc(nmp, vp, nfhp, fhlen, newfhp,
    543 			    newfhlen, mode, op, name, namelen, &ndp, 0, 0x0,
    544 			    cred, p, syscred, 1);
    545 			if (ret == NFSERR_DELAY)
    546 			    (void) nfs_catnap(PZERO, ret, "nfs_open2");
    547 		    } while (ret == NFSERR_DELAY);
    548 		    if (ret) {
    549 			if (ndp != NULL) {
    550 				FREE((caddr_t)ndp, M_NFSCLDELEG);
    551 				ndp = NULL;
    552 			}
    553 			if (ret == NFSERR_STALECLIENTID ||
    554 			    ret == NFSERR_STALEDONTRECOVER ||
    555 			    ret == NFSERR_BADSESSION)
    556 				error = ret;
    557 		    }
    558 		}
    559 	}
    560 	if (nd->nd_repstat != 0 && error == 0)
    561 		error = nd->nd_repstat;
    562 	if (error == NFSERR_STALECLIENTID || error == NFSERR_BADSESSION)
    563 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
    564 nfsmout:
    565 	if (!error)
    566 		*dpp = ndp;
    567 	else if (ndp != NULL)
    568 		FREE((caddr_t)ndp, M_NFSCLDELEG);
    569 	mbuf_freem(nd->nd_mrep);
    570 	return (error);
    571 }
    572 
    573 /*
    574  * open downgrade rpc
    575  */
    576 APPLESTATIC int
    577 nfsrpc_opendowngrade(vnode_t vp, u_int32_t mode, struct nfsclopen *op,
    578     struct ucred *cred, NFSPROC_T *p)
    579 {
    580 	u_int32_t *tl;
    581 	struct nfsrv_descript nfsd, *nd = &nfsd;
    582 	int error;
    583 
    584 	NFSCL_REQSTART(nd, NFSPROC_OPENDOWNGRADE, vp);
    585 	NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 3 * NFSX_UNSIGNED);
    586 	if (NFSHASNFSV4N(VFSTONFS(vnode_mount(vp))))
    587 		*tl++ = 0;
    588 	else
    589 		*tl++ = op->nfso_stateid.seqid;
    590 	*tl++ = op->nfso_stateid.other[0];
    591 	*tl++ = op->nfso_stateid.other[1];
    592 	*tl++ = op->nfso_stateid.other[2];
    593 	*tl++ = txdr_unsigned(op->nfso_own->nfsow_seqid);
    594 	*tl++ = txdr_unsigned(mode & NFSV4OPEN_ACCESSBOTH);
    595 	*tl = txdr_unsigned((mode >> NFSLCK_SHIFT) & NFSV4OPEN_DENYBOTH);
    596 	error = nfscl_request(nd, vp, p, cred, NULL);
    597 	if (error)
    598 		return (error);
    599 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
    600 	if (!nd->nd_repstat) {
    601 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
    602 		op->nfso_stateid.seqid = *tl++;
    603 		op->nfso_stateid.other[0] = *tl++;
    604 		op->nfso_stateid.other[1] = *tl++;
    605 		op->nfso_stateid.other[2] = *tl;
    606 	}
    607 	if (nd->nd_repstat && error == 0)
    608 		error = nd->nd_repstat;
    609 	if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
    610 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
    611 nfsmout:
    612 	mbuf_freem(nd->nd_mrep);
    613 	return (error);
    614 }
    615 
    616 /*
    617  * V4 Close operation.
    618  */
    619 APPLESTATIC int
    620 nfsrpc_close(vnode_t vp, int doclose, NFSPROC_T *p)
    621 {
    622 	struct nfsclclient *clp;
    623 	int error;
    624 
    625 	if (vnode_vtype(vp) != VREG)
    626 		return (0);
    627 	if (doclose)
    628 		error = nfscl_doclose(vp, &clp, p);
    629 	else
    630 		error = nfscl_getclose(vp, &clp);
    631 	if (error)
    632 		return (error);
    633 
    634 	nfscl_clientrelease(clp);
    635 	return (0);
    636 }
    637 
    638 /*
    639  * Close the open.
    640  */
    641 APPLESTATIC void
    642 nfsrpc_doclose(struct nfsmount *nmp, struct nfsclopen *op, NFSPROC_T *p)
    643 {
    644 	struct nfsrv_descript nfsd, *nd = &nfsd;
    645 	struct nfscllockowner *lp, *nlp;
    646 	struct nfscllock *lop, *nlop;
    647 	struct ucred *tcred;
    648 	u_int64_t off = 0, len = 0;
    649 	u_int32_t type = NFSV4LOCKT_READ;
    650 	int error, do_unlock, trycnt;
    651 
    652 	tcred = newnfs_getcred();
    653 	newnfs_copycred(&op->nfso_cred, tcred);
    654 	/*
    655 	 * (Theoretically this could be done in the same
    656 	 *  compound as the close, but having multiple
    657 	 *  sequenced Ops in the same compound might be
    658 	 *  too scary for some servers.)
    659 	 */
    660 	if (op->nfso_posixlock) {
    661 		off = 0;
    662 		len = NFS64BITSSET;
    663 		type = NFSV4LOCKT_READ;
    664 	}
    665 
    666 	/*
    667 	 * Since this function is only called from VOP_INACTIVE(), no
    668 	 * other thread will be manipulating this Open. As such, the
    669 	 * lock lists are not being changed by other threads, so it should
    670 	 * be safe to do this without locking.
    671 	 */
    672 	LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
    673 		do_unlock = 1;
    674 		LIST_FOREACH_SAFE(lop, &lp->nfsl_lock, nfslo_list, nlop) {
    675 			if (op->nfso_posixlock == 0) {
    676 				off = lop->nfslo_first;
    677 				len = lop->nfslo_end - lop->nfslo_first;
    678 				if (lop->nfslo_type == F_WRLCK)
    679 					type = NFSV4LOCKT_WRITE;
    680 				else
    681 					type = NFSV4LOCKT_READ;
    682 			}
    683 			if (do_unlock) {
    684 				trycnt = 0;
    685 				do {
    686 					error = nfsrpc_locku(nd, nmp, lp, off,
    687 					    len, type, tcred, p, 0);
    688 					if ((nd->nd_repstat == NFSERR_GRACE ||
    689 					    nd->nd_repstat == NFSERR_DELAY) &&
    690 					    error == 0)
    691 						(void) nfs_catnap(PZERO,
    692 						    (int)nd->nd_repstat,
    693 						    "nfs_close");
    694 				} while ((nd->nd_repstat == NFSERR_GRACE ||
    695 				    nd->nd_repstat == NFSERR_DELAY) &&
    696 				    error == 0 && trycnt++ < 5);
    697 				if (op->nfso_posixlock)
    698 					do_unlock = 0;
    699 			}
    700 			nfscl_freelock(lop, 0);
    701 		}
    702 		/*
    703 		 * Do a ReleaseLockOwner.
    704 		 * The lock owner name nfsl_owner may be used by other opens for
    705 		 * other files but the lock_owner4 name that nfsrpc_rellockown()
    706 		 * puts on the wire has the file handle for this file appended
    707 		 * to it, so it can be done now.
    708 		 */
    709 		(void)nfsrpc_rellockown(nmp, lp, lp->nfsl_open->nfso_fh,
    710 		    lp->nfsl_open->nfso_fhlen, tcred, p);
    711 	}
    712 
    713 	/*
    714 	 * There could be other Opens for different files on the same
    715 	 * OpenOwner, so locking is required.
    716 	 */
    717 	NFSLOCKCLSTATE();
    718 	nfscl_lockexcl(&op->nfso_own->nfsow_rwlock, NFSCLSTATEMUTEXPTR);
    719 	NFSUNLOCKCLSTATE();
    720 	do {
    721 		error = nfscl_tryclose(op, tcred, nmp, p);
    722 		if (error == NFSERR_GRACE)
    723 			(void) nfs_catnap(PZERO, error, "nfs_close");
    724 	} while (error == NFSERR_GRACE);
    725 	NFSLOCKCLSTATE();
    726 	nfscl_lockunlock(&op->nfso_own->nfsow_rwlock);
    727 
    728 	LIST_FOREACH_SAFE(lp, &op->nfso_lock, nfsl_list, nlp)
    729 		nfscl_freelockowner(lp, 0);
    730 	nfscl_freeopen(op, 0);
    731 	NFSUNLOCKCLSTATE();
    732 	NFSFREECRED(tcred);
    733 }
    734 
    735 /*
    736  * The actual Close RPC.
    737  */
    738 APPLESTATIC int
    739 nfsrpc_closerpc(struct nfsrv_descript *nd, struct nfsmount *nmp,
    740     struct nfsclopen *op, struct ucred *cred, NFSPROC_T *p,
    741     int syscred)
    742 {
    743 	u_int32_t *tl;
    744 	int error;
    745 
    746 	nfscl_reqstart(nd, NFSPROC_CLOSE, nmp, op->nfso_fh,
    747 	    op->nfso_fhlen, NULL, NULL);
    748 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
    749 	*tl++ = txdr_unsigned(op->nfso_own->nfsow_seqid);
    750 	if (NFSHASNFSV4N(nmp))
    751 		*tl++ = 0;
    752 	else
    753 		*tl++ = op->nfso_stateid.seqid;
    754 	*tl++ = op->nfso_stateid.other[0];
    755 	*tl++ = op->nfso_stateid.other[1];
    756 	*tl = op->nfso_stateid.other[2];
    757 	if (syscred)
    758 		nd->nd_flag |= ND_USEGSSNAME;
    759 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
    760 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    761 	if (error)
    762 		return (error);
    763 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
    764 	if (nd->nd_repstat == 0)
    765 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
    766 	error = nd->nd_repstat;
    767 	if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
    768 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
    769 nfsmout:
    770 	mbuf_freem(nd->nd_mrep);
    771 	return (error);
    772 }
    773 
    774 /*
    775  * V4 Open Confirm RPC.
    776  */
    777 APPLESTATIC int
    778 nfsrpc_openconfirm(vnode_t vp, u_int8_t *nfhp, int fhlen,
    779     struct nfsclopen *op, struct ucred *cred, NFSPROC_T *p)
    780 {
    781 	u_int32_t *tl;
    782 	struct nfsrv_descript nfsd, *nd = &nfsd;
    783 	struct nfsmount *nmp;
    784 	int error;
    785 
    786 	nmp = VFSTONFS(vnode_mount(vp));
    787 	if (NFSHASNFSV4N(nmp))
    788 		return (0);		/* No confirmation for NFSv4.1. */
    789 	nfscl_reqstart(nd, NFSPROC_OPENCONFIRM, nmp, nfhp, fhlen, NULL, NULL);
    790 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
    791 	*tl++ = op->nfso_stateid.seqid;
    792 	*tl++ = op->nfso_stateid.other[0];
    793 	*tl++ = op->nfso_stateid.other[1];
    794 	*tl++ = op->nfso_stateid.other[2];
    795 	*tl = txdr_unsigned(op->nfso_own->nfsow_seqid);
    796 	error = nfscl_request(nd, vp, p, cred, NULL);
    797 	if (error)
    798 		return (error);
    799 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
    800 	if (!nd->nd_repstat) {
    801 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
    802 		op->nfso_stateid.seqid = *tl++;
    803 		op->nfso_stateid.other[0] = *tl++;
    804 		op->nfso_stateid.other[1] = *tl++;
    805 		op->nfso_stateid.other[2] = *tl;
    806 	}
    807 	error = nd->nd_repstat;
    808 	if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
    809 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
    810 nfsmout:
    811 	mbuf_freem(nd->nd_mrep);
    812 	return (error);
    813 }
    814 
    815 /*
    816  * Do the setclientid and setclientid confirm RPCs. Called from nfs_statfs()
    817  * when a mount has just occurred and when the server replies NFSERR_EXPIRED.
    818  */
    819 APPLESTATIC int
    820 nfsrpc_setclient(struct nfsmount *nmp, struct nfsclclient *clp, int reclaim,
    821     struct ucred *cred, NFSPROC_T *p)
    822 {
    823 	u_int32_t *tl;
    824 	struct nfsrv_descript nfsd;
    825 	struct nfsrv_descript *nd = &nfsd;
    826 	nfsattrbit_t attrbits;
    827 	u_int8_t *cp = NULL, *cp2, addr[INET6_ADDRSTRLEN + 9];
    828 	u_short port;
    829 	int error, isinet6 = 0, callblen;
    830 	nfsquad_t confirm;
    831 	u_int32_t lease;
    832 	static u_int32_t rev = 0;
    833 	struct nfsclds *dsp, *ndsp, *tdsp;
    834 	struct in6_addr a6;
    835 
    836 	if (nfsboottime.tv_sec == 0)
    837 		NFSSETBOOTTIME(nfsboottime);
    838 	clp->nfsc_rev = rev++;
    839 	if (NFSHASNFSV4N(nmp)) {
    840 		error = nfsrpc_exchangeid(nmp, clp, &nmp->nm_sockreq,
    841 		    NFSV4EXCH_USEPNFSMDS | NFSV4EXCH_USENONPNFS, &dsp, cred, p);
    842 		NFSCL_DEBUG(1, "aft exch=%d\n", error);
    843 		if (error == 0) {
    844 			error = nfsrpc_createsession(nmp, &dsp->nfsclds_sess,
    845 			    &nmp->nm_sockreq,
    846 			    dsp->nfsclds_sess.nfsess_sequenceid, 1, cred, p);
    847 			if (error == 0) {
    848 				NFSLOCKMNT(nmp);
    849 				TAILQ_FOREACH_SAFE(tdsp, &nmp->nm_sess,
    850 				    nfsclds_list, ndsp)
    851 					nfscl_freenfsclds(tdsp);
    852 				TAILQ_INIT(&nmp->nm_sess);
    853 				TAILQ_INSERT_HEAD(&nmp->nm_sess, dsp,
    854 				    nfsclds_list);
    855 				NFSUNLOCKMNT(nmp);
    856 			} else
    857 				nfscl_freenfsclds(dsp);
    858 			NFSCL_DEBUG(1, "aft createsess=%d\n", error);
    859 		}
    860 		if (error == 0 && reclaim == 0) {
    861 			error = nfsrpc_reclaimcomplete(nmp, cred, p);
    862 			NFSCL_DEBUG(1, "aft reclaimcomp=%d\n", error);
    863 			if (error == NFSERR_COMPLETEALREADY ||
    864 			    error == NFSERR_NOTSUPP)
    865 				/* Ignore this error. */
    866 				error = 0;
    867 		}
    868 		return (error);
    869 	}
    870 
    871 	/*
    872 	 * Allocate a single session structure for NFSv4.0, because some of
    873 	 * the fields are used by NFSv4.0 although it doesn't do a session.
    874 	 */
    875 	dsp = malloc(sizeof(struct nfsclds), M_NFSCLDS, M_WAITOK | M_ZERO);
    876 	mtx_init(&dsp->nfsclds_mtx, "nfsds", NULL, MTX_DEF);
    877 	mtx_init(&dsp->nfsclds_sess.nfsess_mtx, "nfssession", NULL, MTX_DEF);
    878 	NFSLOCKMNT(nmp);
    879 	TAILQ_INSERT_HEAD(&nmp->nm_sess, dsp, nfsclds_list);
    880 	NFSUNLOCKMNT(nmp);
    881 
    882 	nfscl_reqstart(nd, NFSPROC_SETCLIENTID, nmp, NULL, 0, NULL, NULL);
    883 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
    884 	*tl++ = txdr_unsigned(nfsboottime.tv_sec);
    885 	*tl = txdr_unsigned(clp->nfsc_rev);
    886 	(void) nfsm_strtom(nd, clp->nfsc_id, clp->nfsc_idlen);
    887 
    888 	/*
    889 	 * set up the callback address
    890 	 */
    891 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    892 	*tl = txdr_unsigned(NFS_CALLBCKPROG);
    893 	callblen = strlen(nfsv4_callbackaddr);
    894 	if (callblen == 0)
    895 		cp = nfscl_getmyip(nmp, &a6, &isinet6);
    896 	if (nfscl_enablecallb && nfs_numnfscbd > 0 &&
    897 	    (callblen > 0 || cp != NULL)) {
    898 		port = htons(nfsv4_cbport);
    899 		cp2 = (u_int8_t *)&port;
    900 #ifdef INET6
    901 		if ((callblen > 0 &&
    902 		     strchr(nfsv4_callbackaddr, ':')) || isinet6) {
    903 			char ip6buf[INET6_ADDRSTRLEN], *ip6add;
    904 
    905 			(void) nfsm_strtom(nd, "tcp6", 4);
    906 			if (callblen == 0) {
    907 				ip6_sprintf(ip6buf, (struct in6_addr *)cp);
    908 				ip6add = ip6buf;
    909 			} else {
    910 				ip6add = nfsv4_callbackaddr;
    911 			}
    912 			snprintf(addr, INET6_ADDRSTRLEN + 9, "%s.%d.%d",
    913 			    ip6add, cp2[0], cp2[1]);
    914 		} else
    915 #endif
    916 		{
    917 			(void) nfsm_strtom(nd, "tcp", 3);
    918 			if (callblen == 0)
    919 				snprintf(addr, INET6_ADDRSTRLEN + 9,
    920 				    "%d.%d.%d.%d.%d.%d", cp[0], cp[1],
    921 				    cp[2], cp[3], cp2[0], cp2[1]);
    922 			else
    923 				snprintf(addr, INET6_ADDRSTRLEN + 9,
    924 				    "%s.%d.%d", nfsv4_callbackaddr,
    925 				    cp2[0], cp2[1]);
    926 		}
    927 		(void) nfsm_strtom(nd, addr, strlen(addr));
    928 	} else {
    929 		(void) nfsm_strtom(nd, "tcp", 3);
    930 		(void) nfsm_strtom(nd, "0.0.0.0.0.0", 11);
    931 	}
    932 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
    933 	*tl = txdr_unsigned(clp->nfsc_cbident);
    934 	nd->nd_flag |= ND_USEGSSNAME;
    935 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
    936 		NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    937 	if (error)
    938 		return (error);
    939 	if (nd->nd_repstat == 0) {
    940 	    NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
    941 	    NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0] = *tl++;
    942 	    NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1] = *tl++;
    943 	    confirm.lval[0] = *tl++;
    944 	    confirm.lval[1] = *tl;
    945 	    mbuf_freem(nd->nd_mrep);
    946 	    nd->nd_mrep = NULL;
    947 
    948 	    /*
    949 	     * and confirm it.
    950 	     */
    951 	    nfscl_reqstart(nd, NFSPROC_SETCLIENTIDCFRM, nmp, NULL, 0, NULL,
    952 		NULL);
    953 	    NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
    954 	    *tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
    955 	    *tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
    956 	    *tl++ = confirm.lval[0];
    957 	    *tl = confirm.lval[1];
    958 	    nd->nd_flag |= ND_USEGSSNAME;
    959 	    error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p,
    960 		cred, NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    961 	    if (error)
    962 		return (error);
    963 	    mbuf_freem(nd->nd_mrep);
    964 	    nd->nd_mrep = NULL;
    965 	    if (nd->nd_repstat == 0) {
    966 		nfscl_reqstart(nd, NFSPROC_GETATTR, nmp, nmp->nm_fh,
    967 		    nmp->nm_fhsize, NULL, NULL);
    968 		NFSZERO_ATTRBIT(&attrbits);
    969 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_LEASETIME);
    970 		(void) nfsrv_putattrbit(nd, &attrbits);
    971 		nd->nd_flag |= ND_USEGSSNAME;
    972 		error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p,
    973 		    cred, NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
    974 		if (error)
    975 		    return (error);
    976 		if (nd->nd_repstat == 0) {
    977 		    error = nfsv4_loadattr(nd, NULL, NULL, NULL, NULL, 0, NULL,
    978 			NULL, NULL, NULL, NULL, 0, NULL, &lease, NULL, p, cred);
    979 		    if (error)
    980 			goto nfsmout;
    981 		    clp->nfsc_renew = NFSCL_RENEW(lease);
    982 		    clp->nfsc_expire = NFSD_MONOSEC + clp->nfsc_renew;
    983 		    clp->nfsc_clientidrev++;
    984 		    if (clp->nfsc_clientidrev == 0)
    985 			clp->nfsc_clientidrev++;
    986 		}
    987 	    }
    988 	}
    989 	error = nd->nd_repstat;
    990 nfsmout:
    991 	mbuf_freem(nd->nd_mrep);
    992 	return (error);
    993 }
    994 
    995 /*
    996  * nfs getattr call.
    997  */
    998 APPLESTATIC int
    999 nfsrpc_getattr(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
   1000     struct nfsvattr *nap, void *stuff)
   1001 {
   1002 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1003 	int error;
   1004 	nfsattrbit_t attrbits;
   1005 
   1006 	NFSCL_REQSTART(nd, NFSPROC_GETATTR, vp);
   1007 	if (nd->nd_flag & ND_NFSV4) {
   1008 		NFSGETATTR_ATTRBIT(&attrbits);
   1009 		(void) nfsrv_putattrbit(nd, &attrbits);
   1010 	}
   1011 	error = nfscl_request(nd, vp, p, cred, stuff);
   1012 	if (error)
   1013 		return (error);
   1014 	if (!nd->nd_repstat)
   1015 		error = nfsm_loadattr(nd, nap);
   1016 	else
   1017 		error = nd->nd_repstat;
   1018 	mbuf_freem(nd->nd_mrep);
   1019 	return (error);
   1020 }
   1021 
   1022 /*
   1023  * nfs getattr call with non-vnode arguemnts.
   1024  */
   1025 APPLESTATIC int
   1026 nfsrpc_getattrnovp(struct nfsmount *nmp, u_int8_t *fhp, int fhlen, int syscred,
   1027     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, u_int64_t *xidp,
   1028     uint32_t *leasep)
   1029 {
   1030 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1031 	int error, vers = NFS_VER2;
   1032 	nfsattrbit_t attrbits;
   1033 
   1034 	nfscl_reqstart(nd, NFSPROC_GETATTR, nmp, fhp, fhlen, NULL, NULL);
   1035 	if (nd->nd_flag & ND_NFSV4) {
   1036 		vers = NFS_VER4;
   1037 		NFSGETATTR_ATTRBIT(&attrbits);
   1038 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_LEASETIME);
   1039 		(void) nfsrv_putattrbit(nd, &attrbits);
   1040 	} else if (nd->nd_flag & ND_NFSV3) {
   1041 		vers = NFS_VER3;
   1042 	}
   1043 	if (syscred)
   1044 		nd->nd_flag |= ND_USEGSSNAME;
   1045 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   1046 	    NFS_PROG, vers, NULL, 1, xidp, NULL);
   1047 	if (error)
   1048 		return (error);
   1049 	if (nd->nd_repstat == 0) {
   1050 		if ((nd->nd_flag & ND_NFSV4) != 0)
   1051 			error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0,
   1052 			    NULL, NULL, NULL, NULL, NULL, 0, NULL, leasep, NULL,
   1053 			    NULL, NULL);
   1054 		else
   1055 			error = nfsm_loadattr(nd, nap);
   1056 	} else
   1057 		error = nd->nd_repstat;
   1058 	mbuf_freem(nd->nd_mrep);
   1059 	return (error);
   1060 }
   1061 
   1062 /*
   1063  * Do an nfs setattr operation.
   1064  */
   1065 APPLESTATIC int
   1066 nfsrpc_setattr(vnode_t vp, struct vattr *vap, NFSACL_T *aclp,
   1067     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *rnap, int *attrflagp,
   1068     void *stuff)
   1069 {
   1070 	int error, expireret = 0, openerr, retrycnt;
   1071 	u_int32_t clidrev = 0, mode;
   1072 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1073 	struct nfsfh *nfhp;
   1074 	nfsv4stateid_t stateid;
   1075 	void *lckp;
   1076 
   1077 	if (nmp->nm_clp != NULL)
   1078 		clidrev = nmp->nm_clp->nfsc_clientidrev;
   1079 	if (vap != NULL && NFSATTRISSET(u_quad_t, vap, va_size))
   1080 		mode = NFSV4OPEN_ACCESSWRITE;
   1081 	else
   1082 		mode = NFSV4OPEN_ACCESSREAD;
   1083 	retrycnt = 0;
   1084 	do {
   1085 		lckp = NULL;
   1086 		openerr = 1;
   1087 		if (NFSHASNFSV4(nmp)) {
   1088 			nfhp = VTONFS(vp)->n_fhp;
   1089 			error = nfscl_getstateid(vp, nfhp->nfh_fh,
   1090 			    nfhp->nfh_len, mode, 0, cred, p, &stateid, &lckp);
   1091 			if (error && vnode_vtype(vp) == VREG &&
   1092 			    (mode == NFSV4OPEN_ACCESSWRITE ||
   1093 			     nfstest_openallsetattr)) {
   1094 				/*
   1095 				 * No Open stateid, so try and open the file
   1096 				 * now.
   1097 				 */
   1098 				if (mode == NFSV4OPEN_ACCESSWRITE)
   1099 					openerr = nfsrpc_open(vp, FWRITE, cred,
   1100 					    p);
   1101 				else
   1102 					openerr = nfsrpc_open(vp, FREAD, cred,
   1103 					    p);
   1104 				if (!openerr)
   1105 					(void) nfscl_getstateid(vp,
   1106 					    nfhp->nfh_fh, nfhp->nfh_len,
   1107 					    mode, 0, cred, p, &stateid, &lckp);
   1108 			}
   1109 		}
   1110 		if (vap != NULL)
   1111 			error = nfsrpc_setattrrpc(vp, vap, &stateid, cred, p,
   1112 			    rnap, attrflagp, stuff);
   1113 		else
   1114 			error = nfsrpc_setaclrpc(vp, cred, p, aclp, &stateid,
   1115 			    stuff);
   1116 		if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
   1117 			nfscl_initiate_recovery(nmp->nm_clp);
   1118 		if (lckp != NULL)
   1119 			nfscl_lockderef(lckp);
   1120 		if (!openerr)
   1121 			(void) nfsrpc_close(vp, 0, p);
   1122 		if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1123 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1124 		    error == NFSERR_OLDSTATEID || error == NFSERR_BADSESSION) {
   1125 			(void) nfs_catnap(PZERO, error, "nfs_setattr");
   1126 		} else if ((error == NFSERR_EXPIRED ||
   1127 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
   1128 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   1129 		}
   1130 		retrycnt++;
   1131 	} while (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1132 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1133 	    error == NFSERR_BADSESSION ||
   1134 	    (error == NFSERR_OLDSTATEID && retrycnt < 20) ||
   1135 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   1136 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
   1137 	if (error && retrycnt >= 4)
   1138 		error = EIO;
   1139 	return (error);
   1140 }
   1141 
   1142 static int
   1143 nfsrpc_setattrrpc(vnode_t vp, struct vattr *vap,
   1144     nfsv4stateid_t *stateidp, struct ucred *cred, NFSPROC_T *p,
   1145     struct nfsvattr *rnap, int *attrflagp, void *stuff)
   1146 {
   1147 	u_int32_t *tl;
   1148 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1149 	int error;
   1150 	nfsattrbit_t attrbits;
   1151 
   1152 	*attrflagp = 0;
   1153 	NFSCL_REQSTART(nd, NFSPROC_SETATTR, vp);
   1154 	if (nd->nd_flag & ND_NFSV4)
   1155 		nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
   1156 	vap->va_type = vnode_vtype(vp);
   1157 	nfscl_fillsattr(nd, vap, vp, NFSSATTR_FULL, 0);
   1158 	if (nd->nd_flag & ND_NFSV3) {
   1159 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1160 		*tl = newnfs_false;
   1161 	} else if (nd->nd_flag & ND_NFSV4) {
   1162 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1163 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1164 		NFSGETATTR_ATTRBIT(&attrbits);
   1165 		(void) nfsrv_putattrbit(nd, &attrbits);
   1166 	}
   1167 	error = nfscl_request(nd, vp, p, cred, stuff);
   1168 	if (error)
   1169 		return (error);
   1170 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
   1171 		error = nfscl_wcc_data(nd, vp, rnap, attrflagp, NULL, stuff);
   1172 	if ((nd->nd_flag & ND_NFSV4) && !error)
   1173 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
   1174 	if (!(nd->nd_flag & ND_NFSV3) && !nd->nd_repstat && !error)
   1175 		error = nfscl_postop_attr(nd, rnap, attrflagp, stuff);
   1176 	mbuf_freem(nd->nd_mrep);
   1177 	if (nd->nd_repstat && !error)
   1178 		error = nd->nd_repstat;
   1179 	return (error);
   1180 }
   1181 
   1182 /*
   1183  * nfs lookup rpc
   1184  */
   1185 APPLESTATIC int
   1186 nfsrpc_lookup(vnode_t dvp, char *name, int len, struct ucred *cred,
   1187     NFSPROC_T *p, struct nfsvattr *dnap, struct nfsvattr *nap,
   1188     struct nfsfh **nfhpp, int *attrflagp, int *dattrflagp, void *stuff)
   1189 {
   1190 	u_int32_t *tl;
   1191 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1192 	struct nfsmount *nmp;
   1193 	struct nfsnode *np;
   1194 	struct nfsfh *nfhp;
   1195 	nfsattrbit_t attrbits;
   1196 	int error = 0, lookupp = 0;
   1197 
   1198 	*attrflagp = 0;
   1199 	*dattrflagp = 0;
   1200 	if (vnode_vtype(dvp) != VDIR)
   1201 		return (ENOTDIR);
   1202 	nmp = VFSTONFS(vnode_mount(dvp));
   1203 	if (len > NFS_MAXNAMLEN)
   1204 		return (ENAMETOOLONG);
   1205 	if (NFSHASNFSV4(nmp) && len == 1 &&
   1206 		name[0] == '.') {
   1207 		/*
   1208 		 * Just return the current dir's fh.
   1209 		 */
   1210 		np = VTONFS(dvp);
   1211 		MALLOC(nfhp, struct nfsfh *, sizeof (struct nfsfh) +
   1212 			np->n_fhp->nfh_len, M_NFSFH, M_WAITOK);
   1213 		nfhp->nfh_len = np->n_fhp->nfh_len;
   1214 		NFSBCOPY(np->n_fhp->nfh_fh, nfhp->nfh_fh, nfhp->nfh_len);
   1215 		*nfhpp = nfhp;
   1216 		return (0);
   1217 	}
   1218 	if (NFSHASNFSV4(nmp) && len == 2 &&
   1219 		name[0] == '.' && name[1] == '.') {
   1220 		lookupp = 1;
   1221 		NFSCL_REQSTART(nd, NFSPROC_LOOKUPP, dvp);
   1222 	} else {
   1223 		NFSCL_REQSTART(nd, NFSPROC_LOOKUP, dvp);
   1224 		(void) nfsm_strtom(nd, name, len);
   1225 	}
   1226 	if (nd->nd_flag & ND_NFSV4) {
   1227 		NFSGETATTR_ATTRBIT(&attrbits);
   1228 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1229 		*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   1230 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1231 		(void) nfsrv_putattrbit(nd, &attrbits);
   1232 	}
   1233 	error = nfscl_request(nd, dvp, p, cred, stuff);
   1234 	if (error)
   1235 		return (error);
   1236 	if (nd->nd_repstat) {
   1237 		/*
   1238 		 * When an NFSv4 Lookupp returns ENOENT, it means that
   1239 		 * the lookup is at the root of an fs, so return this dir.
   1240 		 */
   1241 		if (nd->nd_repstat == NFSERR_NOENT && lookupp) {
   1242 		    np = VTONFS(dvp);
   1243 		    MALLOC(nfhp, struct nfsfh *, sizeof (struct nfsfh) +
   1244 			np->n_fhp->nfh_len, M_NFSFH, M_WAITOK);
   1245 		    nfhp->nfh_len = np->n_fhp->nfh_len;
   1246 		    NFSBCOPY(np->n_fhp->nfh_fh, nfhp->nfh_fh, nfhp->nfh_len);
   1247 		    *nfhpp = nfhp;
   1248 		    mbuf_freem(nd->nd_mrep);
   1249 		    return (0);
   1250 		}
   1251 		if (nd->nd_flag & ND_NFSV3)
   1252 		    error = nfscl_postop_attr(nd, dnap, dattrflagp, stuff);
   1253 		else if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) ==
   1254 		    ND_NFSV4) {
   1255 			/* Load the directory attributes. */
   1256 			error = nfsm_loadattr(nd, dnap);
   1257 			if (error == 0)
   1258 				*dattrflagp = 1;
   1259 		}
   1260 		goto nfsmout;
   1261 	}
   1262 	if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4) {
   1263 		/* Load the directory attributes. */
   1264 		error = nfsm_loadattr(nd, dnap);
   1265 		if (error != 0)
   1266 			goto nfsmout;
   1267 		*dattrflagp = 1;
   1268 		/* Skip over the Lookup and GetFH operation status values. */
   1269 		NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
   1270 	}
   1271 	error = nfsm_getfh(nd, nfhpp);
   1272 	if (error)
   1273 		goto nfsmout;
   1274 
   1275 	error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   1276 	if ((nd->nd_flag & ND_NFSV3) && !error)
   1277 		error = nfscl_postop_attr(nd, dnap, dattrflagp, stuff);
   1278 nfsmout:
   1279 	mbuf_freem(nd->nd_mrep);
   1280 	if (!error && nd->nd_repstat)
   1281 		error = nd->nd_repstat;
   1282 	return (error);
   1283 }
   1284 
   1285 /*
   1286  * Do a readlink rpc.
   1287  */
   1288 APPLESTATIC int
   1289 nfsrpc_readlink(vnode_t vp, struct uio *uiop, struct ucred *cred,
   1290     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   1291 {
   1292 	u_int32_t *tl;
   1293 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1294 	struct nfsnode *np = VTONFS(vp);
   1295 	nfsattrbit_t attrbits;
   1296 	int error, len, cangetattr = 1;
   1297 
   1298 	*attrflagp = 0;
   1299 	NFSCL_REQSTART(nd, NFSPROC_READLINK, vp);
   1300 	if (nd->nd_flag & ND_NFSV4) {
   1301 		/*
   1302 		 * And do a Getattr op.
   1303 		 */
   1304 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1305 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1306 		NFSGETATTR_ATTRBIT(&attrbits);
   1307 		(void) nfsrv_putattrbit(nd, &attrbits);
   1308 	}
   1309 	error = nfscl_request(nd, vp, p, cred, stuff);
   1310 	if (error)
   1311 		return (error);
   1312 	if (nd->nd_flag & ND_NFSV3)
   1313 		error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   1314 	if (!nd->nd_repstat && !error) {
   1315 		NFSM_STRSIZ(len, NFS_MAXPATHLEN);
   1316 		/*
   1317 		 * This seems weird to me, but must have been added to
   1318 		 * FreeBSD for some reason. The only thing I can think of
   1319 		 * is that there was/is some server that replies with
   1320 		 * more link data than it should?
   1321 		 */
   1322 		if (len == NFS_MAXPATHLEN) {
   1323 			NFSLOCKNODE(np);
   1324 			if (np->n_size > 0 && np->n_size < NFS_MAXPATHLEN) {
   1325 				len = np->n_size;
   1326 				cangetattr = 0;
   1327 			}
   1328 			NFSUNLOCKNODE(np);
   1329 		}
   1330 		error = nfsm_mbufuio(nd, uiop, len);
   1331 		if ((nd->nd_flag & ND_NFSV4) && !error && cangetattr)
   1332 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   1333 	}
   1334 	if (nd->nd_repstat && !error)
   1335 		error = nd->nd_repstat;
   1336 nfsmout:
   1337 	mbuf_freem(nd->nd_mrep);
   1338 	return (error);
   1339 }
   1340 
   1341 /*
   1342  * Read operation.
   1343  */
   1344 APPLESTATIC int
   1345 nfsrpc_read(vnode_t vp, struct uio *uiop, struct ucred *cred,
   1346     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   1347 {
   1348 	int error, expireret = 0, retrycnt;
   1349 	u_int32_t clidrev = 0;
   1350 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1351 	struct nfsnode *np = VTONFS(vp);
   1352 	struct ucred *newcred;
   1353 	struct nfsfh *nfhp = NULL;
   1354 	nfsv4stateid_t stateid;
   1355 	void *lckp;
   1356 
   1357 	if (nmp->nm_clp != NULL)
   1358 		clidrev = nmp->nm_clp->nfsc_clientidrev;
   1359 	newcred = cred;
   1360 	if (NFSHASNFSV4(nmp)) {
   1361 		nfhp = np->n_fhp;
   1362 		newcred = NFSNEWCRED(cred);
   1363 	}
   1364 	retrycnt = 0;
   1365 	do {
   1366 		lckp = NULL;
   1367 		if (NFSHASNFSV4(nmp))
   1368 			(void)nfscl_getstateid(vp, nfhp->nfh_fh, nfhp->nfh_len,
   1369 			    NFSV4OPEN_ACCESSREAD, 0, newcred, p, &stateid,
   1370 			    &lckp);
   1371 		error = nfsrpc_readrpc(vp, uiop, newcred, &stateid, p, nap,
   1372 		    attrflagp, stuff);
   1373 		if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
   1374 			nfscl_initiate_recovery(nmp->nm_clp);
   1375 		if (lckp != NULL)
   1376 			nfscl_lockderef(lckp);
   1377 		if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1378 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1379 		    error == NFSERR_OLDSTATEID || error == NFSERR_BADSESSION) {
   1380 			(void) nfs_catnap(PZERO, error, "nfs_read");
   1381 		} else if ((error == NFSERR_EXPIRED ||
   1382 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
   1383 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   1384 		}
   1385 		retrycnt++;
   1386 	} while (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1387 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1388 	    error == NFSERR_BADSESSION ||
   1389 	    (error == NFSERR_OLDSTATEID && retrycnt < 20) ||
   1390 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   1391 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
   1392 	if (error && retrycnt >= 4)
   1393 		error = EIO;
   1394 	if (NFSHASNFSV4(nmp))
   1395 		NFSFREECRED(newcred);
   1396 	return (error);
   1397 }
   1398 
   1399 /*
   1400  * The actual read RPC.
   1401  */
   1402 static int
   1403 nfsrpc_readrpc(vnode_t vp, struct uio *uiop, struct ucred *cred,
   1404     nfsv4stateid_t *stateidp, NFSPROC_T *p, struct nfsvattr *nap,
   1405     int *attrflagp, void *stuff)
   1406 {
   1407 	u_int32_t *tl;
   1408 	int error = 0, len, retlen, tsiz, eof = 0;
   1409 	struct nfsrv_descript nfsd;
   1410 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1411 	struct nfsrv_descript *nd = &nfsd;
   1412 	int rsize;
   1413 	off_t tmp_off;
   1414 
   1415 	*attrflagp = 0;
   1416 	tsiz = uio_uio_resid(uiop);
   1417 	tmp_off = uiop->uio_offset + tsiz;
   1418 	NFSLOCKMNT(nmp);
   1419 	if (tmp_off > nmp->nm_maxfilesize || tmp_off < uiop->uio_offset) {
   1420 		NFSUNLOCKMNT(nmp);
   1421 		return (EFBIG);
   1422 	}
   1423 	rsize = nmp->nm_rsize;
   1424 	NFSUNLOCKMNT(nmp);
   1425 	nd->nd_mrep = NULL;
   1426 	while (tsiz > 0) {
   1427 		*attrflagp = 0;
   1428 		len = (tsiz > rsize) ? rsize : tsiz;
   1429 		NFSCL_REQSTART(nd, NFSPROC_READ, vp);
   1430 		if (nd->nd_flag & ND_NFSV4)
   1431 			nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
   1432 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED * 3);
   1433 		if (nd->nd_flag & ND_NFSV2) {
   1434 			*tl++ = txdr_unsigned(uiop->uio_offset);
   1435 			*tl++ = txdr_unsigned(len);
   1436 			*tl = 0;
   1437 		} else {
   1438 			txdr_hyper(uiop->uio_offset, tl);
   1439 			*(tl + 2) = txdr_unsigned(len);
   1440 		}
   1441 		/*
   1442 		 * Since I can't do a Getattr for NFSv4 for Write, there
   1443 		 * doesn't seem any point in doing one here, either.
   1444 		 * (See the comment in nfsrpc_writerpc() for more info.)
   1445 		 */
   1446 		error = nfscl_request(nd, vp, p, cred, stuff);
   1447 		if (error)
   1448 			return (error);
   1449 		if (nd->nd_flag & ND_NFSV3) {
   1450 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   1451 		} else if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV2)) {
   1452 			error = nfsm_loadattr(nd, nap);
   1453 			if (!error)
   1454 				*attrflagp = 1;
   1455 		}
   1456 		if (nd->nd_repstat || error) {
   1457 			if (!error)
   1458 				error = nd->nd_repstat;
   1459 			goto nfsmout;
   1460 		}
   1461 		if (nd->nd_flag & ND_NFSV3) {
   1462 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1463 			eof = fxdr_unsigned(int, *(tl + 1));
   1464 		} else if (nd->nd_flag & ND_NFSV4) {
   1465 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   1466 			eof = fxdr_unsigned(int, *tl);
   1467 		}
   1468 		NFSM_STRSIZ(retlen, len);
   1469 		error = nfsm_mbufuio(nd, uiop, retlen);
   1470 		if (error)
   1471 			goto nfsmout;
   1472 		mbuf_freem(nd->nd_mrep);
   1473 		nd->nd_mrep = NULL;
   1474 		tsiz -= retlen;
   1475 		if (!(nd->nd_flag & ND_NFSV2)) {
   1476 			if (eof || retlen == 0)
   1477 				tsiz = 0;
   1478 		} else if (retlen < len)
   1479 			tsiz = 0;
   1480 	}
   1481 	return (0);
   1482 nfsmout:
   1483 	if (nd->nd_mrep != NULL)
   1484 		mbuf_freem(nd->nd_mrep);
   1485 	return (error);
   1486 }
   1487 
   1488 /*
   1489  * nfs write operation
   1490  * When called_from_strategy != 0, it should return EIO for an error that
   1491  * indicates recovery is in progress, so that the buffer will be left
   1492  * dirty and be written back to the server later. If it loops around,
   1493  * the recovery thread could get stuck waiting for the buffer and recovery
   1494  * will then deadlock.
   1495  */
   1496 APPLESTATIC int
   1497 nfsrpc_write(vnode_t vp, struct uio *uiop, int *iomode, int *must_commit,
   1498     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   1499     void *stuff, int called_from_strategy)
   1500 {
   1501 	int error, expireret = 0, retrycnt, nostateid;
   1502 	u_int32_t clidrev = 0;
   1503 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1504 	struct nfsnode *np = VTONFS(vp);
   1505 	struct ucred *newcred;
   1506 	struct nfsfh *nfhp = NULL;
   1507 	nfsv4stateid_t stateid;
   1508 	void *lckp;
   1509 
   1510 	*must_commit = 0;
   1511 	if (nmp->nm_clp != NULL)
   1512 		clidrev = nmp->nm_clp->nfsc_clientidrev;
   1513 	newcred = cred;
   1514 	if (NFSHASNFSV4(nmp)) {
   1515 		newcred = NFSNEWCRED(cred);
   1516 		nfhp = np->n_fhp;
   1517 	}
   1518 	retrycnt = 0;
   1519 	do {
   1520 		lckp = NULL;
   1521 		nostateid = 0;
   1522 		if (NFSHASNFSV4(nmp)) {
   1523 			(void)nfscl_getstateid(vp, nfhp->nfh_fh, nfhp->nfh_len,
   1524 			    NFSV4OPEN_ACCESSWRITE, 0, newcred, p, &stateid,
   1525 			    &lckp);
   1526 			if (stateid.other[0] == 0 && stateid.other[1] == 0 &&
   1527 			    stateid.other[2] == 0) {
   1528 				nostateid = 1;
   1529 				NFSCL_DEBUG(1, "stateid0 in write\n");
   1530 			}
   1531 		}
   1532 
   1533 		/*
   1534 		 * If there is no stateid for NFSv4, it means this is an
   1535 		 * extraneous write after close. Basically a poorly
   1536 		 * implemented buffer cache. Just don't do the write.
   1537 		 */
   1538 		if (nostateid)
   1539 			error = 0;
   1540 		else
   1541 			error = nfsrpc_writerpc(vp, uiop, iomode, must_commit,
   1542 			    newcred, &stateid, p, nap, attrflagp, stuff);
   1543 		if (error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION)
   1544 			nfscl_initiate_recovery(nmp->nm_clp);
   1545 		if (lckp != NULL)
   1546 			nfscl_lockderef(lckp);
   1547 		if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   1548 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1549 		    error == NFSERR_OLDSTATEID || error == NFSERR_BADSESSION) {
   1550 			(void) nfs_catnap(PZERO, error, "nfs_write");
   1551 		} else if ((error == NFSERR_EXPIRED ||
   1552 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
   1553 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   1554 		}
   1555 		retrycnt++;
   1556 	} while (error == NFSERR_GRACE || error == NFSERR_DELAY ||
   1557 	    ((error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION ||
   1558 	      error == NFSERR_STALEDONTRECOVER) && called_from_strategy == 0) ||
   1559 	    (error == NFSERR_OLDSTATEID && retrycnt < 20) ||
   1560 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   1561 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
   1562 	if (error != 0 && (retrycnt >= 4 ||
   1563 	    ((error == NFSERR_STALESTATEID || error == NFSERR_BADSESSION ||
   1564 	      error == NFSERR_STALEDONTRECOVER) && called_from_strategy != 0)))
   1565 		error = EIO;
   1566 	if (NFSHASNFSV4(nmp))
   1567 		NFSFREECRED(newcred);
   1568 	return (error);
   1569 }
   1570 
   1571 /*
   1572  * The actual write RPC.
   1573  */
   1574 static int
   1575 nfsrpc_writerpc(vnode_t vp, struct uio *uiop, int *iomode,
   1576     int *must_commit, struct ucred *cred, nfsv4stateid_t *stateidp,
   1577     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   1578 {
   1579 	u_int32_t *tl;
   1580 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   1581 	struct nfsnode *np = VTONFS(vp);
   1582 	int error = 0, len, tsiz, rlen, commit, committed = NFSWRITE_FILESYNC;
   1583 	int wccflag = 0, wsize;
   1584 	int32_t backup;
   1585 	struct nfsrv_descript nfsd;
   1586 	struct nfsrv_descript *nd = &nfsd;
   1587 	nfsattrbit_t attrbits;
   1588 	off_t tmp_off;
   1589 
   1590 	KASSERT(uiop->uio_iovcnt == 1, ("nfs: writerpc iovcnt > 1"));
   1591 	*attrflagp = 0;
   1592 	tsiz = uio_uio_resid(uiop);
   1593 	tmp_off = uiop->uio_offset + tsiz;
   1594 	NFSLOCKMNT(nmp);
   1595 	if (tmp_off > nmp->nm_maxfilesize || tmp_off < uiop->uio_offset) {
   1596 		NFSUNLOCKMNT(nmp);
   1597 		return (EFBIG);
   1598 	}
   1599 	wsize = nmp->nm_wsize;
   1600 	NFSUNLOCKMNT(nmp);
   1601 	nd->nd_mrep = NULL;	/* NFSv2 sometimes does a write with */
   1602 	nd->nd_repstat = 0;	/* uio_resid == 0, so the while is not done */
   1603 	while (tsiz > 0) {
   1604 		*attrflagp = 0;
   1605 		len = (tsiz > wsize) ? wsize : tsiz;
   1606 		NFSCL_REQSTART(nd, NFSPROC_WRITE, vp);
   1607 		if (nd->nd_flag & ND_NFSV4) {
   1608 			nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
   1609 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER+2*NFSX_UNSIGNED);
   1610 			txdr_hyper(uiop->uio_offset, tl);
   1611 			tl += 2;
   1612 			*tl++ = txdr_unsigned(*iomode);
   1613 			*tl = txdr_unsigned(len);
   1614 		} else if (nd->nd_flag & ND_NFSV3) {
   1615 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER+3*NFSX_UNSIGNED);
   1616 			txdr_hyper(uiop->uio_offset, tl);
   1617 			tl += 2;
   1618 			*tl++ = txdr_unsigned(len);
   1619 			*tl++ = txdr_unsigned(*iomode);
   1620 			*tl = txdr_unsigned(len);
   1621 		} else {
   1622 			u_int32_t x;
   1623 
   1624 			NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
   1625 			/*
   1626 			 * Not sure why someone changed this, since the
   1627 			 * RFC clearly states that "beginoffset" and
   1628 			 * "totalcount" are ignored, but it wouldn't
   1629 			 * surprise me if there's a busted server out there.
   1630 			 */
   1631 			/* Set both "begin" and "current" to non-garbage. */
   1632 			x = txdr_unsigned((u_int32_t)uiop->uio_offset);
   1633 			*tl++ = x;      /* "begin offset" */
   1634 			*tl++ = x;      /* "current offset" */
   1635 			x = txdr_unsigned(len);
   1636 			*tl++ = x;      /* total to this offset */
   1637 			*tl = x;        /* size of this write */
   1638 
   1639 		}
   1640 		nfsm_uiombuf(nd, uiop, len);
   1641 		/*
   1642 		 * Although it is tempting to do a normal Getattr Op in the
   1643 		 * NFSv4 compound, the result can be a nearly hung client
   1644 		 * system if the Getattr asks for Owner and/or OwnerGroup.
   1645 		 * It occurs when the client can't map either the Owner or
   1646 		 * Owner_group name in the Getattr reply to a uid/gid. When
   1647 		 * there is a cache miss, the kernel does an upcall to the
   1648 		 * nfsuserd. Then, it can try and read the local /etc/passwd
   1649 		 * or /etc/group file. It can then block in getnewbuf(),
   1650 		 * waiting for dirty writes to be pushed to the NFS server.
   1651 		 * The only reason this doesn't result in a complete
   1652 		 * deadlock, is that the upcall times out and allows
   1653 		 * the write to complete. However, progress is so slow
   1654 		 * that it might just as well be deadlocked.
   1655 		 * As such, we get the rest of the attributes, but not
   1656 		 * Owner or Owner_group.
   1657 		 * nb: nfscl_loadattrcache() needs to be told that these
   1658 		 *     partial attributes from a write rpc are being
   1659 		 *     passed in, via a argument flag.
   1660 		 */
   1661 		if (nd->nd_flag & ND_NFSV4) {
   1662 			NFSWRITEGETATTR_ATTRBIT(&attrbits);
   1663 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1664 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1665 			(void) nfsrv_putattrbit(nd, &attrbits);
   1666 		}
   1667 		error = nfscl_request(nd, vp, p, cred, stuff);
   1668 		if (error)
   1669 			return (error);
   1670 		if (nd->nd_repstat) {
   1671 			/*
   1672 			 * In case the rpc gets retried, roll
   1673 			 * the uio fileds changed by nfsm_uiombuf()
   1674 			 * back.
   1675 			 */
   1676 			uiop->uio_offset -= len;
   1677 			uio_uio_resid_add(uiop, len);
   1678 			uio_iov_base_add(uiop, -len);
   1679 			uio_iov_len_add(uiop, len);
   1680 		}
   1681 		if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
   1682 			error = nfscl_wcc_data(nd, vp, nap, attrflagp,
   1683 			    &wccflag, stuff);
   1684 			if (error)
   1685 				goto nfsmout;
   1686 		}
   1687 		if (!nd->nd_repstat) {
   1688 			if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
   1689 				NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED
   1690 					+ NFSX_VERF);
   1691 				rlen = fxdr_unsigned(int, *tl++);
   1692 				if (rlen == 0) {
   1693 					error = NFSERR_IO;
   1694 					goto nfsmout;
   1695 				} else if (rlen < len) {
   1696 					backup = len - rlen;
   1697 					uio_iov_base_add(uiop, -(backup));
   1698 					uio_iov_len_add(uiop, backup);
   1699 					uiop->uio_offset -= backup;
   1700 					uio_uio_resid_add(uiop, backup);
   1701 					len = rlen;
   1702 				}
   1703 				commit = fxdr_unsigned(int, *tl++);
   1704 
   1705 				/*
   1706 				 * Return the lowest commitment level
   1707 				 * obtained by any of the RPCs.
   1708 				 */
   1709 				if (committed == NFSWRITE_FILESYNC)
   1710 					committed = commit;
   1711 				else if (committed == NFSWRITE_DATASYNC &&
   1712 					commit == NFSWRITE_UNSTABLE)
   1713 					committed = commit;
   1714 				NFSLOCKMNT(nmp);
   1715 				if (!NFSHASWRITEVERF(nmp)) {
   1716 					NFSBCOPY((caddr_t)tl,
   1717 					    (caddr_t)&nmp->nm_verf[0],
   1718 					    NFSX_VERF);
   1719 					NFSSETWRITEVERF(nmp);
   1720 	    			} else if (NFSBCMP(tl, nmp->nm_verf,
   1721 				    NFSX_VERF)) {
   1722 					*must_commit = 1;
   1723 					NFSBCOPY(tl, nmp->nm_verf, NFSX_VERF);
   1724 				}
   1725 				NFSUNLOCKMNT(nmp);
   1726 			}
   1727 			if (nd->nd_flag & ND_NFSV4)
   1728 				NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1729 			if (nd->nd_flag & (ND_NFSV2 | ND_NFSV4)) {
   1730 				error = nfsm_loadattr(nd, nap);
   1731 				if (!error)
   1732 					*attrflagp = NFS_LATTR_NOSHRINK;
   1733 			}
   1734 		} else {
   1735 			error = nd->nd_repstat;
   1736 		}
   1737 		if (error)
   1738 			goto nfsmout;
   1739 		NFSWRITERPC_SETTIME(wccflag, np, nap, (nd->nd_flag & ND_NFSV4));
   1740 		mbuf_freem(nd->nd_mrep);
   1741 		nd->nd_mrep = NULL;
   1742 		tsiz -= len;
   1743 	}
   1744 nfsmout:
   1745 	if (nd->nd_mrep != NULL)
   1746 		mbuf_freem(nd->nd_mrep);
   1747 	*iomode = committed;
   1748 	if (nd->nd_repstat && !error)
   1749 		error = nd->nd_repstat;
   1750 	return (error);
   1751 }
   1752 
   1753 /*
   1754  * nfs mknod rpc
   1755  * For NFS v2 this is a kludge. Use a create rpc but with the IFMT bits of the
   1756  * mode set to specify the file type and the size field for rdev.
   1757  */
   1758 APPLESTATIC int
   1759 nfsrpc_mknod(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   1760     u_int32_t rdev, enum vtype vtyp, struct ucred *cred, NFSPROC_T *p,
   1761     struct nfsvattr *dnap, struct nfsvattr *nnap, struct nfsfh **nfhpp,
   1762     int *attrflagp, int *dattrflagp, void *dstuff)
   1763 {
   1764 	u_int32_t *tl;
   1765 	int error = 0;
   1766 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1767 	nfsattrbit_t attrbits;
   1768 
   1769 	*nfhpp = NULL;
   1770 	*attrflagp = 0;
   1771 	*dattrflagp = 0;
   1772 	if (namelen > NFS_MAXNAMLEN)
   1773 		return (ENAMETOOLONG);
   1774 	NFSCL_REQSTART(nd, NFSPROC_MKNOD, dvp);
   1775 	if (nd->nd_flag & ND_NFSV4) {
   1776 		if (vtyp == VBLK || vtyp == VCHR) {
   1777 			NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
   1778 			*tl++ = vtonfsv34_type(vtyp);
   1779 			*tl++ = txdr_unsigned(NFSMAJOR(rdev));
   1780 			*tl = txdr_unsigned(NFSMINOR(rdev));
   1781 		} else {
   1782 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1783 			*tl = vtonfsv34_type(vtyp);
   1784 		}
   1785 	}
   1786 	(void) nfsm_strtom(nd, name, namelen);
   1787 	if (nd->nd_flag & ND_NFSV3) {
   1788 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1789 		*tl = vtonfsv34_type(vtyp);
   1790 	}
   1791 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
   1792 		nfscl_fillsattr(nd, vap, dvp, 0, 0);
   1793 	if ((nd->nd_flag & ND_NFSV3) &&
   1794 	    (vtyp == VCHR || vtyp == VBLK)) {
   1795 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1796 		*tl++ = txdr_unsigned(NFSMAJOR(rdev));
   1797 		*tl = txdr_unsigned(NFSMINOR(rdev));
   1798 	}
   1799 	if (nd->nd_flag & ND_NFSV4) {
   1800 		NFSGETATTR_ATTRBIT(&attrbits);
   1801 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1802 		*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   1803 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   1804 		(void) nfsrv_putattrbit(nd, &attrbits);
   1805 	}
   1806 	if (nd->nd_flag & ND_NFSV2)
   1807 		nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZERDEV, rdev);
   1808 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   1809 	if (error)
   1810 		return (error);
   1811 	if (nd->nd_flag & ND_NFSV4)
   1812 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   1813 	if (!nd->nd_repstat) {
   1814 		if (nd->nd_flag & ND_NFSV4) {
   1815 			NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
   1816 			error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
   1817 			if (error)
   1818 				goto nfsmout;
   1819 		}
   1820 		error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   1821 		if (error)
   1822 			goto nfsmout;
   1823 	}
   1824 	if (nd->nd_flag & ND_NFSV3)
   1825 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   1826 	if (!error && nd->nd_repstat)
   1827 		error = nd->nd_repstat;
   1828 nfsmout:
   1829 	mbuf_freem(nd->nd_mrep);
   1830 	return (error);
   1831 }
   1832 
   1833 /*
   1834  * nfs file create call
   1835  * Mostly just call the approriate routine. (I separated out v4, so that
   1836  * error recovery wouldn't be as difficult.)
   1837  */
   1838 APPLESTATIC int
   1839 nfsrpc_create(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   1840     nfsquad_t cverf, int fmode, struct ucred *cred, NFSPROC_T *p,
   1841     struct nfsvattr *dnap, struct nfsvattr *nnap, struct nfsfh **nfhpp,
   1842     int *attrflagp, int *dattrflagp, void *dstuff)
   1843 {
   1844 	int error = 0, newone, expireret = 0, retrycnt, unlocked;
   1845 	struct nfsclowner *owp;
   1846 	struct nfscldeleg *dp;
   1847 	struct nfsmount *nmp = VFSTONFS(vnode_mount(dvp));
   1848 	u_int32_t clidrev;
   1849 
   1850 	if (NFSHASNFSV4(nmp)) {
   1851 	    retrycnt = 0;
   1852 	    do {
   1853 		dp = NULL;
   1854 		error = nfscl_open(dvp, NULL, 0, (NFSV4OPEN_ACCESSWRITE |
   1855 		    NFSV4OPEN_ACCESSREAD), 0, cred, p, &owp, NULL, &newone,
   1856 		    NULL, 1);
   1857 		if (error)
   1858 			return (error);
   1859 		if (nmp->nm_clp != NULL)
   1860 			clidrev = nmp->nm_clp->nfsc_clientidrev;
   1861 		else
   1862 			clidrev = 0;
   1863 		error = nfsrpc_createv4(dvp, name, namelen, vap, cverf, fmode,
   1864 		  owp, &dp, cred, p, dnap, nnap, nfhpp, attrflagp, dattrflagp,
   1865 		  dstuff, &unlocked);
   1866 		/*
   1867 		 * There is no need to invalidate cached attributes here,
   1868 		 * since new post-delegation issue attributes are always
   1869 		 * returned by nfsrpc_createv4() and these will update the
   1870 		 * attribute cache.
   1871 		 */
   1872 		if (dp != NULL)
   1873 			(void) nfscl_deleg(nmp->nm_mountp, owp->nfsow_clp,
   1874 			    (*nfhpp)->nfh_fh, (*nfhpp)->nfh_len, cred, p, &dp);
   1875 		nfscl_ownerrelease(owp, error, newone, unlocked);
   1876 		if (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
   1877 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1878 		    error == NFSERR_BADSESSION) {
   1879 			(void) nfs_catnap(PZERO, error, "nfs_open");
   1880 		} else if ((error == NFSERR_EXPIRED ||
   1881 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
   1882 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   1883 			retrycnt++;
   1884 		}
   1885 	    } while (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
   1886 		error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
   1887 		error == NFSERR_BADSESSION ||
   1888 		((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   1889 		 expireret == 0 && clidrev != 0 && retrycnt < 4));
   1890 	    if (error && retrycnt >= 4)
   1891 		    error = EIO;
   1892 	} else {
   1893 		error = nfsrpc_createv23(dvp, name, namelen, vap, cverf,
   1894 		    fmode, cred, p, dnap, nnap, nfhpp, attrflagp, dattrflagp,
   1895 		    dstuff);
   1896 	}
   1897 	return (error);
   1898 }
   1899 
   1900 /*
   1901  * The create rpc for v2 and 3.
   1902  */
   1903 static int
   1904 nfsrpc_createv23(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   1905     nfsquad_t cverf, int fmode, struct ucred *cred, NFSPROC_T *p,
   1906     struct nfsvattr *dnap, struct nfsvattr *nnap, struct nfsfh **nfhpp,
   1907     int *attrflagp, int *dattrflagp, void *dstuff)
   1908 {
   1909 	u_int32_t *tl;
   1910 	int error = 0;
   1911 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1912 
   1913 	*nfhpp = NULL;
   1914 	*attrflagp = 0;
   1915 	*dattrflagp = 0;
   1916 	if (namelen > NFS_MAXNAMLEN)
   1917 		return (ENAMETOOLONG);
   1918 	NFSCL_REQSTART(nd, NFSPROC_CREATE, dvp);
   1919 	(void) nfsm_strtom(nd, name, namelen);
   1920 	if (nd->nd_flag & ND_NFSV3) {
   1921 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   1922 		if (fmode & O_EXCL) {
   1923 			*tl = txdr_unsigned(NFSCREATE_EXCLUSIVE);
   1924 			NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
   1925 			*tl++ = cverf.lval[0];
   1926 			*tl = cverf.lval[1];
   1927 		} else {
   1928 			*tl = txdr_unsigned(NFSCREATE_UNCHECKED);
   1929 			nfscl_fillsattr(nd, vap, dvp, 0, 0);
   1930 		}
   1931 	} else {
   1932 		nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZE0, 0);
   1933 	}
   1934 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   1935 	if (error)
   1936 		return (error);
   1937 	if (nd->nd_repstat == 0) {
   1938 		error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   1939 		if (error)
   1940 			goto nfsmout;
   1941 	}
   1942 	if (nd->nd_flag & ND_NFSV3)
   1943 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   1944 	if (nd->nd_repstat != 0 && error == 0)
   1945 		error = nd->nd_repstat;
   1946 nfsmout:
   1947 	mbuf_freem(nd->nd_mrep);
   1948 	return (error);
   1949 }
   1950 
   1951 static int
   1952 nfsrpc_createv4(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   1953     nfsquad_t cverf, int fmode, struct nfsclowner *owp, struct nfscldeleg **dpp,
   1954     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
   1955     struct nfsvattr *nnap, struct nfsfh **nfhpp, int *attrflagp,
   1956     int *dattrflagp, void *dstuff, int *unlockedp)
   1957 {
   1958 	u_int32_t *tl;
   1959 	int error = 0, deleg, newone, ret, acesize, limitby;
   1960 	struct nfsrv_descript nfsd, *nd = &nfsd;
   1961 	struct nfsclopen *op;
   1962 	struct nfscldeleg *dp = NULL;
   1963 	struct nfsnode *np;
   1964 	struct nfsfh *nfhp;
   1965 	nfsattrbit_t attrbits;
   1966 	nfsv4stateid_t stateid;
   1967 	u_int32_t rflags;
   1968 	struct nfsmount *nmp;
   1969 
   1970 	nmp = VFSTONFS(dvp->v_mount);
   1971 	np = VTONFS(dvp);
   1972 	*unlockedp = 0;
   1973 	*nfhpp = NULL;
   1974 	*dpp = NULL;
   1975 	*attrflagp = 0;
   1976 	*dattrflagp = 0;
   1977 	if (namelen > NFS_MAXNAMLEN)
   1978 		return (ENAMETOOLONG);
   1979 	NFSCL_REQSTART(nd, NFSPROC_CREATE, dvp);
   1980 	/*
   1981 	 * For V4, this is actually an Open op.
   1982 	 */
   1983 	NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
   1984 	*tl++ = txdr_unsigned(owp->nfsow_seqid);
   1985 	*tl++ = txdr_unsigned(NFSV4OPEN_ACCESSWRITE |
   1986 	    NFSV4OPEN_ACCESSREAD);
   1987 	*tl++ = txdr_unsigned(NFSV4OPEN_DENYNONE);
   1988 	*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   1989 	*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   1990 	(void) nfsm_strtom(nd, owp->nfsow_owner, NFSV4CL_LOCKNAMELEN);
   1991 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   1992 	*tl++ = txdr_unsigned(NFSV4OPEN_CREATE);
   1993 	if (fmode & O_EXCL) {
   1994 		if (NFSHASNFSV4N(nmp)) {
   1995 			if (NFSHASSESSPERSIST(nmp)) {
   1996 				/* Use GUARDED for persistent sessions. */
   1997 				*tl = txdr_unsigned(NFSCREATE_GUARDED);
   1998 				nfscl_fillsattr(nd, vap, dvp, 0, 0);
   1999 			} else {
   2000 				/* Otherwise, use EXCLUSIVE4_1. */
   2001 				*tl = txdr_unsigned(NFSCREATE_EXCLUSIVE41);
   2002 				NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
   2003 				*tl++ = cverf.lval[0];
   2004 				*tl = cverf.lval[1];
   2005 				nfscl_fillsattr(nd, vap, dvp, 0, 0);
   2006 			}
   2007 		} else {
   2008 			/* NFSv4.0 */
   2009 			*tl = txdr_unsigned(NFSCREATE_EXCLUSIVE);
   2010 			NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
   2011 			*tl++ = cverf.lval[0];
   2012 			*tl = cverf.lval[1];
   2013 		}
   2014 	} else {
   2015 		*tl = txdr_unsigned(NFSCREATE_UNCHECKED);
   2016 		nfscl_fillsattr(nd, vap, dvp, 0, 0);
   2017 	}
   2018 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2019 	*tl = txdr_unsigned(NFSV4OPEN_CLAIMNULL);
   2020 	(void) nfsm_strtom(nd, name, namelen);
   2021 	/* Get the new file's handle and attributes. */
   2022 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2023 	*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   2024 	*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2025 	NFSGETATTR_ATTRBIT(&attrbits);
   2026 	(void) nfsrv_putattrbit(nd, &attrbits);
   2027 	/* Get the directory's post-op attributes. */
   2028 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2029 	*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2030 	(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh, np->n_fhp->nfh_len, 0);
   2031 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2032 	*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2033 	(void) nfsrv_putattrbit(nd, &attrbits);
   2034 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2035 	if (error)
   2036 		return (error);
   2037 	NFSCL_INCRSEQID(owp->nfsow_seqid, nd);
   2038 	if (nd->nd_repstat == 0) {
   2039 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
   2040 		    6 * NFSX_UNSIGNED);
   2041 		stateid.seqid = *tl++;
   2042 		stateid.other[0] = *tl++;
   2043 		stateid.other[1] = *tl++;
   2044 		stateid.other[2] = *tl;
   2045 		rflags = fxdr_unsigned(u_int32_t, *(tl + 6));
   2046 		(void) nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
   2047 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   2048 		deleg = fxdr_unsigned(int, *tl);
   2049 		if (deleg == NFSV4OPEN_DELEGATEREAD ||
   2050 		    deleg == NFSV4OPEN_DELEGATEWRITE) {
   2051 			if (!(owp->nfsow_clp->nfsc_flags &
   2052 			      NFSCLFLAGS_FIRSTDELEG))
   2053 				owp->nfsow_clp->nfsc_flags |=
   2054 				  (NFSCLFLAGS_FIRSTDELEG | NFSCLFLAGS_GOTDELEG);
   2055 			MALLOC(dp, struct nfscldeleg *,
   2056 			    sizeof (struct nfscldeleg) + NFSX_V4FHMAX,
   2057 			    M_NFSCLDELEG, M_WAITOK);
   2058 			LIST_INIT(&dp->nfsdl_owner);
   2059 			LIST_INIT(&dp->nfsdl_lock);
   2060 			dp->nfsdl_clp = owp->nfsow_clp;
   2061 			newnfs_copyincred(cred, &dp->nfsdl_cred);
   2062 			nfscl_lockinit(&dp->nfsdl_rwlock);
   2063 			NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
   2064 			    NFSX_UNSIGNED);
   2065 			dp->nfsdl_stateid.seqid = *tl++;
   2066 			dp->nfsdl_stateid.other[0] = *tl++;
   2067 			dp->nfsdl_stateid.other[1] = *tl++;
   2068 			dp->nfsdl_stateid.other[2] = *tl++;
   2069 			ret = fxdr_unsigned(int, *tl);
   2070 			if (deleg == NFSV4OPEN_DELEGATEWRITE) {
   2071 				dp->nfsdl_flags = NFSCLDL_WRITE;
   2072 				/*
   2073 				 * Indicates how much the file can grow.
   2074 				 */
   2075 				NFSM_DISSECT(tl, u_int32_t *,
   2076 				    3 * NFSX_UNSIGNED);
   2077 				limitby = fxdr_unsigned(int, *tl++);
   2078 				switch (limitby) {
   2079 				case NFSV4OPEN_LIMITSIZE:
   2080 					dp->nfsdl_sizelimit = fxdr_hyper(tl);
   2081 					break;
   2082 				case NFSV4OPEN_LIMITBLOCKS:
   2083 					dp->nfsdl_sizelimit =
   2084 					    fxdr_unsigned(u_int64_t, *tl++);
   2085 					dp->nfsdl_sizelimit *=
   2086 					    fxdr_unsigned(u_int64_t, *tl);
   2087 					break;
   2088 				default:
   2089 					error = NFSERR_BADXDR;
   2090 					goto nfsmout;
   2091 				}
   2092 			} else {
   2093 				dp->nfsdl_flags = NFSCLDL_READ;
   2094 			}
   2095 			if (ret)
   2096 				dp->nfsdl_flags |= NFSCLDL_RECALL;
   2097 			error = nfsrv_dissectace(nd, &dp->nfsdl_ace, &ret,
   2098 			    &acesize, p);
   2099 			if (error)
   2100 				goto nfsmout;
   2101 		} else if (deleg != NFSV4OPEN_DELEGATENONE) {
   2102 			error = NFSERR_BADXDR;
   2103 			goto nfsmout;
   2104 		}
   2105 		error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   2106 		if (error)
   2107 			goto nfsmout;
   2108 		/* Get rid of the PutFH and Getattr status values. */
   2109 		NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
   2110 		/* Load the directory attributes. */
   2111 		error = nfsm_loadattr(nd, dnap);
   2112 		if (error)
   2113 			goto nfsmout;
   2114 		*dattrflagp = 1;
   2115 		if (dp != NULL && *attrflagp) {
   2116 			dp->nfsdl_change = nnap->na_filerev;
   2117 			dp->nfsdl_modtime = nnap->na_mtime;
   2118 			dp->nfsdl_flags |= NFSCLDL_MODTIMESET;
   2119 		}
   2120 		/*
   2121 		 * We can now complete the Open state.
   2122 		 */
   2123 		nfhp = *nfhpp;
   2124 		if (dp != NULL) {
   2125 			dp->nfsdl_fhlen = nfhp->nfh_len;
   2126 			NFSBCOPY(nfhp->nfh_fh, dp->nfsdl_fh, nfhp->nfh_len);
   2127 		}
   2128 		/*
   2129 		 * Get an Open structure that will be
   2130 		 * attached to the OpenOwner, acquired already.
   2131 		 */
   2132 		error = nfscl_open(dvp, nfhp->nfh_fh, nfhp->nfh_len,
   2133 		    (NFSV4OPEN_ACCESSWRITE | NFSV4OPEN_ACCESSREAD), 0,
   2134 		    cred, p, NULL, &op, &newone, NULL, 0);
   2135 		if (error)
   2136 			goto nfsmout;
   2137 		op->nfso_stateid = stateid;
   2138 		newnfs_copyincred(cred, &op->nfso_cred);
   2139 		if ((rflags & NFSV4OPEN_RESULTCONFIRM)) {
   2140 		    do {
   2141 			ret = nfsrpc_openconfirm(dvp, nfhp->nfh_fh,
   2142 			    nfhp->nfh_len, op, cred, p);
   2143 			if (ret == NFSERR_DELAY)
   2144 			    (void) nfs_catnap(PZERO, ret, "nfs_create");
   2145 		    } while (ret == NFSERR_DELAY);
   2146 		    error = ret;
   2147 		}
   2148 
   2149 		/*
   2150 		 * If the server is handing out delegations, but we didn't
   2151 		 * get one because an OpenConfirm was required, try the
   2152 		 * Open again, to get a delegation. This is a harmless no-op,
   2153 		 * from a server's point of view.
   2154 		 */
   2155 		if ((rflags & NFSV4OPEN_RESULTCONFIRM) &&
   2156 		    (owp->nfsow_clp->nfsc_flags & NFSCLFLAGS_GOTDELEG) &&
   2157 		    !error && dp == NULL) {
   2158 		    do {
   2159 			ret = nfsrpc_openrpc(VFSTONFS(vnode_mount(dvp)), dvp,
   2160 			    np->n_fhp->nfh_fh, np->n_fhp->nfh_len,
   2161 			    nfhp->nfh_fh, nfhp->nfh_len,
   2162 			    (NFSV4OPEN_ACCESSWRITE | NFSV4OPEN_ACCESSREAD), op,
   2163 			    name, namelen, &dp, 0, 0x0, cred, p, 0, 1);
   2164 			if (ret == NFSERR_DELAY)
   2165 			    (void) nfs_catnap(PZERO, ret, "nfs_crt2");
   2166 		    } while (ret == NFSERR_DELAY);
   2167 		    if (ret) {
   2168 			if (dp != NULL) {
   2169 				FREE((caddr_t)dp, M_NFSCLDELEG);
   2170 				dp = NULL;
   2171 			}
   2172 			if (ret == NFSERR_STALECLIENTID ||
   2173 			    ret == NFSERR_STALEDONTRECOVER ||
   2174 			    ret == NFSERR_BADSESSION)
   2175 				error = ret;
   2176 		    }
   2177 		}
   2178 		nfscl_openrelease(op, error, newone);
   2179 		*unlockedp = 1;
   2180 	}
   2181 	if (nd->nd_repstat != 0 && error == 0)
   2182 		error = nd->nd_repstat;
   2183 	if (error == NFSERR_STALECLIENTID || error == NFSERR_BADSESSION)
   2184 		nfscl_initiate_recovery(owp->nfsow_clp);
   2185 nfsmout:
   2186 	if (!error)
   2187 		*dpp = dp;
   2188 	else if (dp != NULL)
   2189 		FREE((caddr_t)dp, M_NFSCLDELEG);
   2190 	mbuf_freem(nd->nd_mrep);
   2191 	return (error);
   2192 }
   2193 
   2194 /*
   2195  * Nfs remove rpc
   2196  */
   2197 APPLESTATIC int
   2198 nfsrpc_remove(vnode_t dvp, char *name, int namelen, vnode_t vp,
   2199     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap, int *dattrflagp,
   2200     void *dstuff)
   2201 {
   2202 	u_int32_t *tl;
   2203 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2204 	struct nfsnode *np;
   2205 	struct nfsmount *nmp;
   2206 	nfsv4stateid_t dstateid;
   2207 	int error, ret = 0, i;
   2208 
   2209 	*dattrflagp = 0;
   2210 	if (namelen > NFS_MAXNAMLEN)
   2211 		return (ENAMETOOLONG);
   2212 	nmp = VFSTONFS(vnode_mount(dvp));
   2213 tryagain:
   2214 	if (NFSHASNFSV4(nmp) && ret == 0) {
   2215 		ret = nfscl_removedeleg(vp, p, &dstateid);
   2216 		if (ret == 1) {
   2217 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGREMOVE, vp);
   2218 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID +
   2219 			    NFSX_UNSIGNED);
   2220 			if (NFSHASNFSV4N(nmp))
   2221 				*tl++ = 0;
   2222 			else
   2223 				*tl++ = dstateid.seqid;
   2224 			*tl++ = dstateid.other[0];
   2225 			*tl++ = dstateid.other[1];
   2226 			*tl++ = dstateid.other[2];
   2227 			*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2228 			np = VTONFS(dvp);
   2229 			(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh,
   2230 			    np->n_fhp->nfh_len, 0);
   2231 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2232 			*tl = txdr_unsigned(NFSV4OP_REMOVE);
   2233 		}
   2234 	} else {
   2235 		ret = 0;
   2236 	}
   2237 	if (ret == 0)
   2238 		NFSCL_REQSTART(nd, NFSPROC_REMOVE, dvp);
   2239 	(void) nfsm_strtom(nd, name, namelen);
   2240 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2241 	if (error)
   2242 		return (error);
   2243 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
   2244 		/* For NFSv4, parse out any Delereturn replies. */
   2245 		if (ret > 0 && nd->nd_repstat != 0 &&
   2246 		    (nd->nd_flag & ND_NOMOREDATA)) {
   2247 			/*
   2248 			 * If the Delegreturn failed, try again without
   2249 			 * it. The server will Recall, as required.
   2250 			 */
   2251 			mbuf_freem(nd->nd_mrep);
   2252 			goto tryagain;
   2253 		}
   2254 		for (i = 0; i < (ret * 2); i++) {
   2255 			if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) ==
   2256 			    ND_NFSV4) {
   2257 			    NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2258 			    if (*(tl + 1))
   2259 				nd->nd_flag |= ND_NOMOREDATA;
   2260 			}
   2261 		}
   2262 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2263 	}
   2264 	if (nd->nd_repstat && !error)
   2265 		error = nd->nd_repstat;
   2266 nfsmout:
   2267 	mbuf_freem(nd->nd_mrep);
   2268 	return (error);
   2269 }
   2270 
   2271 /*
   2272  * Do an nfs rename rpc.
   2273  */
   2274 APPLESTATIC int
   2275 nfsrpc_rename(vnode_t fdvp, vnode_t fvp, char *fnameptr, int fnamelen,
   2276     vnode_t tdvp, vnode_t tvp, char *tnameptr, int tnamelen, struct ucred *cred,
   2277     NFSPROC_T *p, struct nfsvattr *fnap, struct nfsvattr *tnap,
   2278     int *fattrflagp, int *tattrflagp, void *fstuff, void *tstuff)
   2279 {
   2280 	u_int32_t *tl;
   2281 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2282 	struct nfsmount *nmp;
   2283 	struct nfsnode *np;
   2284 	nfsattrbit_t attrbits;
   2285 	nfsv4stateid_t fdstateid, tdstateid;
   2286 	int error = 0, ret = 0, gottd = 0, gotfd = 0, i;
   2287 
   2288 	*fattrflagp = 0;
   2289 	*tattrflagp = 0;
   2290 	nmp = VFSTONFS(vnode_mount(fdvp));
   2291 	if (fnamelen > NFS_MAXNAMLEN || tnamelen > NFS_MAXNAMLEN)
   2292 		return (ENAMETOOLONG);
   2293 tryagain:
   2294 	if (NFSHASNFSV4(nmp) && ret == 0) {
   2295 		ret = nfscl_renamedeleg(fvp, &fdstateid, &gotfd, tvp,
   2296 		    &tdstateid, &gottd, p);
   2297 		if (gotfd && gottd) {
   2298 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGRENAME2, fvp);
   2299 		} else if (gotfd) {
   2300 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGRENAME1, fvp);
   2301 		} else if (gottd) {
   2302 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGRENAME1, tvp);
   2303 		}
   2304 		if (gotfd) {
   2305 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
   2306 			if (NFSHASNFSV4N(nmp))
   2307 				*tl++ = 0;
   2308 			else
   2309 				*tl++ = fdstateid.seqid;
   2310 			*tl++ = fdstateid.other[0];
   2311 			*tl++ = fdstateid.other[1];
   2312 			*tl = fdstateid.other[2];
   2313 			if (gottd) {
   2314 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2315 				*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2316 				np = VTONFS(tvp);
   2317 				(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh,
   2318 				    np->n_fhp->nfh_len, 0);
   2319 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2320 				*tl = txdr_unsigned(NFSV4OP_DELEGRETURN);
   2321 			}
   2322 		}
   2323 		if (gottd) {
   2324 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
   2325 			if (NFSHASNFSV4N(nmp))
   2326 				*tl++ = 0;
   2327 			else
   2328 				*tl++ = tdstateid.seqid;
   2329 			*tl++ = tdstateid.other[0];
   2330 			*tl++ = tdstateid.other[1];
   2331 			*tl = tdstateid.other[2];
   2332 		}
   2333 		if (ret > 0) {
   2334 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2335 			*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2336 			np = VTONFS(fdvp);
   2337 			(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh,
   2338 			    np->n_fhp->nfh_len, 0);
   2339 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2340 			*tl = txdr_unsigned(NFSV4OP_SAVEFH);
   2341 		}
   2342 	} else {
   2343 		ret = 0;
   2344 	}
   2345 	if (ret == 0)
   2346 		NFSCL_REQSTART(nd, NFSPROC_RENAME, fdvp);
   2347 	if (nd->nd_flag & ND_NFSV4) {
   2348 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2349 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2350 		NFSWCCATTR_ATTRBIT(&attrbits);
   2351 		(void) nfsrv_putattrbit(nd, &attrbits);
   2352 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2353 		*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2354 		(void) nfsm_fhtom(nd, VTONFS(tdvp)->n_fhp->nfh_fh,
   2355 		    VTONFS(tdvp)->n_fhp->nfh_len, 0);
   2356 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2357 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2358 		(void) nfsrv_putattrbit(nd, &attrbits);
   2359 		nd->nd_flag |= ND_V4WCCATTR;
   2360 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2361 		*tl = txdr_unsigned(NFSV4OP_RENAME);
   2362 	}
   2363 	(void) nfsm_strtom(nd, fnameptr, fnamelen);
   2364 	if (!(nd->nd_flag & ND_NFSV4))
   2365 		(void) nfsm_fhtom(nd, VTONFS(tdvp)->n_fhp->nfh_fh,
   2366 			VTONFS(tdvp)->n_fhp->nfh_len, 0);
   2367 	(void) nfsm_strtom(nd, tnameptr, tnamelen);
   2368 	error = nfscl_request(nd, fdvp, p, cred, fstuff);
   2369 	if (error)
   2370 		return (error);
   2371 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
   2372 		/* For NFSv4, parse out any Delereturn replies. */
   2373 		if (ret > 0 && nd->nd_repstat != 0 &&
   2374 		    (nd->nd_flag & ND_NOMOREDATA)) {
   2375 			/*
   2376 			 * If the Delegreturn failed, try again without
   2377 			 * it. The server will Recall, as required.
   2378 			 */
   2379 			mbuf_freem(nd->nd_mrep);
   2380 			goto tryagain;
   2381 		}
   2382 		for (i = 0; i < (ret * 2); i++) {
   2383 			if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) ==
   2384 			    ND_NFSV4) {
   2385 			    NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2386 			    if (*(tl + 1)) {
   2387 				if (i == 0 && ret > 1) {
   2388 				    /*
   2389 				     * If the Delegreturn failed, try again
   2390 				     * without it. The server will Recall, as
   2391 				     * required.
   2392 				     * If ret > 1, the first iteration of this
   2393 				     * loop is the second DelegReturn result.
   2394 				     */
   2395 				    mbuf_freem(nd->nd_mrep);
   2396 				    goto tryagain;
   2397 				} else {
   2398 				    nd->nd_flag |= ND_NOMOREDATA;
   2399 				}
   2400 			    }
   2401 			}
   2402 		}
   2403 		/* Now, the first wcc attribute reply. */
   2404 		if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4) {
   2405 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2406 			if (*(tl + 1))
   2407 				nd->nd_flag |= ND_NOMOREDATA;
   2408 		}
   2409 		error = nfscl_wcc_data(nd, fdvp, fnap, fattrflagp, NULL,
   2410 		    fstuff);
   2411 		/* and the second wcc attribute reply. */
   2412 		if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4 &&
   2413 		    !error) {
   2414 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2415 			if (*(tl + 1))
   2416 				nd->nd_flag |= ND_NOMOREDATA;
   2417 		}
   2418 		if (!error)
   2419 			error = nfscl_wcc_data(nd, tdvp, tnap, tattrflagp,
   2420 			    NULL, tstuff);
   2421 	}
   2422 	if (nd->nd_repstat && !error)
   2423 		error = nd->nd_repstat;
   2424 nfsmout:
   2425 	mbuf_freem(nd->nd_mrep);
   2426 	return (error);
   2427 }
   2428 
   2429 /*
   2430  * nfs hard link create rpc
   2431  */
   2432 APPLESTATIC int
   2433 nfsrpc_link(vnode_t dvp, vnode_t vp, char *name, int namelen,
   2434     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
   2435     struct nfsvattr *nap, int *attrflagp, int *dattrflagp, void *dstuff)
   2436 {
   2437 	u_int32_t *tl;
   2438 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2439 	nfsattrbit_t attrbits;
   2440 	int error = 0;
   2441 
   2442 	*attrflagp = 0;
   2443 	*dattrflagp = 0;
   2444 	if (namelen > NFS_MAXNAMLEN)
   2445 		return (ENAMETOOLONG);
   2446 	NFSCL_REQSTART(nd, NFSPROC_LINK, vp);
   2447 	if (nd->nd_flag & ND_NFSV4) {
   2448 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2449 		*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2450 	}
   2451 	(void) nfsm_fhtom(nd, VTONFS(dvp)->n_fhp->nfh_fh,
   2452 		VTONFS(dvp)->n_fhp->nfh_len, 0);
   2453 	if (nd->nd_flag & ND_NFSV4) {
   2454 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2455 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2456 		NFSWCCATTR_ATTRBIT(&attrbits);
   2457 		(void) nfsrv_putattrbit(nd, &attrbits);
   2458 		nd->nd_flag |= ND_V4WCCATTR;
   2459 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2460 		*tl = txdr_unsigned(NFSV4OP_LINK);
   2461 	}
   2462 	(void) nfsm_strtom(nd, name, namelen);
   2463 	error = nfscl_request(nd, vp, p, cred, dstuff);
   2464 	if (error)
   2465 		return (error);
   2466 	if (nd->nd_flag & ND_NFSV3) {
   2467 		error = nfscl_postop_attr(nd, nap, attrflagp, dstuff);
   2468 		if (!error)
   2469 			error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp,
   2470 			    NULL, dstuff);
   2471 	} else if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4) {
   2472 		/*
   2473 		 * First, parse out the PutFH and Getattr result.
   2474 		 */
   2475 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2476 		if (!(*(tl + 1)))
   2477 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2478 		if (*(tl + 1))
   2479 			nd->nd_flag |= ND_NOMOREDATA;
   2480 		/*
   2481 		 * Get the pre-op attributes.
   2482 		 */
   2483 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2484 	}
   2485 	if (nd->nd_repstat && !error)
   2486 		error = nd->nd_repstat;
   2487 nfsmout:
   2488 	mbuf_freem(nd->nd_mrep);
   2489 	return (error);
   2490 }
   2491 
   2492 /*
   2493  * nfs symbolic link create rpc
   2494  */
   2495 APPLESTATIC int
   2496 nfsrpc_symlink(vnode_t dvp, char *name, int namelen, char *target,
   2497     struct vattr *vap, struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
   2498     struct nfsvattr *nnap, struct nfsfh **nfhpp, int *attrflagp,
   2499     int *dattrflagp, void *dstuff)
   2500 {
   2501 	u_int32_t *tl;
   2502 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2503 	struct nfsmount *nmp;
   2504 	int slen, error = 0;
   2505 
   2506 	*nfhpp = NULL;
   2507 	*attrflagp = 0;
   2508 	*dattrflagp = 0;
   2509 	nmp = VFSTONFS(vnode_mount(dvp));
   2510 	slen = strlen(target);
   2511 	if (slen > NFS_MAXPATHLEN || namelen > NFS_MAXNAMLEN)
   2512 		return (ENAMETOOLONG);
   2513 	NFSCL_REQSTART(nd, NFSPROC_SYMLINK, dvp);
   2514 	if (nd->nd_flag & ND_NFSV4) {
   2515 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2516 		*tl = txdr_unsigned(NFLNK);
   2517 		(void) nfsm_strtom(nd, target, slen);
   2518 	}
   2519 	(void) nfsm_strtom(nd, name, namelen);
   2520 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
   2521 		nfscl_fillsattr(nd, vap, dvp, 0, 0);
   2522 	if (!(nd->nd_flag & ND_NFSV4))
   2523 		(void) nfsm_strtom(nd, target, slen);
   2524 	if (nd->nd_flag & ND_NFSV2)
   2525 		nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZENEG1, 0);
   2526 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2527 	if (error)
   2528 		return (error);
   2529 	if (nd->nd_flag & ND_NFSV4)
   2530 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2531 	if ((nd->nd_flag & ND_NFSV3) && !error) {
   2532 		if (!nd->nd_repstat)
   2533 			error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   2534 		if (!error)
   2535 			error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp,
   2536 			    NULL, dstuff);
   2537 	}
   2538 	if (nd->nd_repstat && !error)
   2539 		error = nd->nd_repstat;
   2540 	mbuf_freem(nd->nd_mrep);
   2541 	/*
   2542 	 * Kludge: Map EEXIST => 0 assuming that it is a reply to a retry.
   2543 	 * Only do this if vfs.nfs.ignore_eexist is set.
   2544 	 * Never do this for NFSv4.1 or later minor versions, since sessions
   2545 	 * should guarantee "exactly once" RPC semantics.
   2546 	 */
   2547 	if (error == EEXIST && nfsignore_eexist != 0 && (!NFSHASNFSV4(nmp) ||
   2548 	    nmp->nm_minorvers == 0))
   2549 		error = 0;
   2550 	return (error);
   2551 }
   2552 
   2553 /*
   2554  * nfs make dir rpc
   2555  */
   2556 APPLESTATIC int
   2557 nfsrpc_mkdir(vnode_t dvp, char *name, int namelen, struct vattr *vap,
   2558     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
   2559     struct nfsvattr *nnap, struct nfsfh **nfhpp, int *attrflagp,
   2560     int *dattrflagp, void *dstuff)
   2561 {
   2562 	u_int32_t *tl;
   2563 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2564 	nfsattrbit_t attrbits;
   2565 	int error = 0;
   2566 	struct nfsfh *fhp;
   2567 	struct nfsmount *nmp;
   2568 
   2569 	*nfhpp = NULL;
   2570 	*attrflagp = 0;
   2571 	*dattrflagp = 0;
   2572 	nmp = VFSTONFS(vnode_mount(dvp));
   2573 	fhp = VTONFS(dvp)->n_fhp;
   2574 	if (namelen > NFS_MAXNAMLEN)
   2575 		return (ENAMETOOLONG);
   2576 	NFSCL_REQSTART(nd, NFSPROC_MKDIR, dvp);
   2577 	if (nd->nd_flag & ND_NFSV4) {
   2578 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2579 		*tl = txdr_unsigned(NFDIR);
   2580 	}
   2581 	(void) nfsm_strtom(nd, name, namelen);
   2582 	nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZENEG1, 0);
   2583 	if (nd->nd_flag & ND_NFSV4) {
   2584 		NFSGETATTR_ATTRBIT(&attrbits);
   2585 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2586 		*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   2587 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2588 		(void) nfsrv_putattrbit(nd, &attrbits);
   2589 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2590 		*tl = txdr_unsigned(NFSV4OP_PUTFH);
   2591 		(void) nfsm_fhtom(nd, fhp->nfh_fh, fhp->nfh_len, 0);
   2592 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2593 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2594 		(void) nfsrv_putattrbit(nd, &attrbits);
   2595 	}
   2596 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2597 	if (error)
   2598 		return (error);
   2599 	if (nd->nd_flag & ND_NFSV4)
   2600 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2601 	if (!nd->nd_repstat && !error) {
   2602 		if (nd->nd_flag & ND_NFSV4) {
   2603 			NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
   2604 			error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
   2605 		}
   2606 		if (!error)
   2607 			error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
   2608 		if (error == 0 && (nd->nd_flag & ND_NFSV4) != 0) {
   2609 			/* Get rid of the PutFH and Getattr status values. */
   2610 			NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
   2611 			/* Load the directory attributes. */
   2612 			error = nfsm_loadattr(nd, dnap);
   2613 			if (error == 0)
   2614 				*dattrflagp = 1;
   2615 		}
   2616 	}
   2617 	if ((nd->nd_flag & ND_NFSV3) && !error)
   2618 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2619 	if (nd->nd_repstat && !error)
   2620 		error = nd->nd_repstat;
   2621 nfsmout:
   2622 	mbuf_freem(nd->nd_mrep);
   2623 	/*
   2624 	 * Kludge: Map EEXIST => 0 assuming that it is a reply to a retry.
   2625 	 * Only do this if vfs.nfs.ignore_eexist is set.
   2626 	 * Never do this for NFSv4.1 or later minor versions, since sessions
   2627 	 * should guarantee "exactly once" RPC semantics.
   2628 	 */
   2629 	if (error == EEXIST && nfsignore_eexist != 0 && (!NFSHASNFSV4(nmp) ||
   2630 	    nmp->nm_minorvers == 0))
   2631 		error = 0;
   2632 	return (error);
   2633 }
   2634 
   2635 /*
   2636  * nfs remove directory call
   2637  */
   2638 APPLESTATIC int
   2639 nfsrpc_rmdir(vnode_t dvp, char *name, int namelen, struct ucred *cred,
   2640     NFSPROC_T *p, struct nfsvattr *dnap, int *dattrflagp, void *dstuff)
   2641 {
   2642 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2643 	int error = 0;
   2644 
   2645 	*dattrflagp = 0;
   2646 	if (namelen > NFS_MAXNAMLEN)
   2647 		return (ENAMETOOLONG);
   2648 	NFSCL_REQSTART(nd, NFSPROC_RMDIR, dvp);
   2649 	(void) nfsm_strtom(nd, name, namelen);
   2650 	error = nfscl_request(nd, dvp, p, cred, dstuff);
   2651 	if (error)
   2652 		return (error);
   2653 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
   2654 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
   2655 	if (nd->nd_repstat && !error)
   2656 		error = nd->nd_repstat;
   2657 	mbuf_freem(nd->nd_mrep);
   2658 	/*
   2659 	 * Kludge: Map ENOENT => 0 assuming that you have a reply to a retry.
   2660 	 */
   2661 	if (error == ENOENT)
   2662 		error = 0;
   2663 	return (error);
   2664 }
   2665 
   2666 /*
   2667  * Readdir rpc.
   2668  * Always returns with either uio_resid unchanged, if you are at the
   2669  * end of the directory, or uio_resid == 0, with all DIRBLKSIZ chunks
   2670  * filled in.
   2671  * I felt this would allow caching of directory blocks more easily
   2672  * than returning a pertially filled block.
   2673  * Directory offset cookies:
   2674  * Oh my, what to do with them...
   2675  * I can think of three ways to deal with them:
   2676  * 1 - have the layer above these RPCs maintain a map between logical
   2677  *     directory byte offsets and the NFS directory offset cookies
   2678  * 2 - pass the opaque directory offset cookies up into userland
   2679  *     and let the libc functions deal with them, via the system call
   2680  * 3 - return them to userland in the "struct dirent", so future versions
   2681  *     of libc can use them and do whatever is necessary to make things work
   2682  *     above these rpc calls, in the meantime
   2683  * For now, I do #3 by "hiding" the directory offset cookies after the
   2684  * d_name field in struct dirent. This is space inside d_reclen that
   2685  * will be ignored by anything that doesn't know about them.
   2686  * The directory offset cookies are filled in as the last 8 bytes of
   2687  * each directory entry, after d_name. Someday, the userland libc
   2688  * functions may be able to use these. In the meantime, it satisfies
   2689  * OpenBSD's requirements for cookies being returned.
   2690  * If expects the directory offset cookie for the read to be in uio_offset
   2691  * and returns the one for the next entry after this directory block in
   2692  * there, as well.
   2693  */
   2694 APPLESTATIC int
   2695 nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep,
   2696     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   2697     int *eofp, void *stuff)
   2698 {
   2699 	int len, left;
   2700 	struct dirent *dp = NULL;
   2701 	u_int32_t *tl;
   2702 	nfsquad_t cookie, ncookie;
   2703 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   2704 	struct nfsnode *dnp = VTONFS(vp);
   2705 	struct nfsvattr nfsva;
   2706 	struct nfsrv_descript nfsd, *nd = &nfsd;
   2707 	int error = 0, tlen, more_dirs = 1, blksiz = 0, bigenough = 1;
   2708 	int reqsize, tryformoredirs = 1, readsize, eof = 0, gotmnton = 0;
   2709 	long dotfileid, dotdotfileid = 0;
   2710 	u_int32_t fakefileno = 0xffffffff, rderr;
   2711 	char *cp;
   2712 	nfsattrbit_t attrbits, dattrbits;
   2713 	u_int32_t *tl2 = NULL;
   2714 	size_t tresid;
   2715 
   2716 	KASSERT(uiop->uio_iovcnt == 1 &&
   2717 	    (uio_uio_resid(uiop) & (DIRBLKSIZ - 1)) == 0,
   2718 	    ("nfs readdirrpc bad uio"));
   2719 
   2720 	/*
   2721 	 * There is no point in reading a lot more than uio_resid, however
   2722 	 * adding one additional DIRBLKSIZ makes sense. Since uio_resid
   2723 	 * and nm_readdirsize are both exact multiples of DIRBLKSIZ, this
   2724 	 * will never make readsize > nm_readdirsize.
   2725 	 */
   2726 	readsize = nmp->nm_readdirsize;
   2727 	if (readsize > uio_uio_resid(uiop))
   2728 		readsize = uio_uio_resid(uiop) + DIRBLKSIZ;
   2729 
   2730 	*attrflagp = 0;
   2731 	if (eofp)
   2732 		*eofp = 0;
   2733 	tresid = uio_uio_resid(uiop);
   2734 	cookie.lval[0] = cookiep->nfsuquad[0];
   2735 	cookie.lval[1] = cookiep->nfsuquad[1];
   2736 	nd->nd_mrep = NULL;
   2737 
   2738 	/*
   2739 	 * For NFSv4, first create the "." and ".." entries.
   2740 	 */
   2741 	if (NFSHASNFSV4(nmp)) {
   2742 		reqsize = 6 * NFSX_UNSIGNED;
   2743 		NFSGETATTR_ATTRBIT(&dattrbits);
   2744 		NFSZERO_ATTRBIT(&attrbits);
   2745 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FILEID);
   2746 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TYPE);
   2747 		if (NFSISSET_ATTRBIT(&dnp->n_vattr.na_suppattr,
   2748 		    NFSATTRBIT_MOUNTEDONFILEID)) {
   2749 			NFSSETBIT_ATTRBIT(&attrbits,
   2750 			    NFSATTRBIT_MOUNTEDONFILEID);
   2751 			gotmnton = 1;
   2752 		} else {
   2753 			/*
   2754 			 * Must fake it. Use the fileno, except when the
   2755 			 * fsid is != to that of the directory. For that
   2756 			 * case, generate a fake fileno that is not the same.
   2757 			 */
   2758 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FSID);
   2759 			gotmnton = 0;
   2760 		}
   2761 
   2762 		/*
   2763 		 * Joy, oh joy. For V4 we get to hand craft '.' and '..'.
   2764 		 */
   2765 		if (uiop->uio_offset == 0) {
   2766 			NFSCL_REQSTART(nd, NFSPROC_LOOKUPP, vp);
   2767 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2768 			*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   2769 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2770 			(void) nfsrv_putattrbit(nd, &attrbits);
   2771 			error = nfscl_request(nd, vp, p, cred, stuff);
   2772 			if (error)
   2773 			    return (error);
   2774 			dotfileid = 0;	/* Fake out the compiler. */
   2775 			if ((nd->nd_flag & ND_NOMOREDATA) == 0) {
   2776 			    error = nfsm_loadattr(nd, &nfsva);
   2777 			    if (error != 0)
   2778 				goto nfsmout;
   2779 			    dotfileid = nfsva.na_fileid;
   2780 			}
   2781 			if (nd->nd_repstat == 0) {
   2782 			    NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
   2783 			    len = fxdr_unsigned(int, *(tl + 4));
   2784 			    if (len > 0 && len <= NFSX_V4FHMAX)
   2785 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
   2786 			    else
   2787 				error = EPERM;
   2788 			    if (!error) {
   2789 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
   2790 				nfsva.na_mntonfileno = 0xffffffff;
   2791 				error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
   2792 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
   2793 				    NULL, NULL, NULL, p, cred);
   2794 				if (error) {
   2795 				    dotdotfileid = dotfileid;
   2796 				} else if (gotmnton) {
   2797 				    if (nfsva.na_mntonfileno != 0xffffffff)
   2798 					dotdotfileid = nfsva.na_mntonfileno;
   2799 				    else
   2800 					dotdotfileid = nfsva.na_fileid;
   2801 				} else if (nfsva.na_filesid[0] ==
   2802 				    dnp->n_vattr.na_filesid[0] &&
   2803 				    nfsva.na_filesid[1] ==
   2804 				    dnp->n_vattr.na_filesid[1]) {
   2805 				    dotdotfileid = nfsva.na_fileid;
   2806 				} else {
   2807 				    do {
   2808 					fakefileno--;
   2809 				    } while (fakefileno ==
   2810 					nfsva.na_fileid);
   2811 				    dotdotfileid = fakefileno;
   2812 				}
   2813 			    }
   2814 			} else if (nd->nd_repstat == NFSERR_NOENT) {
   2815 			    /*
   2816 			     * Lookupp returns NFSERR_NOENT when we are
   2817 			     * at the root, so just use the current dir.
   2818 			     */
   2819 			    nd->nd_repstat = 0;
   2820 			    dotdotfileid = dotfileid;
   2821 			} else {
   2822 			    error = nd->nd_repstat;
   2823 			}
   2824 			mbuf_freem(nd->nd_mrep);
   2825 			if (error)
   2826 			    return (error);
   2827 			nd->nd_mrep = NULL;
   2828 			dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
   2829 			dp->d_type = DT_DIR;
   2830 			dp->d_fileno = dotfileid;
   2831 			dp->d_namlen = 1;
   2832 			dp->d_name[0] = '.';
   2833 			dp->d_name[1] = '\0';
   2834 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
   2835 			/*
   2836 			 * Just make these offset cookie 0.
   2837 			 */
   2838 			tl = (u_int32_t *)&dp->d_name[4];
   2839 			*tl++ = 0;
   2840 			*tl = 0;
   2841 			blksiz += dp->d_reclen;
   2842 			uio_uio_resid_add(uiop, -(dp->d_reclen));
   2843 			uiop->uio_offset += dp->d_reclen;
   2844 			uio_iov_base_add(uiop, dp->d_reclen);
   2845 			uio_iov_len_add(uiop, -(dp->d_reclen));
   2846 			dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
   2847 			dp->d_type = DT_DIR;
   2848 			dp->d_fileno = dotdotfileid;
   2849 			dp->d_namlen = 2;
   2850 			dp->d_name[0] = '.';
   2851 			dp->d_name[1] = '.';
   2852 			dp->d_name[2] = '\0';
   2853 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
   2854 			/*
   2855 			 * Just make these offset cookie 0.
   2856 			 */
   2857 			tl = (u_int32_t *)&dp->d_name[4];
   2858 			*tl++ = 0;
   2859 			*tl = 0;
   2860 			blksiz += dp->d_reclen;
   2861 			uio_uio_resid_add(uiop, -(dp->d_reclen));
   2862 			uiop->uio_offset += dp->d_reclen;
   2863 			uio_iov_base_add(uiop, dp->d_reclen);
   2864 			uio_iov_len_add(uiop, -(dp->d_reclen));
   2865 		}
   2866 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_RDATTRERROR);
   2867 	} else {
   2868 		reqsize = 5 * NFSX_UNSIGNED;
   2869 	}
   2870 
   2871 
   2872 	/*
   2873 	 * Loop around doing readdir rpc's of size readsize.
   2874 	 * The stopping criteria is EOF or buffer full.
   2875 	 */
   2876 	while (more_dirs && bigenough) {
   2877 		*attrflagp = 0;
   2878 		NFSCL_REQSTART(nd, NFSPROC_READDIR, vp);
   2879 		if (nd->nd_flag & ND_NFSV2) {
   2880 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   2881 			*tl++ = cookie.lval[1];
   2882 			*tl = txdr_unsigned(readsize);
   2883 		} else {
   2884 			NFSM_BUILD(tl, u_int32_t *, reqsize);
   2885 			*tl++ = cookie.lval[0];
   2886 			*tl++ = cookie.lval[1];
   2887 			if (cookie.qval == 0) {
   2888 				*tl++ = 0;
   2889 				*tl++ = 0;
   2890 			} else {
   2891 				NFSLOCKNODE(dnp);
   2892 				*tl++ = dnp->n_cookieverf.nfsuquad[0];
   2893 				*tl++ = dnp->n_cookieverf.nfsuquad[1];
   2894 				NFSUNLOCKNODE(dnp);
   2895 			}
   2896 			if (nd->nd_flag & ND_NFSV4) {
   2897 				*tl++ = txdr_unsigned(readsize);
   2898 				*tl = txdr_unsigned(readsize);
   2899 				(void) nfsrv_putattrbit(nd, &attrbits);
   2900 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   2901 				*tl = txdr_unsigned(NFSV4OP_GETATTR);
   2902 				(void) nfsrv_putattrbit(nd, &dattrbits);
   2903 			} else {
   2904 				*tl = txdr_unsigned(readsize);
   2905 			}
   2906 		}
   2907 		error = nfscl_request(nd, vp, p, cred, stuff);
   2908 		if (error)
   2909 			return (error);
   2910 		if (!(nd->nd_flag & ND_NFSV2)) {
   2911 			if (nd->nd_flag & ND_NFSV3)
   2912 				error = nfscl_postop_attr(nd, nap, attrflagp,
   2913 				    stuff);
   2914 			if (!nd->nd_repstat && !error) {
   2915 				NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
   2916 				NFSLOCKNODE(dnp);
   2917 				dnp->n_cookieverf.nfsuquad[0] = *tl++;
   2918 				dnp->n_cookieverf.nfsuquad[1] = *tl;
   2919 				NFSUNLOCKNODE(dnp);
   2920 			}
   2921 		}
   2922 		if (nd->nd_repstat || error) {
   2923 			if (!error)
   2924 				error = nd->nd_repstat;
   2925 			goto nfsmout;
   2926 		}
   2927 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   2928 		more_dirs = fxdr_unsigned(int, *tl);
   2929 		if (!more_dirs)
   2930 			tryformoredirs = 0;
   2931 
   2932 		/* loop through the dir entries, doctoring them to 4bsd form */
   2933 		while (more_dirs && bigenough) {
   2934 			if (nd->nd_flag & ND_NFSV4) {
   2935 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   2936 				ncookie.lval[0] = *tl++;
   2937 				ncookie.lval[1] = *tl++;
   2938 				len = fxdr_unsigned(int, *tl);
   2939 			} else if (nd->nd_flag & ND_NFSV3) {
   2940 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   2941 				nfsva.na_fileid = fxdr_hyper(tl);
   2942 				tl += 2;
   2943 				len = fxdr_unsigned(int, *tl);
   2944 			} else {
   2945 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
   2946 				nfsva.na_fileid =
   2947 				    fxdr_unsigned(long, *tl++);
   2948 				len = fxdr_unsigned(int, *tl);
   2949 			}
   2950 			if (len <= 0 || len > NFS_MAXNAMLEN) {
   2951 				error = EBADRPC;
   2952 				goto nfsmout;
   2953 			}
   2954 			tlen = NFSM_RNDUP(len);
   2955 			if (tlen == len)
   2956 				tlen += 4;  /* To ensure null termination */
   2957 			left = DIRBLKSIZ - blksiz;
   2958 			if ((int)(tlen + DIRHDSIZ + NFSX_HYPER) > left) {
   2959 				dp->d_reclen += left;
   2960 				uio_iov_base_add(uiop, left);
   2961 				uio_iov_len_add(uiop, -(left));
   2962 				uio_uio_resid_add(uiop, -(left));
   2963 				uiop->uio_offset += left;
   2964 				blksiz = 0;
   2965 			}
   2966 			if ((int)(tlen + DIRHDSIZ + NFSX_HYPER) > uio_uio_resid(uiop))
   2967 				bigenough = 0;
   2968 			if (bigenough) {
   2969 				dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
   2970 				dp->d_namlen = len;
   2971 				dp->d_reclen = tlen + DIRHDSIZ + NFSX_HYPER;
   2972 				dp->d_type = DT_UNKNOWN;
   2973 				blksiz += dp->d_reclen;
   2974 				if (blksiz == DIRBLKSIZ)
   2975 					blksiz = 0;
   2976 				uio_uio_resid_add(uiop, -(DIRHDSIZ));
   2977 				uiop->uio_offset += DIRHDSIZ;
   2978 				uio_iov_base_add(uiop, DIRHDSIZ);
   2979 				uio_iov_len_add(uiop, -(DIRHDSIZ));
   2980 				error = nfsm_mbufuio(nd, uiop, len);
   2981 				if (error)
   2982 					goto nfsmout;
   2983 				cp = CAST_DOWN(caddr_t, uio_iov_base(uiop));
   2984 				tlen -= len;
   2985 				*cp = '\0';	/* null terminate */
   2986 				cp += tlen;	/* points to cookie storage */
   2987 				tl2 = (u_int32_t *)cp;
   2988 				uio_iov_base_add(uiop, (tlen + NFSX_HYPER));
   2989 				uio_iov_len_add(uiop, -(tlen + NFSX_HYPER));
   2990 				uio_uio_resid_add(uiop, -(tlen + NFSX_HYPER));
   2991 				uiop->uio_offset += (tlen + NFSX_HYPER);
   2992 			} else {
   2993 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
   2994 				if (error)
   2995 					goto nfsmout;
   2996 			}
   2997 			if (nd->nd_flag & ND_NFSV4) {
   2998 				rderr = 0;
   2999 				nfsva.na_mntonfileno = 0xffffffff;
   3000 				error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
   3001 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
   3002 				    NULL, NULL, &rderr, p, cred);
   3003 				if (error)
   3004 					goto nfsmout;
   3005 				NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   3006 			} else if (nd->nd_flag & ND_NFSV3) {
   3007 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   3008 				ncookie.lval[0] = *tl++;
   3009 				ncookie.lval[1] = *tl++;
   3010 			} else {
   3011 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
   3012 				ncookie.lval[0] = 0;
   3013 				ncookie.lval[1] = *tl++;
   3014 			}
   3015 			if (bigenough) {
   3016 			    if (nd->nd_flag & ND_NFSV4) {
   3017 				if (rderr) {
   3018 				    dp->d_fileno = 0;
   3019 				} else {
   3020 				    if (gotmnton) {
   3021 					if (nfsva.na_mntonfileno != 0xffffffff)
   3022 					    dp->d_fileno = nfsva.na_mntonfileno;
   3023 					else
   3024 					    dp->d_fileno = nfsva.na_fileid;
   3025 				    } else if (nfsva.na_filesid[0] ==
   3026 					dnp->n_vattr.na_filesid[0] &&
   3027 					nfsva.na_filesid[1] ==
   3028 					dnp->n_vattr.na_filesid[1]) {
   3029 					dp->d_fileno = nfsva.na_fileid;
   3030 				    } else {
   3031 					do {
   3032 					    fakefileno--;
   3033 					} while (fakefileno ==
   3034 					    nfsva.na_fileid);
   3035 					dp->d_fileno = fakefileno;
   3036 				    }
   3037 				    dp->d_type = vtonfs_dtype(nfsva.na_type);
   3038 				}
   3039 			    } else {
   3040 				dp->d_fileno = nfsva.na_fileid;
   3041 			    }
   3042 			    *tl2++ = cookiep->nfsuquad[0] = cookie.lval[0] =
   3043 				ncookie.lval[0];
   3044 			    *tl2 = cookiep->nfsuquad[1] = cookie.lval[1] =
   3045 				ncookie.lval[1];
   3046 			}
   3047 			more_dirs = fxdr_unsigned(int, *tl);
   3048 		}
   3049 		/*
   3050 		 * If at end of rpc data, get the eof boolean
   3051 		 */
   3052 		if (!more_dirs) {
   3053 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   3054 			eof = fxdr_unsigned(int, *tl);
   3055 			if (tryformoredirs)
   3056 				more_dirs = !eof;
   3057 			if (nd->nd_flag & ND_NFSV4) {
   3058 				error = nfscl_postop_attr(nd, nap, attrflagp,
   3059 				    stuff);
   3060 				if (error)
   3061 					goto nfsmout;
   3062 			}
   3063 		}
   3064 		mbuf_freem(nd->nd_mrep);
   3065 		nd->nd_mrep = NULL;
   3066 	}
   3067 	/*
   3068 	 * Fill last record, iff any, out to a multiple of DIRBLKSIZ
   3069 	 * by increasing d_reclen for the last record.
   3070 	 */
   3071 	if (blksiz > 0) {
   3072 		left = DIRBLKSIZ - blksiz;
   3073 		dp->d_reclen += left;
   3074 		uio_iov_base_add(uiop, left);
   3075 		uio_iov_len_add(uiop, -(left));
   3076 		uio_uio_resid_add(uiop, -(left));
   3077 		uiop->uio_offset += left;
   3078 	}
   3079 
   3080 	/*
   3081 	 * If returning no data, assume end of file.
   3082 	 * If not bigenough, return not end of file, since you aren't
   3083 	 *    returning all the data
   3084 	 * Otherwise, return the eof flag from the server.
   3085 	 */
   3086 	if (eofp) {
   3087 		if (tresid == ((size_t)(uio_uio_resid(uiop))))
   3088 			*eofp = 1;
   3089 		else if (!bigenough)
   3090 			*eofp = 0;
   3091 		else
   3092 			*eofp = eof;
   3093 	}
   3094 
   3095 	/*
   3096 	 * Add extra empty records to any remaining DIRBLKSIZ chunks.
   3097 	 */
   3098 	while (uio_uio_resid(uiop) > 0 && ((size_t)(uio_uio_resid(uiop))) != tresid) {
   3099 		dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
   3100 		dp->d_type = DT_UNKNOWN;
   3101 		dp->d_fileno = 0;
   3102 		dp->d_namlen = 0;
   3103 		dp->d_name[0] = '\0';
   3104 		tl = (u_int32_t *)&dp->d_name[4];
   3105 		*tl++ = cookie.lval[0];
   3106 		*tl = cookie.lval[1];
   3107 		dp->d_reclen = DIRBLKSIZ;
   3108 		uio_iov_base_add(uiop, DIRBLKSIZ);
   3109 		uio_iov_len_add(uiop, -(DIRBLKSIZ));
   3110 		uio_uio_resid_add(uiop, -(DIRBLKSIZ));
   3111 		uiop->uio_offset += DIRBLKSIZ;
   3112 	}
   3113 
   3114 nfsmout:
   3115 	if (nd->nd_mrep != NULL)
   3116 		mbuf_freem(nd->nd_mrep);
   3117 	return (error);
   3118 }
   3119 
   3120 #ifndef APPLE
   3121 /*
   3122  * NFS V3 readdir plus RPC. Used in place of nfsrpc_readdir().
   3123  * (Also used for NFS V4 when mount flag set.)
   3124  * (ditto above w.r.t. multiple of DIRBLKSIZ, etc.)
   3125  */
   3126 APPLESTATIC int
   3127 nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep,
   3128     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   3129     int *eofp, void *stuff)
   3130 {
   3131 	int len, left;
   3132 	struct dirent *dp = NULL;
   3133 	u_int32_t *tl;
   3134 	vnode_t newvp = NULLVP;
   3135 	struct nfsrv_descript nfsd, *nd = &nfsd;
   3136 	struct nameidata nami, *ndp = &nami;
   3137 	struct componentname *cnp = &ndp->ni_cnd;
   3138 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   3139 	struct nfsnode *dnp = VTONFS(vp), *np;
   3140 	struct nfsvattr nfsva;
   3141 	struct nfsfh *nfhp;
   3142 	nfsquad_t cookie, ncookie;
   3143 	int error = 0, tlen, more_dirs = 1, blksiz = 0, bigenough = 1;
   3144 	int attrflag, tryformoredirs = 1, eof = 0, gotmnton = 0;
   3145 	int isdotdot = 0, unlocknewvp = 0;
   3146 	long dotfileid, dotdotfileid = 0, fileno = 0;
   3147 	char *cp;
   3148 	nfsattrbit_t attrbits, dattrbits;
   3149 	size_t tresid;
   3150 	u_int32_t *tl2 = NULL, fakefileno = 0xffffffff, rderr;
   3151 	struct timespec dctime;
   3152 
   3153 	KASSERT(uiop->uio_iovcnt == 1 &&
   3154 	    (uio_uio_resid(uiop) & (DIRBLKSIZ - 1)) == 0,
   3155 	    ("nfs readdirplusrpc bad uio"));
   3156 	timespecclear(&dctime);
   3157 	*attrflagp = 0;
   3158 	if (eofp != NULL)
   3159 		*eofp = 0;
   3160 	ndp->ni_dvp = vp;
   3161 	nd->nd_mrep = NULL;
   3162 	cookie.lval[0] = cookiep->nfsuquad[0];
   3163 	cookie.lval[1] = cookiep->nfsuquad[1];
   3164 	tresid = uio_uio_resid(uiop);
   3165 
   3166 	/*
   3167 	 * For NFSv4, first create the "." and ".." entries.
   3168 	 */
   3169 	if (NFSHASNFSV4(nmp)) {
   3170 		NFSGETATTR_ATTRBIT(&dattrbits);
   3171 		NFSZERO_ATTRBIT(&attrbits);
   3172 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FILEID);
   3173 		if (NFSISSET_ATTRBIT(&dnp->n_vattr.na_suppattr,
   3174 		    NFSATTRBIT_MOUNTEDONFILEID)) {
   3175 			NFSSETBIT_ATTRBIT(&attrbits,
   3176 			    NFSATTRBIT_MOUNTEDONFILEID);
   3177 			gotmnton = 1;
   3178 		} else {
   3179 			/*
   3180 			 * Must fake it. Use the fileno, except when the
   3181 			 * fsid is != to that of the directory. For that
   3182 			 * case, generate a fake fileno that is not the same.
   3183 			 */
   3184 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FSID);
   3185 			gotmnton = 0;
   3186 		}
   3187 
   3188 		/*
   3189 		 * Joy, oh joy. For V4 we get to hand craft '.' and '..'.
   3190 		 */
   3191 		if (uiop->uio_offset == 0) {
   3192 			NFSCL_REQSTART(nd, NFSPROC_LOOKUPP, vp);
   3193 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   3194 			*tl++ = txdr_unsigned(NFSV4OP_GETFH);
   3195 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
   3196 			(void) nfsrv_putattrbit(nd, &attrbits);
   3197 			error = nfscl_request(nd, vp, p, cred, stuff);
   3198 			if (error)
   3199 			    return (error);
   3200 			dotfileid = 0;	/* Fake out the compiler. */
   3201 			if ((nd->nd_flag & ND_NOMOREDATA) == 0) {
   3202 			    error = nfsm_loadattr(nd, &nfsva);
   3203 			    if (error != 0)
   3204 				goto nfsmout;
   3205 			    dctime = nfsva.na_ctime;
   3206 			    dotfileid = nfsva.na_fileid;
   3207 			}
   3208 			if (nd->nd_repstat == 0) {
   3209 			    NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
   3210 			    len = fxdr_unsigned(int, *(tl + 4));
   3211 			    if (len > 0 && len <= NFSX_V4FHMAX)
   3212 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
   3213 			    else
   3214 				error = EPERM;
   3215 			    if (!error) {
   3216 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
   3217 				nfsva.na_mntonfileno = 0xffffffff;
   3218 				error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
   3219 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
   3220 				    NULL, NULL, NULL, p, cred);
   3221 				if (error) {
   3222 				    dotdotfileid = dotfileid;
   3223 				} else if (gotmnton) {
   3224 				    if (nfsva.na_mntonfileno != 0xffffffff)
   3225 					dotdotfileid = nfsva.na_mntonfileno;
   3226 				    else
   3227 					dotdotfileid = nfsva.na_fileid;
   3228 				} else if (nfsva.na_filesid[0] ==
   3229 				    dnp->n_vattr.na_filesid[0] &&
   3230 				    nfsva.na_filesid[1] ==
   3231 				    dnp->n_vattr.na_filesid[1]) {
   3232 				    dotdotfileid = nfsva.na_fileid;
   3233 				} else {
   3234 				    do {
   3235 					fakefileno--;
   3236 				    } while (fakefileno ==
   3237 					nfsva.na_fileid);
   3238 				    dotdotfileid = fakefileno;
   3239 				}
   3240 			    }
   3241 			} else if (nd->nd_repstat == NFSERR_NOENT) {
   3242 			    /*
   3243 			     * Lookupp returns NFSERR_NOENT when we are
   3244 			     * at the root, so just use the current dir.
   3245 			     */
   3246 			    nd->nd_repstat = 0;
   3247 			    dotdotfileid = dotfileid;
   3248 			} else {
   3249 			    error = nd->nd_repstat;
   3250 			}
   3251 			mbuf_freem(nd->nd_mrep);
   3252 			if (error)
   3253 			    return (error);
   3254 			nd->nd_mrep = NULL;
   3255 			dp = (struct dirent *)uio_iov_base(uiop);
   3256 			dp->d_type = DT_DIR;
   3257 			dp->d_fileno = dotfileid;
   3258 			dp->d_namlen = 1;
   3259 			dp->d_name[0] = '.';
   3260 			dp->d_name[1] = '\0';
   3261 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
   3262 			/*
   3263 			 * Just make these offset cookie 0.
   3264 			 */
   3265 			tl = (u_int32_t *)&dp->d_name[4];
   3266 			*tl++ = 0;
   3267 			*tl = 0;
   3268 			blksiz += dp->d_reclen;
   3269 			uio_uio_resid_add(uiop, -(dp->d_reclen));
   3270 			uiop->uio_offset += dp->d_reclen;
   3271 			uio_iov_base_add(uiop, dp->d_reclen);
   3272 			uio_iov_len_add(uiop, -(dp->d_reclen));
   3273 			dp = (struct dirent *)uio_iov_base(uiop);
   3274 			dp->d_type = DT_DIR;
   3275 			dp->d_fileno = dotdotfileid;
   3276 			dp->d_namlen = 2;
   3277 			dp->d_name[0] = '.';
   3278 			dp->d_name[1] = '.';
   3279 			dp->d_name[2] = '\0';
   3280 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
   3281 			/*
   3282 			 * Just make these offset cookie 0.
   3283 			 */
   3284 			tl = (u_int32_t *)&dp->d_name[4];
   3285 			*tl++ = 0;
   3286 			*tl = 0;
   3287 			blksiz += dp->d_reclen;
   3288 			uio_uio_resid_add(uiop, -(dp->d_reclen));
   3289 			uiop->uio_offset += dp->d_reclen;
   3290 			uio_iov_base_add(uiop, dp->d_reclen);
   3291 			uio_iov_len_add(uiop, -(dp->d_reclen));
   3292 		}
   3293 		NFSREADDIRPLUS_ATTRBIT(&attrbits);
   3294 		if (gotmnton)
   3295 			NFSSETBIT_ATTRBIT(&attrbits,
   3296 			    NFSATTRBIT_MOUNTEDONFILEID);
   3297 	}
   3298 
   3299 	/*
   3300 	 * Loop around doing readdir rpc's of size nm_readdirsize.
   3301 	 * The stopping criteria is EOF or buffer full.
   3302 	 */
   3303 	while (more_dirs && bigenough) {
   3304 		*attrflagp = 0;
   3305 		NFSCL_REQSTART(nd, NFSPROC_READDIRPLUS, vp);
   3306  		NFSM_BUILD(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
   3307 		*tl++ = cookie.lval[0];
   3308 		*tl++ = cookie.lval[1];
   3309 		if (cookie.qval == 0) {
   3310 			*tl++ = 0;
   3311 			*tl++ = 0;
   3312 		} else {
   3313 			NFSLOCKNODE(dnp);
   3314 			*tl++ = dnp->n_cookieverf.nfsuquad[0];
   3315 			*tl++ = dnp->n_cookieverf.nfsuquad[1];
   3316 			NFSUNLOCKNODE(dnp);
   3317 		}
   3318 		*tl++ = txdr_unsigned(nmp->nm_readdirsize);
   3319 		*tl = txdr_unsigned(nmp->nm_readdirsize);
   3320 		if (nd->nd_flag & ND_NFSV4) {
   3321 			(void) nfsrv_putattrbit(nd, &attrbits);
   3322 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   3323 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
   3324 			(void) nfsrv_putattrbit(nd, &dattrbits);
   3325 		}
   3326 		error = nfscl_request(nd, vp, p, cred, stuff);
   3327 		if (error)
   3328 			return (error);
   3329 		if (nd->nd_flag & ND_NFSV3)
   3330 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   3331 		if (nd->nd_repstat || error) {
   3332 			if (!error)
   3333 				error = nd->nd_repstat;
   3334 			goto nfsmout;
   3335 		}
   3336 		if ((nd->nd_flag & ND_NFSV3) != 0 && *attrflagp != 0)
   3337 			dctime = nap->na_ctime;
   3338 		NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
   3339 		NFSLOCKNODE(dnp);
   3340 		dnp->n_cookieverf.nfsuquad[0] = *tl++;
   3341 		dnp->n_cookieverf.nfsuquad[1] = *tl++;
   3342 		NFSUNLOCKNODE(dnp);
   3343 		more_dirs = fxdr_unsigned(int, *tl);
   3344 		if (!more_dirs)
   3345 			tryformoredirs = 0;
   3346 
   3347 		/* loop through the dir entries, doctoring them to 4bsd form */
   3348 		while (more_dirs && bigenough) {
   3349 			NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
   3350 			if (nd->nd_flag & ND_NFSV4) {
   3351 				ncookie.lval[0] = *tl++;
   3352 				ncookie.lval[1] = *tl++;
   3353 			} else {
   3354 				fileno = fxdr_unsigned(long, *++tl);
   3355 				tl++;
   3356 			}
   3357 			len = fxdr_unsigned(int, *tl);
   3358 			if (len <= 0 || len > NFS_MAXNAMLEN) {
   3359 				error = EBADRPC;
   3360 				goto nfsmout;
   3361 			}
   3362 			tlen = NFSM_RNDUP(len);
   3363 			if (tlen == len)
   3364 				tlen += 4;  /* To ensure null termination */
   3365 			left = DIRBLKSIZ - blksiz;
   3366 			if ((tlen + DIRHDSIZ + NFSX_HYPER) > left) {
   3367 				dp->d_reclen += left;
   3368 				uio_iov_base_add(uiop, left);
   3369 				uio_iov_len_add(uiop, -(left));
   3370 				uio_uio_resid_add(uiop, -(left));
   3371 				uiop->uio_offset += left;
   3372 				blksiz = 0;
   3373 			}
   3374 			if ((tlen + DIRHDSIZ + NFSX_HYPER) > uio_uio_resid(uiop))
   3375 				bigenough = 0;
   3376 			if (bigenough) {
   3377 				dp = (struct dirent *)uio_iov_base(uiop);
   3378 				dp->d_namlen = len;
   3379 				dp->d_reclen = tlen + DIRHDSIZ + NFSX_HYPER;
   3380 				dp->d_type = DT_UNKNOWN;
   3381 				blksiz += dp->d_reclen;
   3382 				if (blksiz == DIRBLKSIZ)
   3383 					blksiz = 0;
   3384 				uio_uio_resid_add(uiop, -(DIRHDSIZ));
   3385 				uiop->uio_offset += DIRHDSIZ;
   3386 				uio_iov_base_add(uiop, DIRHDSIZ);
   3387 				uio_iov_len_add(uiop, -(DIRHDSIZ));
   3388 				cnp->cn_nameptr = uio_iov_base(uiop);
   3389 				cnp->cn_namelen = len;
   3390 				NFSCNHASHZERO(cnp);
   3391 				error = nfsm_mbufuio(nd, uiop, len);
   3392 				if (error)
   3393 					goto nfsmout;
   3394 				cp = uio_iov_base(uiop);
   3395 				tlen -= len;
   3396 				*cp = '\0';
   3397 				cp += tlen;	/* points to cookie storage */
   3398 				tl2 = (u_int32_t *)cp;
   3399 				if (len == 2 && cnp->cn_nameptr[0] == '.' &&
   3400 				    cnp->cn_nameptr[1] == '.')
   3401 					isdotdot = 1;
   3402 				else
   3403 					isdotdot = 0;
   3404 				uio_iov_base_add(uiop, (tlen + NFSX_HYPER));
   3405 				uio_iov_len_add(uiop, -(tlen + NFSX_HYPER));
   3406 				uio_uio_resid_add(uiop, -(tlen + NFSX_HYPER));
   3407 				uiop->uio_offset += (tlen + NFSX_HYPER);
   3408 			} else {
   3409 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
   3410 				if (error)
   3411 					goto nfsmout;
   3412 			}
   3413 			nfhp = NULL;
   3414 			if (nd->nd_flag & ND_NFSV3) {
   3415 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
   3416 				ncookie.lval[0] = *tl++;
   3417 				ncookie.lval[1] = *tl++;
   3418 				attrflag = fxdr_unsigned(int, *tl);
   3419 				if (attrflag) {
   3420 				  error = nfsm_loadattr(nd, &nfsva);
   3421 				  if (error)
   3422 					goto nfsmout;
   3423 				}
   3424 				NFSM_DISSECT(tl,u_int32_t *,NFSX_UNSIGNED);
   3425 				if (*tl) {
   3426 					error = nfsm_getfh(nd, &nfhp);
   3427 					if (error)
   3428 					    goto nfsmout;
   3429 				}
   3430 				if (!attrflag && nfhp != NULL) {
   3431 					FREE((caddr_t)nfhp, M_NFSFH);
   3432 					nfhp = NULL;
   3433 				}
   3434 			} else {
   3435 				rderr = 0;
   3436 				nfsva.na_mntonfileno = 0xffffffff;
   3437 				error = nfsv4_loadattr(nd, NULL, &nfsva, &nfhp,
   3438 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
   3439 				    NULL, NULL, &rderr, p, cred);
   3440 				if (error)
   3441 					goto nfsmout;
   3442 			}
   3443 
   3444 			if (bigenough) {
   3445 			    if (nd->nd_flag & ND_NFSV4) {
   3446 				if (rderr) {
   3447 				    dp->d_fileno = 0;
   3448 				} else if (gotmnton) {
   3449 				    if (nfsva.na_mntonfileno != 0xffffffff)
   3450 					dp->d_fileno = nfsva.na_mntonfileno;
   3451 				    else
   3452 					dp->d_fileno = nfsva.na_fileid;
   3453 				} else if (nfsva.na_filesid[0] ==
   3454 				    dnp->n_vattr.na_filesid[0] &&
   3455 				    nfsva.na_filesid[1] ==
   3456 				    dnp->n_vattr.na_filesid[1]) {
   3457 				    dp->d_fileno = nfsva.na_fileid;
   3458 				} else {
   3459 				    do {
   3460 					fakefileno--;
   3461 				    } while (fakefileno ==
   3462 					nfsva.na_fileid);
   3463 				    dp->d_fileno = fakefileno;
   3464 				}
   3465 			    } else {
   3466 				dp->d_fileno = fileno;
   3467 			    }
   3468 			    *tl2++ = cookiep->nfsuquad[0] = cookie.lval[0] =
   3469 				ncookie.lval[0];
   3470 			    *tl2 = cookiep->nfsuquad[1] = cookie.lval[1] =
   3471 				ncookie.lval[1];
   3472 
   3473 			    if (nfhp != NULL) {
   3474 				if (NFSRV_CMPFH(nfhp->nfh_fh, nfhp->nfh_len,
   3475 				    dnp->n_fhp->nfh_fh, dnp->n_fhp->nfh_len)) {
   3476 				    VREF(vp);
   3477 				    newvp = vp;
   3478 				    unlocknewvp = 0;
   3479 				    FREE((caddr_t)nfhp, M_NFSFH);
   3480 				    np = dnp;
   3481 				} else if (isdotdot != 0) {
   3482 				    /*
   3483 				     * Skip doing a nfscl_nget() call for "..".
   3484 				     * There's a race between acquiring the nfs
   3485 				     * node here and lookups that look for the
   3486 				     * directory being read (in the parent).
   3487 				     * It would try to get a lock on ".." here,
   3488 				     * owning the lock on the directory being
   3489 				     * read. Lookup will hold the lock on ".."
   3490 				     * and try to acquire the lock on the
   3491 				     * directory being read.
   3492 				     * If the directory is unlocked/relocked,
   3493 				     * then there is a LOR with the buflock
   3494 				     * vp is relocked.
   3495 				     */
   3496 				    free(nfhp, M_NFSFH);
   3497 				} else {
   3498 				    error = nfscl_nget(vnode_mount(vp), vp,
   3499 				      nfhp, cnp, p, &np, NULL, LK_EXCLUSIVE);
   3500 				    if (!error) {
   3501 					newvp = NFSTOV(np);
   3502 					unlocknewvp = 1;
   3503 				    }
   3504 				}
   3505 				nfhp = NULL;
   3506 				if (newvp != NULLVP) {
   3507 				    error = nfscl_loadattrcache(&newvp,
   3508 					&nfsva, NULL, NULL, 0, 0);
   3509 				    if (error) {
   3510 					if (unlocknewvp)
   3511 					    vput(newvp);
   3512 					else
   3513 					    vrele(newvp);
   3514 					goto nfsmout;
   3515 				    }
   3516 				    dp->d_type =
   3517 					vtonfs_dtype(np->n_vattr.na_type);
   3518 				    ndp->ni_vp = newvp;
   3519 				    NFSCNHASH(cnp, HASHINIT);
   3520 				    if (cnp->cn_namelen <= NCHNAMLEN &&
   3521 					(newvp->v_type != VDIR ||
   3522 					 dctime.tv_sec != 0)) {
   3523 					cache_enter_time(ndp->ni_dvp,
   3524 					    ndp->ni_vp, cnp,
   3525 					    &nfsva.na_ctime,
   3526 					    newvp->v_type != VDIR ? NULL :
   3527 					    &dctime);
   3528 				    }
   3529 				    if (unlocknewvp)
   3530 					vput(newvp);
   3531 				    else
   3532 					vrele(newvp);
   3533 				    newvp = NULLVP;
   3534 				}
   3535 			    }
   3536 			} else if (nfhp != NULL) {
   3537 			    FREE((caddr_t)nfhp, M_NFSFH);
   3538 			}
   3539 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   3540 			more_dirs = fxdr_unsigned(int, *tl);
   3541 		}
   3542 		/*
   3543 		 * If at end of rpc data, get the eof boolean
   3544 		 */
   3545 		if (!more_dirs) {
   3546 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
   3547 			eof = fxdr_unsigned(int, *tl);
   3548 			if (tryformoredirs)
   3549 				more_dirs = !eof;
   3550 			if (nd->nd_flag & ND_NFSV4) {
   3551 				error = nfscl_postop_attr(nd, nap, attrflagp,
   3552 				    stuff);
   3553 				if (error)
   3554 					goto nfsmout;
   3555 			}
   3556 		}
   3557 		mbuf_freem(nd->nd_mrep);
   3558 		nd->nd_mrep = NULL;
   3559 	}
   3560 	/*
   3561 	 * Fill last record, iff any, out to a multiple of DIRBLKSIZ
   3562 	 * by increasing d_reclen for the last record.
   3563 	 */
   3564 	if (blksiz > 0) {
   3565 		left = DIRBLKSIZ - blksiz;
   3566 		dp->d_reclen += left;
   3567 		uio_iov_base_add(uiop, left);
   3568 		uio_iov_len_add(uiop, -(left));
   3569 		uio_uio_resid_add(uiop, -(left));
   3570 		uiop->uio_offset += left;
   3571 	}
   3572 
   3573 	/*
   3574 	 * If returning no data, assume end of file.
   3575 	 * If not bigenough, return not end of file, since you aren't
   3576 	 *    returning all the data
   3577 	 * Otherwise, return the eof flag from the server.
   3578 	 */
   3579 	if (eofp != NULL) {
   3580 		if (tresid == uio_uio_resid(uiop))
   3581 			*eofp = 1;
   3582 		else if (!bigenough)
   3583 			*eofp = 0;
   3584 		else
   3585 			*eofp = eof;
   3586 	}
   3587 
   3588 	/*
   3589 	 * Add extra empty records to any remaining DIRBLKSIZ chunks.
   3590 	 */
   3591 	while (uio_uio_resid(uiop) > 0 && uio_uio_resid(uiop) != tresid) {
   3592 		dp = (struct dirent *)uio_iov_base(uiop);
   3593 		dp->d_type = DT_UNKNOWN;
   3594 		dp->d_fileno = 0;
   3595 		dp->d_namlen = 0;
   3596 		dp->d_name[0] = '\0';
   3597 		tl = (u_int32_t *)&dp->d_name[4];
   3598 		*tl++ = cookie.lval[0];
   3599 		*tl = cookie.lval[1];
   3600 		dp->d_reclen = DIRBLKSIZ;
   3601 		uio_iov_base_add(uiop, DIRBLKSIZ);
   3602 		uio_iov_len_add(uiop, -(DIRBLKSIZ));
   3603 		uio_uio_resid_add(uiop, -(DIRBLKSIZ));
   3604 		uiop->uio_offset += DIRBLKSIZ;
   3605 	}
   3606 
   3607 nfsmout:
   3608 	if (nd->nd_mrep != NULL)
   3609 		mbuf_freem(nd->nd_mrep);
   3610 	return (error);
   3611 }
   3612 #endif	/* !APPLE */
   3613 
   3614 /*
   3615  * Nfs commit rpc
   3616  */
   3617 APPLESTATIC int
   3618 nfsrpc_commit(vnode_t vp, u_quad_t offset, int cnt, struct ucred *cred,
   3619     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   3620 {
   3621 	u_int32_t *tl;
   3622 	struct nfsrv_descript nfsd, *nd = &nfsd;
   3623 	nfsattrbit_t attrbits;
   3624 	int error;
   3625 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   3626 
   3627 	*attrflagp = 0;
   3628 	NFSCL_REQSTART(nd, NFSPROC_COMMIT, vp);
   3629 	NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
   3630 	txdr_hyper(offset, tl);
   3631 	tl += 2;
   3632 	*tl = txdr_unsigned(cnt);
   3633 	if (nd->nd_flag & ND_NFSV4) {
   3634 		/*
   3635 		 * And do a Getattr op.
   3636 		 */
   3637 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   3638 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
   3639 		NFSGETATTR_ATTRBIT(&attrbits);
   3640 		(void) nfsrv_putattrbit(nd, &attrbits);
   3641 	}
   3642 	error = nfscl_request(nd, vp, p, cred, stuff);
   3643 	if (error)
   3644 		return (error);
   3645 	error = nfscl_wcc_data(nd, vp, nap, attrflagp, NULL, stuff);
   3646 	if (!error && !nd->nd_repstat) {
   3647 		NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
   3648 		NFSLOCKMNT(nmp);
   3649 		if (NFSBCMP(nmp->nm_verf, tl, NFSX_VERF)) {
   3650 			NFSBCOPY(tl, nmp->nm_verf, NFSX_VERF);
   3651 			nd->nd_repstat = NFSERR_STALEWRITEVERF;
   3652 		}
   3653 		NFSUNLOCKMNT(nmp);
   3654 		if (nd->nd_flag & ND_NFSV4)
   3655 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   3656 	}
   3657 nfsmout:
   3658 	if (!error && nd->nd_repstat)
   3659 		error = nd->nd_repstat;
   3660 	mbuf_freem(nd->nd_mrep);
   3661 	return (error);
   3662 }
   3663 
   3664 /*
   3665  * NFS byte range lock rpc.
   3666  * (Mostly just calls one of the three lower level RPC routines.)
   3667  */
   3668 APPLESTATIC int
   3669 nfsrpc_advlock(vnode_t vp, off_t size, int op, struct flock *fl,
   3670     int reclaim, struct ucred *cred, NFSPROC_T *p, void *id, int flags)
   3671 {
   3672 	struct nfscllockowner *lp;
   3673 	struct nfsclclient *clp;
   3674 	struct nfsfh *nfhp;
   3675 	struct nfsrv_descript nfsd, *nd = &nfsd;
   3676 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   3677 	u_int64_t off, len;
   3678 	off_t start, end;
   3679 	u_int32_t clidrev = 0;
   3680 	int error = 0, newone = 0, expireret = 0, retrycnt, donelocally;
   3681 	int callcnt, dorpc;
   3682 
   3683 	/*
   3684 	 * Convert the flock structure into a start and end and do POSIX
   3685 	 * bounds checking.
   3686 	 */
   3687 	switch (fl->l_whence) {
   3688 	case SEEK_SET:
   3689 	case SEEK_CUR:
   3690 		/*
   3691 		 * Caller is responsible for adding any necessary offset
   3692 		 * when SEEK_CUR is used.
   3693 		 */
   3694 		start = fl->l_start;
   3695 		off = fl->l_start;
   3696 		break;
   3697 	case SEEK_END:
   3698 		start = size + fl->l_start;
   3699 		off = size + fl->l_start;
   3700 		break;
   3701 	default:
   3702 		return (EINVAL);
   3703 	}
   3704 	if (start < 0)
   3705 		return (EINVAL);
   3706 	if (fl->l_len != 0) {
   3707 		end = start + fl->l_len - 1;
   3708 		if (end < start)
   3709 			return (EINVAL);
   3710 	}
   3711 
   3712 	len = fl->l_len;
   3713 	if (len == 0)
   3714 		len = NFS64BITSSET;
   3715 	retrycnt = 0;
   3716 	do {
   3717 	    nd->nd_repstat = 0;
   3718 	    if (op == F_GETLK) {
   3719 		error = nfscl_getcl(vnode_mount(vp), cred, p, 1, &clp);
   3720 		if (error)
   3721 			return (error);
   3722 		error = nfscl_lockt(vp, clp, off, len, fl, p, id, flags);
   3723 		if (!error) {
   3724 			clidrev = clp->nfsc_clientidrev;
   3725 			error = nfsrpc_lockt(nd, vp, clp, off, len, fl, cred,
   3726 			    p, id, flags);
   3727 		} else if (error == -1) {
   3728 			error = 0;
   3729 		}
   3730 		nfscl_clientrelease(clp);
   3731 	    } else if (op == F_UNLCK && fl->l_type == F_UNLCK) {
   3732 		/*
   3733 		 * We must loop around for all lockowner cases.
   3734 		 */
   3735 		callcnt = 0;
   3736 		error = nfscl_getcl(vnode_mount(vp), cred, p, 1, &clp);
   3737 		if (error)
   3738 			return (error);
   3739 		do {
   3740 		    error = nfscl_relbytelock(vp, off, len, cred, p, callcnt,
   3741 			clp, id, flags, &lp, &dorpc);
   3742 		    /*
   3743 		     * If it returns a NULL lp, we're done.
   3744 		     */
   3745 		    if (lp == NULL) {
   3746 			if (callcnt == 0)
   3747 			    nfscl_clientrelease(clp);
   3748 			else
   3749 			    nfscl_releasealllocks(clp, vp, p, id, flags);
   3750 			return (error);
   3751 		    }
   3752 		    if (nmp->nm_clp != NULL)
   3753 			clidrev = nmp->nm_clp->nfsc_clientidrev;
   3754 		    else
   3755 			clidrev = 0;
   3756 		    /*
   3757 		     * If the server doesn't support Posix lock semantics,
   3758 		     * only allow locks on the entire file, since it won't
   3759 		     * handle overlapping byte ranges.
   3760 		     * There might still be a problem when a lock
   3761 		     * upgrade/downgrade (read<->write) occurs, since the
   3762 		     * server "might" expect an unlock first?
   3763 		     */
   3764 		    if (dorpc && (lp->nfsl_open->nfso_posixlock ||
   3765 			(off == 0 && len == NFS64BITSSET))) {
   3766 			/*
   3767 			 * Since the lock records will go away, we must
   3768 			 * wait for grace and delay here.
   3769 			 */
   3770 			do {
   3771 			    error = nfsrpc_locku(nd, nmp, lp, off, len,
   3772 				NFSV4LOCKT_READ, cred, p, 0);
   3773 			    if ((nd->nd_repstat == NFSERR_GRACE ||
   3774 				 nd->nd_repstat == NFSERR_DELAY) &&
   3775 				error == 0)
   3776 				(void) nfs_catnap(PZERO, (int)nd->nd_repstat,
   3777 				    "nfs_advlock");
   3778 			} while ((nd->nd_repstat == NFSERR_GRACE ||
   3779 			    nd->nd_repstat == NFSERR_DELAY) && error == 0);
   3780 		    }
   3781 		    callcnt++;
   3782 		} while (error == 0 && nd->nd_repstat == 0);
   3783 		nfscl_releasealllocks(clp, vp, p, id, flags);
   3784 	    } else if (op == F_SETLK) {
   3785 		error = nfscl_getbytelock(vp, off, len, fl->l_type, cred, p,
   3786 		    NULL, 0, id, flags, NULL, NULL, &lp, &newone, &donelocally);
   3787 		if (error || donelocally) {
   3788 			return (error);
   3789 		}
   3790 		if (nmp->nm_clp != NULL)
   3791 			clidrev = nmp->nm_clp->nfsc_clientidrev;
   3792 		else
   3793 			clidrev = 0;
   3794 		nfhp = VTONFS(vp)->n_fhp;
   3795 		if (!lp->nfsl_open->nfso_posixlock &&
   3796 		    (off != 0 || len != NFS64BITSSET)) {
   3797 			error = EINVAL;
   3798 		} else {
   3799 			error = nfsrpc_lock(nd, nmp, vp, nfhp->nfh_fh,
   3800 			    nfhp->nfh_len, lp, newone, reclaim, off,
   3801 			    len, fl->l_type, cred, p, 0);
   3802 		}
   3803 		if (!error)
   3804 			error = nd->nd_repstat;
   3805 		nfscl_lockrelease(lp, error, newone);
   3806 	    } else {
   3807 		error = EINVAL;
   3808 	    }
   3809 	    if (!error)
   3810 	        error = nd->nd_repstat;
   3811 	    if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
   3812 		error == NFSERR_STALEDONTRECOVER ||
   3813 		error == NFSERR_STALECLIENTID || error == NFSERR_DELAY ||
   3814 		error == NFSERR_BADSESSION) {
   3815 		(void) nfs_catnap(PZERO, error, "nfs_advlock");
   3816 	    } else if ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID)
   3817 		&& clidrev != 0) {
   3818 		expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
   3819 		retrycnt++;
   3820 	    }
   3821 	} while (error == NFSERR_GRACE ||
   3822 	    error == NFSERR_STALECLIENTID || error == NFSERR_DELAY ||
   3823 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_STALESTATEID ||
   3824 	    error == NFSERR_BADSESSION ||
   3825 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
   3826 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
   3827 	if (error && retrycnt >= 4)
   3828 		error = EIO;
   3829 	return (error);
   3830 }
   3831 
   3832 /*
   3833  * The lower level routine for the LockT case.
   3834  */
   3835 APPLESTATIC int
   3836 nfsrpc_lockt(struct nfsrv_descript *nd, vnode_t vp,
   3837     struct nfsclclient *clp, u_int64_t off, u_int64_t len, struct flock *fl,
   3838     struct ucred *cred, NFSPROC_T *p, void *id, int flags)
   3839 {
   3840 	u_int32_t *tl;
   3841 	int error, type, size;
   3842 	uint8_t own[NFSV4CL_LOCKNAMELEN + NFSX_V4FHMAX];
   3843 	struct nfsnode *np;
   3844 	struct nfsmount *nmp;
   3845 
   3846 	nmp = VFSTONFS(vp->v_mount);
   3847 	NFSCL_REQSTART(nd, NFSPROC_LOCKT, vp);
   3848 	NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
   3849 	if (fl->l_type == F_RDLCK)
   3850 		*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
   3851 	else
   3852 		*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
   3853 	txdr_hyper(off, tl);
   3854 	tl += 2;
   3855 	txdr_hyper(len, tl);
   3856 	tl += 2;
   3857 	*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   3858 	*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   3859 	nfscl_filllockowner(id, own, flags);
   3860 	np = VTONFS(vp);
   3861 	NFSBCOPY(np->n_fhp->nfh_fh, &own[NFSV4CL_LOCKNAMELEN],
   3862 	    np->n_fhp->nfh_len);
   3863 	(void)nfsm_strtom(nd, own, NFSV4CL_LOCKNAMELEN + np->n_fhp->nfh_len);
   3864 	error = nfscl_request(nd, vp, p, cred, NULL);
   3865 	if (error)
   3866 		return (error);
   3867 	if (nd->nd_repstat == 0) {
   3868 		fl->l_type = F_UNLCK;
   3869 	} else if (nd->nd_repstat == NFSERR_DENIED) {
   3870 		nd->nd_repstat = 0;
   3871 		fl->l_whence = SEEK_SET;
   3872 		NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
   3873 		fl->l_start = fxdr_hyper(tl);
   3874 		tl += 2;
   3875 		len = fxdr_hyper(tl);
   3876 		tl += 2;
   3877 		if (len == NFS64BITSSET)
   3878 			fl->l_len = 0;
   3879 		else
   3880 			fl->l_len = len;
   3881 		type = fxdr_unsigned(int, *tl++);
   3882 		if (type == NFSV4LOCKT_WRITE)
   3883 			fl->l_type = F_WRLCK;
   3884 		else
   3885 			fl->l_type = F_RDLCK;
   3886 		/*
   3887 		 * XXX For now, I have no idea what to do with the
   3888 		 * conflicting lock_owner, so I'll just set the pid == 0
   3889 		 * and skip over the lock_owner.
   3890 		 */
   3891 		fl->l_pid = (pid_t)0;
   3892 		tl += 2;
   3893 		size = fxdr_unsigned(int, *tl);
   3894 		if (size < 0 || size > NFSV4_OPAQUELIMIT)
   3895 			error = EBADRPC;
   3896 		if (!error)
   3897 			error = nfsm_advance(nd, NFSM_RNDUP(size), -1);
   3898 	} else if (nd->nd_repstat == NFSERR_STALECLIENTID ||
   3899 	    nd->nd_repstat == NFSERR_BADSESSION)
   3900 		nfscl_initiate_recovery(clp);
   3901 nfsmout:
   3902 	mbuf_freem(nd->nd_mrep);
   3903 	return (error);
   3904 }
   3905 
   3906 /*
   3907  * Lower level function that performs the LockU RPC.
   3908  */
   3909 static int
   3910 nfsrpc_locku(struct nfsrv_descript *nd, struct nfsmount *nmp,
   3911     struct nfscllockowner *lp, u_int64_t off, u_int64_t len,
   3912     u_int32_t type, struct ucred *cred, NFSPROC_T *p, int syscred)
   3913 {
   3914 	u_int32_t *tl;
   3915 	int error;
   3916 
   3917 	nfscl_reqstart(nd, NFSPROC_LOCKU, nmp, lp->nfsl_open->nfso_fh,
   3918 	    lp->nfsl_open->nfso_fhlen, NULL, NULL);
   3919 	NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 6 * NFSX_UNSIGNED);
   3920 	*tl++ = txdr_unsigned(type);
   3921 	*tl = txdr_unsigned(lp->nfsl_seqid);
   3922 	if (nfstest_outofseq &&
   3923 	    (arc4random() % nfstest_outofseq) == 0)
   3924 		*tl = txdr_unsigned(lp->nfsl_seqid + 1);
   3925 	tl++;
   3926 	if (NFSHASNFSV4N(nmp))
   3927 		*tl++ = 0;
   3928 	else
   3929 		*tl++ = lp->nfsl_stateid.seqid;
   3930 	*tl++ = lp->nfsl_stateid.other[0];
   3931 	*tl++ = lp->nfsl_stateid.other[1];
   3932 	*tl++ = lp->nfsl_stateid.other[2];
   3933 	txdr_hyper(off, tl);
   3934 	tl += 2;
   3935 	txdr_hyper(len, tl);
   3936 	if (syscred)
   3937 		nd->nd_flag |= ND_USEGSSNAME;
   3938 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   3939 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   3940 	NFSCL_INCRSEQID(lp->nfsl_seqid, nd);
   3941 	if (error)
   3942 		return (error);
   3943 	if (nd->nd_repstat == 0) {
   3944 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
   3945 		lp->nfsl_stateid.seqid = *tl++;
   3946 		lp->nfsl_stateid.other[0] = *tl++;
   3947 		lp->nfsl_stateid.other[1] = *tl++;
   3948 		lp->nfsl_stateid.other[2] = *tl;
   3949 	} else if (nd->nd_repstat == NFSERR_STALESTATEID ||
   3950 	    nd->nd_repstat == NFSERR_BADSESSION)
   3951 		nfscl_initiate_recovery(lp->nfsl_open->nfso_own->nfsow_clp);
   3952 nfsmout:
   3953 	mbuf_freem(nd->nd_mrep);
   3954 	return (error);
   3955 }
   3956 
   3957 /*
   3958  * The actual Lock RPC.
   3959  */
   3960 APPLESTATIC int
   3961 nfsrpc_lock(struct nfsrv_descript *nd, struct nfsmount *nmp, vnode_t vp,
   3962     u_int8_t *nfhp, int fhlen, struct nfscllockowner *lp, int newone,
   3963     int reclaim, u_int64_t off, u_int64_t len, short type, struct ucred *cred,
   3964     NFSPROC_T *p, int syscred)
   3965 {
   3966 	u_int32_t *tl;
   3967 	int error, size;
   3968 	uint8_t own[NFSV4CL_LOCKNAMELEN + NFSX_V4FHMAX];
   3969 
   3970 	nfscl_reqstart(nd, NFSPROC_LOCK, nmp, nfhp, fhlen, NULL, NULL);
   3971 	NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
   3972 	if (type == F_RDLCK)
   3973 		*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
   3974 	else
   3975 		*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
   3976 	*tl++ = txdr_unsigned(reclaim);
   3977 	txdr_hyper(off, tl);
   3978 	tl += 2;
   3979 	txdr_hyper(len, tl);
   3980 	tl += 2;
   3981 	if (newone) {
   3982 	    *tl = newnfs_true;
   3983 	    NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID +
   3984 		2 * NFSX_UNSIGNED + NFSX_HYPER);
   3985 	    *tl++ = txdr_unsigned(lp->nfsl_open->nfso_own->nfsow_seqid);
   3986 	    if (NFSHASNFSV4N(nmp))
   3987 		*tl++ = 0;
   3988 	    else
   3989 		*tl++ = lp->nfsl_open->nfso_stateid.seqid;
   3990 	    *tl++ = lp->nfsl_open->nfso_stateid.other[0];
   3991 	    *tl++ = lp->nfsl_open->nfso_stateid.other[1];
   3992 	    *tl++ = lp->nfsl_open->nfso_stateid.other[2];
   3993 	    *tl++ = txdr_unsigned(lp->nfsl_seqid);
   3994 	    *tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   3995 	    *tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   3996 	    NFSBCOPY(lp->nfsl_owner, own, NFSV4CL_LOCKNAMELEN);
   3997 	    NFSBCOPY(nfhp, &own[NFSV4CL_LOCKNAMELEN], fhlen);
   3998 	    (void)nfsm_strtom(nd, own, NFSV4CL_LOCKNAMELEN + fhlen);
   3999 	} else {
   4000 	    *tl = newnfs_false;
   4001 	    NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
   4002 	    if (NFSHASNFSV4N(nmp))
   4003 		*tl++ = 0;
   4004 	    else
   4005 		*tl++ = lp->nfsl_stateid.seqid;
   4006 	    *tl++ = lp->nfsl_stateid.other[0];
   4007 	    *tl++ = lp->nfsl_stateid.other[1];
   4008 	    *tl++ = lp->nfsl_stateid.other[2];
   4009 	    *tl = txdr_unsigned(lp->nfsl_seqid);
   4010 	    if (nfstest_outofseq &&
   4011 		(arc4random() % nfstest_outofseq) == 0)
   4012 		    *tl = txdr_unsigned(lp->nfsl_seqid + 1);
   4013 	}
   4014 	if (syscred)
   4015 		nd->nd_flag |= ND_USEGSSNAME;
   4016 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, vp, p, cred,
   4017 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4018 	if (error)
   4019 		return (error);
   4020 	if (newone)
   4021 	    NFSCL_INCRSEQID(lp->nfsl_open->nfso_own->nfsow_seqid, nd);
   4022 	NFSCL_INCRSEQID(lp->nfsl_seqid, nd);
   4023 	if (nd->nd_repstat == 0) {
   4024 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
   4025 		lp->nfsl_stateid.seqid = *tl++;
   4026 		lp->nfsl_stateid.other[0] = *tl++;
   4027 		lp->nfsl_stateid.other[1] = *tl++;
   4028 		lp->nfsl_stateid.other[2] = *tl;
   4029 	} else if (nd->nd_repstat == NFSERR_DENIED) {
   4030 		NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
   4031 		size = fxdr_unsigned(int, *(tl + 7));
   4032 		if (size < 0 || size > NFSV4_OPAQUELIMIT)
   4033 			error = EBADRPC;
   4034 		if (!error)
   4035 			error = nfsm_advance(nd, NFSM_RNDUP(size), -1);
   4036 	} else if (nd->nd_repstat == NFSERR_STALESTATEID ||
   4037 	    nd->nd_repstat == NFSERR_BADSESSION)
   4038 		nfscl_initiate_recovery(lp->nfsl_open->nfso_own->nfsow_clp);
   4039 nfsmout:
   4040 	mbuf_freem(nd->nd_mrep);
   4041 	return (error);
   4042 }
   4043 
   4044 /*
   4045  * nfs statfs rpc
   4046  * (always called with the vp for the mount point)
   4047  */
   4048 APPLESTATIC int
   4049 nfsrpc_statfs(vnode_t vp, struct nfsstatfs *sbp, struct nfsfsinfo *fsp,
   4050     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   4051     void *stuff)
   4052 {
   4053 	u_int32_t *tl = NULL;
   4054 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4055 	struct nfsmount *nmp;
   4056 	nfsattrbit_t attrbits;
   4057 	int error;
   4058 
   4059 	*attrflagp = 0;
   4060 	nmp = VFSTONFS(vnode_mount(vp));
   4061 	if (NFSHASNFSV4(nmp)) {
   4062 		/*
   4063 		 * For V4, you actually do a getattr.
   4064 		 */
   4065 		NFSCL_REQSTART(nd, NFSPROC_GETATTR, vp);
   4066 		NFSSTATFS_GETATTRBIT(&attrbits);
   4067 		(void) nfsrv_putattrbit(nd, &attrbits);
   4068 		nd->nd_flag |= ND_USEGSSNAME;
   4069 		error = nfscl_request(nd, vp, p, cred, stuff);
   4070 		if (error)
   4071 			return (error);
   4072 		if (nd->nd_repstat == 0) {
   4073 			error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0,
   4074 			    NULL, NULL, sbp, fsp, NULL, 0, NULL, NULL, NULL, p,
   4075 			    cred);
   4076 			if (!error) {
   4077 				nmp->nm_fsid[0] = nap->na_filesid[0];
   4078 				nmp->nm_fsid[1] = nap->na_filesid[1];
   4079 				NFSSETHASSETFSID(nmp);
   4080 				*attrflagp = 1;
   4081 			}
   4082 		} else {
   4083 			error = nd->nd_repstat;
   4084 		}
   4085 		if (error)
   4086 			goto nfsmout;
   4087 	} else {
   4088 		NFSCL_REQSTART(nd, NFSPROC_FSSTAT, vp);
   4089 		error = nfscl_request(nd, vp, p, cred, stuff);
   4090 		if (error)
   4091 			return (error);
   4092 		if (nd->nd_flag & ND_NFSV3) {
   4093 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   4094 			if (error)
   4095 				goto nfsmout;
   4096 		}
   4097 		if (nd->nd_repstat) {
   4098 			error = nd->nd_repstat;
   4099 			goto nfsmout;
   4100 		}
   4101 		NFSM_DISSECT(tl, u_int32_t *,
   4102 		    NFSX_STATFS(nd->nd_flag & ND_NFSV3));
   4103 	}
   4104 	if (NFSHASNFSV3(nmp)) {
   4105 		sbp->sf_tbytes = fxdr_hyper(tl); tl += 2;
   4106 		sbp->sf_fbytes = fxdr_hyper(tl); tl += 2;
   4107 		sbp->sf_abytes = fxdr_hyper(tl); tl += 2;
   4108 		sbp->sf_tfiles = fxdr_hyper(tl); tl += 2;
   4109 		sbp->sf_ffiles = fxdr_hyper(tl); tl += 2;
   4110 		sbp->sf_afiles = fxdr_hyper(tl); tl += 2;
   4111 		sbp->sf_invarsec = fxdr_unsigned(u_int32_t, *tl);
   4112 	} else if (NFSHASNFSV4(nmp) == 0) {
   4113 		sbp->sf_tsize = fxdr_unsigned(u_int32_t, *tl++);
   4114 		sbp->sf_bsize = fxdr_unsigned(u_int32_t, *tl++);
   4115 		sbp->sf_blocks = fxdr_unsigned(u_int32_t, *tl++);
   4116 		sbp->sf_bfree = fxdr_unsigned(u_int32_t, *tl++);
   4117 		sbp->sf_bavail = fxdr_unsigned(u_int32_t, *tl);
   4118 	}
   4119 nfsmout:
   4120 	mbuf_freem(nd->nd_mrep);
   4121 	return (error);
   4122 }
   4123 
   4124 /*
   4125  * nfs pathconf rpc
   4126  */
   4127 APPLESTATIC int
   4128 nfsrpc_pathconf(vnode_t vp, struct nfsv3_pathconf *pc,
   4129     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
   4130     void *stuff)
   4131 {
   4132 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4133 	struct nfsmount *nmp;
   4134 	u_int32_t *tl;
   4135 	nfsattrbit_t attrbits;
   4136 	int error;
   4137 
   4138 	*attrflagp = 0;
   4139 	nmp = VFSTONFS(vnode_mount(vp));
   4140 	if (NFSHASNFSV4(nmp)) {
   4141 		/*
   4142 		 * For V4, you actually do a getattr.
   4143 		 */
   4144 		NFSCL_REQSTART(nd, NFSPROC_GETATTR, vp);
   4145 		NFSPATHCONF_GETATTRBIT(&attrbits);
   4146 		(void) nfsrv_putattrbit(nd, &attrbits);
   4147 		nd->nd_flag |= ND_USEGSSNAME;
   4148 		error = nfscl_request(nd, vp, p, cred, stuff);
   4149 		if (error)
   4150 			return (error);
   4151 		if (nd->nd_repstat == 0) {
   4152 			error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0,
   4153 			    pc, NULL, NULL, NULL, NULL, 0, NULL, NULL, NULL, p,
   4154 			    cred);
   4155 			if (!error)
   4156 				*attrflagp = 1;
   4157 		} else {
   4158 			error = nd->nd_repstat;
   4159 		}
   4160 	} else {
   4161 		NFSCL_REQSTART(nd, NFSPROC_PATHCONF, vp);
   4162 		error = nfscl_request(nd, vp, p, cred, stuff);
   4163 		if (error)
   4164 			return (error);
   4165 		error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   4166 		if (nd->nd_repstat && !error)
   4167 			error = nd->nd_repstat;
   4168 		if (!error) {
   4169 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V3PATHCONF);
   4170 			pc->pc_linkmax = fxdr_unsigned(u_int32_t, *tl++);
   4171 			pc->pc_namemax = fxdr_unsigned(u_int32_t, *tl++);
   4172 			pc->pc_notrunc = fxdr_unsigned(u_int32_t, *tl++);
   4173 			pc->pc_chownrestricted =
   4174 			    fxdr_unsigned(u_int32_t, *tl++);
   4175 			pc->pc_caseinsensitive =
   4176 			    fxdr_unsigned(u_int32_t, *tl++);
   4177 			pc->pc_casepreserving = fxdr_unsigned(u_int32_t, *tl);
   4178 		}
   4179 	}
   4180 nfsmout:
   4181 	mbuf_freem(nd->nd_mrep);
   4182 	return (error);
   4183 }
   4184 
   4185 /*
   4186  * nfs version 3 fsinfo rpc call
   4187  */
   4188 APPLESTATIC int
   4189 nfsrpc_fsinfo(vnode_t vp, struct nfsfsinfo *fsp, struct ucred *cred,
   4190     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
   4191 {
   4192 	u_int32_t *tl;
   4193 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4194 	int error;
   4195 
   4196 	*attrflagp = 0;
   4197 	NFSCL_REQSTART(nd, NFSPROC_FSINFO, vp);
   4198 	error = nfscl_request(nd, vp, p, cred, stuff);
   4199 	if (error)
   4200 		return (error);
   4201 	error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
   4202 	if (nd->nd_repstat && !error)
   4203 		error = nd->nd_repstat;
   4204 	if (!error) {
   4205 		NFSM_DISSECT(tl, u_int32_t *, NFSX_V3FSINFO);
   4206 		fsp->fs_rtmax = fxdr_unsigned(u_int32_t, *tl++);
   4207 		fsp->fs_rtpref = fxdr_unsigned(u_int32_t, *tl++);
   4208 		fsp->fs_rtmult = fxdr_unsigned(u_int32_t, *tl++);
   4209 		fsp->fs_wtmax = fxdr_unsigned(u_int32_t, *tl++);
   4210 		fsp->fs_wtpref = fxdr_unsigned(u_int32_t, *tl++);
   4211 		fsp->fs_wtmult = fxdr_unsigned(u_int32_t, *tl++);
   4212 		fsp->fs_dtpref = fxdr_unsigned(u_int32_t, *tl++);
   4213 		fsp->fs_maxfilesize = fxdr_hyper(tl);
   4214 		tl += 2;
   4215 		fxdr_nfsv3time(tl, &fsp->fs_timedelta);
   4216 		tl += 2;
   4217 		fsp->fs_properties = fxdr_unsigned(u_int32_t, *tl);
   4218 	}
   4219 nfsmout:
   4220 	mbuf_freem(nd->nd_mrep);
   4221 	return (error);
   4222 }
   4223 
   4224 /*
   4225  * This function performs the Renew RPC.
   4226  */
   4227 APPLESTATIC int
   4228 nfsrpc_renew(struct nfsclclient *clp, struct nfsclds *dsp, struct ucred *cred,
   4229     NFSPROC_T *p)
   4230 {
   4231 	u_int32_t *tl;
   4232 	struct nfsrv_descript nfsd;
   4233 	struct nfsrv_descript *nd = &nfsd;
   4234 	struct nfsmount *nmp;
   4235 	int error;
   4236 	struct nfssockreq *nrp;
   4237 
   4238 	nmp = clp->nfsc_nmp;
   4239 	if (nmp == NULL)
   4240 		return (0);
   4241 	nfscl_reqstart(nd, NFSPROC_RENEW, nmp, NULL, 0, NULL,
   4242 	    &dsp->nfsclds_sess);
   4243 	if (!NFSHASNFSV4N(nmp)) {
   4244 		/* NFSv4.1 just uses a Sequence Op and not a Renew. */
   4245 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   4246 		*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   4247 		*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   4248 	}
   4249 	nrp = dsp->nfsclds_sockp;
   4250 	if (nrp == NULL)
   4251 		/* If NULL, use the MDS socket. */
   4252 		nrp = &nmp->nm_sockreq;
   4253 	nd->nd_flag |= ND_USEGSSNAME;
   4254 	error = newnfs_request(nd, nmp, NULL, nrp, NULL, p, cred,
   4255 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, &dsp->nfsclds_sess);
   4256 	if (error)
   4257 		return (error);
   4258 	error = nd->nd_repstat;
   4259 	mbuf_freem(nd->nd_mrep);
   4260 	return (error);
   4261 }
   4262 
   4263 /*
   4264  * This function performs the Releaselockowner RPC.
   4265  */
   4266 APPLESTATIC int
   4267 nfsrpc_rellockown(struct nfsmount *nmp, struct nfscllockowner *lp,
   4268     uint8_t *fh, int fhlen, struct ucred *cred, NFSPROC_T *p)
   4269 {
   4270 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4271 	u_int32_t *tl;
   4272 	int error;
   4273 	uint8_t own[NFSV4CL_LOCKNAMELEN + NFSX_V4FHMAX];
   4274 
   4275 	if (NFSHASNFSV4N(nmp)) {
   4276 		/* For NFSv4.1, do a FreeStateID. */
   4277 		nfscl_reqstart(nd, NFSPROC_FREESTATEID, nmp, NULL, 0, NULL,
   4278 		    NULL);
   4279 		nfsm_stateidtom(nd, &lp->nfsl_stateid, NFSSTATEID_PUTSTATEID);
   4280 	} else {
   4281 		nfscl_reqstart(nd, NFSPROC_RELEASELCKOWN, nmp, NULL, 0, NULL,
   4282 		    NULL);
   4283 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
   4284 		*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   4285 		*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   4286 		NFSBCOPY(lp->nfsl_owner, own, NFSV4CL_LOCKNAMELEN);
   4287 		NFSBCOPY(fh, &own[NFSV4CL_LOCKNAMELEN], fhlen);
   4288 		(void)nfsm_strtom(nd, own, NFSV4CL_LOCKNAMELEN + fhlen);
   4289 	}
   4290 	nd->nd_flag |= ND_USEGSSNAME;
   4291 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4292 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4293 	if (error)
   4294 		return (error);
   4295 	error = nd->nd_repstat;
   4296 	mbuf_freem(nd->nd_mrep);
   4297 	return (error);
   4298 }
   4299 
   4300 /*
   4301  * This function performs the Compound to get the mount pt FH.
   4302  */
   4303 APPLESTATIC int
   4304 nfsrpc_getdirpath(struct nfsmount *nmp, u_char *dirpath, struct ucred *cred,
   4305     NFSPROC_T *p)
   4306 {
   4307 	u_int32_t *tl;
   4308 	struct nfsrv_descript nfsd;
   4309 	struct nfsrv_descript *nd = &nfsd;
   4310 	u_char *cp, *cp2;
   4311 	int error, cnt, len, setnil;
   4312 	u_int32_t *opcntp;
   4313 
   4314 	nfscl_reqstart(nd, NFSPROC_PUTROOTFH, nmp, NULL, 0, &opcntp, NULL);
   4315 	cp = dirpath;
   4316 	cnt = 0;
   4317 	do {
   4318 		setnil = 0;
   4319 		while (*cp == '/')
   4320 			cp++;
   4321 		cp2 = cp;
   4322 		while (*cp2 != '\0' && *cp2 != '/')
   4323 			cp2++;
   4324 		if (*cp2 == '/') {
   4325 			setnil = 1;
   4326 			*cp2 = '\0';
   4327 		}
   4328 		if (cp2 != cp) {
   4329 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   4330 			*tl = txdr_unsigned(NFSV4OP_LOOKUP);
   4331 			nfsm_strtom(nd, cp, strlen(cp));
   4332 			cnt++;
   4333 		}
   4334 		if (setnil)
   4335 			*cp2++ = '/';
   4336 		cp = cp2;
   4337 	} while (*cp != '\0');
   4338 	if (NFSHASNFSV4N(nmp))
   4339 		/* Has a Sequence Op done by nfscl_reqstart(). */
   4340 		*opcntp = txdr_unsigned(3 + cnt);
   4341 	else
   4342 		*opcntp = txdr_unsigned(2 + cnt);
   4343 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
   4344 	*tl = txdr_unsigned(NFSV4OP_GETFH);
   4345 	nd->nd_flag |= ND_USEGSSNAME;
   4346 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4347 		NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4348 	if (error)
   4349 		return (error);
   4350 	if (nd->nd_repstat == 0) {
   4351 		NFSM_DISSECT(tl, u_int32_t *, (3 + 2 * cnt) * NFSX_UNSIGNED);
   4352 		tl += (2 + 2 * cnt);
   4353 		if ((len = fxdr_unsigned(int, *tl)) <= 0 ||
   4354 			len > NFSX_FHMAX) {
   4355 			nd->nd_repstat = NFSERR_BADXDR;
   4356 		} else {
   4357 			nd->nd_repstat = nfsrv_mtostr(nd, nmp->nm_fh, len);
   4358 			if (nd->nd_repstat == 0)
   4359 				nmp->nm_fhsize = len;
   4360 		}
   4361 	}
   4362 	error = nd->nd_repstat;
   4363 nfsmout:
   4364 	mbuf_freem(nd->nd_mrep);
   4365 	return (error);
   4366 }
   4367 
   4368 /*
   4369  * This function performs the Delegreturn RPC.
   4370  */
   4371 APPLESTATIC int
   4372 nfsrpc_delegreturn(struct nfscldeleg *dp, struct ucred *cred,
   4373     struct nfsmount *nmp, NFSPROC_T *p, int syscred)
   4374 {
   4375 	u_int32_t *tl;
   4376 	struct nfsrv_descript nfsd;
   4377 	struct nfsrv_descript *nd = &nfsd;
   4378 	int error;
   4379 
   4380 	nfscl_reqstart(nd, NFSPROC_DELEGRETURN, nmp, dp->nfsdl_fh,
   4381 	    dp->nfsdl_fhlen, NULL, NULL);
   4382 	NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
   4383 	if (NFSHASNFSV4N(nmp))
   4384 		*tl++ = 0;
   4385 	else
   4386 		*tl++ = dp->nfsdl_stateid.seqid;
   4387 	*tl++ = dp->nfsdl_stateid.other[0];
   4388 	*tl++ = dp->nfsdl_stateid.other[1];
   4389 	*tl = dp->nfsdl_stateid.other[2];
   4390 	if (syscred)
   4391 		nd->nd_flag |= ND_USEGSSNAME;
   4392 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4393 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4394 	if (error)
   4395 		return (error);
   4396 	error = nd->nd_repstat;
   4397 	mbuf_freem(nd->nd_mrep);
   4398 	return (error);
   4399 }
   4400 
   4401 /*
   4402  * nfs getacl call.
   4403  */
   4404 APPLESTATIC int
   4405 nfsrpc_getacl(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
   4406     struct acl *aclp, void *stuff)
   4407 {
   4408 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4409 	int error;
   4410 	nfsattrbit_t attrbits;
   4411 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   4412 
   4413 	if (nfsrv_useacl == 0 || !NFSHASNFSV4(nmp))
   4414 		return (EOPNOTSUPP);
   4415 	NFSCL_REQSTART(nd, NFSPROC_GETACL, vp);
   4416 	NFSZERO_ATTRBIT(&attrbits);
   4417 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_ACL);
   4418 	(void) nfsrv_putattrbit(nd, &attrbits);
   4419 	error = nfscl_request(nd, vp, p, cred, stuff);
   4420 	if (error)
   4421 		return (error);
   4422 	if (!nd->nd_repstat)
   4423 		error = nfsv4_loadattr(nd, vp, NULL, NULL, NULL, 0, NULL,
   4424 		    NULL, NULL, NULL, aclp, 0, NULL, NULL, NULL, p, cred);
   4425 	else
   4426 		error = nd->nd_repstat;
   4427 	mbuf_freem(nd->nd_mrep);
   4428 	return (error);
   4429 }
   4430 
   4431 /*
   4432  * nfs setacl call.
   4433  */
   4434 APPLESTATIC int
   4435 nfsrpc_setacl(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
   4436     struct acl *aclp, void *stuff)
   4437 {
   4438 	int error;
   4439 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   4440 
   4441 	if (nfsrv_useacl == 0 || !NFSHASNFSV4(nmp))
   4442 		return (EOPNOTSUPP);
   4443 	error = nfsrpc_setattr(vp, NULL, aclp, cred, p, NULL, NULL, stuff);
   4444 	return (error);
   4445 }
   4446 
   4447 /*
   4448  * nfs setacl call.
   4449  */
   4450 static int
   4451 nfsrpc_setaclrpc(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
   4452     struct acl *aclp, nfsv4stateid_t *stateidp, void *stuff)
   4453 {
   4454 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4455 	int error;
   4456 	nfsattrbit_t attrbits;
   4457 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   4458 
   4459 	if (!NFSHASNFSV4(nmp))
   4460 		return (EOPNOTSUPP);
   4461 	NFSCL_REQSTART(nd, NFSPROC_SETACL, vp);
   4462 	nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
   4463 	NFSZERO_ATTRBIT(&attrbits);
   4464 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_ACL);
   4465 	(void) nfsv4_fillattr(nd, vnode_mount(vp), vp, aclp, NULL, NULL, 0,
   4466 	    &attrbits, NULL, NULL, 0, 0, 0, 0, (uint64_t)0);
   4467 	error = nfscl_request(nd, vp, p, cred, stuff);
   4468 	if (error)
   4469 		return (error);
   4470 	/* Don't care about the pre/postop attributes */
   4471 	mbuf_freem(nd->nd_mrep);
   4472 	return (nd->nd_repstat);
   4473 }
   4474 
   4475 /*
   4476  * Do the NFSv4.1 Exchange ID.
   4477  */
   4478 int
   4479 nfsrpc_exchangeid(struct nfsmount *nmp, struct nfsclclient *clp,
   4480     struct nfssockreq *nrp, uint32_t exchflags, struct nfsclds **dspp,
   4481     struct ucred *cred, NFSPROC_T *p)
   4482 {
   4483 	uint32_t *tl, v41flags;
   4484 	struct nfsrv_descript nfsd;
   4485 	struct nfsrv_descript *nd = &nfsd;
   4486 	struct nfsclds *dsp;
   4487 	struct timespec verstime;
   4488 	int error, len;
   4489 
   4490 	*dspp = NULL;
   4491 	nfscl_reqstart(nd, NFSPROC_EXCHANGEID, nmp, NULL, 0, NULL, NULL);
   4492 	NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
   4493 	*tl++ = txdr_unsigned(nfsboottime.tv_sec);	/* Client owner */
   4494 	*tl = txdr_unsigned(clp->nfsc_rev);
   4495 	(void) nfsm_strtom(nd, clp->nfsc_id, clp->nfsc_idlen);
   4496 
   4497 	NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
   4498 	*tl++ = txdr_unsigned(exchflags);
   4499 	*tl++ = txdr_unsigned(NFSV4EXCH_SP4NONE);
   4500 
   4501 	/* Set the implementation id4 */
   4502 	*tl = txdr_unsigned(1);
   4503 	(void) nfsm_strtom(nd, "freebsd.org", strlen("freebsd.org"));
   4504 	(void) nfsm_strtom(nd, version, strlen(version));
   4505 	NFSM_BUILD(tl, uint32_t *, NFSX_V4TIME);
   4506 	verstime.tv_sec = 1293840000;		/* Jan 1, 2011 */
   4507 	verstime.tv_nsec = 0;
   4508 	txdr_nfsv4time(&verstime, tl);
   4509 	nd->nd_flag |= ND_USEGSSNAME;
   4510 	error = newnfs_request(nd, nmp, NULL, nrp, NULL, p, cred,
   4511 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4512 	NFSCL_DEBUG(1, "exchangeid err=%d reps=%d\n", error,
   4513 	    (int)nd->nd_repstat);
   4514 	if (error != 0)
   4515 		return (error);
   4516 	if (nd->nd_repstat == 0) {
   4517 		NFSM_DISSECT(tl, uint32_t *, 6 * NFSX_UNSIGNED + NFSX_HYPER);
   4518 		len = fxdr_unsigned(int, *(tl + 7));
   4519 		if (len < 0 || len > NFSV4_OPAQUELIMIT) {
   4520 			error = NFSERR_BADXDR;
   4521 			goto nfsmout;
   4522 		}
   4523 		dsp = malloc(sizeof(struct nfsclds) + len, M_NFSCLDS,
   4524 		    M_WAITOK | M_ZERO);
   4525 		dsp->nfsclds_expire = NFSD_MONOSEC + clp->nfsc_renew;
   4526 		dsp->nfsclds_servownlen = len;
   4527 		dsp->nfsclds_sess.nfsess_clientid.lval[0] = *tl++;
   4528 		dsp->nfsclds_sess.nfsess_clientid.lval[1] = *tl++;
   4529 		dsp->nfsclds_sess.nfsess_sequenceid =
   4530 		    fxdr_unsigned(uint32_t, *tl++);
   4531 		v41flags = fxdr_unsigned(uint32_t, *tl);
   4532 		if ((v41flags & NFSV4EXCH_USEPNFSMDS) != 0 &&
   4533 		    NFSHASPNFSOPT(nmp)) {
   4534 			NFSCL_DEBUG(1, "set PNFS\n");
   4535 			NFSLOCKMNT(nmp);
   4536 			nmp->nm_state |= NFSSTA_PNFS;
   4537 			NFSUNLOCKMNT(nmp);
   4538 			dsp->nfsclds_flags |= NFSCLDS_MDS;
   4539 		}
   4540 		if ((v41flags & NFSV4EXCH_USEPNFSDS) != 0)
   4541 			dsp->nfsclds_flags |= NFSCLDS_DS;
   4542 		if (len > 0)
   4543 			nd->nd_repstat = nfsrv_mtostr(nd,
   4544 			    dsp->nfsclds_serverown, len);
   4545 		if (nd->nd_repstat == 0) {
   4546 			mtx_init(&dsp->nfsclds_mtx, "nfsds", NULL, MTX_DEF);
   4547 			mtx_init(&dsp->nfsclds_sess.nfsess_mtx, "nfssession",
   4548 			    NULL, MTX_DEF);
   4549 			nfscl_initsessionslots(&dsp->nfsclds_sess);
   4550 			*dspp = dsp;
   4551 		} else
   4552 			free(dsp, M_NFSCLDS);
   4553 	}
   4554 	error = nd->nd_repstat;
   4555 nfsmout:
   4556 	mbuf_freem(nd->nd_mrep);
   4557 	return (error);
   4558 }
   4559 
   4560 /*
   4561  * Do the NFSv4.1 Create Session.
   4562  */
   4563 int
   4564 nfsrpc_createsession(struct nfsmount *nmp, struct nfsclsession *sep,
   4565     struct nfssockreq *nrp, uint32_t sequenceid, int mds, struct ucred *cred,
   4566     NFSPROC_T *p)
   4567 {
   4568 	uint32_t crflags, *tl;
   4569 	struct nfsrv_descript nfsd;
   4570 	struct nfsrv_descript *nd = &nfsd;
   4571 	int error, irdcnt;
   4572 
   4573 	nfscl_reqstart(nd, NFSPROC_CREATESESSION, nmp, NULL, 0, NULL, NULL);
   4574 	NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED);
   4575 	*tl++ = sep->nfsess_clientid.lval[0];
   4576 	*tl++ = sep->nfsess_clientid.lval[1];
   4577 	*tl++ = txdr_unsigned(sequenceid);
   4578 	crflags = (NFSMNT_RDONLY(nmp->nm_mountp) ? 0 : NFSV4CRSESS_PERSIST);
   4579 	if (nfscl_enablecallb != 0 && nfs_numnfscbd > 0)
   4580 		crflags |= NFSV4CRSESS_CONNBACKCHAN;
   4581 	*tl = txdr_unsigned(crflags);
   4582 
   4583 	/* Fill in fore channel attributes. */
   4584 	NFSM_BUILD(tl, uint32_t *, 7 * NFSX_UNSIGNED);
   4585 	*tl++ = 0;				/* Header pad size */
   4586 	*tl++ = txdr_unsigned(100000);		/* Max request size */
   4587 	*tl++ = txdr_unsigned(100000);		/* Max response size */
   4588 	*tl++ = txdr_unsigned(4096);		/* Max response size cached */
   4589 	*tl++ = txdr_unsigned(20);		/* Max operations */
   4590 	*tl++ = txdr_unsigned(64);		/* Max slots */
   4591 	*tl = 0;				/* No rdma ird */
   4592 
   4593 	/* Fill in back channel attributes. */
   4594 	NFSM_BUILD(tl, uint32_t *, 7 * NFSX_UNSIGNED);
   4595 	*tl++ = 0;				/* Header pad size */
   4596 	*tl++ = txdr_unsigned(10000);		/* Max request size */
   4597 	*tl++ = txdr_unsigned(10000);		/* Max response size */
   4598 	*tl++ = txdr_unsigned(4096);		/* Max response size cached */
   4599 	*tl++ = txdr_unsigned(4);		/* Max operations */
   4600 	*tl++ = txdr_unsigned(NFSV4_CBSLOTS);	/* Max slots */
   4601 	*tl = 0;				/* No rdma ird */
   4602 
   4603 	NFSM_BUILD(tl, uint32_t *, 8 * NFSX_UNSIGNED);
   4604 	*tl++ = txdr_unsigned(NFS_CALLBCKPROG);	/* Call back prog # */
   4605 
   4606 	/* Allow AUTH_SYS callbacks as uid, gid == 0. */
   4607 	*tl++ = txdr_unsigned(1);		/* Auth_sys only */
   4608 	*tl++ = txdr_unsigned(AUTH_SYS);	/* AUTH_SYS type */
   4609 	*tl++ = txdr_unsigned(nfsboottime.tv_sec); /* time stamp */
   4610 	*tl++ = 0;				/* Null machine name */
   4611 	*tl++ = 0;				/* Uid == 0 */
   4612 	*tl++ = 0;				/* Gid == 0 */
   4613 	*tl = 0;				/* No additional gids */
   4614 	nd->nd_flag |= ND_USEGSSNAME;
   4615 	error = newnfs_request(nd, nmp, NULL, nrp, NULL, p, cred, NFS_PROG,
   4616 	    NFS_VER4, NULL, 1, NULL, NULL);
   4617 	if (error != 0)
   4618 		return (error);
   4619 	if (nd->nd_repstat == 0) {
   4620 		NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID +
   4621 		    2 * NFSX_UNSIGNED);
   4622 		bcopy(tl, sep->nfsess_sessionid, NFSX_V4SESSIONID);
   4623 		tl += NFSX_V4SESSIONID / NFSX_UNSIGNED;
   4624 		sep->nfsess_sequenceid = fxdr_unsigned(uint32_t, *tl++);
   4625 		crflags = fxdr_unsigned(uint32_t, *tl);
   4626 		if ((crflags & NFSV4CRSESS_PERSIST) != 0 && mds != 0) {
   4627 			NFSLOCKMNT(nmp);
   4628 			nmp->nm_state |= NFSSTA_SESSPERSIST;
   4629 			NFSUNLOCKMNT(nmp);
   4630 		}
   4631 
   4632 		/* Get the fore channel slot count. */
   4633 		NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
   4634 		tl += 3;		/* Skip the other counts. */
   4635 		sep->nfsess_maxcache = fxdr_unsigned(int, *tl++);
   4636 		tl++;
   4637 		sep->nfsess_foreslots = fxdr_unsigned(uint16_t, *tl++);
   4638 		NFSCL_DEBUG(4, "fore slots=%d\n", (int)sep->nfsess_foreslots);
   4639 		irdcnt = fxdr_unsigned(int, *tl);
   4640 		if (irdcnt > 0)
   4641 			NFSM_DISSECT(tl, uint32_t *, irdcnt * NFSX_UNSIGNED);
   4642 
   4643 		/* and the back channel slot count. */
   4644 		NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
   4645 		tl += 5;
   4646 		sep->nfsess_backslots = fxdr_unsigned(uint16_t, *tl);
   4647 		NFSCL_DEBUG(4, "back slots=%d\n", (int)sep->nfsess_backslots);
   4648 	}
   4649 	error = nd->nd_repstat;
   4650 nfsmout:
   4651 	mbuf_freem(nd->nd_mrep);
   4652 	return (error);
   4653 }
   4654 
   4655 /*
   4656  * Do the NFSv4.1 Destroy Session.
   4657  */
   4658 int
   4659 nfsrpc_destroysession(struct nfsmount *nmp, struct nfsclclient *clp,
   4660     struct ucred *cred, NFSPROC_T *p)
   4661 {
   4662 	uint32_t *tl;
   4663 	struct nfsrv_descript nfsd;
   4664 	struct nfsrv_descript *nd = &nfsd;
   4665 	int error;
   4666 
   4667 	nfscl_reqstart(nd, NFSPROC_DESTROYSESSION, nmp, NULL, 0, NULL, NULL);
   4668 	NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
   4669 	bcopy(NFSMNT_MDSSESSION(nmp)->nfsess_sessionid, tl, NFSX_V4SESSIONID);
   4670 	nd->nd_flag |= ND_USEGSSNAME;
   4671 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4672 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4673 	if (error != 0)
   4674 		return (error);
   4675 	error = nd->nd_repstat;
   4676 	mbuf_freem(nd->nd_mrep);
   4677 	return (error);
   4678 }
   4679 
   4680 /*
   4681  * Do the NFSv4.1 Destroy Client.
   4682  */
   4683 int
   4684 nfsrpc_destroyclient(struct nfsmount *nmp, struct nfsclclient *clp,
   4685     struct ucred *cred, NFSPROC_T *p)
   4686 {
   4687 	uint32_t *tl;
   4688 	struct nfsrv_descript nfsd;
   4689 	struct nfsrv_descript *nd = &nfsd;
   4690 	int error;
   4691 
   4692 	nfscl_reqstart(nd, NFSPROC_DESTROYCLIENT, nmp, NULL, 0, NULL, NULL);
   4693 	NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
   4694 	*tl++ = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[0];
   4695 	*tl = NFSMNT_MDSSESSION(nmp)->nfsess_clientid.lval[1];
   4696 	nd->nd_flag |= ND_USEGSSNAME;
   4697 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4698 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4699 	if (error != 0)
   4700 		return (error);
   4701 	error = nd->nd_repstat;
   4702 	mbuf_freem(nd->nd_mrep);
   4703 	return (error);
   4704 }
   4705 
   4706 /*
   4707  * Do the NFSv4.1 LayoutGet.
   4708  */
   4709 int
   4710 nfsrpc_layoutget(struct nfsmount *nmp, uint8_t *fhp, int fhlen, int iomode,
   4711     uint64_t offset, uint64_t len, uint64_t minlen, int layoutlen,
   4712     nfsv4stateid_t *stateidp, int *retonclosep, struct nfsclflayouthead *flhp,
   4713     struct ucred *cred, NFSPROC_T *p, void *stuff)
   4714 {
   4715 	uint32_t *tl;
   4716 	struct nfsrv_descript nfsd, *nd = &nfsd;
   4717 	struct nfsfh *nfhp;
   4718 	struct nfsclflayout *flp, *prevflp, *tflp;
   4719 	int cnt, error, gotiomode, fhcnt, nfhlen, i, j;
   4720 	uint8_t *cp;
   4721 	uint64_t retlen;
   4722 
   4723 	flp = NULL;
   4724 	gotiomode = -1;
   4725 	nfscl_reqstart(nd, NFSPROC_LAYOUTGET, nmp, fhp, fhlen, NULL, NULL);
   4726 	NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + 3 * NFSX_HYPER +
   4727 	    NFSX_STATEID);
   4728 	*tl++ = newnfs_false;		/* Don't signal availability. */
   4729 	*tl++ = txdr_unsigned(NFSLAYOUT_NFSV4_1_FILES);
   4730 	*tl++ = txdr_unsigned(iomode);
   4731 	txdr_hyper(offset, tl);
   4732 	tl += 2;
   4733 	txdr_hyper(len, tl);
   4734 	tl += 2;
   4735 	txdr_hyper(minlen, tl);
   4736 	tl += 2;
   4737 	*tl++ = txdr_unsigned(stateidp->seqid);
   4738 	NFSCL_DEBUG(4, "layget seq=%d\n", (int)stateidp->seqid);
   4739 	*tl++ = stateidp->other[0];
   4740 	*tl++ = stateidp->other[1];
   4741 	*tl++ = stateidp->other[2];
   4742 	*tl = txdr_unsigned(layoutlen);
   4743 	nd->nd_flag |= ND_USEGSSNAME;
   4744 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4745 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4746 	if (error != 0)
   4747 		return (error);
   4748 	if (nd->nd_repstat == 0) {
   4749 		NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED + NFSX_STATEID);
   4750 		if (*tl++ != 0)
   4751 			*retonclosep = 1;
   4752 		else
   4753 			*retonclosep = 0;
   4754 		stateidp->seqid = fxdr_unsigned(uint32_t, *tl++);
   4755 		NFSCL_DEBUG(4, "retoncls=%d stseq=%d\n", *retonclosep,
   4756 		    (int)stateidp->seqid);
   4757 		stateidp->other[0] = *tl++;
   4758 		stateidp->other[1] = *tl++;
   4759 		stateidp->other[2] = *tl++;
   4760 		cnt = fxdr_unsigned(int, *tl);
   4761 		NFSCL_DEBUG(4, "layg cnt=%d\n", cnt);
   4762 		if (cnt <= 0 || cnt > 10000) {
   4763 			/* Don't accept more than 10000 layouts in reply. */
   4764 			error = NFSERR_BADXDR;
   4765 			goto nfsmout;
   4766 		}
   4767 		for (i = 0; i < cnt; i++) {
   4768 			/* Dissect all the way to the file handle cnt. */
   4769 			NFSM_DISSECT(tl, uint32_t *, 3 * NFSX_HYPER +
   4770 			    6 * NFSX_UNSIGNED + NFSX_V4DEVICEID);
   4771 			fhcnt = fxdr_unsigned(int, *(tl + 11 +
   4772 			    NFSX_V4DEVICEID / NFSX_UNSIGNED));
   4773 			NFSCL_DEBUG(4, "fhcnt=%d\n", fhcnt);
   4774 			if (fhcnt < 0 || fhcnt > 100) {
   4775 				/* Don't accept more than 100 file handles. */
   4776 				error = NFSERR_BADXDR;
   4777 				goto nfsmout;
   4778 			}
   4779 			if (fhcnt > 1)
   4780 				flp = malloc(sizeof(*flp) + (fhcnt - 1) *
   4781 				    sizeof(struct nfsfh *),
   4782 				    M_NFSFLAYOUT, M_WAITOK);
   4783 			else
   4784 				flp = malloc(sizeof(*flp),
   4785 				    M_NFSFLAYOUT, M_WAITOK);
   4786 			flp->nfsfl_flags = 0;
   4787 			flp->nfsfl_fhcnt = 0;
   4788 			flp->nfsfl_devp = NULL;
   4789 			flp->nfsfl_off = fxdr_hyper(tl); tl += 2;
   4790 			retlen = fxdr_hyper(tl); tl += 2;
   4791 			if (flp->nfsfl_off + retlen < flp->nfsfl_off)
   4792 				flp->nfsfl_end = UINT64_MAX - flp->nfsfl_off;
   4793 			else
   4794 				flp->nfsfl_end = flp->nfsfl_off + retlen;
   4795 			flp->nfsfl_iomode = fxdr_unsigned(int, *tl++);
   4796 			if (gotiomode == -1)
   4797 				gotiomode = flp->nfsfl_iomode;
   4798 			NFSCL_DEBUG(4, "layg reqiom=%d retiom=%d\n", iomode,
   4799 			    (int)flp->nfsfl_iomode);
   4800 			if (fxdr_unsigned(int, *tl++) !=
   4801 			    NFSLAYOUT_NFSV4_1_FILES) {
   4802 				printf("NFSv4.1: got non-files layout\n");
   4803 				error = NFSERR_BADXDR;
   4804 				goto nfsmout;
   4805 			}
   4806 			NFSBCOPY(++tl, flp->nfsfl_dev, NFSX_V4DEVICEID);
   4807 			tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
   4808 			flp->nfsfl_util = fxdr_unsigned(uint32_t, *tl++);
   4809 			NFSCL_DEBUG(4, "flutil=0x%x\n", flp->nfsfl_util);
   4810 			flp->nfsfl_stripe1 = fxdr_unsigned(uint32_t, *tl++);
   4811 			flp->nfsfl_patoff = fxdr_hyper(tl); tl += 2;
   4812 			if (fxdr_unsigned(int, *tl) != fhcnt) {
   4813 				printf("EEK! bad fhcnt\n");
   4814 				error = NFSERR_BADXDR;
   4815 				goto nfsmout;
   4816 			}
   4817 			for (j = 0; j < fhcnt; j++) {
   4818 				NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   4819 				nfhlen = fxdr_unsigned(int, *tl);
   4820 				if (nfhlen <= 0 || nfhlen > NFSX_V4FHMAX) {
   4821 					error = NFSERR_BADXDR;
   4822 					goto nfsmout;
   4823 				}
   4824 				nfhp = malloc(sizeof(*nfhp) + nfhlen - 1,
   4825 				    M_NFSFH, M_WAITOK);
   4826 				flp->nfsfl_fh[j] = nfhp;
   4827 				flp->nfsfl_fhcnt++;
   4828 				nfhp->nfh_len = nfhlen;
   4829 				NFSM_DISSECT(cp, uint8_t *, NFSM_RNDUP(nfhlen));
   4830 				NFSBCOPY(cp, nfhp->nfh_fh, nfhlen);
   4831 			}
   4832 			if (flp->nfsfl_iomode == gotiomode) {
   4833 				/* Keep the list in increasing offset order. */
   4834 				tflp = LIST_FIRST(flhp);
   4835 				prevflp = NULL;
   4836 				while (tflp != NULL &&
   4837 				    tflp->nfsfl_off < flp->nfsfl_off) {
   4838 					prevflp = tflp;
   4839 					tflp = LIST_NEXT(tflp, nfsfl_list);
   4840 				}
   4841 				if (prevflp == NULL)
   4842 					LIST_INSERT_HEAD(flhp, flp, nfsfl_list);
   4843 				else
   4844 					LIST_INSERT_AFTER(prevflp, flp,
   4845 					    nfsfl_list);
   4846 			} else {
   4847 				printf("nfscl_layoutget(): got wrong iomode\n");
   4848 				nfscl_freeflayout(flp);
   4849 			}
   4850 			flp = NULL;
   4851 		}
   4852 	}
   4853 	if (nd->nd_repstat != 0 && error == 0)
   4854 		error = nd->nd_repstat;
   4855 nfsmout:
   4856 	if (error != 0 && flp != NULL)
   4857 		nfscl_freeflayout(flp);
   4858 	mbuf_freem(nd->nd_mrep);
   4859 	return (error);
   4860 }
   4861 
   4862 /*
   4863  * Do the NFSv4.1 Get Device Info.
   4864  */
   4865 int
   4866 nfsrpc_getdeviceinfo(struct nfsmount *nmp, uint8_t *deviceid, int layouttype,
   4867     uint32_t *notifybitsp, struct nfscldevinfo **ndip, struct ucred *cred,
   4868     NFSPROC_T *p)
   4869 {
   4870 	uint32_t cnt, *tl;
   4871 	struct nfsrv_descript nfsd;
   4872 	struct nfsrv_descript *nd = &nfsd;
   4873 	struct sockaddr_storage ss;
   4874 	struct nfsclds *dsp = NULL, **dspp;
   4875 	struct nfscldevinfo *ndi;
   4876 	int addrcnt, bitcnt, error, i, isudp, j, pos, safilled, stripecnt;
   4877 	uint8_t stripeindex;
   4878 
   4879 	*ndip = NULL;
   4880 	ndi = NULL;
   4881 	nfscl_reqstart(nd, NFSPROC_GETDEVICEINFO, nmp, NULL, 0, NULL, NULL);
   4882 	NFSM_BUILD(tl, uint32_t *, NFSX_V4DEVICEID + 3 * NFSX_UNSIGNED);
   4883 	NFSBCOPY(deviceid, tl, NFSX_V4DEVICEID);
   4884 	tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
   4885 	*tl++ = txdr_unsigned(layouttype);
   4886 	*tl++ = txdr_unsigned(100000);
   4887 	if (notifybitsp != NULL && *notifybitsp != 0) {
   4888 		*tl = txdr_unsigned(1);		/* One word of bits. */
   4889 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
   4890 		*tl = txdr_unsigned(*notifybitsp);
   4891 	} else
   4892 		*tl = txdr_unsigned(0);
   4893 	nd->nd_flag |= ND_USEGSSNAME;
   4894 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   4895 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   4896 	if (error != 0)
   4897 		return (error);
   4898 	if (nd->nd_repstat == 0) {
   4899 		NFSM_DISSECT(tl, uint32_t *, 3 * NFSX_UNSIGNED);
   4900 		if (layouttype != fxdr_unsigned(int, *tl++))
   4901 			printf("EEK! devinfo layout type not same!\n");
   4902 		stripecnt = fxdr_unsigned(int, *++tl);
   4903 		NFSCL_DEBUG(4, "stripecnt=%d\n", stripecnt);
   4904 		if (stripecnt < 1 || stripecnt > 4096) {
   4905 			printf("NFS devinfo stripecnt %d: out of range\n",
   4906 			    stripecnt);
   4907 			error = NFSERR_BADXDR;
   4908 			goto nfsmout;
   4909 		}
   4910 		NFSM_DISSECT(tl, uint32_t *, (stripecnt + 1) * NFSX_UNSIGNED);
   4911 		addrcnt = fxdr_unsigned(int, *(tl + stripecnt));
   4912 		NFSCL_DEBUG(4, "addrcnt=%d\n", addrcnt);
   4913 		if (addrcnt < 1 || addrcnt > 128) {
   4914 			printf("NFS devinfo addrcnt %d: out of range\n",
   4915 			    addrcnt);
   4916 			error = NFSERR_BADXDR;
   4917 			goto nfsmout;
   4918 		}
   4919 
   4920 		/*
   4921 		 * Now we know how many stripe indices and addresses, so
   4922 		 * we can allocate the structure the correct size.
   4923 		 */
   4924 		i = (stripecnt * sizeof(uint8_t)) / sizeof(struct nfsclds *)
   4925 		    + 1;
   4926 		NFSCL_DEBUG(4, "stripeindices=%d\n", i);
   4927 		ndi = malloc(sizeof(*ndi) + (addrcnt + i) *
   4928 		    sizeof(struct nfsclds *), M_NFSDEVINFO, M_WAITOK | M_ZERO);
   4929 		NFSBCOPY(deviceid, ndi->nfsdi_deviceid, NFSX_V4DEVICEID);
   4930 		ndi->nfsdi_refcnt = 0;
   4931 		ndi->nfsdi_stripecnt = stripecnt;
   4932 		ndi->nfsdi_addrcnt = addrcnt;
   4933 		/* Fill in the stripe indices. */
   4934 		for (i = 0; i < stripecnt; i++) {
   4935 			stripeindex = fxdr_unsigned(uint8_t, *tl++);
   4936 			NFSCL_DEBUG(4, "stripeind=%d\n", stripeindex);
   4937 			if (stripeindex >= addrcnt) {
   4938 				printf("NFS devinfo stripeindex %d: too big\n",
   4939 				    (int)stripeindex);
   4940 				error = NFSERR_BADXDR;
   4941 				goto nfsmout;
   4942 			}
   4943 			nfsfldi_setstripeindex(ndi, i, stripeindex);
   4944 		}
   4945 
   4946 		/* Now, dissect the server address(es). */
   4947 		safilled = 0;
   4948 		for (i = 0; i < addrcnt; i++) {
   4949 			NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   4950 			cnt = fxdr_unsigned(uint32_t, *tl);
   4951 			if (cnt == 0) {
   4952 				printf("NFS devinfo 0 len addrlist\n");
   4953 				error = NFSERR_BADXDR;
   4954 				goto nfsmout;
   4955 			}
   4956 			dspp = nfsfldi_addr(ndi, i);
   4957 			pos = arc4random() % cnt;	/* Choose one. */
   4958 			safilled = 0;
   4959 			for (j = 0; j < cnt; j++) {
   4960 				error = nfsv4_getipaddr(nd, &ss, &isudp);
   4961 				if (error != 0 && error != EPERM) {
   4962 					error = NFSERR_BADXDR;
   4963 					goto nfsmout;
   4964 				}
   4965 				if (error == 0 && isudp == 0) {
   4966 					/*
   4967 					 * The algorithm is:
   4968 					 * - use "pos" entry if it is of the
   4969 					 *   same af_family or none of them
   4970 					 *   is of the same af_family
   4971 					 * else
   4972 					 * - use the first one of the same
   4973 					 *   af_family.
   4974 					 */
   4975 					if ((safilled == 0 && ss.ss_family ==
   4976 					     nmp->nm_nam->sa_family) ||
   4977 					    (j == pos &&
   4978 					     (safilled == 0 || ss.ss_family ==
   4979 					      nmp->nm_nam->sa_family)) ||
   4980 					    (safilled == 1 && ss.ss_family ==
   4981 					     nmp->nm_nam->sa_family)) {
   4982 						error = nfsrpc_fillsa(nmp, &ss,
   4983 						    &dsp, p);
   4984 						if (error == 0) {
   4985 							*dspp = dsp;
   4986 							if (ss.ss_family ==
   4987 							 nmp->nm_nam->sa_family)
   4988 								safilled = 2;
   4989 							else
   4990 								safilled = 1;
   4991 						}
   4992 					}
   4993 				}
   4994 			}
   4995 			if (safilled == 0)
   4996 				break;
   4997 		}
   4998 
   4999 		/* And the notify bits. */
   5000 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   5001 		if (safilled != 0) {
   5002 			bitcnt = fxdr_unsigned(int, *tl);
   5003 			if (bitcnt > 0) {
   5004 				NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   5005 				if (notifybitsp != NULL)
   5006 					*notifybitsp =
   5007 					    fxdr_unsigned(uint32_t, *tl);
   5008 			}
   5009 			*ndip = ndi;
   5010 		} else
   5011 			error = EPERM;
   5012 	}
   5013 	if (nd->nd_repstat != 0)
   5014 		error = nd->nd_repstat;
   5015 nfsmout:
   5016 	if (error != 0 && ndi != NULL)
   5017 		nfscl_freedevinfo(ndi);
   5018 	mbuf_freem(nd->nd_mrep);
   5019 	return (error);
   5020 }
   5021 
   5022 /*
   5023  * Do the NFSv4.1 LayoutCommit.
   5024  */
   5025 int
   5026 nfsrpc_layoutcommit(struct nfsmount *nmp, uint8_t *fh, int fhlen, int reclaim,
   5027     uint64_t off, uint64_t len, uint64_t lastbyte, nfsv4stateid_t *stateidp,
   5028     int layouttype, int layoutupdatecnt, uint8_t *layp, struct ucred *cred,
   5029     NFSPROC_T *p, void *stuff)
   5030 {
   5031 	uint32_t *tl;
   5032 	struct nfsrv_descript nfsd, *nd = &nfsd;
   5033 	int error, outcnt, i;
   5034 	uint8_t *cp;
   5035 
   5036 	nfscl_reqstart(nd, NFSPROC_LAYOUTCOMMIT, nmp, fh, fhlen, NULL, NULL);
   5037 	NFSM_BUILD(tl, uint32_t *, 5 * NFSX_UNSIGNED + 3 * NFSX_HYPER +
   5038 	    NFSX_STATEID);
   5039 	txdr_hyper(off, tl);
   5040 	tl += 2;
   5041 	txdr_hyper(len, tl);
   5042 	tl += 2;
   5043 	if (reclaim != 0)
   5044 		*tl++ = newnfs_true;
   5045 	else
   5046 		*tl++ = newnfs_false;
   5047 	*tl++ = txdr_unsigned(stateidp->seqid);
   5048 	*tl++ = stateidp->other[0];
   5049 	*tl++ = stateidp->other[1];
   5050 	*tl++ = stateidp->other[2];
   5051 	*tl++ = newnfs_true;
   5052 	if (lastbyte < off)
   5053 		lastbyte = off;
   5054 	else if (lastbyte >= (off + len))
   5055 		lastbyte = off + len - 1;
   5056 	txdr_hyper(lastbyte, tl);
   5057 	tl += 2;
   5058 	*tl++ = newnfs_false;
   5059 	*tl++ = txdr_unsigned(layouttype);
   5060 	*tl = txdr_unsigned(layoutupdatecnt);
   5061 	if (layoutupdatecnt > 0) {
   5062 		KASSERT(layouttype != NFSLAYOUT_NFSV4_1_FILES,
   5063 		    ("Must be nil for Files Layout"));
   5064 		outcnt = NFSM_RNDUP(layoutupdatecnt);
   5065 		NFSM_BUILD(cp, uint8_t *, outcnt);
   5066 		NFSBCOPY(layp, cp, layoutupdatecnt);
   5067 		cp += layoutupdatecnt;
   5068 		for (i = 0; i < (outcnt - layoutupdatecnt); i++)
   5069 			*cp++ = 0x0;
   5070 	}
   5071 	nd->nd_flag |= ND_USEGSSNAME;
   5072 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   5073 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   5074 	if (error != 0)
   5075 		return (error);
   5076 	error = nd->nd_repstat;
   5077 	mbuf_freem(nd->nd_mrep);
   5078 	return (error);
   5079 }
   5080 
   5081 /*
   5082  * Do the NFSv4.1 LayoutReturn.
   5083  */
   5084 int
   5085 nfsrpc_layoutreturn(struct nfsmount *nmp, uint8_t *fh, int fhlen, int reclaim,
   5086     int layouttype, uint32_t iomode, int layoutreturn, uint64_t offset,
   5087     uint64_t len, nfsv4stateid_t *stateidp, int layoutcnt, uint32_t *layp,
   5088     struct ucred *cred, NFSPROC_T *p, void *stuff)
   5089 {
   5090 	uint32_t *tl;
   5091 	struct nfsrv_descript nfsd, *nd = &nfsd;
   5092 	int error, outcnt, i;
   5093 	uint8_t *cp;
   5094 
   5095 	nfscl_reqstart(nd, NFSPROC_LAYOUTRETURN, nmp, fh, fhlen, NULL, NULL);
   5096 	NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED);
   5097 	if (reclaim != 0)
   5098 		*tl++ = newnfs_true;
   5099 	else
   5100 		*tl++ = newnfs_false;
   5101 	*tl++ = txdr_unsigned(layouttype);
   5102 	*tl++ = txdr_unsigned(iomode);
   5103 	*tl = txdr_unsigned(layoutreturn);
   5104 	if (layoutreturn == NFSLAYOUTRETURN_FILE) {
   5105 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
   5106 		    NFSX_UNSIGNED);
   5107 		txdr_hyper(offset, tl);
   5108 		tl += 2;
   5109 		txdr_hyper(len, tl);
   5110 		tl += 2;
   5111 		NFSCL_DEBUG(4, "layoutret stseq=%d\n", (int)stateidp->seqid);
   5112 		*tl++ = txdr_unsigned(stateidp->seqid);
   5113 		*tl++ = stateidp->other[0];
   5114 		*tl++ = stateidp->other[1];
   5115 		*tl++ = stateidp->other[2];
   5116 		*tl = txdr_unsigned(layoutcnt);
   5117 		if (layoutcnt > 0) {
   5118 			outcnt = NFSM_RNDUP(layoutcnt);
   5119 			NFSM_BUILD(cp, uint8_t *, outcnt);
   5120 			NFSBCOPY(layp, cp, layoutcnt);
   5121 			cp += layoutcnt;
   5122 			for (i = 0; i < (outcnt - layoutcnt); i++)
   5123 				*cp++ = 0x0;
   5124 		}
   5125 	}
   5126 	nd->nd_flag |= ND_USEGSSNAME;
   5127 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   5128 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   5129 	if (error != 0)
   5130 		return (error);
   5131 	if (nd->nd_repstat == 0) {
   5132 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   5133 		if (*tl != 0) {
   5134 			NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
   5135 			stateidp->seqid = fxdr_unsigned(uint32_t, *tl++);
   5136 			stateidp->other[0] = *tl++;
   5137 			stateidp->other[1] = *tl++;
   5138 			stateidp->other[2] = *tl;
   5139 		}
   5140 	} else
   5141 		error = nd->nd_repstat;
   5142 nfsmout:
   5143 	mbuf_freem(nd->nd_mrep);
   5144 	return (error);
   5145 }
   5146 
   5147 /*
   5148  * Acquire a layout and devinfo, if possible. The caller must have acquired
   5149  * a reference count on the nfsclclient structure before calling this.
   5150  * Return the layout in lypp with a reference count on it, if successful.
   5151  */
   5152 static int
   5153 nfsrpc_getlayout(struct nfsmount *nmp, vnode_t vp, struct nfsfh *nfhp,
   5154     int iomode, uint32_t *notifybitsp, nfsv4stateid_t *stateidp, uint64_t off,
   5155     struct nfscllayout **lypp, struct ucred *cred, NFSPROC_T *p)
   5156 {
   5157 	struct nfscllayout *lyp;
   5158 	struct nfsclflayout *flp, *tflp;
   5159 	struct nfscldevinfo *dip;
   5160 	struct nfsclflayouthead flh;
   5161 	int error = 0, islocked, layoutlen, recalled, retonclose;
   5162 	nfsv4stateid_t stateid;
   5163 
   5164 	*lypp = NULL;
   5165 	/*
   5166 	 * If lyp is returned non-NULL, there will be a refcnt (shared lock)
   5167 	 * on it, iff flp != NULL or a lock (exclusive lock) on it iff
   5168 	 * flp == NULL.
   5169 	 */
   5170 	lyp = nfscl_getlayout(nmp->nm_clp, nfhp->nfh_fh, nfhp->nfh_len,
   5171 	    off, &flp, &recalled);
   5172 	islocked = 0;
   5173 	if (lyp == NULL || flp == NULL) {
   5174 		if (recalled != 0)
   5175 			return (EIO);
   5176 		LIST_INIT(&flh);
   5177 		layoutlen = NFSMNT_MDSSESSION(nmp)->nfsess_maxcache -
   5178 		    (NFSX_STATEID + 3 * NFSX_UNSIGNED);
   5179 		if (lyp == NULL) {
   5180 			stateid.seqid = 0;
   5181 			stateid.other[0] = stateidp->other[0];
   5182 			stateid.other[1] = stateidp->other[1];
   5183 			stateid.other[2] = stateidp->other[2];
   5184 			error = nfsrpc_layoutget(nmp, nfhp->nfh_fh,
   5185 			    nfhp->nfh_len, iomode, (uint64_t)0, INT64_MAX,
   5186 			    (uint64_t)0, layoutlen, &stateid, &retonclose,
   5187 			    &flh, cred, p, NULL);
   5188 		} else {
   5189 			islocked = 1;
   5190 			stateid.seqid = lyp->nfsly_stateid.seqid;
   5191 			stateid.other[0] = lyp->nfsly_stateid.other[0];
   5192 			stateid.other[1] = lyp->nfsly_stateid.other[1];
   5193 			stateid.other[2] = lyp->nfsly_stateid.other[2];
   5194 			error = nfsrpc_layoutget(nmp, nfhp->nfh_fh,
   5195 			    nfhp->nfh_len, iomode, off, INT64_MAX,
   5196 			    (uint64_t)0, layoutlen, &stateid, &retonclose,
   5197 			    &flh, cred, p, NULL);
   5198 		}
   5199 		if (error == 0)
   5200 			LIST_FOREACH(tflp, &flh, nfsfl_list) {
   5201 				error = nfscl_adddevinfo(nmp, NULL, tflp);
   5202 				if (error != 0) {
   5203 					error = nfsrpc_getdeviceinfo(nmp,
   5204 					    tflp->nfsfl_dev,
   5205 					    NFSLAYOUT_NFSV4_1_FILES,
   5206 					    notifybitsp, &dip, cred, p);
   5207 					if (error != 0)
   5208 						break;
   5209 					error = nfscl_adddevinfo(nmp, dip,
   5210 					    tflp);
   5211 					if (error != 0)
   5212 						printf(
   5213 						    "getlayout: cannot add\n");
   5214 				}
   5215 			}
   5216 		if (error == 0) {
   5217 			/*
   5218 			 * nfscl_layout() always returns with the nfsly_lock
   5219 			 * set to a refcnt (shared lock).
   5220 			 */
   5221 			error = nfscl_layout(nmp, vp, nfhp->nfh_fh,
   5222 			    nfhp->nfh_len, &stateid, retonclose, &flh, &lyp,
   5223 			    cred, p);
   5224 			if (error == 0)
   5225 				*lypp = lyp;
   5226 		} else if (islocked != 0)
   5227 			nfsv4_unlock(&lyp->nfsly_lock, 0);
   5228 	} else
   5229 		*lypp = lyp;
   5230 	return (error);
   5231 }
   5232 
   5233 /*
   5234  * Do a TCP connection plus exchange id and create session.
   5235  * If successful, a "struct nfsclds" is linked into the list for the
   5236  * mount point and a pointer to it is returned.
   5237  */
   5238 static int
   5239 nfsrpc_fillsa(struct nfsmount *nmp, struct sockaddr_storage *ssp,
   5240     struct nfsclds **dspp, NFSPROC_T *p)
   5241 {
   5242 	struct sockaddr_in *msad, *sad, *ssd;
   5243 	struct sockaddr_in6 *msad6, *sad6, *ssd6;
   5244 	struct nfsclclient *clp;
   5245 	struct nfssockreq *nrp;
   5246 	struct nfsclds *dsp, *tdsp;
   5247 	int error;
   5248 	enum nfsclds_state retv;
   5249 	uint32_t sequenceid;
   5250 
   5251 	KASSERT(nmp->nm_sockreq.nr_cred != NULL,
   5252 	    ("nfsrpc_fillsa: NULL nr_cred"));
   5253 	NFSLOCKCLSTATE();
   5254 	clp = nmp->nm_clp;
   5255 	NFSUNLOCKCLSTATE();
   5256 	if (clp == NULL)
   5257 		return (EPERM);
   5258 	if (ssp->ss_family == AF_INET) {
   5259 		ssd = (struct sockaddr_in *)ssp;
   5260 		NFSLOCKMNT(nmp);
   5261 
   5262 		/*
   5263 		 * Check to see if we already have a session for this
   5264 		 * address that is usable for a DS.
   5265 		 * Note that the MDS's address is in a different place
   5266 		 * than the sessions already acquired for DS's.
   5267 		 */
   5268 		msad = (struct sockaddr_in *)nmp->nm_sockreq.nr_nam;
   5269 		tdsp = TAILQ_FIRST(&nmp->nm_sess);
   5270 		while (tdsp != NULL) {
   5271 			if (msad != NULL && msad->sin_family == AF_INET &&
   5272 			    ssd->sin_addr.s_addr == msad->sin_addr.s_addr &&
   5273 			    ssd->sin_port == msad->sin_port &&
   5274 			    (tdsp->nfsclds_flags & NFSCLDS_DS) != 0) {
   5275 				*dspp = tdsp;
   5276 				NFSUNLOCKMNT(nmp);
   5277 				NFSCL_DEBUG(4, "fnd same addr\n");
   5278 				return (0);
   5279 			}
   5280 			tdsp = TAILQ_NEXT(tdsp, nfsclds_list);
   5281 			if (tdsp != NULL && tdsp->nfsclds_sockp != NULL)
   5282 				msad = (struct sockaddr_in *)
   5283 				    tdsp->nfsclds_sockp->nr_nam;
   5284 			else
   5285 				msad = NULL;
   5286 		}
   5287 		NFSUNLOCKMNT(nmp);
   5288 
   5289 		/* No IP address match, so look for new/trunked one. */
   5290 		sad = malloc(sizeof(*sad), M_SONAME, M_WAITOK | M_ZERO);
   5291 		sad->sin_len = sizeof(*sad);
   5292 		sad->sin_family = AF_INET;
   5293 		sad->sin_port = ssd->sin_port;
   5294 		sad->sin_addr.s_addr = ssd->sin_addr.s_addr;
   5295 		nrp = malloc(sizeof(*nrp), M_NFSSOCKREQ, M_WAITOK | M_ZERO);
   5296 		nrp->nr_nam = (struct sockaddr *)sad;
   5297 	} else if (ssp->ss_family == AF_INET6) {
   5298 		ssd6 = (struct sockaddr_in6 *)ssp;
   5299 		NFSLOCKMNT(nmp);
   5300 
   5301 		/*
   5302 		 * Check to see if we already have a session for this
   5303 		 * address that is usable for a DS.
   5304 		 * Note that the MDS's address is in a different place
   5305 		 * than the sessions already acquired for DS's.
   5306 		 */
   5307 		msad6 = (struct sockaddr_in6 *)nmp->nm_sockreq.nr_nam;
   5308 		tdsp = TAILQ_FIRST(&nmp->nm_sess);
   5309 		while (tdsp != NULL) {
   5310 			if (msad6 != NULL && msad6->sin6_family == AF_INET6 &&
   5311 			    IN6_ARE_ADDR_EQUAL(&ssd6->sin6_addr,
   5312 			    &msad6->sin6_addr) &&
   5313 			    ssd6->sin6_port == msad6->sin6_port &&
   5314 			    (tdsp->nfsclds_flags & NFSCLDS_DS) != 0) {
   5315 				*dspp = tdsp;
   5316 				NFSUNLOCKMNT(nmp);
   5317 				return (0);
   5318 			}
   5319 			tdsp = TAILQ_NEXT(tdsp, nfsclds_list);
   5320 			if (tdsp != NULL && tdsp->nfsclds_sockp != NULL)
   5321 				msad6 = (struct sockaddr_in6 *)
   5322 				    tdsp->nfsclds_sockp->nr_nam;
   5323 			else
   5324 				msad6 = NULL;
   5325 		}
   5326 		NFSUNLOCKMNT(nmp);
   5327 
   5328 		/* No IP address match, so look for new/trunked one. */
   5329 		sad6 = malloc(sizeof(*sad6), M_SONAME, M_WAITOK | M_ZERO);
   5330 		sad6->sin6_len = sizeof(*sad6);
   5331 		sad6->sin6_family = AF_INET6;
   5332 		sad6->sin6_port = ssd6->sin6_port;
   5333 		NFSBCOPY(&ssd6->sin6_addr, &sad6->sin6_addr,
   5334 		    sizeof(struct in6_addr));
   5335 		nrp = malloc(sizeof(*nrp), M_NFSSOCKREQ, M_WAITOK | M_ZERO);
   5336 		nrp->nr_nam = (struct sockaddr *)sad6;
   5337 	} else
   5338 		return (EPERM);
   5339 
   5340 	nrp->nr_sotype = SOCK_STREAM;
   5341 	mtx_init(&nrp->nr_mtx, "nfssock", NULL, MTX_DEF);
   5342 	nrp->nr_prog = NFS_PROG;
   5343 	nrp->nr_vers = NFS_VER4;
   5344 
   5345 	/*
   5346 	 * Use the credentials that were used for the mount, which are
   5347 	 * in nmp->nm_sockreq.nr_cred for newnfs_connect() etc.
   5348 	 * Ref. counting the credentials with crhold() is probably not
   5349 	 * necessary, since nm_sockreq.nr_cred won't be crfree()'d until
   5350 	 * unmount, but I did it anyhow.
   5351 	 */
   5352 	nrp->nr_cred = crhold(nmp->nm_sockreq.nr_cred);
   5353 	error = newnfs_connect(nmp, nrp, NULL, p, 0);
   5354 	NFSCL_DEBUG(3, "DS connect=%d\n", error);
   5355 
   5356 	/* Now, do the exchangeid and create session. */
   5357 	if (error == 0)
   5358 		error = nfsrpc_exchangeid(nmp, clp, nrp, NFSV4EXCH_USEPNFSDS,
   5359 		    &dsp, nrp->nr_cred, p);
   5360 	NFSCL_DEBUG(3, "DS exchangeid=%d\n", error);
   5361 	if (error == 0) {
   5362 		dsp->nfsclds_sockp = nrp;
   5363 		NFSLOCKMNT(nmp);
   5364 		retv = nfscl_getsameserver(nmp, dsp, &tdsp);
   5365 		NFSCL_DEBUG(3, "getsame ret=%d\n", retv);
   5366 		if (retv == NFSDSP_USETHISSESSION) {
   5367 			NFSUNLOCKMNT(nmp);
   5368 			/*
   5369 			 * If there is already a session for this server,
   5370 			 * use it.
   5371 			 */
   5372 			(void)newnfs_disconnect(nrp);
   5373 			nfscl_freenfsclds(dsp);
   5374 			*dspp = tdsp;
   5375 			return (0);
   5376 		}
   5377 		if (retv == NFSDSP_SEQTHISSESSION)
   5378 			sequenceid = tdsp->nfsclds_sess.nfsess_sequenceid;
   5379 		else
   5380 			sequenceid = dsp->nfsclds_sess.nfsess_sequenceid;
   5381 		NFSUNLOCKMNT(nmp);
   5382 		error = nfsrpc_createsession(nmp, &dsp->nfsclds_sess,
   5383 		    nrp, sequenceid, 0, nrp->nr_cred, p);
   5384 		NFSCL_DEBUG(3, "DS createsess=%d\n", error);
   5385 	} else {
   5386 		NFSFREECRED(nrp->nr_cred);
   5387 		NFSFREEMUTEX(&nrp->nr_mtx);
   5388 		free(nrp->nr_nam, M_SONAME);
   5389 		free(nrp, M_NFSSOCKREQ);
   5390 	}
   5391 	if (error == 0) {
   5392 		NFSCL_DEBUG(3, "add DS session\n");
   5393 		/*
   5394 		 * Put it at the end of the list. That way the list
   5395 		 * is ordered by when the entry was added. This matters
   5396 		 * since the one done first is the one that should be
   5397 		 * used for sequencid'ing any subsequent create sessions.
   5398 		 */
   5399 		NFSLOCKMNT(nmp);
   5400 		TAILQ_INSERT_TAIL(&nmp->nm_sess, dsp, nfsclds_list);
   5401 		NFSUNLOCKMNT(nmp);
   5402 		*dspp = dsp;
   5403 	} else if (dsp != NULL)
   5404 		nfscl_freenfsclds(dsp);
   5405 	return (error);
   5406 }
   5407 
   5408 /*
   5409  * Do the NFSv4.1 Reclaim Complete.
   5410  */
   5411 int
   5412 nfsrpc_reclaimcomplete(struct nfsmount *nmp, struct ucred *cred, NFSPROC_T *p)
   5413 {
   5414 	uint32_t *tl;
   5415 	struct nfsrv_descript nfsd;
   5416 	struct nfsrv_descript *nd = &nfsd;
   5417 	int error;
   5418 
   5419 	nfscl_reqstart(nd, NFSPROC_RECLAIMCOMPL, nmp, NULL, 0, NULL, NULL);
   5420 	NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
   5421 	*tl = newnfs_false;
   5422 	nd->nd_flag |= ND_USEGSSNAME;
   5423 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
   5424 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
   5425 	if (error != 0)
   5426 		return (error);
   5427 	error = nd->nd_repstat;
   5428 	mbuf_freem(nd->nd_mrep);
   5429 	return (error);
   5430 }
   5431 
   5432 /*
   5433  * Initialize the slot tables for a session.
   5434  */
   5435 static void
   5436 nfscl_initsessionslots(struct nfsclsession *sep)
   5437 {
   5438 	int i;
   5439 
   5440 	for (i = 0; i < NFSV4_CBSLOTS; i++) {
   5441 		if (sep->nfsess_cbslots[i].nfssl_reply != NULL)
   5442 			m_freem(sep->nfsess_cbslots[i].nfssl_reply);
   5443 		NFSBZERO(&sep->nfsess_cbslots[i], sizeof(struct nfsslot));
   5444 	}
   5445 	for (i = 0; i < 64; i++)
   5446 		sep->nfsess_slotseq[i] = 0;
   5447 	sep->nfsess_slots = 0;
   5448 }
   5449 
   5450 /*
   5451  * Called to try and do an I/O operation via an NFSv4.1 Data Server (DS).
   5452  */
   5453 int
   5454 nfscl_doiods(vnode_t vp, struct uio *uiop, int *iomode, int *must_commit,
   5455     uint32_t rwaccess, struct ucred *cred, NFSPROC_T *p)
   5456 {
   5457 	struct nfsnode *np = VTONFS(vp);
   5458 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   5459 	struct nfscllayout *layp;
   5460 	struct nfscldevinfo *dip;
   5461 	struct nfsclflayout *rflp;
   5462 	nfsv4stateid_t stateid;
   5463 	struct ucred *newcred;
   5464 	uint64_t lastbyte, len, off, oresid, xfer;
   5465 	int eof, error, iolaymode, recalled;
   5466 	void *lckp;
   5467 
   5468 	if (!NFSHASPNFS(nmp) || nfscl_enablecallb == 0 || nfs_numnfscbd == 0 ||
   5469 	    (np->n_flag & NNOLAYOUT) != 0)
   5470 		return (EIO);
   5471 	/* Now, get a reference cnt on the clientid for this mount. */
   5472 	if (nfscl_getref(nmp) == 0)
   5473 		return (EIO);
   5474 
   5475 	/* Find an appropriate stateid. */
   5476 	newcred = NFSNEWCRED(cred);
   5477 	error = nfscl_getstateid(vp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len,
   5478 	    rwaccess, 1, newcred, p, &stateid, &lckp);
   5479 	if (error != 0) {
   5480 		NFSFREECRED(newcred);
   5481 		nfscl_relref(nmp);
   5482 		return (error);
   5483 	}
   5484 	/* Search for a layout for this file. */
   5485 	off = uiop->uio_offset;
   5486 	layp = nfscl_getlayout(nmp->nm_clp, np->n_fhp->nfh_fh,
   5487 	    np->n_fhp->nfh_len, off, &rflp, &recalled);
   5488 	if (layp == NULL || rflp == NULL) {
   5489 		if (recalled != 0) {
   5490 			NFSFREECRED(newcred);
   5491 			nfscl_relref(nmp);
   5492 			return (EIO);
   5493 		}
   5494 		if (layp != NULL) {
   5495 			nfscl_rellayout(layp, (rflp == NULL) ? 1 : 0);
   5496 			layp = NULL;
   5497 		}
   5498 		/* Try and get a Layout, if it is supported. */
   5499 		if (rwaccess == NFSV4OPEN_ACCESSWRITE ||
   5500 		    (np->n_flag & NWRITEOPENED) != 0)
   5501 			iolaymode = NFSLAYOUTIOMODE_RW;
   5502 		else
   5503 			iolaymode = NFSLAYOUTIOMODE_READ;
   5504 		error = nfsrpc_getlayout(nmp, vp, np->n_fhp, iolaymode,
   5505 		    NULL, &stateid, off, &layp, newcred, p);
   5506 		if (error != 0) {
   5507 			NFSLOCKNODE(np);
   5508 			np->n_flag |= NNOLAYOUT;
   5509 			NFSUNLOCKNODE(np);
   5510 			if (lckp != NULL)
   5511 				nfscl_lockderef(lckp);
   5512 			NFSFREECRED(newcred);
   5513 			if (layp != NULL)
   5514 				nfscl_rellayout(layp, 0);
   5515 			nfscl_relref(nmp);
   5516 			return (error);
   5517 		}
   5518 	}
   5519 
   5520 	/*
   5521 	 * Loop around finding a layout that works for the first part of
   5522 	 * this I/O operation, and then call the function that actually
   5523 	 * does the RPC.
   5524 	 */
   5525 	eof = 0;
   5526 	len = (uint64_t)uiop->uio_resid;
   5527 	while (len > 0 && error == 0 && eof == 0) {
   5528 		off = uiop->uio_offset;
   5529 		error = nfscl_findlayoutforio(layp, off, rwaccess, &rflp);
   5530 		if (error == 0) {
   5531 			oresid = xfer = (uint64_t)uiop->uio_resid;
   5532 			if (xfer > (rflp->nfsfl_end - rflp->nfsfl_off))
   5533 				xfer = rflp->nfsfl_end - rflp->nfsfl_off;
   5534 			dip = nfscl_getdevinfo(nmp->nm_clp, rflp->nfsfl_dev,
   5535 			    rflp->nfsfl_devp);
   5536 			if (dip != NULL) {
   5537 				error = nfscl_doflayoutio(vp, uiop, iomode,
   5538 				    must_commit, &eof, &stateid, rwaccess, dip,
   5539 				    layp, rflp, off, xfer, newcred, p);
   5540 				nfscl_reldevinfo(dip);
   5541 				lastbyte = off + xfer - 1;
   5542 				if (error == 0) {
   5543 					NFSLOCKCLSTATE();
   5544 					if (lastbyte > layp->nfsly_lastbyte)
   5545 						layp->nfsly_lastbyte = lastbyte;
   5546 					NFSUNLOCKCLSTATE();
   5547 				}
   5548 			} else
   5549 				error = EIO;
   5550 			if (error == 0)
   5551 				len -= (oresid - (uint64_t)uiop->uio_resid);
   5552 		}
   5553 	}
   5554 	if (lckp != NULL)
   5555 		nfscl_lockderef(lckp);
   5556 	NFSFREECRED(newcred);
   5557 	nfscl_rellayout(layp, 0);
   5558 	nfscl_relref(nmp);
   5559 	return (error);
   5560 }
   5561 
   5562 /*
   5563  * Find a file layout that will handle the first bytes of the requested
   5564  * range and return the information from it needed to to the I/O operation.
   5565  */
   5566 int
   5567 nfscl_findlayoutforio(struct nfscllayout *lyp, uint64_t off, uint32_t rwaccess,
   5568     struct nfsclflayout **retflpp)
   5569 {
   5570 	struct nfsclflayout *flp, *nflp, *rflp;
   5571 	uint32_t rw;
   5572 
   5573 	rflp = NULL;
   5574 	rw = rwaccess;
   5575 	/* For reading, do the Read list first and then the Write list. */
   5576 	do {
   5577 		if (rw == NFSV4OPEN_ACCESSREAD)
   5578 			flp = LIST_FIRST(&lyp->nfsly_flayread);
   5579 		else
   5580 			flp = LIST_FIRST(&lyp->nfsly_flayrw);
   5581 		while (flp != NULL) {
   5582 			nflp = LIST_NEXT(flp, nfsfl_list);
   5583 			if (flp->nfsfl_off > off)
   5584 				break;
   5585 			if (flp->nfsfl_end > off &&
   5586 			    (rflp == NULL || rflp->nfsfl_end < flp->nfsfl_end))
   5587 				rflp = flp;
   5588 			flp = nflp;
   5589 		}
   5590 		if (rw == NFSV4OPEN_ACCESSREAD)
   5591 			rw = NFSV4OPEN_ACCESSWRITE;
   5592 		else
   5593 			rw = 0;
   5594 	} while (rw != 0);
   5595 	if (rflp != NULL) {
   5596 		/* This one covers the most bytes starting at off. */
   5597 		*retflpp = rflp;
   5598 		return (0);
   5599 	}
   5600 	return (EIO);
   5601 }
   5602 
   5603 /*
   5604  * Do I/O using an NFSv4.1 file layout.
   5605  */
   5606 static int
   5607 nfscl_doflayoutio(vnode_t vp, struct uio *uiop, int *iomode, int *must_commit,
   5608     int *eofp, nfsv4stateid_t *stateidp, int rwflag, struct nfscldevinfo *dp,
   5609     struct nfscllayout *lyp, struct nfsclflayout *flp, uint64_t off,
   5610     uint64_t len, struct ucred *cred, NFSPROC_T *p)
   5611 {
   5612 	uint64_t io_off, rel_off, stripe_unit_size, transfer, xfer;
   5613 	int commit_thru_mds, error = 0, stripe_index, stripe_pos;
   5614 	struct nfsnode *np;
   5615 	struct nfsfh *fhp;
   5616 	struct nfsclds **dspp;
   5617 
   5618 	np = VTONFS(vp);
   5619 	rel_off = off - flp->nfsfl_patoff;
   5620 	stripe_unit_size = (flp->nfsfl_util >> 6) & 0x3ffffff;
   5621 	stripe_pos = (rel_off / stripe_unit_size + flp->nfsfl_stripe1) %
   5622 	    dp->nfsdi_stripecnt;
   5623 	transfer = stripe_unit_size - (rel_off % stripe_unit_size);
   5624 
   5625 	/* Loop around, doing I/O for each stripe unit. */
   5626 	while (len > 0 && error == 0) {
   5627 		stripe_index = nfsfldi_stripeindex(dp, stripe_pos);
   5628 		dspp = nfsfldi_addr(dp, stripe_index);
   5629 		if (len > transfer)
   5630 			xfer = transfer;
   5631 		else
   5632 			xfer = len;
   5633 		if ((flp->nfsfl_util & NFSFLAYUTIL_DENSE) != 0) {
   5634 			/* Dense layout. */
   5635 			if (stripe_pos >= flp->nfsfl_fhcnt)
   5636 				return (EIO);
   5637 			fhp = flp->nfsfl_fh[stripe_pos];
   5638 			io_off = (rel_off / (stripe_unit_size *
   5639 			    dp->nfsdi_stripecnt)) * stripe_unit_size +
   5640 			    rel_off % stripe_unit_size;
   5641 		} else {
   5642 			/* Sparse layout. */
   5643 			if (flp->nfsfl_fhcnt > 1) {
   5644 				if (stripe_index >= flp->nfsfl_fhcnt)
   5645 					return (EIO);
   5646 				fhp = flp->nfsfl_fh[stripe_index];
   5647 			} else if (flp->nfsfl_fhcnt == 1)
   5648 				fhp = flp->nfsfl_fh[0];
   5649 			else
   5650 				fhp = np->n_fhp;
   5651 			io_off = off;
   5652 		}
   5653 		if ((flp->nfsfl_util & NFSFLAYUTIL_COMMIT_THRU_MDS) != 0)
   5654 			commit_thru_mds = 1;
   5655 		else
   5656 			commit_thru_mds = 0;
   5657 		if (rwflag == FREAD)
   5658 			error = nfsrpc_readds(vp, uiop, stateidp, eofp, *dspp,
   5659 			    io_off, xfer, fhp, cred, p);
   5660 		else {
   5661 			error = nfsrpc_writeds(vp, uiop, iomode, must_commit,
   5662 			    stateidp, *dspp, io_off, xfer, fhp, commit_thru_mds,
   5663 			    cred, p);
   5664 			if (error == 0) {
   5665 				NFSLOCKCLSTATE();
   5666 				lyp->nfsly_flags |= NFSLY_WRITTEN;
   5667 				NFSUNLOCKCLSTATE();
   5668 			}
   5669 		}
   5670 		if (error == 0) {
   5671 			transfer = stripe_unit_size;
   5672 			stripe_pos = (stripe_pos + 1) % dp->nfsdi_stripecnt;
   5673 			len -= xfer;
   5674 			off += xfer;
   5675 		}
   5676 	}
   5677 	return (error);
   5678 }
   5679 
   5680 /*
   5681  * The actual read RPC done to a DS.
   5682  */
   5683 static int
   5684 nfsrpc_readds(vnode_t vp, struct uio *uiop, nfsv4stateid_t *stateidp, int *eofp,
   5685     struct nfsclds *dsp, uint64_t io_off, int len, struct nfsfh *fhp,
   5686     struct ucred *cred, NFSPROC_T *p)
   5687 {
   5688 	uint32_t *tl;
   5689 	int error, retlen;
   5690 	struct nfsrv_descript nfsd;
   5691 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   5692 	struct nfsrv_descript *nd = &nfsd;
   5693 	struct nfssockreq *nrp;
   5694 
   5695 	nd->nd_mrep = NULL;
   5696 	nfscl_reqstart(nd, NFSPROC_READDS, nmp, fhp->nfh_fh, fhp->nfh_len,
   5697 	    NULL, &dsp->nfsclds_sess);
   5698 	nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSEQIDZERO);
   5699 	NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED * 3);
   5700 	txdr_hyper(io_off, tl);
   5701 	*(tl + 2) = txdr_unsigned(len);
   5702 	nrp = dsp->nfsclds_sockp;
   5703 	if (nrp == NULL)
   5704 		/* If NULL, use the MDS socket. */
   5705 		nrp = &nmp->nm_sockreq;
   5706 	error = newnfs_request(nd, nmp, NULL, nrp, vp, p, cred,
   5707 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, &dsp->nfsclds_sess);
   5708 	if (error != 0)
   5709 		return (error);
   5710 	if (nd->nd_repstat != 0) {
   5711 		error = nd->nd_repstat;
   5712 		goto nfsmout;
   5713 	}
   5714 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
   5715 	*eofp = fxdr_unsigned(int, *tl);
   5716 	NFSM_STRSIZ(retlen, len);
   5717 	error = nfsm_mbufuio(nd, uiop, retlen);
   5718 nfsmout:
   5719 	if (nd->nd_mrep != NULL)
   5720 		mbuf_freem(nd->nd_mrep);
   5721 	return (error);
   5722 }
   5723 
   5724 /*
   5725  * The actual write RPC done to a DS.
   5726  */
   5727 static int
   5728 nfsrpc_writeds(vnode_t vp, struct uio *uiop, int *iomode, int *must_commit,
   5729     nfsv4stateid_t *stateidp, struct nfsclds *dsp, uint64_t io_off, int len,
   5730     struct nfsfh *fhp, int commit_thru_mds, struct ucred *cred, NFSPROC_T *p)
   5731 {
   5732 	uint32_t *tl;
   5733 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   5734 	int error, rlen, commit, committed = NFSWRITE_FILESYNC;
   5735 	int32_t backup;
   5736 	struct nfsrv_descript nfsd;
   5737 	struct nfsrv_descript *nd = &nfsd;
   5738 	struct nfssockreq *nrp;
   5739 
   5740 	KASSERT(uiop->uio_iovcnt == 1, ("nfs: writerpc iovcnt > 1"));
   5741 	nd->nd_mrep = NULL;
   5742 	nfscl_reqstart(nd, NFSPROC_WRITEDS, nmp, fhp->nfh_fh, fhp->nfh_len,
   5743 	    NULL, &dsp->nfsclds_sess);
   5744 	nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSEQIDZERO);
   5745 	NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + 2 * NFSX_UNSIGNED);
   5746 	txdr_hyper(io_off, tl);
   5747 	tl += 2;
   5748 	*tl++ = txdr_unsigned(*iomode);
   5749 	*tl = txdr_unsigned(len);
   5750 	nfsm_uiombuf(nd, uiop, len);
   5751 	nrp = dsp->nfsclds_sockp;
   5752 	if (nrp == NULL)
   5753 		/* If NULL, use the MDS socket. */
   5754 		nrp = &nmp->nm_sockreq;
   5755 	error = newnfs_request(nd, nmp, NULL, nrp, vp, p, cred,
   5756 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, &dsp->nfsclds_sess);
   5757 	if (error != 0)
   5758 		return (error);
   5759 	if (nd->nd_repstat != 0) {
   5760 		/*
   5761 		 * In case the rpc gets retried, roll
   5762 		 * the uio fileds changed by nfsm_uiombuf()
   5763 		 * back.
   5764 		 */
   5765 		uiop->uio_offset -= len;
   5766 		uio_uio_resid_add(uiop, len);
   5767 		uio_iov_base_add(uiop, -len);
   5768 		uio_iov_len_add(uiop, len);
   5769 		error = nd->nd_repstat;
   5770 	} else {
   5771 		NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED + NFSX_VERF);
   5772 		rlen = fxdr_unsigned(int, *tl++);
   5773 		if (rlen == 0) {
   5774 			error = NFSERR_IO;
   5775 			goto nfsmout;
   5776 		} else if (rlen < len) {
   5777 			backup = len - rlen;
   5778 			uio_iov_base_add(uiop, -(backup));
   5779 			uio_iov_len_add(uiop, backup);
   5780 			uiop->uio_offset -= backup;
   5781 			uio_uio_resid_add(uiop, backup);
   5782 			len = rlen;
   5783 		}
   5784 		commit = fxdr_unsigned(int, *tl++);
   5785 
   5786 		/*
   5787 		 * Return the lowest commitment level
   5788 		 * obtained by any of the RPCs.
   5789 		 */
   5790 		if (committed == NFSWRITE_FILESYNC)
   5791 			committed = commit;
   5792 		else if (committed == NFSWRITE_DATASYNC &&
   5793 		    commit == NFSWRITE_UNSTABLE)
   5794 			committed = commit;
   5795 		if (commit_thru_mds != 0) {
   5796 			NFSLOCKMNT(nmp);
   5797 			if (!NFSHASWRITEVERF(nmp)) {
   5798 				NFSBCOPY(tl, nmp->nm_verf, NFSX_VERF);
   5799 				NFSSETWRITEVERF(nmp);
   5800 	    		} else if (NFSBCMP(tl, nmp->nm_verf, NFSX_VERF)) {
   5801 				*must_commit = 1;
   5802 				NFSBCOPY(tl, nmp->nm_verf, NFSX_VERF);
   5803 			}
   5804 			NFSUNLOCKMNT(nmp);
   5805 		} else {
   5806 			NFSLOCKDS(dsp);
   5807 			if ((dsp->nfsclds_flags & NFSCLDS_HASWRITEVERF) == 0) {
   5808 				NFSBCOPY(tl, dsp->nfsclds_verf, NFSX_VERF);
   5809 				dsp->nfsclds_flags |= NFSCLDS_HASWRITEVERF;
   5810 			} else if (NFSBCMP(tl, dsp->nfsclds_verf, NFSX_VERF)) {
   5811 				*must_commit = 1;
   5812 				NFSBCOPY(tl, dsp->nfsclds_verf, NFSX_VERF);
   5813 			}
   5814 			NFSUNLOCKDS(dsp);
   5815 		}
   5816 	}
   5817 nfsmout:
   5818 	if (nd->nd_mrep != NULL)
   5819 		mbuf_freem(nd->nd_mrep);
   5820 	*iomode = committed;
   5821 	if (nd->nd_repstat != 0 && error == 0)
   5822 		error = nd->nd_repstat;
   5823 	return (error);
   5824 }
   5825 
   5826 /*
   5827  * Free up the nfsclds structure.
   5828  */
   5829 void
   5830 nfscl_freenfsclds(struct nfsclds *dsp)
   5831 {
   5832 	int i;
   5833 
   5834 	if (dsp == NULL)
   5835 		return;
   5836 	if (dsp->nfsclds_sockp != NULL) {
   5837 		NFSFREECRED(dsp->nfsclds_sockp->nr_cred);
   5838 		NFSFREEMUTEX(&dsp->nfsclds_sockp->nr_mtx);
   5839 		free(dsp->nfsclds_sockp->nr_nam, M_SONAME);
   5840 		free(dsp->nfsclds_sockp, M_NFSSOCKREQ);
   5841 	}
   5842 	NFSFREEMUTEX(&dsp->nfsclds_mtx);
   5843 	NFSFREEMUTEX(&dsp->nfsclds_sess.nfsess_mtx);
   5844 	for (i = 0; i < NFSV4_CBSLOTS; i++) {
   5845 		if (dsp->nfsclds_sess.nfsess_cbslots[i].nfssl_reply != NULL)
   5846 			m_freem(
   5847 			    dsp->nfsclds_sess.nfsess_cbslots[i].nfssl_reply);
   5848 	}
   5849 	free(dsp, M_NFSCLDS);
   5850 }
   5851 
   5852 static enum nfsclds_state
   5853 nfscl_getsameserver(struct nfsmount *nmp, struct nfsclds *newdsp,
   5854     struct nfsclds **retdspp)
   5855 {
   5856 	struct nfsclds *dsp, *cur_dsp;
   5857 
   5858 	/*
   5859 	 * Search the list of nfsclds structures for one with the same
   5860 	 * server.
   5861 	 */
   5862 	cur_dsp = NULL;
   5863 	TAILQ_FOREACH(dsp, &nmp->nm_sess, nfsclds_list) {
   5864 		if (dsp->nfsclds_servownlen == newdsp->nfsclds_servownlen &&
   5865 		    dsp->nfsclds_servownlen != 0 &&
   5866 		    !NFSBCMP(dsp->nfsclds_serverown, newdsp->nfsclds_serverown,
   5867 		    dsp->nfsclds_servownlen)) {
   5868 			NFSCL_DEBUG(4, "fnd same fdsp=%p dsp=%p flg=0x%x\n",
   5869 			    TAILQ_FIRST(&nmp->nm_sess), dsp,
   5870 			    dsp->nfsclds_flags);
   5871 			/* Server major id matches. */
   5872 			if ((dsp->nfsclds_flags & NFSCLDS_DS) != 0) {
   5873 				*retdspp = dsp;
   5874 				return (NFSDSP_USETHISSESSION);
   5875 			}
   5876 
   5877 			/*
   5878 			 * Note the first match, so it can be used for
   5879 			 * sequence'ing new sessions.
   5880 			 */
   5881 			if (cur_dsp == NULL)
   5882 				cur_dsp = dsp;
   5883 		}
   5884 	}
   5885 	if (cur_dsp != NULL) {
   5886 		*retdspp = cur_dsp;
   5887 		return (NFSDSP_SEQTHISSESSION);
   5888 	}
   5889 	return (NFSDSP_NOTFOUND);
   5890 }
   5891 
   5892 #ifdef notyet
   5893 /*
   5894  * NFS commit rpc to a DS.
   5895  */
   5896 static int
   5897 nfsrpc_commitds(vnode_t vp, uint64_t offset, int cnt, struct nfsclds *dsp,
   5898     struct nfsfh *fhp, struct ucred *cred, NFSPROC_T *p, void *stuff)
   5899 {
   5900 	uint32_t *tl;
   5901 	struct nfsrv_descript nfsd, *nd = &nfsd;
   5902 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
   5903 	struct nfssockreq *nrp;
   5904 	int error;
   5905 
   5906 	nfscl_reqstart(nd, NFSPROC_COMMITDS, nmp, fhp->nfh_fh, fhp->nfh_len,
   5907 	    NULL, &dsp->nfsclds_sess);
   5908 	NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
   5909 	txdr_hyper(offset, tl);
   5910 	tl += 2;
   5911 	*tl = txdr_unsigned(cnt);
   5912 	nrp = dsp->nfsclds_sockp;
   5913 	if (nrp == NULL)
   5914 		/* If NULL, use the MDS socket. */
   5915 		nrp = &nmp->nm_sockreq;
   5916 	error = newnfs_request(nd, nmp, NULL, nrp, vp, p, cred,
   5917 	    NFS_PROG, NFS_VER4, NULL, 1, NULL, &dsp->nfsclds_sess);
   5918 	if (error)
   5919 		return (error);
   5920 	if (nd->nd_repstat == 0) {
   5921 		NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
   5922 		NFSLOCKDS(dsp);
   5923 		if (NFSBCMP(tl, dsp->nfsclds_verf, NFSX_VERF)) {
   5924 			NFSBCOPY(tl, dsp->nfsclds_verf, NFSX_VERF);
   5925 			error = NFSERR_STALEWRITEVERF;
   5926 		}
   5927 		NFSUNLOCKDS(dsp);
   5928 	}
   5929 nfsmout:
   5930 	if (error == 0 && nd->nd_repstat != 0)
   5931 		error = nd->nd_repstat;
   5932 	mbuf_freem(nd->nd_mrep);
   5933 	return (error);
   5934 }
   5935 #endif
   5936 
   5937