xref: /freebsd/sys/fs/nfsclient/nfs_clrpcops.c (revision 3157ba21)
1 /*-
2  * Copyright (c) 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Rick Macklem at The University of Guelph.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 4. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 /*
38  * Rpc op calls, generally called from the vnode op calls or through the
39  * buffer cache, for NFS v2, 3 and 4.
40  * These do not normally make any changes to vnode arguments or use
41  * structures that might change between the VFS variants. The returned
42  * arguments are all at the end, after the NFSPROC_T *p one.
43  */
44 
45 #ifndef APPLEKEXT
46 #include <fs/nfs/nfsport.h>
47 
48 /*
49  * Global variables
50  */
51 extern int nfs_numnfscbd;
52 extern struct timeval nfsboottime;
53 extern u_int32_t newnfs_false, newnfs_true;
54 extern nfstype nfsv34_type[9];
55 extern int nfsrv_useacl;
56 extern char nfsv4_callbackaddr[INET6_ADDRSTRLEN];
57 NFSCLSTATEMUTEX;
58 int nfstest_outofseq = 0;
59 int nfscl_assumeposixlocks = 1;
60 int nfscl_enablecallb = 0;
61 short nfsv4_cbport = NFSV4_CBPORT;
62 int nfstest_openallsetattr = 0;
63 #endif	/* !APPLEKEXT */
64 
65 #define	DIRHDSIZ	(sizeof (struct dirent) - (MAXNAMLEN + 1))
66 
67 static int nfsrpc_setattrrpc(vnode_t , struct vattr *, nfsv4stateid_t *,
68     struct ucred *, NFSPROC_T *, struct nfsvattr *, int *, void *);
69 static int nfsrpc_readrpc(vnode_t , struct uio *, struct ucred *,
70     nfsv4stateid_t *, NFSPROC_T *, struct nfsvattr *, int *, void *);
71 static int nfsrpc_writerpc(vnode_t , struct uio *, int *, u_char *,
72     struct ucred *, nfsv4stateid_t *, NFSPROC_T *, struct nfsvattr *, int *,
73     void *);
74 static int nfsrpc_createv23(vnode_t , char *, int, struct vattr *,
75     nfsquad_t, int, struct ucred *, NFSPROC_T *, struct nfsvattr *,
76     struct nfsvattr *, struct nfsfh **, int *, int *, void *);
77 static int nfsrpc_createv4(vnode_t , char *, int, struct vattr *,
78     nfsquad_t, int, struct nfsclowner *, struct nfscldeleg **, struct ucred *,
79     NFSPROC_T *, struct nfsvattr *, struct nfsvattr *, struct nfsfh **, int *,
80     int *, void *, int *);
81 static int nfsrpc_locku(struct nfsrv_descript *, struct nfsmount *,
82     struct nfscllockowner *, u_int64_t, u_int64_t,
83     u_int32_t, struct ucred *, NFSPROC_T *, int);
84 static int nfsrpc_setaclrpc(vnode_t, struct ucred *, NFSPROC_T *,
85     struct acl *, nfsv4stateid_t *, void *);
86 
87 /*
88  * nfs null call from vfs.
89  */
90 APPLESTATIC int
91 nfsrpc_null(vnode_t vp, struct ucred *cred, NFSPROC_T *p)
92 {
93 	int error;
94 	struct nfsrv_descript nfsd, *nd = &nfsd;
95 
96 	NFSCL_REQSTART(nd, NFSPROC_NULL, vp);
97 	error = nfscl_request(nd, vp, p, cred, NULL);
98 	if (nd->nd_repstat && !error)
99 		error = nd->nd_repstat;
100 	mbuf_freem(nd->nd_mrep);
101 	return (error);
102 }
103 
104 /*
105  * nfs access rpc op.
106  * For nfs version 3 and 4, use the access rpc to check accessibility. If file
107  * modes are changed on the server, accesses might still fail later.
108  */
109 APPLESTATIC int
110 nfsrpc_access(vnode_t vp, int acmode, struct ucred *cred,
111     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp)
112 {
113 	int error;
114 	u_int32_t mode, rmode;
115 
116 	if (acmode & VREAD)
117 		mode = NFSACCESS_READ;
118 	else
119 		mode = 0;
120 	if (vnode_vtype(vp) == VDIR) {
121 		if (acmode & VWRITE)
122 			mode |= (NFSACCESS_MODIFY | NFSACCESS_EXTEND |
123 				 NFSACCESS_DELETE);
124 		if (acmode & VEXEC)
125 			mode |= NFSACCESS_LOOKUP;
126 	} else {
127 		if (acmode & VWRITE)
128 			mode |= (NFSACCESS_MODIFY | NFSACCESS_EXTEND);
129 		if (acmode & VEXEC)
130 			mode |= NFSACCESS_EXECUTE;
131 	}
132 
133 	/*
134 	 * Now, just call nfsrpc_accessrpc() to do the actual RPC.
135 	 */
136 	error = nfsrpc_accessrpc(vp, mode, cred, p, nap, attrflagp, &rmode,
137 	    NULL);
138 
139 	/*
140 	 * The NFS V3 spec does not clarify whether or not
141 	 * the returned access bits can be a superset of
142 	 * the ones requested, so...
143 	 */
144 	if (!error && (rmode & mode) != mode)
145 		error = EACCES;
146 	return (error);
147 }
148 
149 /*
150  * The actual rpc, separated out for Darwin.
151  */
152 APPLESTATIC int
153 nfsrpc_accessrpc(vnode_t vp, u_int32_t mode, struct ucred *cred,
154     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, u_int32_t *rmodep,
155     void *stuff)
156 {
157 	u_int32_t *tl;
158 	u_int32_t supported, rmode;
159 	int error;
160 	struct nfsrv_descript nfsd, *nd = &nfsd;
161 	nfsattrbit_t attrbits;
162 
163 	*attrflagp = 0;
164 	supported = mode;
165 	NFSCL_REQSTART(nd, NFSPROC_ACCESS, vp);
166 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
167 	*tl = txdr_unsigned(mode);
168 	if (nd->nd_flag & ND_NFSV4) {
169 		/*
170 		 * And do a Getattr op.
171 		 */
172 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
173 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
174 		NFSGETATTR_ATTRBIT(&attrbits);
175 		(void) nfsrv_putattrbit(nd, &attrbits);
176 	}
177 	error = nfscl_request(nd, vp, p, cred, stuff);
178 	if (error)
179 		return (error);
180 	if (nd->nd_flag & ND_NFSV3) {
181 		error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
182 		if (error)
183 			goto nfsmout;
184 	}
185 	if (!nd->nd_repstat) {
186 		if (nd->nd_flag & ND_NFSV4) {
187 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
188 			supported = fxdr_unsigned(u_int32_t, *tl++);
189 		} else {
190 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
191 		}
192 		rmode = fxdr_unsigned(u_int32_t, *tl);
193 		if (nd->nd_flag & ND_NFSV4)
194 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
195 
196 		/*
197 		 * It's not obvious what should be done about
198 		 * unsupported access modes. For now, be paranoid
199 		 * and clear the unsupported ones.
200 		 */
201 		rmode &= supported;
202 		*rmodep = rmode;
203 	} else
204 		error = nd->nd_repstat;
205 nfsmout:
206 	mbuf_freem(nd->nd_mrep);
207 	return (error);
208 }
209 
210 /*
211  * nfs open rpc
212  */
213 APPLESTATIC int
214 nfsrpc_open(vnode_t vp, int amode, struct ucred *cred, NFSPROC_T *p)
215 {
216 	struct nfsclopen *op;
217 	struct nfscldeleg *dp;
218 	struct nfsfh *nfhp;
219 	struct nfsnode *np = VTONFS(vp);
220 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
221 	u_int32_t mode, clidrev;
222 	int ret, newone, error, expireret = 0, retrycnt;
223 
224 	/*
225 	 * For NFSv4, Open Ops are only done on Regular Files.
226 	 */
227 	if (vnode_vtype(vp) != VREG)
228 		return (0);
229 	mode = 0;
230 	if (amode & FREAD)
231 		mode |= NFSV4OPEN_ACCESSREAD;
232 	if (amode & FWRITE)
233 		mode |= NFSV4OPEN_ACCESSWRITE;
234 	nfhp = np->n_fhp;
235 
236 	retrycnt = 0;
237 #ifdef notdef
238 { char name[100]; int namel;
239 namel = (np->n_v4->n4_namelen < 100) ? np->n_v4->n4_namelen : 99;
240 bcopy(NFS4NODENAME(np->n_v4), name, namel);
241 name[namel] = '\0';
242 printf("rpcopen p=0x%x name=%s",p->p_pid,name);
243 if (nfhp->nfh_len > 0) printf(" fh=0x%x\n",nfhp->nfh_fh[12]);
244 else printf(" fhl=0\n");
245 }
246 #endif
247 	do {
248 	    dp = NULL;
249 	    error = nfscl_open(vp, nfhp->nfh_fh, nfhp->nfh_len, mode, 1,
250 		cred, p, NULL, &op, &newone, &ret, 1);
251 	    if (error) {
252 		return (error);
253 	    }
254 	    if (nmp->nm_clp != NULL)
255 		clidrev = nmp->nm_clp->nfsc_clientidrev;
256 	    else
257 		clidrev = 0;
258 	    if (ret == NFSCLOPEN_DOOPEN) {
259 		if (np->n_v4 != NULL) {
260 			error = nfsrpc_openrpc(nmp, vp, np->n_v4->n4_data,
261 			   np->n_v4->n4_fhlen, np->n_fhp->nfh_fh,
262 			   np->n_fhp->nfh_len, mode, op,
263 			   NFS4NODENAME(np->n_v4), np->n_v4->n4_namelen, &dp,
264 			   0, 0x0, cred, p, 0, 0);
265 			if (dp != NULL) {
266 #ifdef APPLE
267 				OSBitAndAtomic((int32_t)~NDELEGMOD, (UInt32 *)&np->n_flag);
268 #else
269 				NFSLOCKNODE(np);
270 				np->n_flag &= ~NDELEGMOD;
271 				NFSUNLOCKNODE(np);
272 #endif
273 				(void) nfscl_deleg(nmp->nm_mountp,
274 				    op->nfso_own->nfsow_clp,
275 				    nfhp->nfh_fh, nfhp->nfh_len, cred, p, &dp);
276 			}
277 		} else {
278 			error = EIO;
279 		}
280 		newnfs_copyincred(cred, &op->nfso_cred);
281 	    } else if (ret == NFSCLOPEN_SETCRED)
282 		/*
283 		 * This is a new local open on a delegation. It needs
284 		 * to have credentials so that an open can be done
285 		 * against the server during recovery.
286 		 */
287 		newnfs_copyincred(cred, &op->nfso_cred);
288 
289 	    /*
290 	     * nfso_opencnt is the count of how many VOP_OPEN()s have
291 	     * been done on this Open successfully and a VOP_CLOSE()
292 	     * is expected for each of these.
293 	     * If error is non-zero, don't increment it, since the Open
294 	     * hasn't succeeded yet.
295 	     */
296 	    if (!error)
297 		op->nfso_opencnt++;
298 	    nfscl_openrelease(op, error, newone);
299 	    if (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
300 		error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY) {
301 		(void) nfs_catnap(PZERO, error, "nfs_open");
302 	    } else if ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID)
303 		&& clidrev != 0) {
304 		expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
305 		retrycnt++;
306 	    }
307 	} while (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
308 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
309 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
310 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
311 	if (error && retrycnt >= 4)
312 		error = EIO;
313 	return (error);
314 }
315 
316 /*
317  * the actual open rpc
318  */
319 APPLESTATIC int
320 nfsrpc_openrpc(struct nfsmount *nmp, vnode_t vp, u_int8_t *nfhp, int fhlen,
321     u_int8_t *newfhp, int newfhlen, u_int32_t mode, struct nfsclopen *op,
322     u_int8_t *name, int namelen, struct nfscldeleg **dpp,
323     int reclaim, u_int32_t delegtype, struct ucred *cred, NFSPROC_T *p,
324     int syscred, int recursed)
325 {
326 	u_int32_t *tl;
327 	struct nfsrv_descript nfsd, *nd = &nfsd;
328 	struct nfscldeleg *dp, *ndp = NULL;
329 	struct nfsvattr nfsva;
330 	u_int32_t rflags, deleg;
331 	nfsattrbit_t attrbits;
332 	int error, ret, acesize, limitby;
333 
334 	dp = *dpp;
335 	*dpp = NULL;
336 	nfscl_reqstart(nd, NFSPROC_OPEN, nmp, nfhp, fhlen, NULL);
337 	NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
338 	*tl++ = txdr_unsigned(op->nfso_own->nfsow_seqid);
339 	*tl++ = txdr_unsigned(mode & NFSV4OPEN_ACCESSBOTH);
340 	*tl++ = txdr_unsigned((mode >> NFSLCK_SHIFT) & NFSV4OPEN_DENYBOTH);
341 	*tl++ = op->nfso_own->nfsow_clp->nfsc_clientid.lval[0];
342 	*tl = op->nfso_own->nfsow_clp->nfsc_clientid.lval[1];
343 	(void) nfsm_strtom(nd, op->nfso_own->nfsow_owner, NFSV4CL_LOCKNAMELEN);
344 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
345 	*tl++ = txdr_unsigned(NFSV4OPEN_NOCREATE);
346 	if (reclaim) {
347 		*tl = txdr_unsigned(NFSV4OPEN_CLAIMPREVIOUS);
348 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
349 		*tl = txdr_unsigned(delegtype);
350 	} else {
351 		if (dp != NULL) {
352 			*tl = txdr_unsigned(NFSV4OPEN_CLAIMDELEGATECUR);
353 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
354 			*tl++ = dp->nfsdl_stateid.seqid;
355 			*tl++ = dp->nfsdl_stateid.other[0];
356 			*tl++ = dp->nfsdl_stateid.other[1];
357 			*tl = dp->nfsdl_stateid.other[2];
358 		} else {
359 			*tl = txdr_unsigned(NFSV4OPEN_CLAIMNULL);
360 		}
361 		(void) nfsm_strtom(nd, name, namelen);
362 	}
363 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
364 	*tl = txdr_unsigned(NFSV4OP_GETATTR);
365 	NFSZERO_ATTRBIT(&attrbits);
366 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
367 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFY);
368 	(void) nfsrv_putattrbit(nd, &attrbits);
369 	if (syscred)
370 		nd->nd_flag |= ND_USEGSSNAME;
371 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, vp, p, cred,
372 	    NFS_PROG, NFS_VER4, NULL, 1, NULL);
373 	if (error)
374 		return (error);
375 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
376 	if (!nd->nd_repstat) {
377 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
378 		    6 * NFSX_UNSIGNED);
379 		op->nfso_stateid.seqid = *tl++;
380 		op->nfso_stateid.other[0] = *tl++;
381 		op->nfso_stateid.other[1] = *tl++;
382 		op->nfso_stateid.other[2] = *tl;
383 		rflags = fxdr_unsigned(u_int32_t, *(tl + 6));
384 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
385 		if (error)
386 			goto nfsmout;
387 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
388 		deleg = fxdr_unsigned(u_int32_t, *tl);
389 		if (deleg == NFSV4OPEN_DELEGATEREAD ||
390 		    deleg == NFSV4OPEN_DELEGATEWRITE) {
391 			if (!(op->nfso_own->nfsow_clp->nfsc_flags &
392 			      NFSCLFLAGS_FIRSTDELEG))
393 				op->nfso_own->nfsow_clp->nfsc_flags |=
394 				  (NFSCLFLAGS_FIRSTDELEG | NFSCLFLAGS_GOTDELEG);
395 			MALLOC(ndp, struct nfscldeleg *,
396 			    sizeof (struct nfscldeleg) + newfhlen,
397 			    M_NFSCLDELEG, M_WAITOK);
398 			LIST_INIT(&ndp->nfsdl_owner);
399 			LIST_INIT(&ndp->nfsdl_lock);
400 			ndp->nfsdl_clp = op->nfso_own->nfsow_clp;
401 			ndp->nfsdl_fhlen = newfhlen;
402 			NFSBCOPY(newfhp, ndp->nfsdl_fh, newfhlen);
403 			newnfs_copyincred(cred, &ndp->nfsdl_cred);
404 			nfscl_lockinit(&ndp->nfsdl_rwlock);
405 			NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
406 			    NFSX_UNSIGNED);
407 			ndp->nfsdl_stateid.seqid = *tl++;
408 			ndp->nfsdl_stateid.other[0] = *tl++;
409 			ndp->nfsdl_stateid.other[1] = *tl++;
410 			ndp->nfsdl_stateid.other[2] = *tl++;
411 			ret = fxdr_unsigned(int, *tl);
412 			if (deleg == NFSV4OPEN_DELEGATEWRITE) {
413 				ndp->nfsdl_flags = NFSCLDL_WRITE;
414 				/*
415 				 * Indicates how much the file can grow.
416 				 */
417 				NFSM_DISSECT(tl, u_int32_t *,
418 				    3 * NFSX_UNSIGNED);
419 				limitby = fxdr_unsigned(int, *tl++);
420 				switch (limitby) {
421 				case NFSV4OPEN_LIMITSIZE:
422 					ndp->nfsdl_sizelimit = fxdr_hyper(tl);
423 					break;
424 				case NFSV4OPEN_LIMITBLOCKS:
425 					ndp->nfsdl_sizelimit =
426 					    fxdr_unsigned(u_int64_t, *tl++);
427 					ndp->nfsdl_sizelimit *=
428 					    fxdr_unsigned(u_int64_t, *tl);
429 					break;
430 				default:
431 					error = NFSERR_BADXDR;
432 					goto nfsmout;
433 				};
434 			} else {
435 				ndp->nfsdl_flags = NFSCLDL_READ;
436 			}
437 			if (ret)
438 				ndp->nfsdl_flags |= NFSCLDL_RECALL;
439 			error = nfsrv_dissectace(nd, &ndp->nfsdl_ace, &ret,
440 			    &acesize, p);
441 			if (error)
442 				goto nfsmout;
443 		} else if (deleg != NFSV4OPEN_DELEGATENONE) {
444 			error = NFSERR_BADXDR;
445 			goto nfsmout;
446 		}
447 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
448 		error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
449 		    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
450 		    NULL, NULL, NULL, p, cred);
451 		if (error)
452 			goto nfsmout;
453 		if (ndp != NULL) {
454 			ndp->nfsdl_change = nfsva.na_filerev;
455 			ndp->nfsdl_modtime = nfsva.na_mtime;
456 			ndp->nfsdl_flags |= NFSCLDL_MODTIMESET;
457 		}
458 		if (!reclaim && (rflags & NFSV4OPEN_RESULTCONFIRM)) {
459 		    do {
460 			ret = nfsrpc_openconfirm(vp, newfhp, newfhlen, op,
461 			    cred, p);
462 			if (ret == NFSERR_DELAY)
463 			    (void) nfs_catnap(PZERO, ret, "nfs_open");
464 		    } while (ret == NFSERR_DELAY);
465 		    error = ret;
466 		}
467 		if ((rflags & NFSV4OPEN_LOCKTYPEPOSIX) ||
468 		    nfscl_assumeposixlocks)
469 		    op->nfso_posixlock = 1;
470 		else
471 		    op->nfso_posixlock = 0;
472 
473 		/*
474 		 * If the server is handing out delegations, but we didn't
475 		 * get one because an OpenConfirm was required, try the
476 		 * Open again, to get a delegation. This is a harmless no-op,
477 		 * from a server's point of view.
478 		 */
479 		if (!reclaim && (rflags & NFSV4OPEN_RESULTCONFIRM) &&
480 		    (op->nfso_own->nfsow_clp->nfsc_flags & NFSCLFLAGS_GOTDELEG)
481 		    && !error && dp == NULL && ndp == NULL && !recursed) {
482 		    do {
483 			ret = nfsrpc_openrpc(nmp, vp, nfhp, fhlen, newfhp,
484 			    newfhlen, mode, op, name, namelen, &ndp, 0, 0x0,
485 			    cred, p, syscred, 1);
486 			if (ret == NFSERR_DELAY)
487 			    (void) nfs_catnap(PZERO, ret, "nfs_open2");
488 		    } while (ret == NFSERR_DELAY);
489 		    if (ret) {
490 			if (ndp != NULL)
491 				FREE((caddr_t)ndp, M_NFSCLDELEG);
492 			if (ret == NFSERR_STALECLIENTID ||
493 			    ret == NFSERR_STALEDONTRECOVER)
494 				error = ret;
495 		    }
496 		}
497 	}
498 	if (nd->nd_repstat != 0 && error == 0)
499 		error = nd->nd_repstat;
500 	if (error == NFSERR_STALECLIENTID)
501 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
502 nfsmout:
503 	if (!error)
504 		*dpp = ndp;
505 	else if (ndp != NULL)
506 		FREE((caddr_t)ndp, M_NFSCLDELEG);
507 	mbuf_freem(nd->nd_mrep);
508 	return (error);
509 }
510 
511 /*
512  * open downgrade rpc
513  */
514 APPLESTATIC int
515 nfsrpc_opendowngrade(vnode_t vp, u_int32_t mode, struct nfsclopen *op,
516     struct ucred *cred, NFSPROC_T *p)
517 {
518 	u_int32_t *tl;
519 	struct nfsrv_descript nfsd, *nd = &nfsd;
520 	int error;
521 
522 	NFSCL_REQSTART(nd, NFSPROC_OPENDOWNGRADE, vp);
523 	NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 3 * NFSX_UNSIGNED);
524 	*tl++ = op->nfso_stateid.seqid;
525 	*tl++ = op->nfso_stateid.other[0];
526 	*tl++ = op->nfso_stateid.other[1];
527 	*tl++ = op->nfso_stateid.other[2];
528 	*tl++ = txdr_unsigned(op->nfso_own->nfsow_seqid);
529 	*tl++ = txdr_unsigned(mode & NFSV4OPEN_ACCESSBOTH);
530 	*tl = txdr_unsigned((mode >> NFSLCK_SHIFT) & NFSV4OPEN_DENYBOTH);
531 	error = nfscl_request(nd, vp, p, cred, NULL);
532 	if (error)
533 		return (error);
534 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
535 	if (!nd->nd_repstat) {
536 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
537 		op->nfso_stateid.seqid = *tl++;
538 		op->nfso_stateid.other[0] = *tl++;
539 		op->nfso_stateid.other[1] = *tl++;
540 		op->nfso_stateid.other[2] = *tl;
541 	}
542 	if (nd->nd_repstat && error == 0)
543 		error = nd->nd_repstat;
544 	if (error == NFSERR_STALESTATEID)
545 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
546 nfsmout:
547 	mbuf_freem(nd->nd_mrep);
548 	return (error);
549 }
550 
551 /*
552  * V4 Close operation.
553  */
554 APPLESTATIC int
555 nfsrpc_close(vnode_t vp, int doclose, NFSPROC_T *p)
556 {
557 	struct nfsclclient *clp;
558 	int error;
559 
560 	if (vnode_vtype(vp) != VREG)
561 		return (0);
562 	if (doclose)
563 		error = nfscl_doclose(vp, &clp, p);
564 	else
565 		error = nfscl_getclose(vp, &clp);
566 	if (error)
567 		return (error);
568 
569 	nfscl_clientrelease(clp);
570 	return (0);
571 }
572 
573 /*
574  * Close the open.
575  */
576 APPLESTATIC void
577 nfsrpc_doclose(struct nfsmount *nmp, struct nfsclopen *op, NFSPROC_T *p)
578 {
579 	struct nfsrv_descript nfsd, *nd = &nfsd;
580 	struct nfscllockowner *lp;
581 	struct nfscllock *lop, *nlop;
582 	struct ucred *tcred;
583 	u_int64_t off = 0, len = 0;
584 	u_int32_t type = NFSV4LOCKT_READ;
585 	int error, do_unlock, trycnt;
586 
587 	tcred = newnfs_getcred();
588 	newnfs_copycred(&op->nfso_cred, tcred);
589 	/*
590 	 * (Theoretically this could be done in the same
591 	 *  compound as the close, but having multiple
592 	 *  sequenced Ops in the same compound might be
593 	 *  too scary for some servers.)
594 	 */
595 	if (op->nfso_posixlock) {
596 		off = 0;
597 		len = NFS64BITSSET;
598 		type = NFSV4LOCKT_READ;
599 	}
600 
601 	/*
602 	 * Since this function is only called from VOP_INACTIVE(), no
603 	 * other thread will be manipulating this Open. As such, the
604 	 * lock lists are not being changed by other threads, so it should
605 	 * be safe to do this without locking.
606 	 */
607 	LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
608 		do_unlock = 1;
609 		LIST_FOREACH_SAFE(lop, &lp->nfsl_lock, nfslo_list, nlop) {
610 			if (op->nfso_posixlock == 0) {
611 				off = lop->nfslo_first;
612 				len = lop->nfslo_end - lop->nfslo_first;
613 				if (lop->nfslo_type == F_WRLCK)
614 					type = NFSV4LOCKT_WRITE;
615 				else
616 					type = NFSV4LOCKT_READ;
617 			}
618 			if (do_unlock) {
619 				trycnt = 0;
620 				do {
621 					error = nfsrpc_locku(nd, nmp, lp, off,
622 					    len, type, tcred, p, 0);
623 					if ((nd->nd_repstat == NFSERR_GRACE ||
624 					    nd->nd_repstat == NFSERR_DELAY) &&
625 					    error == 0)
626 						(void) nfs_catnap(PZERO,
627 						    (int)nd->nd_repstat,
628 						    "nfs_close");
629 				} while ((nd->nd_repstat == NFSERR_GRACE ||
630 				    nd->nd_repstat == NFSERR_DELAY) &&
631 				    error == 0 && trycnt++ < 5);
632 				if (op->nfso_posixlock)
633 					do_unlock = 0;
634 			}
635 			nfscl_freelock(lop, 0);
636 		}
637 	}
638 
639 	/*
640 	 * There could be other Opens for different files on the same
641 	 * OpenOwner, so locking is required.
642 	 */
643 	NFSLOCKCLSTATE();
644 	nfscl_lockexcl(&op->nfso_own->nfsow_rwlock, NFSCLSTATEMUTEXPTR);
645 	NFSUNLOCKCLSTATE();
646 	do {
647 		error = nfscl_tryclose(op, tcred, nmp, p);
648 		if (error == NFSERR_GRACE)
649 			(void) nfs_catnap(PZERO, error, "nfs_close");
650 	} while (error == NFSERR_GRACE);
651 	NFSLOCKCLSTATE();
652 	nfscl_lockunlock(&op->nfso_own->nfsow_rwlock);
653 
654 	/*
655 	 * Move the lockowner to nfsc_defunctlockowner,
656 	 * so the Renew thread will do the ReleaseLockOwner
657 	 * Op on it later. There might still be other
658 	 * opens using the same lockowner name.
659 	 */
660 	lp = LIST_FIRST(&op->nfso_lock);
661 	if (lp != NULL) {
662 		while (LIST_NEXT(lp, nfsl_list) != NULL)
663 			lp = LIST_NEXT(lp, nfsl_list);
664 		LIST_PREPEND(&nmp->nm_clp->nfsc_defunctlockowner,
665 		    &op->nfso_lock, lp, nfsl_list);
666 		LIST_INIT(&op->nfso_lock);
667 	}
668 	nfscl_freeopen(op, 0);
669 	NFSUNLOCKCLSTATE();
670 	NFSFREECRED(tcred);
671 }
672 
673 /*
674  * The actual Close RPC.
675  */
676 APPLESTATIC int
677 nfsrpc_closerpc(struct nfsrv_descript *nd, struct nfsmount *nmp,
678     struct nfsclopen *op, struct ucred *cred, NFSPROC_T *p,
679     int syscred)
680 {
681 	u_int32_t *tl;
682 	int error;
683 
684 	nfscl_reqstart(nd, NFSPROC_CLOSE, nmp, op->nfso_fh,
685 	    op->nfso_fhlen, NULL);
686 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
687 	*tl++ = txdr_unsigned(op->nfso_own->nfsow_seqid);
688 	*tl++ = op->nfso_stateid.seqid;
689 	*tl++ = op->nfso_stateid.other[0];
690 	*tl++ = op->nfso_stateid.other[1];
691 	*tl = op->nfso_stateid.other[2];
692 	if (syscred)
693 		nd->nd_flag |= ND_USEGSSNAME;
694 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
695 	    NFS_PROG, NFS_VER4, NULL, 1, NULL);
696 	if (error)
697 		return (error);
698 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
699 	if (nd->nd_repstat == 0)
700 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
701 	error = nd->nd_repstat;
702 	if (error == NFSERR_STALESTATEID)
703 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
704 nfsmout:
705 	mbuf_freem(nd->nd_mrep);
706 	return (error);
707 }
708 
709 /*
710  * V4 Open Confirm RPC.
711  */
712 APPLESTATIC int
713 nfsrpc_openconfirm(vnode_t vp, u_int8_t *nfhp, int fhlen,
714     struct nfsclopen *op, struct ucred *cred, NFSPROC_T *p)
715 {
716 	u_int32_t *tl;
717 	struct nfsrv_descript nfsd, *nd = &nfsd;
718 	int error;
719 
720 	nfscl_reqstart(nd, NFSPROC_OPENCONFIRM, VFSTONFS(vnode_mount(vp)),
721 	    nfhp, fhlen, NULL);
722 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
723 	*tl++ = op->nfso_stateid.seqid;
724 	*tl++ = op->nfso_stateid.other[0];
725 	*tl++ = op->nfso_stateid.other[1];
726 	*tl++ = op->nfso_stateid.other[2];
727 	*tl = txdr_unsigned(op->nfso_own->nfsow_seqid);
728 	error = nfscl_request(nd, vp, p, cred, NULL);
729 	if (error)
730 		return (error);
731 	NFSCL_INCRSEQID(op->nfso_own->nfsow_seqid, nd);
732 	if (!nd->nd_repstat) {
733 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
734 		op->nfso_stateid.seqid = *tl++;
735 		op->nfso_stateid.other[0] = *tl++;
736 		op->nfso_stateid.other[1] = *tl++;
737 		op->nfso_stateid.other[2] = *tl;
738 	}
739 	error = nd->nd_repstat;
740 	if (error == NFSERR_STALESTATEID)
741 		nfscl_initiate_recovery(op->nfso_own->nfsow_clp);
742 nfsmout:
743 	mbuf_freem(nd->nd_mrep);
744 	return (error);
745 }
746 
747 /*
748  * Do the setclientid and setclientid confirm RPCs. Called from nfs_statfs()
749  * when a mount has just occurred and when the server replies NFSERR_EXPIRED.
750  */
751 APPLESTATIC int
752 nfsrpc_setclient(struct nfsmount *nmp, struct nfsclclient *clp,
753     struct ucred *cred, NFSPROC_T *p)
754 {
755 	u_int32_t *tl;
756 	struct nfsrv_descript nfsd;
757 	struct nfsrv_descript *nd = &nfsd;
758 	nfsattrbit_t attrbits;
759 	u_int8_t *cp = NULL, *cp2, addr[INET6_ADDRSTRLEN + 9];
760 	u_short port;
761 	int error, isinet6 = 0, callblen;
762 	nfsquad_t confirm;
763 	u_int32_t lease;
764 	static u_int32_t rev = 0;
765 
766 	if (nfsboottime.tv_sec == 0)
767 		NFSSETBOOTTIME(nfsboottime);
768 	nfscl_reqstart(nd, NFSPROC_SETCLIENTID, nmp, NULL, 0, NULL);
769 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
770 	*tl++ = txdr_unsigned(nfsboottime.tv_sec);
771 	*tl = txdr_unsigned(rev++);
772 	(void) nfsm_strtom(nd, clp->nfsc_id, clp->nfsc_idlen);
773 
774 	/*
775 	 * set up the callback address
776 	 */
777 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
778 	*tl = txdr_unsigned(NFS_CALLBCKPROG);
779 	callblen = strlen(nfsv4_callbackaddr);
780 	if (callblen == 0)
781 		cp = nfscl_getmyip(nmp, &isinet6);
782 	if (nfscl_enablecallb && nfs_numnfscbd > 0 &&
783 	    (callblen > 0 || cp != NULL)) {
784 		port = htons(nfsv4_cbport);
785 		cp2 = (u_int8_t *)&port;
786 #ifdef INET6
787 		if ((callblen > 0 &&
788 		     strchr(nfsv4_callbackaddr, ':')) || isinet6) {
789 			char ip6buf[INET6_ADDRSTRLEN], *ip6add;
790 
791 			(void) nfsm_strtom(nd, "tcp6", 4);
792 			if (callblen == 0) {
793 				ip6_sprintf(ip6buf, (struct in6_addr *)cp);
794 				ip6add = ip6buf;
795 			} else {
796 				ip6add = nfsv4_callbackaddr;
797 			}
798 			snprintf(addr, INET6_ADDRSTRLEN + 9, "%s.%d.%d",
799 			    ip6add, cp2[0], cp2[1]);
800 		} else
801 #endif
802 		{
803 			(void) nfsm_strtom(nd, "tcp", 3);
804 			if (callblen == 0)
805 				snprintf(addr, INET6_ADDRSTRLEN + 9,
806 				    "%d.%d.%d.%d.%d.%d", cp[0], cp[1],
807 				    cp[2], cp[3], cp2[0], cp2[1]);
808 			else
809 				snprintf(addr, INET6_ADDRSTRLEN + 9,
810 				    "%s.%d.%d", nfsv4_callbackaddr,
811 				    cp2[0], cp2[1]);
812 		}
813 		(void) nfsm_strtom(nd, addr, strlen(addr));
814 	} else {
815 		(void) nfsm_strtom(nd, "tcp", 3);
816 		(void) nfsm_strtom(nd, "0.0.0.0.0.0", 11);
817 	}
818 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
819 	*tl = txdr_unsigned(clp->nfsc_cbident);
820 	nd->nd_flag |= ND_USEGSSNAME;
821 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
822 		NFS_PROG, NFS_VER4, NULL, 1, NULL);
823 	if (error)
824 		return (error);
825 	if (nd->nd_repstat == 0) {
826 	    NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
827 	    clp->nfsc_clientid.lval[0] = *tl++;
828 	    clp->nfsc_clientid.lval[1] = *tl++;
829 	    confirm.lval[0] = *tl++;
830 	    confirm.lval[1] = *tl;
831 	    mbuf_freem(nd->nd_mrep);
832 	    nd->nd_mrep = NULL;
833 
834 	    /*
835 	     * and confirm it.
836 	     */
837 	    nfscl_reqstart(nd, NFSPROC_SETCLIENTIDCFRM, nmp, NULL, 0, NULL);
838 	    NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
839 	    *tl++ = clp->nfsc_clientid.lval[0];
840 	    *tl++ = clp->nfsc_clientid.lval[1];
841 	    *tl++ = confirm.lval[0];
842 	    *tl = confirm.lval[1];
843 	    nd->nd_flag |= ND_USEGSSNAME;
844 	    error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p,
845 		cred, NFS_PROG, NFS_VER4, NULL, 1, NULL);
846 	    if (error)
847 		return (error);
848 	    mbuf_freem(nd->nd_mrep);
849 	    nd->nd_mrep = NULL;
850 	    if (nd->nd_repstat == 0) {
851 		nfscl_reqstart(nd, NFSPROC_GETATTR, nmp, nmp->nm_fh,
852 		    nmp->nm_fhsize, NULL);
853 		NFSZERO_ATTRBIT(&attrbits);
854 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_LEASETIME);
855 		(void) nfsrv_putattrbit(nd, &attrbits);
856 		nd->nd_flag |= ND_USEGSSNAME;
857 		error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p,
858 		    cred, NFS_PROG, NFS_VER4, NULL, 1, NULL);
859 		if (error)
860 		    return (error);
861 		if (nd->nd_repstat == 0) {
862 		    error = nfsv4_loadattr(nd, NULL, NULL, NULL, NULL, 0, NULL,
863 			NULL, NULL, NULL, NULL, 0, NULL, &lease, NULL, p, cred);
864 		    if (error)
865 			goto nfsmout;
866 		    clp->nfsc_renew = NFSCL_RENEW(lease);
867 		    clp->nfsc_expire = NFSD_MONOSEC + clp->nfsc_renew;
868 		    clp->nfsc_clientidrev++;
869 		    if (clp->nfsc_clientidrev == 0)
870 			clp->nfsc_clientidrev++;
871 		}
872 	    }
873 	}
874 	error = nd->nd_repstat;
875 nfsmout:
876 	mbuf_freem(nd->nd_mrep);
877 	return (error);
878 }
879 
880 /*
881  * nfs getattr call.
882  */
883 APPLESTATIC int
884 nfsrpc_getattr(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
885     struct nfsvattr *nap, void *stuff)
886 {
887 	struct nfsrv_descript nfsd, *nd = &nfsd;
888 	int error;
889 	nfsattrbit_t attrbits;
890 
891 	NFSCL_REQSTART(nd, NFSPROC_GETATTR, vp);
892 	if (nd->nd_flag & ND_NFSV4) {
893 		NFSGETATTR_ATTRBIT(&attrbits);
894 		(void) nfsrv_putattrbit(nd, &attrbits);
895 	}
896 	error = nfscl_request(nd, vp, p, cred, stuff);
897 	if (error)
898 		return (error);
899 	if (!nd->nd_repstat)
900 		error = nfsm_loadattr(nd, nap);
901 	else
902 		error = nd->nd_repstat;
903 	mbuf_freem(nd->nd_mrep);
904 	return (error);
905 }
906 
907 /*
908  * nfs getattr call with non-vnode arguemnts.
909  */
910 APPLESTATIC int
911 nfsrpc_getattrnovp(struct nfsmount *nmp, u_int8_t *fhp, int fhlen, int syscred,
912     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, u_int64_t *xidp)
913 {
914 	struct nfsrv_descript nfsd, *nd = &nfsd;
915 	int error, vers = NFS_VER2;
916 	nfsattrbit_t attrbits;
917 
918 	nfscl_reqstart(nd, NFSPROC_GETATTR, nmp, fhp, fhlen, NULL);
919 	if (nd->nd_flag & ND_NFSV4) {
920 		vers = NFS_VER4;
921 		NFSGETATTR_ATTRBIT(&attrbits);
922 		(void) nfsrv_putattrbit(nd, &attrbits);
923 	} else if (nd->nd_flag & ND_NFSV3) {
924 		vers = NFS_VER3;
925 	}
926 	if (syscred)
927 		nd->nd_flag |= ND_USEGSSNAME;
928 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
929 	    NFS_PROG, vers, NULL, 1, xidp);
930 	if (error)
931 		return (error);
932 	if (!nd->nd_repstat)
933 		error = nfsm_loadattr(nd, nap);
934 	else
935 		error = nd->nd_repstat;
936 	mbuf_freem(nd->nd_mrep);
937 	return (error);
938 }
939 
940 /*
941  * Do an nfs setattr operation.
942  */
943 APPLESTATIC int
944 nfsrpc_setattr(vnode_t vp, struct vattr *vap, NFSACL_T *aclp,
945     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *rnap, int *attrflagp,
946     void *stuff)
947 {
948 	int error, expireret = 0, openerr, retrycnt;
949 	u_int32_t clidrev = 0, mode;
950 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
951 	struct nfsfh *nfhp;
952 	nfsv4stateid_t stateid;
953 	void *lckp;
954 
955 	if (nmp->nm_clp != NULL)
956 		clidrev = nmp->nm_clp->nfsc_clientidrev;
957 	if (vap != NULL && NFSATTRISSET(u_quad_t, vap, va_size))
958 		mode = NFSV4OPEN_ACCESSWRITE;
959 	else
960 		mode = NFSV4OPEN_ACCESSREAD;
961 	retrycnt = 0;
962 	do {
963 		lckp = NULL;
964 		openerr = 1;
965 		if (NFSHASNFSV4(nmp)) {
966 			nfhp = VTONFS(vp)->n_fhp;
967 			error = nfscl_getstateid(vp, nfhp->nfh_fh,
968 			    nfhp->nfh_len, mode, cred, p, &stateid, &lckp);
969 			if (error && vnode_vtype(vp) == VREG &&
970 			    (mode == NFSV4OPEN_ACCESSWRITE ||
971 			     nfstest_openallsetattr)) {
972 				/*
973 				 * No Open stateid, so try and open the file
974 				 * now.
975 				 */
976 				if (mode == NFSV4OPEN_ACCESSWRITE)
977 					openerr = nfsrpc_open(vp, FWRITE, cred,
978 					    p);
979 				else
980 					openerr = nfsrpc_open(vp, FREAD, cred,
981 					    p);
982 				if (!openerr)
983 					(void) nfscl_getstateid(vp,
984 					    nfhp->nfh_fh, nfhp->nfh_len,
985 					    mode, cred, p, &stateid, &lckp);
986 			}
987 		}
988 		if (vap != NULL)
989 			error = nfsrpc_setattrrpc(vp, vap, &stateid, cred, p,
990 			    rnap, attrflagp, stuff);
991 		else
992 			error = nfsrpc_setaclrpc(vp, cred, p, aclp, &stateid,
993 			    stuff);
994 		if (error == NFSERR_STALESTATEID)
995 			nfscl_initiate_recovery(nmp->nm_clp);
996 		if (lckp != NULL)
997 			nfscl_lockderef(lckp);
998 		if (!openerr)
999 			(void) nfsrpc_close(vp, 0, p);
1000 		if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
1001 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
1002 		    error == NFSERR_OLDSTATEID) {
1003 			(void) nfs_catnap(PZERO, error, "nfs_setattr");
1004 		} else if ((error == NFSERR_EXPIRED ||
1005 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
1006 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
1007 		}
1008 		retrycnt++;
1009 	} while (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
1010 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
1011 	    (error == NFSERR_OLDSTATEID && retrycnt < 20) ||
1012 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
1013 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
1014 	if (error && retrycnt >= 4)
1015 		error = EIO;
1016 	return (error);
1017 }
1018 
1019 static int
1020 nfsrpc_setattrrpc(vnode_t vp, struct vattr *vap,
1021     nfsv4stateid_t *stateidp, struct ucred *cred, NFSPROC_T *p,
1022     struct nfsvattr *rnap, int *attrflagp, void *stuff)
1023 {
1024 	u_int32_t *tl;
1025 	struct nfsrv_descript nfsd, *nd = &nfsd;
1026 	int error;
1027 	nfsattrbit_t attrbits;
1028 
1029 	*attrflagp = 0;
1030 	NFSCL_REQSTART(nd, NFSPROC_SETATTR, vp);
1031 	if (nd->nd_flag & ND_NFSV4)
1032 		nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
1033 	vap->va_type = vnode_vtype(vp);
1034 	nfscl_fillsattr(nd, vap, vp, NFSSATTR_FULL, 0);
1035 	if (nd->nd_flag & ND_NFSV3) {
1036 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
1037 		*tl = newnfs_false;
1038 	} else if (nd->nd_flag & ND_NFSV4) {
1039 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
1040 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
1041 		NFSGETATTR_ATTRBIT(&attrbits);
1042 		(void) nfsrv_putattrbit(nd, &attrbits);
1043 	}
1044 	error = nfscl_request(nd, vp, p, cred, stuff);
1045 	if (error)
1046 		return (error);
1047 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
1048 		error = nfscl_wcc_data(nd, vp, rnap, attrflagp, NULL, stuff);
1049 	if ((nd->nd_flag & ND_NFSV4) && !error)
1050 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
1051 	if (!(nd->nd_flag & ND_NFSV3) && !nd->nd_repstat && !error)
1052 		error = nfscl_postop_attr(nd, rnap, attrflagp, stuff);
1053 	mbuf_freem(nd->nd_mrep);
1054 	if (nd->nd_repstat && !error)
1055 		error = nd->nd_repstat;
1056 	return (error);
1057 }
1058 
1059 /*
1060  * nfs lookup rpc
1061  */
1062 APPLESTATIC int
1063 nfsrpc_lookup(vnode_t dvp, char *name, int len, struct ucred *cred,
1064     NFSPROC_T *p, struct nfsvattr *dnap, struct nfsvattr *nap,
1065     struct nfsfh **nfhpp, int *attrflagp, int *dattrflagp, void *stuff)
1066 {
1067 	u_int32_t *tl;
1068 	struct nfsrv_descript nfsd, *nd = &nfsd;
1069 	struct nfsmount *nmp;
1070 	struct nfsnode *np;
1071 	struct nfsfh *nfhp;
1072 	nfsattrbit_t attrbits;
1073 	int error = 0, lookupp = 0;
1074 
1075 	*attrflagp = 0;
1076 	*dattrflagp = 0;
1077 	if (vnode_vtype(dvp) != VDIR)
1078 		return (ENOTDIR);
1079 	nmp = VFSTONFS(vnode_mount(dvp));
1080 	if (len > NFS_MAXNAMLEN)
1081 		return (ENAMETOOLONG);
1082 	if (NFSHASNFSV4(nmp) && len == 1 &&
1083 		name[0] == '.') {
1084 		/*
1085 		 * Just return the current dir's fh.
1086 		 */
1087 		np = VTONFS(dvp);
1088 		MALLOC(nfhp, struct nfsfh *, sizeof (struct nfsfh) +
1089 			np->n_fhp->nfh_len, M_NFSFH, M_WAITOK);
1090 		nfhp->nfh_len = np->n_fhp->nfh_len;
1091 		NFSBCOPY(np->n_fhp->nfh_fh, nfhp->nfh_fh, nfhp->nfh_len);
1092 		*nfhpp = nfhp;
1093 		return (0);
1094 	}
1095 	if (NFSHASNFSV4(nmp) && len == 2 &&
1096 		name[0] == '.' && name[1] == '.') {
1097 		lookupp = 1;
1098 		NFSCL_REQSTART(nd, NFSPROC_LOOKUPP, dvp);
1099 	} else {
1100 		NFSCL_REQSTART(nd, NFSPROC_LOOKUP, dvp);
1101 		(void) nfsm_strtom(nd, name, len);
1102 	}
1103 	if (nd->nd_flag & ND_NFSV4) {
1104 		NFSGETATTR_ATTRBIT(&attrbits);
1105 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1106 		*tl++ = txdr_unsigned(NFSV4OP_GETFH);
1107 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
1108 		(void) nfsrv_putattrbit(nd, &attrbits);
1109 	}
1110 	error = nfscl_request(nd, dvp, p, cred, stuff);
1111 	if (error)
1112 		return (error);
1113 	if (nd->nd_repstat) {
1114 		/*
1115 		 * When an NFSv4 Lookupp returns ENOENT, it means that
1116 		 * the lookup is at the root of an fs, so return this dir.
1117 		 */
1118 		if (nd->nd_repstat == NFSERR_NOENT && lookupp) {
1119 		    np = VTONFS(dvp);
1120 		    MALLOC(nfhp, struct nfsfh *, sizeof (struct nfsfh) +
1121 			np->n_fhp->nfh_len, M_NFSFH, M_WAITOK);
1122 		    nfhp->nfh_len = np->n_fhp->nfh_len;
1123 		    NFSBCOPY(np->n_fhp->nfh_fh, nfhp->nfh_fh, nfhp->nfh_len);
1124 		    *nfhpp = nfhp;
1125 		    mbuf_freem(nd->nd_mrep);
1126 		    return (0);
1127 		}
1128 		if (nd->nd_flag & ND_NFSV3)
1129 		    error = nfscl_postop_attr(nd, dnap, dattrflagp, stuff);
1130 		goto nfsmout;
1131 	}
1132 	if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4) {
1133 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1134 		if (*(tl + 1)) {
1135 			nd->nd_flag |= ND_NOMOREDATA;
1136 			goto nfsmout;
1137 		}
1138 	}
1139 	error = nfsm_getfh(nd, nfhpp);
1140 	if (error)
1141 		goto nfsmout;
1142 
1143 	error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
1144 	if ((nd->nd_flag & ND_NFSV3) && !error)
1145 		error = nfscl_postop_attr(nd, dnap, dattrflagp, stuff);
1146 nfsmout:
1147 	mbuf_freem(nd->nd_mrep);
1148 	if (!error && nd->nd_repstat)
1149 		error = nd->nd_repstat;
1150 	return (error);
1151 }
1152 
1153 /*
1154  * Do a readlink rpc.
1155  */
1156 APPLESTATIC int
1157 nfsrpc_readlink(vnode_t vp, struct uio *uiop, struct ucred *cred,
1158     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
1159 {
1160 	u_int32_t *tl;
1161 	struct nfsrv_descript nfsd, *nd = &nfsd;
1162 	struct nfsnode *np = VTONFS(vp);
1163 	nfsattrbit_t attrbits;
1164 	int error, len, cangetattr = 1;
1165 
1166 	*attrflagp = 0;
1167 	NFSCL_REQSTART(nd, NFSPROC_READLINK, vp);
1168 	if (nd->nd_flag & ND_NFSV4) {
1169 		/*
1170 		 * And do a Getattr op.
1171 		 */
1172 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
1173 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
1174 		NFSGETATTR_ATTRBIT(&attrbits);
1175 		(void) nfsrv_putattrbit(nd, &attrbits);
1176 	}
1177 	error = nfscl_request(nd, vp, p, cred, stuff);
1178 	if (error)
1179 		return (error);
1180 	if (nd->nd_flag & ND_NFSV3)
1181 		error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
1182 	if (!nd->nd_repstat && !error) {
1183 		NFSM_STRSIZ(len, NFS_MAXPATHLEN);
1184 		/*
1185 		 * This seems weird to me, but must have been added to
1186 		 * FreeBSD for some reason. The only thing I can think of
1187 		 * is that there was/is some server that replies with
1188 		 * more link data than it should?
1189 		 */
1190 		if (len == NFS_MAXPATHLEN) {
1191 			NFSLOCKNODE(np);
1192 			if (np->n_size > 0 && np->n_size < NFS_MAXPATHLEN) {
1193 				len = np->n_size;
1194 				cangetattr = 0;
1195 			}
1196 			NFSUNLOCKNODE(np);
1197 		}
1198 		error = nfsm_mbufuio(nd, uiop, len);
1199 		if ((nd->nd_flag & ND_NFSV4) && !error && cangetattr)
1200 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
1201 	}
1202 	if (nd->nd_repstat && !error)
1203 		error = nd->nd_repstat;
1204 nfsmout:
1205 	mbuf_freem(nd->nd_mrep);
1206 	return (error);
1207 }
1208 
1209 /*
1210  * Read operation.
1211  */
1212 APPLESTATIC int
1213 nfsrpc_read(vnode_t vp, struct uio *uiop, struct ucred *cred,
1214     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
1215 {
1216 	int error, expireret = 0, retrycnt;
1217 	u_int32_t clidrev = 0;
1218 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
1219 	struct nfsnode *np = VTONFS(vp);
1220 	struct ucred *newcred;
1221 	struct nfsfh *nfhp = NULL;
1222 	nfsv4stateid_t stateid;
1223 	void *lckp;
1224 
1225 	if (nmp->nm_clp != NULL)
1226 		clidrev = nmp->nm_clp->nfsc_clientidrev;
1227 	newcred = cred;
1228 	if (NFSHASNFSV4(nmp)) {
1229 		nfhp = np->n_fhp;
1230 		if (p == NULL)
1231 			newcred = NFSNEWCRED(cred);
1232 	}
1233 	retrycnt = 0;
1234 	do {
1235 		lckp = NULL;
1236 		if (NFSHASNFSV4(nmp))
1237 			(void)nfscl_getstateid(vp, nfhp->nfh_fh, nfhp->nfh_len,
1238 			    NFSV4OPEN_ACCESSREAD, newcred, p, &stateid, &lckp);
1239 		error = nfsrpc_readrpc(vp, uiop, newcred, &stateid, p, nap,
1240 		    attrflagp, stuff);
1241 		if (error == NFSERR_STALESTATEID)
1242 			nfscl_initiate_recovery(nmp->nm_clp);
1243 		if (lckp != NULL)
1244 			nfscl_lockderef(lckp);
1245 		if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
1246 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
1247 		    error == NFSERR_OLDSTATEID) {
1248 			(void) nfs_catnap(PZERO, error, "nfs_read");
1249 		} else if ((error == NFSERR_EXPIRED ||
1250 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
1251 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
1252 		}
1253 		retrycnt++;
1254 	} while (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
1255 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
1256 	    (error == NFSERR_OLDSTATEID && retrycnt < 20) ||
1257 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
1258 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
1259 	if (error && retrycnt >= 4)
1260 		error = EIO;
1261 	if (NFSHASNFSV4(nmp) && p == NULL)
1262 		NFSFREECRED(newcred);
1263 	return (error);
1264 }
1265 
1266 /*
1267  * The actual read RPC.
1268  */
1269 static int
1270 nfsrpc_readrpc(vnode_t vp, struct uio *uiop, struct ucred *cred,
1271     nfsv4stateid_t *stateidp, NFSPROC_T *p, struct nfsvattr *nap,
1272     int *attrflagp, void *stuff)
1273 {
1274 	u_int32_t *tl;
1275 	int error = 0, len, retlen, tsiz, eof = 0;
1276 	struct nfsrv_descript nfsd;
1277 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
1278 	struct nfsrv_descript *nd = &nfsd;
1279 
1280 	*attrflagp = 0;
1281 	tsiz = uio_uio_resid(uiop);
1282 	if (uiop->uio_offset + tsiz > 0xffffffff &&
1283 	    !NFSHASNFSV3OR4(nmp))
1284 		return (EFBIG);
1285 	nd->nd_mrep = NULL;
1286 	while (tsiz > 0) {
1287 		*attrflagp = 0;
1288 		len = (tsiz > nmp->nm_rsize) ? nmp->nm_rsize : tsiz;
1289 		NFSCL_REQSTART(nd, NFSPROC_READ, vp);
1290 		if (nd->nd_flag & ND_NFSV4)
1291 			nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
1292 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED * 3);
1293 		if (nd->nd_flag & ND_NFSV2) {
1294 			*tl++ = txdr_unsigned(uiop->uio_offset);
1295 			*tl++ = txdr_unsigned(len);
1296 			*tl = 0;
1297 		} else {
1298 			txdr_hyper(uiop->uio_offset, tl);
1299 			*(tl + 2) = txdr_unsigned(len);
1300 		}
1301 		/*
1302 		 * Since I can't do a Getattr for NFSv4 for Write, there
1303 		 * doesn't seem any point in doing one here, either.
1304 		 * (See the comment in nfsrpc_writerpc() for more info.)
1305 		 */
1306 		error = nfscl_request(nd, vp, p, cred, stuff);
1307 		if (error)
1308 			return (error);
1309 		if (nd->nd_flag & ND_NFSV3) {
1310 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
1311 		} else if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV2)) {
1312 			error = nfsm_loadattr(nd, nap);
1313 			if (!error)
1314 				*attrflagp = 1;
1315 		}
1316 		if (nd->nd_repstat || error) {
1317 			if (!error)
1318 				error = nd->nd_repstat;
1319 			goto nfsmout;
1320 		}
1321 		if (nd->nd_flag & ND_NFSV3) {
1322 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1323 			eof = fxdr_unsigned(int, *(tl + 1));
1324 		} else if (nd->nd_flag & ND_NFSV4) {
1325 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1326 			eof = fxdr_unsigned(int, *tl);
1327 		}
1328 		NFSM_STRSIZ(retlen, nmp->nm_rsize);
1329 		error = nfsm_mbufuio(nd, uiop, retlen);
1330 		if (error)
1331 			goto nfsmout;
1332 		mbuf_freem(nd->nd_mrep);
1333 		nd->nd_mrep = NULL;
1334 		tsiz -= retlen;
1335 		if (!(nd->nd_flag & ND_NFSV2)) {
1336 			if (eof || retlen == 0)
1337 				tsiz = 0;
1338 		} else if (retlen < len)
1339 			tsiz = 0;
1340 	}
1341 	return (0);
1342 nfsmout:
1343 	if (nd->nd_mrep != NULL)
1344 		mbuf_freem(nd->nd_mrep);
1345 	return (error);
1346 }
1347 
1348 /*
1349  * nfs write operation
1350  * When called_from_strategy != 0, it should return EIO for an error that
1351  * indicates recovery is in progress, so that the buffer will be left
1352  * dirty and be written back to the server later. If it loops around,
1353  * the recovery thread could get stuck waiting for the buffer and recovery
1354  * will then deadlock.
1355  */
1356 APPLESTATIC int
1357 nfsrpc_write(vnode_t vp, struct uio *uiop, int *iomode, u_char *verfp,
1358     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
1359     void *stuff, int called_from_strategy)
1360 {
1361 	int error, expireret = 0, retrycnt, nostateid;
1362 	u_int32_t clidrev = 0;
1363 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
1364 	struct nfsnode *np = VTONFS(vp);
1365 	struct ucred *newcred;
1366 	struct nfsfh *nfhp = NULL;
1367 	nfsv4stateid_t stateid;
1368 	void *lckp;
1369 
1370 	if (nmp->nm_clp != NULL)
1371 		clidrev = nmp->nm_clp->nfsc_clientidrev;
1372 	newcred = cred;
1373 	if (NFSHASNFSV4(nmp)) {
1374 		if (p == NULL)
1375 			newcred = NFSNEWCRED(cred);
1376 		nfhp = np->n_fhp;
1377 	}
1378 	retrycnt = 0;
1379 	do {
1380 		lckp = NULL;
1381 		nostateid = 0;
1382 		if (NFSHASNFSV4(nmp)) {
1383 			(void)nfscl_getstateid(vp, nfhp->nfh_fh, nfhp->nfh_len,
1384 			    NFSV4OPEN_ACCESSWRITE, newcred, p, &stateid, &lckp);
1385 			if (stateid.other[0] == 0 && stateid.other[1] == 0 &&
1386 			    stateid.other[2] == 0) {
1387 				nostateid = 1;
1388 				printf("stateid0 in write\n");
1389 			}
1390 		}
1391 
1392 		/*
1393 		 * If there is no stateid for NFSv4, it means this is an
1394 		 * extraneous write after close. Basically a poorly
1395 		 * implemented buffer cache. Just don't do the write.
1396 		 */
1397 		if (nostateid)
1398 			error = 0;
1399 		else
1400 			error = nfsrpc_writerpc(vp, uiop, iomode, verfp,
1401 			    newcred, &stateid, p, nap, attrflagp, stuff);
1402 		if (error == NFSERR_STALESTATEID)
1403 			nfscl_initiate_recovery(nmp->nm_clp);
1404 		if (lckp != NULL)
1405 			nfscl_lockderef(lckp);
1406 		if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
1407 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
1408 		    error == NFSERR_OLDSTATEID) {
1409 			(void) nfs_catnap(PZERO, error, "nfs_write");
1410 		} else if ((error == NFSERR_EXPIRED ||
1411 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
1412 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
1413 		}
1414 		retrycnt++;
1415 	} while (error == NFSERR_GRACE || error == NFSERR_DELAY ||
1416 	    ((error == NFSERR_STALESTATEID ||
1417 	      error == NFSERR_STALEDONTRECOVER) && called_from_strategy == 0) ||
1418 	    (error == NFSERR_OLDSTATEID && retrycnt < 20) ||
1419 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
1420 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
1421 	if (error != 0 && (retrycnt >= 4 ||
1422 	    ((error == NFSERR_STALESTATEID ||
1423 	      error == NFSERR_STALEDONTRECOVER) && called_from_strategy != 0)))
1424 		error = EIO;
1425 	if (NFSHASNFSV4(nmp) && p == NULL)
1426 		NFSFREECRED(newcred);
1427 	return (error);
1428 }
1429 
1430 /*
1431  * The actual write RPC.
1432  */
1433 static int
1434 nfsrpc_writerpc(vnode_t vp, struct uio *uiop, int *iomode,
1435     u_char *verfp, struct ucred *cred, nfsv4stateid_t *stateidp,
1436     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
1437 {
1438 	u_int32_t *tl;
1439 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
1440 	struct nfsnode *np = VTONFS(vp);
1441 	int error = 0, len, tsiz, rlen, commit, committed = NFSWRITE_FILESYNC;
1442 	int wccflag = 0, wsize;
1443 	int32_t backup;
1444 	struct nfsrv_descript nfsd;
1445 	struct nfsrv_descript *nd = &nfsd;
1446 	nfsattrbit_t attrbits;
1447 
1448 	KASSERT(uiop->uio_iovcnt == 1, ("nfs: writerpc iovcnt > 1"));
1449 	*attrflagp = 0;
1450 	tsiz = uio_uio_resid(uiop);
1451 	NFSLOCKMNT(nmp);
1452 	if (uiop->uio_offset + tsiz > 0xffffffff &&
1453 	    !NFSHASNFSV3OR4(nmp)) {
1454 		NFSUNLOCKMNT(nmp);
1455 		return (EFBIG);
1456 	}
1457 	wsize = nmp->nm_wsize;
1458 	NFSUNLOCKMNT(nmp);
1459 	nd->nd_mrep = NULL;	/* NFSv2 sometimes does a write with */
1460 	nd->nd_repstat = 0;	/* uio_resid == 0, so the while is not done */
1461 	while (tsiz > 0) {
1462 		nmp = VFSTONFS(vnode_mount(vp));
1463 		if (nmp == NULL) {
1464 			error = ENXIO;
1465 			goto nfsmout;
1466 		}
1467 		*attrflagp = 0;
1468 		len = (tsiz > wsize) ? wsize : tsiz;
1469 		NFSCL_REQSTART(nd, NFSPROC_WRITE, vp);
1470 		if (nd->nd_flag & ND_NFSV4) {
1471 			nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
1472 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER+2*NFSX_UNSIGNED);
1473 			txdr_hyper(uiop->uio_offset, tl);
1474 			tl += 2;
1475 			*tl++ = txdr_unsigned(*iomode);
1476 			*tl = txdr_unsigned(len);
1477 		} else if (nd->nd_flag & ND_NFSV3) {
1478 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER+3*NFSX_UNSIGNED);
1479 			txdr_hyper(uiop->uio_offset, tl);
1480 			tl += 2;
1481 			*tl++ = txdr_unsigned(len);
1482 			*tl++ = txdr_unsigned(*iomode);
1483 			*tl = txdr_unsigned(len);
1484 		} else {
1485 			u_int32_t x;
1486 
1487 			NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1488 			/*
1489 			 * Not sure why someone changed this, since the
1490 			 * RFC clearly states that "beginoffset" and
1491 			 * "totalcount" are ignored, but it wouldn't
1492 			 * surprise me if there's a busted server out there.
1493 			 */
1494 			/* Set both "begin" and "current" to non-garbage. */
1495 			x = txdr_unsigned((u_int32_t)uiop->uio_offset);
1496 			*tl++ = x;      /* "begin offset" */
1497 			*tl++ = x;      /* "current offset" */
1498 			x = txdr_unsigned(len);
1499 			*tl++ = x;      /* total to this offset */
1500 			*tl = x;        /* size of this write */
1501 
1502 		}
1503 		nfsm_uiombuf(nd, uiop, len);
1504 		/*
1505 		 * Although it is tempting to do a normal Getattr Op in the
1506 		 * NFSv4 compound, the result can be a nearly hung client
1507 		 * system if the Getattr asks for Owner and/or OwnerGroup.
1508 		 * It occurs when the client can't map either the Owner or
1509 		 * Owner_group name in the Getattr reply to a uid/gid. When
1510 		 * there is a cache miss, the kernel does an upcall to the
1511 		 * nfsuserd. Then, it can try and read the local /etc/passwd
1512 		 * or /etc/group file. It can then block in getnewbuf(),
1513 		 * waiting for dirty writes to be pushed to the NFS server.
1514 		 * The only reason this doesn't result in a complete
1515 		 * deadlock, is that the upcall times out and allows
1516 		 * the write to complete. However, progress is so slow
1517 		 * that it might just as well be deadlocked.
1518 		 * So, we just get the attributes that change with each
1519 		 * write Op.
1520 		 * nb: nfscl_loadattrcache() needs to be told that these
1521 		 *     partial attributes from a write rpc are being
1522 		 *     passed in, via a argument flag.
1523 		 */
1524 		if (nd->nd_flag & ND_NFSV4) {
1525 			NFSWRITEGETATTR_ATTRBIT(&attrbits);
1526 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
1527 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
1528 			(void) nfsrv_putattrbit(nd, &attrbits);
1529 		}
1530 		error = nfscl_request(nd, vp, p, cred, stuff);
1531 		if (error)
1532 			return (error);
1533 		if (nd->nd_repstat) {
1534 			/*
1535 			 * In case the rpc gets retried, roll
1536 			 * the uio fileds changed by nfsm_uiombuf()
1537 			 * back.
1538 			 */
1539 			uiop->uio_offset -= len;
1540 			uio_uio_resid_add(uiop, len);
1541 			uio_iov_base_add(uiop, -len);
1542 			uio_iov_len_add(uiop, len);
1543 		}
1544 		if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
1545 			error = nfscl_wcc_data(nd, vp, nap, attrflagp,
1546 			    &wccflag, stuff);
1547 			if (error)
1548 				goto nfsmout;
1549 		}
1550 		if (!nd->nd_repstat) {
1551 			if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
1552 				NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED
1553 					+ NFSX_VERF);
1554 				rlen = fxdr_unsigned(int, *tl++);
1555 				if (rlen == 0) {
1556 					error = NFSERR_IO;
1557 					goto nfsmout;
1558 				} else if (rlen < len) {
1559 					backup = len - rlen;
1560 					uio_iov_base_add(uiop, -(backup));
1561 					uio_iov_len_add(uiop, backup);
1562 					uiop->uio_offset -= backup;
1563 					uio_uio_resid_add(uiop, backup);
1564 					len = rlen;
1565 				}
1566 				commit = fxdr_unsigned(int, *tl++);
1567 
1568 				/*
1569 				 * Return the lowest committment level
1570 				 * obtained by any of the RPCs.
1571 				 */
1572 				if (committed == NFSWRITE_FILESYNC)
1573 					committed = commit;
1574 				else if (committed == NFSWRITE_DATASYNC &&
1575 					commit == NFSWRITE_UNSTABLE)
1576 					committed = commit;
1577 				if (verfp != NULL)
1578 					NFSBCOPY((caddr_t)tl, verfp, NFSX_VERF);
1579 				NFSLOCKMNT(nmp);
1580 				if (!NFSHASWRITEVERF(nmp)) {
1581 					NFSBCOPY((caddr_t)tl,
1582 					    (caddr_t)&nmp->nm_verf[0],
1583 					    NFSX_VERF);
1584 					NFSSETWRITEVERF(nmp);
1585 				}
1586 				NFSUNLOCKMNT(nmp);
1587 			}
1588 			if (nd->nd_flag & ND_NFSV4)
1589 				NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1590 			if (nd->nd_flag & (ND_NFSV2 | ND_NFSV4)) {
1591 				error = nfsm_loadattr(nd, nap);
1592 				if (!error)
1593 					*attrflagp = NFS_LATTR_NOSHRINK;
1594 			}
1595 		} else {
1596 			error = nd->nd_repstat;
1597 		}
1598 		if (error)
1599 			goto nfsmout;
1600 		NFSWRITERPC_SETTIME(wccflag, np, (nd->nd_flag & ND_NFSV4));
1601 		mbuf_freem(nd->nd_mrep);
1602 		nd->nd_mrep = NULL;
1603 		tsiz -= len;
1604 	}
1605 nfsmout:
1606 	if (nd->nd_mrep != NULL)
1607 		mbuf_freem(nd->nd_mrep);
1608 	*iomode = committed;
1609 	if (nd->nd_repstat && !error)
1610 		error = nd->nd_repstat;
1611 	return (error);
1612 }
1613 
1614 /*
1615  * nfs mknod rpc
1616  * For NFS v2 this is a kludge. Use a create rpc but with the IFMT bits of the
1617  * mode set to specify the file type and the size field for rdev.
1618  */
1619 APPLESTATIC int
1620 nfsrpc_mknod(vnode_t dvp, char *name, int namelen, struct vattr *vap,
1621     u_int32_t rdev, enum vtype vtyp, struct ucred *cred, NFSPROC_T *p,
1622     struct nfsvattr *dnap, struct nfsvattr *nnap, struct nfsfh **nfhpp,
1623     int *attrflagp, int *dattrflagp, void *dstuff)
1624 {
1625 	u_int32_t *tl;
1626 	int error = 0;
1627 	struct nfsrv_descript nfsd, *nd = &nfsd;
1628 	nfsattrbit_t attrbits;
1629 
1630 	*nfhpp = NULL;
1631 	*attrflagp = 0;
1632 	*dattrflagp = 0;
1633 	if (namelen > NFS_MAXNAMLEN)
1634 		return (ENAMETOOLONG);
1635 	NFSCL_REQSTART(nd, NFSPROC_MKNOD, dvp);
1636 	if (nd->nd_flag & ND_NFSV4) {
1637 		if (vtyp == VBLK || vtyp == VCHR) {
1638 			NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
1639 			*tl++ = vtonfsv34_type(vtyp);
1640 			*tl++ = txdr_unsigned(NFSMAJOR(rdev));
1641 			*tl = txdr_unsigned(NFSMINOR(rdev));
1642 		} else {
1643 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
1644 			*tl = vtonfsv34_type(vtyp);
1645 		}
1646 	}
1647 	(void) nfsm_strtom(nd, name, namelen);
1648 	if (nd->nd_flag & ND_NFSV3) {
1649 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
1650 		*tl = vtonfsv34_type(vtyp);
1651 	}
1652 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
1653 		nfscl_fillsattr(nd, vap, dvp, 0, 0);
1654 	if ((nd->nd_flag & ND_NFSV3) &&
1655 	    (vtyp == VCHR || vtyp == VBLK)) {
1656 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1657 		*tl++ = txdr_unsigned(NFSMAJOR(rdev));
1658 		*tl = txdr_unsigned(NFSMINOR(rdev));
1659 	}
1660 	if (nd->nd_flag & ND_NFSV4) {
1661 		NFSGETATTR_ATTRBIT(&attrbits);
1662 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1663 		*tl++ = txdr_unsigned(NFSV4OP_GETFH);
1664 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
1665 		(void) nfsrv_putattrbit(nd, &attrbits);
1666 	}
1667 	if (nd->nd_flag & ND_NFSV2)
1668 		nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZERDEV, rdev);
1669 	error = nfscl_request(nd, dvp, p, cred, dstuff);
1670 	if (error)
1671 		return (error);
1672 	if (nd->nd_flag & ND_NFSV4)
1673 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
1674 	if (!nd->nd_repstat) {
1675 		if (nd->nd_flag & ND_NFSV4) {
1676 			NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1677 			error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
1678 			if (error)
1679 				goto nfsmout;
1680 		}
1681 		error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
1682 		if (error)
1683 			goto nfsmout;
1684 	}
1685 	if (nd->nd_flag & ND_NFSV3)
1686 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
1687 	if (!error && nd->nd_repstat)
1688 		error = nd->nd_repstat;
1689 nfsmout:
1690 	mbuf_freem(nd->nd_mrep);
1691 	return (error);
1692 }
1693 
1694 /*
1695  * nfs file create call
1696  * Mostly just call the approriate routine. (I separated out v4, so that
1697  * error recovery wouldn't be as difficult.)
1698  */
1699 APPLESTATIC int
1700 nfsrpc_create(vnode_t dvp, char *name, int namelen, struct vattr *vap,
1701     nfsquad_t cverf, int fmode, struct ucred *cred, NFSPROC_T *p,
1702     struct nfsvattr *dnap, struct nfsvattr *nnap, struct nfsfh **nfhpp,
1703     int *attrflagp, int *dattrflagp, void *dstuff)
1704 {
1705 	int error = 0, newone, expireret = 0, retrycnt, unlocked;
1706 	struct nfsclowner *owp;
1707 	struct nfscldeleg *dp;
1708 	struct nfsmount *nmp = VFSTONFS(vnode_mount(dvp));
1709 	u_int32_t clidrev;
1710 
1711 	if (NFSHASNFSV4(nmp)) {
1712 	    retrycnt = 0;
1713 	    do {
1714 		dp = NULL;
1715 		error = nfscl_open(dvp, NULL, 0, (NFSV4OPEN_ACCESSWRITE |
1716 		    NFSV4OPEN_ACCESSREAD), 0, cred, p, &owp, NULL, &newone,
1717 		    NULL, 1);
1718 		if (error)
1719 			return (error);
1720 		if (nmp->nm_clp != NULL)
1721 			clidrev = nmp->nm_clp->nfsc_clientidrev;
1722 		else
1723 			clidrev = 0;
1724 		error = nfsrpc_createv4(dvp, name, namelen, vap, cverf, fmode,
1725 		  owp, &dp, cred, p, dnap, nnap, nfhpp, attrflagp, dattrflagp,
1726 		  dstuff, &unlocked);
1727 		if (dp != NULL)
1728 			(void) nfscl_deleg(nmp->nm_mountp, owp->nfsow_clp,
1729 			    (*nfhpp)->nfh_fh, (*nfhpp)->nfh_len, cred, p, &dp);
1730 		nfscl_ownerrelease(owp, error, newone, unlocked);
1731 		if (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
1732 		    error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY) {
1733 			(void) nfs_catnap(PZERO, error, "nfs_open");
1734 		} else if ((error == NFSERR_EXPIRED ||
1735 		    error == NFSERR_BADSTATEID) && clidrev != 0) {
1736 			expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
1737 			retrycnt++;
1738 		}
1739 	    } while (error == NFSERR_GRACE || error == NFSERR_STALECLIENTID ||
1740 		error == NFSERR_STALEDONTRECOVER || error == NFSERR_DELAY ||
1741 		((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
1742 		 expireret == 0 && clidrev != 0 && retrycnt < 4));
1743 	    if (error && retrycnt >= 4)
1744 		    error = EIO;
1745 	} else {
1746 		error = nfsrpc_createv23(dvp, name, namelen, vap, cverf,
1747 		    fmode, cred, p, dnap, nnap, nfhpp, attrflagp, dattrflagp,
1748 		    dstuff);
1749 	}
1750 	return (error);
1751 }
1752 
1753 /*
1754  * The create rpc for v2 and 3.
1755  */
1756 static int
1757 nfsrpc_createv23(vnode_t dvp, char *name, int namelen, struct vattr *vap,
1758     nfsquad_t cverf, int fmode, struct ucred *cred, NFSPROC_T *p,
1759     struct nfsvattr *dnap, struct nfsvattr *nnap, struct nfsfh **nfhpp,
1760     int *attrflagp, int *dattrflagp, void *dstuff)
1761 {
1762 	u_int32_t *tl;
1763 	int error = 0;
1764 	struct nfsrv_descript nfsd, *nd = &nfsd;
1765 
1766 	*nfhpp = NULL;
1767 	*attrflagp = 0;
1768 	*dattrflagp = 0;
1769 	if (namelen > NFS_MAXNAMLEN)
1770 		return (ENAMETOOLONG);
1771 	NFSCL_REQSTART(nd, NFSPROC_CREATE, dvp);
1772 	(void) nfsm_strtom(nd, name, namelen);
1773 	if (nd->nd_flag & ND_NFSV3) {
1774 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
1775 		if (fmode & O_EXCL) {
1776 			*tl = txdr_unsigned(NFSCREATE_EXCLUSIVE);
1777 			NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
1778 			*tl++ = cverf.lval[0];
1779 			*tl = cverf.lval[1];
1780 		} else {
1781 			*tl = txdr_unsigned(NFSCREATE_UNCHECKED);
1782 			nfscl_fillsattr(nd, vap, dvp, 0, 0);
1783 		}
1784 	} else {
1785 		nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZE0, 0);
1786 	}
1787 	error = nfscl_request(nd, dvp, p, cred, dstuff);
1788 	if (error)
1789 		return (error);
1790 	if (nd->nd_repstat == 0) {
1791 		error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
1792 		if (error)
1793 			goto nfsmout;
1794 	}
1795 	if (nd->nd_flag & ND_NFSV3)
1796 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
1797 	if (nd->nd_repstat != 0 && error == 0)
1798 		error = nd->nd_repstat;
1799 nfsmout:
1800 	mbuf_freem(nd->nd_mrep);
1801 	return (error);
1802 }
1803 
1804 static int
1805 nfsrpc_createv4(vnode_t dvp, char *name, int namelen, struct vattr *vap,
1806     nfsquad_t cverf, int fmode, struct nfsclowner *owp, struct nfscldeleg **dpp,
1807     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
1808     struct nfsvattr *nnap, struct nfsfh **nfhpp, int *attrflagp,
1809     int *dattrflagp, void *dstuff, int *unlockedp)
1810 {
1811 	u_int32_t *tl;
1812 	int error = 0, deleg, newone, ret, acesize, limitby;
1813 	struct nfsrv_descript nfsd, *nd = &nfsd;
1814 	struct nfsclopen *op;
1815 	struct nfscldeleg *dp = NULL;
1816 	struct nfsnode *np;
1817 	struct nfsfh *nfhp;
1818 	nfsattrbit_t attrbits;
1819 	nfsv4stateid_t stateid;
1820 	u_int32_t rflags;
1821 
1822 	*unlockedp = 0;
1823 	*nfhpp = NULL;
1824 	*dpp = NULL;
1825 	*attrflagp = 0;
1826 	*dattrflagp = 0;
1827 	if (namelen > NFS_MAXNAMLEN)
1828 		return (ENAMETOOLONG);
1829 	NFSCL_REQSTART(nd, NFSPROC_CREATE, dvp);
1830 	/*
1831 	 * For V4, this is actually an Open op.
1832 	 */
1833 	NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1834 	*tl++ = txdr_unsigned(owp->nfsow_seqid);
1835 	*tl++ = txdr_unsigned(NFSV4OPEN_ACCESSWRITE |
1836 	    NFSV4OPEN_ACCESSREAD);
1837 	*tl++ = txdr_unsigned(NFSV4OPEN_DENYNONE);
1838 	*tl++ = owp->nfsow_clp->nfsc_clientid.lval[0];
1839 	*tl = owp->nfsow_clp->nfsc_clientid.lval[1];
1840 	(void) nfsm_strtom(nd, owp->nfsow_owner, NFSV4CL_LOCKNAMELEN);
1841 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1842 	*tl++ = txdr_unsigned(NFSV4OPEN_CREATE);
1843 	if (fmode & O_EXCL) {
1844 		*tl = txdr_unsigned(NFSCREATE_EXCLUSIVE);
1845 		NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
1846 		*tl++ = cverf.lval[0];
1847 		*tl = cverf.lval[1];
1848 	} else {
1849 		*tl = txdr_unsigned(NFSCREATE_UNCHECKED);
1850 		nfscl_fillsattr(nd, vap, dvp, 0, 0);
1851 	}
1852 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
1853 	*tl = txdr_unsigned(NFSV4OPEN_CLAIMNULL);
1854 	(void) nfsm_strtom(nd, name, namelen);
1855 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1856 	*tl++ = txdr_unsigned(NFSV4OP_GETFH);
1857 	*tl = txdr_unsigned(NFSV4OP_GETATTR);
1858 	NFSGETATTR_ATTRBIT(&attrbits);
1859 	(void) nfsrv_putattrbit(nd, &attrbits);
1860 	error = nfscl_request(nd, dvp, p, cred, dstuff);
1861 	if (error)
1862 		return (error);
1863 	error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
1864 	if (error)
1865 		goto nfsmout;
1866 	NFSCL_INCRSEQID(owp->nfsow_seqid, nd);
1867 	if (nd->nd_repstat == 0) {
1868 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
1869 		    6 * NFSX_UNSIGNED);
1870 		stateid.seqid = *tl++;
1871 		stateid.other[0] = *tl++;
1872 		stateid.other[1] = *tl++;
1873 		stateid.other[2] = *tl;
1874 		rflags = fxdr_unsigned(u_int32_t, *(tl + 6));
1875 		(void) nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
1876 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1877 		deleg = fxdr_unsigned(int, *tl);
1878 		if (deleg == NFSV4OPEN_DELEGATEREAD ||
1879 		    deleg == NFSV4OPEN_DELEGATEWRITE) {
1880 			if (!(owp->nfsow_clp->nfsc_flags &
1881 			      NFSCLFLAGS_FIRSTDELEG))
1882 				owp->nfsow_clp->nfsc_flags |=
1883 				  (NFSCLFLAGS_FIRSTDELEG | NFSCLFLAGS_GOTDELEG);
1884 			MALLOC(dp, struct nfscldeleg *,
1885 			    sizeof (struct nfscldeleg) + NFSX_V4FHMAX,
1886 			    M_NFSCLDELEG, M_WAITOK);
1887 			LIST_INIT(&dp->nfsdl_owner);
1888 			LIST_INIT(&dp->nfsdl_lock);
1889 			dp->nfsdl_clp = owp->nfsow_clp;
1890 			newnfs_copyincred(cred, &dp->nfsdl_cred);
1891 			nfscl_lockinit(&dp->nfsdl_rwlock);
1892 			NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
1893 			    NFSX_UNSIGNED);
1894 			dp->nfsdl_stateid.seqid = *tl++;
1895 			dp->nfsdl_stateid.other[0] = *tl++;
1896 			dp->nfsdl_stateid.other[1] = *tl++;
1897 			dp->nfsdl_stateid.other[2] = *tl++;
1898 			ret = fxdr_unsigned(int, *tl);
1899 			if (deleg == NFSV4OPEN_DELEGATEWRITE) {
1900 				dp->nfsdl_flags = NFSCLDL_WRITE;
1901 				/*
1902 				 * Indicates how much the file can grow.
1903 				 */
1904 				NFSM_DISSECT(tl, u_int32_t *,
1905 				    3 * NFSX_UNSIGNED);
1906 				limitby = fxdr_unsigned(int, *tl++);
1907 				switch (limitby) {
1908 				case NFSV4OPEN_LIMITSIZE:
1909 					dp->nfsdl_sizelimit = fxdr_hyper(tl);
1910 					break;
1911 				case NFSV4OPEN_LIMITBLOCKS:
1912 					dp->nfsdl_sizelimit =
1913 					    fxdr_unsigned(u_int64_t, *tl++);
1914 					dp->nfsdl_sizelimit *=
1915 					    fxdr_unsigned(u_int64_t, *tl);
1916 					break;
1917 				default:
1918 					error = NFSERR_BADXDR;
1919 					goto nfsmout;
1920 				};
1921 			} else {
1922 				dp->nfsdl_flags = NFSCLDL_READ;
1923 			}
1924 			if (ret)
1925 				dp->nfsdl_flags |= NFSCLDL_RECALL;
1926 			error = nfsrv_dissectace(nd, &dp->nfsdl_ace, &ret,
1927 			    &acesize, p);
1928 			if (error)
1929 				goto nfsmout;
1930 		} else if (deleg != NFSV4OPEN_DELEGATENONE) {
1931 			error = NFSERR_BADXDR;
1932 			goto nfsmout;
1933 		}
1934 		error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
1935 		if (error)
1936 			goto nfsmout;
1937 		if (dp != NULL && *attrflagp) {
1938 			dp->nfsdl_change = nnap->na_filerev;
1939 			dp->nfsdl_modtime = nnap->na_mtime;
1940 			dp->nfsdl_flags |= NFSCLDL_MODTIMESET;
1941 		}
1942 		/*
1943 		 * We can now complete the Open state.
1944 		 */
1945 		nfhp = *nfhpp;
1946 		if (dp != NULL) {
1947 			dp->nfsdl_fhlen = nfhp->nfh_len;
1948 			NFSBCOPY(nfhp->nfh_fh, dp->nfsdl_fh, nfhp->nfh_len);
1949 		}
1950 		/*
1951 		 * Get an Open structure that will be
1952 		 * attached to the OpenOwner, acquired already.
1953 		 */
1954 		error = nfscl_open(dvp, nfhp->nfh_fh, nfhp->nfh_len,
1955 		    (NFSV4OPEN_ACCESSWRITE | NFSV4OPEN_ACCESSREAD), 0,
1956 		    cred, p, NULL, &op, &newone, NULL, 0);
1957 		if (error)
1958 			goto nfsmout;
1959 		op->nfso_stateid = stateid;
1960 		newnfs_copyincred(cred, &op->nfso_cred);
1961 		if ((rflags & NFSV4OPEN_RESULTCONFIRM)) {
1962 		    do {
1963 			ret = nfsrpc_openconfirm(dvp, nfhp->nfh_fh,
1964 			    nfhp->nfh_len, op, cred, p);
1965 			if (ret == NFSERR_DELAY)
1966 			    (void) nfs_catnap(PZERO, ret, "nfs_create");
1967 		    } while (ret == NFSERR_DELAY);
1968 		    error = ret;
1969 		}
1970 
1971 		/*
1972 		 * If the server is handing out delegations, but we didn't
1973 		 * get one because an OpenConfirm was required, try the
1974 		 * Open again, to get a delegation. This is a harmless no-op,
1975 		 * from a server's point of view.
1976 		 */
1977 		if ((rflags & NFSV4OPEN_RESULTCONFIRM) &&
1978 		    (owp->nfsow_clp->nfsc_flags & NFSCLFLAGS_GOTDELEG) &&
1979 		    !error && dp == NULL) {
1980 		    np = VTONFS(dvp);
1981 		    do {
1982 			ret = nfsrpc_openrpc(VFSTONFS(vnode_mount(dvp)), dvp,
1983 			    np->n_fhp->nfh_fh, np->n_fhp->nfh_len,
1984 			    nfhp->nfh_fh, nfhp->nfh_len,
1985 			    (NFSV4OPEN_ACCESSWRITE | NFSV4OPEN_ACCESSREAD), op,
1986 			    name, namelen, &dp, 0, 0x0, cred, p, 0, 1);
1987 			if (ret == NFSERR_DELAY)
1988 			    (void) nfs_catnap(PZERO, ret, "nfs_crt2");
1989 		    } while (ret == NFSERR_DELAY);
1990 		    if (ret) {
1991 			if (dp != NULL)
1992 				FREE((caddr_t)dp, M_NFSCLDELEG);
1993 			if (ret == NFSERR_STALECLIENTID ||
1994 			    ret == NFSERR_STALEDONTRECOVER)
1995 				error = ret;
1996 		    }
1997 		}
1998 		nfscl_openrelease(op, error, newone);
1999 		*unlockedp = 1;
2000 	}
2001 	if (nd->nd_repstat != 0 && error == 0)
2002 		error = nd->nd_repstat;
2003 	if (error == NFSERR_STALECLIENTID)
2004 		nfscl_initiate_recovery(owp->nfsow_clp);
2005 nfsmout:
2006 	if (!error)
2007 		*dpp = dp;
2008 	else if (dp != NULL)
2009 		FREE((caddr_t)dp, M_NFSCLDELEG);
2010 	mbuf_freem(nd->nd_mrep);
2011 	return (error);
2012 }
2013 
2014 /*
2015  * Nfs remove rpc
2016  */
2017 APPLESTATIC int
2018 nfsrpc_remove(vnode_t dvp, char *name, int namelen, vnode_t vp,
2019     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap, int *dattrflagp,
2020     void *dstuff)
2021 {
2022 	u_int32_t *tl;
2023 	struct nfsrv_descript nfsd, *nd = &nfsd;
2024 	struct nfsnode *np;
2025 	struct nfsmount *nmp;
2026 	nfsv4stateid_t dstateid;
2027 	int error, ret = 0, i;
2028 
2029 	*dattrflagp = 0;
2030 	if (namelen > NFS_MAXNAMLEN)
2031 		return (ENAMETOOLONG);
2032 	nmp = VFSTONFS(vnode_mount(dvp));
2033 tryagain:
2034 	if (NFSHASNFSV4(nmp) && ret == 0) {
2035 		ret = nfscl_removedeleg(vp, p, &dstateid);
2036 		if (ret == 1) {
2037 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGREMOVE, vp);
2038 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID +
2039 			    NFSX_UNSIGNED);
2040 			*tl++ = dstateid.seqid;
2041 			*tl++ = dstateid.other[0];
2042 			*tl++ = dstateid.other[1];
2043 			*tl++ = dstateid.other[2];
2044 			*tl = txdr_unsigned(NFSV4OP_PUTFH);
2045 			np = VTONFS(dvp);
2046 			(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh,
2047 			    np->n_fhp->nfh_len, 0);
2048 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2049 			*tl = txdr_unsigned(NFSV4OP_REMOVE);
2050 		}
2051 	} else {
2052 		ret = 0;
2053 	}
2054 	if (ret == 0)
2055 		NFSCL_REQSTART(nd, NFSPROC_REMOVE, dvp);
2056 	(void) nfsm_strtom(nd, name, namelen);
2057 	error = nfscl_request(nd, dvp, p, cred, dstuff);
2058 	if (error)
2059 		return (error);
2060 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
2061 		/* For NFSv4, parse out any Delereturn replies. */
2062 		if (ret > 0 && nd->nd_repstat != 0 &&
2063 		    (nd->nd_flag & ND_NOMOREDATA)) {
2064 			/*
2065 			 * If the Delegreturn failed, try again without
2066 			 * it. The server will Recall, as required.
2067 			 */
2068 			mbuf_freem(nd->nd_mrep);
2069 			goto tryagain;
2070 		}
2071 		for (i = 0; i < (ret * 2); i++) {
2072 			if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) ==
2073 			    ND_NFSV4) {
2074 			    NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2075 			    if (*(tl + 1))
2076 				nd->nd_flag |= ND_NOMOREDATA;
2077 			}
2078 		}
2079 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
2080 	}
2081 	if (nd->nd_repstat && !error)
2082 		error = nd->nd_repstat;
2083 nfsmout:
2084 	mbuf_freem(nd->nd_mrep);
2085 	return (error);
2086 }
2087 
2088 /*
2089  * Do an nfs rename rpc.
2090  */
2091 APPLESTATIC int
2092 nfsrpc_rename(vnode_t fdvp, vnode_t fvp, char *fnameptr, int fnamelen,
2093     vnode_t tdvp, vnode_t tvp, char *tnameptr, int tnamelen, struct ucred *cred,
2094     NFSPROC_T *p, struct nfsvattr *fnap, struct nfsvattr *tnap,
2095     int *fattrflagp, int *tattrflagp, void *fstuff, void *tstuff)
2096 {
2097 	u_int32_t *tl;
2098 	struct nfsrv_descript nfsd, *nd = &nfsd;
2099 	struct nfsmount *nmp;
2100 	struct nfsnode *np;
2101 	nfsattrbit_t attrbits;
2102 	nfsv4stateid_t fdstateid, tdstateid;
2103 	int error = 0, ret = 0, gottd = 0, gotfd = 0, i;
2104 
2105 	*fattrflagp = 0;
2106 	*tattrflagp = 0;
2107 	nmp = VFSTONFS(vnode_mount(fdvp));
2108 	if (fnamelen > NFS_MAXNAMLEN || tnamelen > NFS_MAXNAMLEN)
2109 		return (ENAMETOOLONG);
2110 tryagain:
2111 	if (NFSHASNFSV4(nmp) && ret == 0) {
2112 		ret = nfscl_renamedeleg(fvp, &fdstateid, &gotfd, tvp,
2113 		    &tdstateid, &gottd, p);
2114 		if (gotfd && gottd) {
2115 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGRENAME2, fvp);
2116 		} else if (gotfd) {
2117 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGRENAME1, fvp);
2118 		} else if (gottd) {
2119 			NFSCL_REQSTART(nd, NFSPROC_RETDELEGRENAME1, tvp);
2120 		}
2121 		if (gotfd) {
2122 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2123 			*tl++ = fdstateid.seqid;
2124 			*tl++ = fdstateid.other[0];
2125 			*tl++ = fdstateid.other[1];
2126 			*tl = fdstateid.other[2];
2127 			if (gottd) {
2128 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2129 				*tl = txdr_unsigned(NFSV4OP_PUTFH);
2130 				np = VTONFS(tvp);
2131 				(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh,
2132 				    np->n_fhp->nfh_len, 0);
2133 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2134 				*tl = txdr_unsigned(NFSV4OP_DELEGRETURN);
2135 			}
2136 		}
2137 		if (gottd) {
2138 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2139 			*tl++ = tdstateid.seqid;
2140 			*tl++ = tdstateid.other[0];
2141 			*tl++ = tdstateid.other[1];
2142 			*tl = tdstateid.other[2];
2143 		}
2144 		if (ret > 0) {
2145 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2146 			*tl = txdr_unsigned(NFSV4OP_PUTFH);
2147 			np = VTONFS(fdvp);
2148 			(void) nfsm_fhtom(nd, np->n_fhp->nfh_fh,
2149 			    np->n_fhp->nfh_len, 0);
2150 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2151 			*tl = txdr_unsigned(NFSV4OP_SAVEFH);
2152 		}
2153 	} else {
2154 		ret = 0;
2155 	}
2156 	if (ret == 0)
2157 		NFSCL_REQSTART(nd, NFSPROC_RENAME, fdvp);
2158 	if (nd->nd_flag & ND_NFSV4) {
2159 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2160 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
2161 		NFSWCCATTR_ATTRBIT(&attrbits);
2162 		(void) nfsrv_putattrbit(nd, &attrbits);
2163 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2164 		*tl = txdr_unsigned(NFSV4OP_PUTFH);
2165 		(void) nfsm_fhtom(nd, VTONFS(tdvp)->n_fhp->nfh_fh,
2166 		    VTONFS(tdvp)->n_fhp->nfh_len, 0);
2167 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2168 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
2169 		(void) nfsrv_putattrbit(nd, &attrbits);
2170 		nd->nd_flag |= ND_V4WCCATTR;
2171 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2172 		*tl = txdr_unsigned(NFSV4OP_RENAME);
2173 	}
2174 	(void) nfsm_strtom(nd, fnameptr, fnamelen);
2175 	if (!(nd->nd_flag & ND_NFSV4))
2176 		(void) nfsm_fhtom(nd, VTONFS(tdvp)->n_fhp->nfh_fh,
2177 			VTONFS(tdvp)->n_fhp->nfh_len, 0);
2178 	(void) nfsm_strtom(nd, tnameptr, tnamelen);
2179 	error = nfscl_request(nd, fdvp, p, cred, fstuff);
2180 	if (error)
2181 		return (error);
2182 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
2183 		/* For NFSv4, parse out any Delereturn replies. */
2184 		if (ret > 0 && nd->nd_repstat != 0 &&
2185 		    (nd->nd_flag & ND_NOMOREDATA)) {
2186 			/*
2187 			 * If the Delegreturn failed, try again without
2188 			 * it. The server will Recall, as required.
2189 			 */
2190 			mbuf_freem(nd->nd_mrep);
2191 			goto tryagain;
2192 		}
2193 		for (i = 0; i < (ret * 2); i++) {
2194 			if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) ==
2195 			    ND_NFSV4) {
2196 			    NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2197 			    if (*(tl + 1)) {
2198 				if (i == 0 && ret > 1) {
2199 				    /*
2200 				     * If the Delegreturn failed, try again
2201 				     * without it. The server will Recall, as
2202 				     * required.
2203 				     * If ret > 1, the first iteration of this
2204 				     * loop is the second DelegReturn result.
2205 				     */
2206 				    mbuf_freem(nd->nd_mrep);
2207 				    goto tryagain;
2208 				} else {
2209 				    nd->nd_flag |= ND_NOMOREDATA;
2210 				}
2211 			    }
2212 			}
2213 		}
2214 		/* Now, the first wcc attribute reply. */
2215 		if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4) {
2216 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2217 			if (*(tl + 1))
2218 				nd->nd_flag |= ND_NOMOREDATA;
2219 		}
2220 		error = nfscl_wcc_data(nd, fdvp, fnap, fattrflagp, NULL,
2221 		    fstuff);
2222 		/* and the second wcc attribute reply. */
2223 		if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4 &&
2224 		    !error) {
2225 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2226 			if (*(tl + 1))
2227 				nd->nd_flag |= ND_NOMOREDATA;
2228 		}
2229 		if (!error)
2230 			error = nfscl_wcc_data(nd, tdvp, tnap, tattrflagp,
2231 			    NULL, tstuff);
2232 	}
2233 	if (nd->nd_repstat && !error)
2234 		error = nd->nd_repstat;
2235 nfsmout:
2236 	mbuf_freem(nd->nd_mrep);
2237 	return (error);
2238 }
2239 
2240 /*
2241  * nfs hard link create rpc
2242  */
2243 APPLESTATIC int
2244 nfsrpc_link(vnode_t dvp, vnode_t vp, char *name, int namelen,
2245     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
2246     struct nfsvattr *nap, int *attrflagp, int *dattrflagp, void *dstuff)
2247 {
2248 	u_int32_t *tl;
2249 	struct nfsrv_descript nfsd, *nd = &nfsd;
2250 	nfsattrbit_t attrbits;
2251 	int error = 0;
2252 
2253 	*attrflagp = 0;
2254 	*dattrflagp = 0;
2255 	if (namelen > NFS_MAXNAMLEN)
2256 		return (ENAMETOOLONG);
2257 	NFSCL_REQSTART(nd, NFSPROC_LINK, vp);
2258 	if (nd->nd_flag & ND_NFSV4) {
2259 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2260 		*tl = txdr_unsigned(NFSV4OP_PUTFH);
2261 	}
2262 	(void) nfsm_fhtom(nd, VTONFS(dvp)->n_fhp->nfh_fh,
2263 		VTONFS(dvp)->n_fhp->nfh_len, 0);
2264 	if (nd->nd_flag & ND_NFSV4) {
2265 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2266 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
2267 		NFSWCCATTR_ATTRBIT(&attrbits);
2268 		(void) nfsrv_putattrbit(nd, &attrbits);
2269 		nd->nd_flag |= ND_V4WCCATTR;
2270 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2271 		*tl = txdr_unsigned(NFSV4OP_LINK);
2272 	}
2273 	(void) nfsm_strtom(nd, name, namelen);
2274 	error = nfscl_request(nd, vp, p, cred, dstuff);
2275 	if (error)
2276 		return (error);
2277 	if (nd->nd_flag & ND_NFSV3) {
2278 		error = nfscl_postop_attr(nd, nap, attrflagp, dstuff);
2279 		if (!error)
2280 			error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp,
2281 			    NULL, dstuff);
2282 	} else if ((nd->nd_flag & (ND_NFSV4 | ND_NOMOREDATA)) == ND_NFSV4) {
2283 		/*
2284 		 * First, parse out the PutFH and Getattr result.
2285 		 */
2286 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2287 		if (!(*(tl + 1)))
2288 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2289 		if (*(tl + 1))
2290 			nd->nd_flag |= ND_NOMOREDATA;
2291 		/*
2292 		 * Get the pre-op attributes.
2293 		 */
2294 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
2295 	}
2296 	if (nd->nd_repstat && !error)
2297 		error = nd->nd_repstat;
2298 nfsmout:
2299 	mbuf_freem(nd->nd_mrep);
2300 	return (error);
2301 }
2302 
2303 /*
2304  * nfs symbolic link create rpc
2305  */
2306 APPLESTATIC int
2307 nfsrpc_symlink(vnode_t dvp, char *name, int namelen, char *target,
2308     struct vattr *vap, struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
2309     struct nfsvattr *nnap, struct nfsfh **nfhpp, int *attrflagp,
2310     int *dattrflagp, void *dstuff)
2311 {
2312 	u_int32_t *tl;
2313 	struct nfsrv_descript nfsd, *nd = &nfsd;
2314 	struct nfsmount *nmp;
2315 	int slen, error = 0;
2316 
2317 	*nfhpp = NULL;
2318 	*attrflagp = 0;
2319 	*dattrflagp = 0;
2320 	nmp = VFSTONFS(vnode_mount(dvp));
2321 	slen = strlen(target);
2322 	if (slen > NFS_MAXPATHLEN || namelen > NFS_MAXNAMLEN)
2323 		return (ENAMETOOLONG);
2324 	NFSCL_REQSTART(nd, NFSPROC_SYMLINK, dvp);
2325 	if (nd->nd_flag & ND_NFSV4) {
2326 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2327 		*tl = txdr_unsigned(NFLNK);
2328 		(void) nfsm_strtom(nd, target, slen);
2329 	}
2330 	(void) nfsm_strtom(nd, name, namelen);
2331 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
2332 		nfscl_fillsattr(nd, vap, dvp, 0, 0);
2333 	if (!(nd->nd_flag & ND_NFSV4))
2334 		(void) nfsm_strtom(nd, target, slen);
2335 	if (nd->nd_flag & ND_NFSV2)
2336 		nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZENEG1, 0);
2337 	error = nfscl_request(nd, dvp, p, cred, dstuff);
2338 	if (error)
2339 		return (error);
2340 	if (nd->nd_flag & ND_NFSV4)
2341 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
2342 	if ((nd->nd_flag & ND_NFSV3) && !error) {
2343 		if (!nd->nd_repstat)
2344 			error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
2345 		if (!error)
2346 			error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp,
2347 			    NULL, dstuff);
2348 	}
2349 	if (nd->nd_repstat && !error)
2350 		error = nd->nd_repstat;
2351 	mbuf_freem(nd->nd_mrep);
2352 	/*
2353 	 * Kludge: Map EEXIST => 0 assuming that it is a reply to a retry.
2354 	 */
2355 	if (error == EEXIST)
2356 		error = 0;
2357 	return (error);
2358 }
2359 
2360 /*
2361  * nfs make dir rpc
2362  */
2363 APPLESTATIC int
2364 nfsrpc_mkdir(vnode_t dvp, char *name, int namelen, struct vattr *vap,
2365     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *dnap,
2366     struct nfsvattr *nnap, struct nfsfh **nfhpp, int *attrflagp,
2367     int *dattrflagp, void *dstuff)
2368 {
2369 	u_int32_t *tl;
2370 	struct nfsrv_descript nfsd, *nd = &nfsd;
2371 	nfsattrbit_t attrbits;
2372 	int error = 0;
2373 
2374 	*nfhpp = NULL;
2375 	*attrflagp = 0;
2376 	*dattrflagp = 0;
2377 	if (namelen > NFS_MAXNAMLEN)
2378 		return (ENAMETOOLONG);
2379 	NFSCL_REQSTART(nd, NFSPROC_MKDIR, dvp);
2380 	if (nd->nd_flag & ND_NFSV4) {
2381 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2382 		*tl = txdr_unsigned(NFDIR);
2383 	}
2384 	(void) nfsm_strtom(nd, name, namelen);
2385 	nfscl_fillsattr(nd, vap, dvp, NFSSATTR_SIZENEG1, 0);
2386 	if (nd->nd_flag & ND_NFSV4) {
2387 		NFSGETATTR_ATTRBIT(&attrbits);
2388 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2389 		*tl++ = txdr_unsigned(NFSV4OP_GETFH);
2390 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
2391 		(void) nfsrv_putattrbit(nd, &attrbits);
2392 	}
2393 	error = nfscl_request(nd, dvp, p, cred, dstuff);
2394 	if (error)
2395 		return (error);
2396 	if (nd->nd_flag & ND_NFSV4)
2397 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
2398 	if (!nd->nd_repstat && !error) {
2399 		if (nd->nd_flag & ND_NFSV4) {
2400 			NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2401 			error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
2402 		}
2403 		if (!error)
2404 			error = nfscl_mtofh(nd, nfhpp, nnap, attrflagp);
2405 	}
2406 	if ((nd->nd_flag & ND_NFSV3) && !error)
2407 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
2408 	if (nd->nd_repstat && !error)
2409 		error = nd->nd_repstat;
2410 nfsmout:
2411 	mbuf_freem(nd->nd_mrep);
2412 	/*
2413 	 * Kludge: Map EEXIST => 0 assuming that you have a reply to a retry.
2414 	 */
2415 	if (error == EEXIST)
2416 		error = 0;
2417 	return (error);
2418 }
2419 
2420 /*
2421  * nfs remove directory call
2422  */
2423 APPLESTATIC int
2424 nfsrpc_rmdir(vnode_t dvp, char *name, int namelen, struct ucred *cred,
2425     NFSPROC_T *p, struct nfsvattr *dnap, int *dattrflagp, void *dstuff)
2426 {
2427 	struct nfsrv_descript nfsd, *nd = &nfsd;
2428 	int error = 0;
2429 
2430 	*dattrflagp = 0;
2431 	if (namelen > NFS_MAXNAMLEN)
2432 		return (ENAMETOOLONG);
2433 	NFSCL_REQSTART(nd, NFSPROC_RMDIR, dvp);
2434 	(void) nfsm_strtom(nd, name, namelen);
2435 	error = nfscl_request(nd, dvp, p, cred, dstuff);
2436 	if (error)
2437 		return (error);
2438 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4))
2439 		error = nfscl_wcc_data(nd, dvp, dnap, dattrflagp, NULL, dstuff);
2440 	if (nd->nd_repstat && !error)
2441 		error = nd->nd_repstat;
2442 	mbuf_freem(nd->nd_mrep);
2443 	/*
2444 	 * Kludge: Map ENOENT => 0 assuming that you have a reply to a retry.
2445 	 */
2446 	if (error == ENOENT)
2447 		error = 0;
2448 	return (error);
2449 }
2450 
2451 /*
2452  * Readdir rpc.
2453  * Always returns with either uio_resid unchanged, if you are at the
2454  * end of the directory, or uio_resid == 0, with all DIRBLKSIZ chunks
2455  * filled in.
2456  * I felt this would allow caching of directory blocks more easily
2457  * than returning a pertially filled block.
2458  * Directory offset cookies:
2459  * Oh my, what to do with them...
2460  * I can think of three ways to deal with them:
2461  * 1 - have the layer above these RPCs maintain a map between logical
2462  *     directory byte offsets and the NFS directory offset cookies
2463  * 2 - pass the opaque directory offset cookies up into userland
2464  *     and let the libc functions deal with them, via the system call
2465  * 3 - return them to userland in the "struct dirent", so future versions
2466  *     of libc can use them and do whatever is necessary to amke things work
2467  *     above these rpc calls, in the meantime
2468  * For now, I do #3 by "hiding" the directory offset cookies after the
2469  * d_name field in struct dirent. This is space inside d_reclen that
2470  * will be ignored by anything that doesn't know about them.
2471  * The directory offset cookies are filled in as the last 8 bytes of
2472  * each directory entry, after d_name. Someday, the userland libc
2473  * functions may be able to use these. In the meantime, it satisfies
2474  * OpenBSD's requirements for cookies being returned.
2475  * If expects the directory offset cookie for the read to be in uio_offset
2476  * and returns the one for the next entry after this directory block in
2477  * there, as well.
2478  */
2479 APPLESTATIC int
2480 nfsrpc_readdir(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep,
2481     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
2482     int *eofp, void *stuff)
2483 {
2484 	int len, left;
2485 	struct dirent *dp = NULL;
2486 	u_int32_t *tl;
2487 	nfsquad_t cookie, ncookie;
2488 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
2489 	struct nfsnode *dnp = VTONFS(vp);
2490 	struct nfsvattr nfsva;
2491 	struct nfsrv_descript nfsd, *nd = &nfsd;
2492 	int error = 0, tlen, more_dirs = 1, blksiz = 0, bigenough = 1;
2493 	int reqsize, tryformoredirs = 1, readsize, eof = 0, gotmnton = 0;
2494 	long dotfileid, dotdotfileid = 0;
2495 	u_int32_t fakefileno = 0xffffffff, rderr;
2496 	char *cp;
2497 	nfsattrbit_t attrbits, dattrbits;
2498 	u_int32_t *tl2 = NULL;
2499 	size_t tresid;
2500 
2501 	KASSERT(uiop->uio_iovcnt == 1 &&
2502 	    (uio_uio_resid(uiop) & (DIRBLKSIZ - 1)) == 0,
2503 	    ("nfs readdirrpc bad uio"));
2504 
2505 	/*
2506 	 * There is no point in reading a lot more than uio_resid, however
2507 	 * adding one additional DIRBLKSIZ makes sense. Since uio_resid
2508 	 * and nm_readdirsize are both exact multiples of DIRBLKSIZ, this
2509 	 * will never make readsize > nm_readdirsize.
2510 	 */
2511 	readsize = nmp->nm_readdirsize;
2512 	if (readsize > uio_uio_resid(uiop))
2513 		readsize = uio_uio_resid(uiop) + DIRBLKSIZ;
2514 
2515 	*attrflagp = 0;
2516 	if (eofp)
2517 		*eofp = 0;
2518 	tresid = uio_uio_resid(uiop);
2519 	cookie.lval[0] = cookiep->nfsuquad[0];
2520 	cookie.lval[1] = cookiep->nfsuquad[1];
2521 	nd->nd_mrep = NULL;
2522 
2523 	/*
2524 	 * For NFSv4, first create the "." and ".." entries.
2525 	 */
2526 	if (NFSHASNFSV4(nmp)) {
2527 		reqsize = 6 * NFSX_UNSIGNED;
2528 		NFSGETATTR_ATTRBIT(&dattrbits);
2529 		NFSZERO_ATTRBIT(&attrbits);
2530 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FILEID);
2531 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TYPE);
2532 		if (NFSISSET_ATTRBIT(&dnp->n_vattr.na_suppattr,
2533 		    NFSATTRBIT_MOUNTEDONFILEID)) {
2534 			NFSSETBIT_ATTRBIT(&attrbits,
2535 			    NFSATTRBIT_MOUNTEDONFILEID);
2536 			gotmnton = 1;
2537 		} else {
2538 			/*
2539 			 * Must fake it. Use the fileno, except when the
2540 			 * fsid is != to that of the directory. For that
2541 			 * case, generate a fake fileno that is not the same.
2542 			 */
2543 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FSID);
2544 			gotmnton = 0;
2545 		}
2546 
2547 		/*
2548 		 * Joy, oh joy. For V4 we get to hand craft '.' and '..'.
2549 		 */
2550 		if (uiop->uio_offset == 0) {
2551 #if defined(__FreeBSD_version) && __FreeBSD_version >= 800000
2552 			error = VOP_GETATTR(vp, &nfsva.na_vattr, cred);
2553 #else
2554 			error = VOP_GETATTR(vp, &nfsva.na_vattr, cred, p);
2555 #endif
2556 			if (error)
2557 			    return (error);
2558 			dotfileid = nfsva.na_fileid;
2559 			NFSCL_REQSTART(nd, NFSPROC_LOOKUPP, vp);
2560 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2561 			*tl++ = txdr_unsigned(NFSV4OP_GETFH);
2562 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
2563 			(void) nfsrv_putattrbit(nd, &attrbits);
2564 			error = nfscl_request(nd, vp, p, cred, stuff);
2565 			if (error)
2566 			    return (error);
2567 			if (nd->nd_repstat == 0) {
2568 			    NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
2569 			    len = fxdr_unsigned(int, *(tl + 2));
2570 			    if (len > 0 && len <= NFSX_V4FHMAX)
2571 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
2572 			    else
2573 				error = EPERM;
2574 			    if (!error) {
2575 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
2576 				nfsva.na_mntonfileno = 0xffffffff;
2577 				error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
2578 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
2579 				    NULL, NULL, NULL, p, cred);
2580 				if (error) {
2581 				    dotdotfileid = dotfileid;
2582 				} else if (gotmnton) {
2583 				    if (nfsva.na_mntonfileno != 0xffffffff)
2584 					dotdotfileid = nfsva.na_mntonfileno;
2585 				    else
2586 					dotdotfileid = nfsva.na_fileid;
2587 				} else if (nfsva.na_filesid[0] ==
2588 				    dnp->n_vattr.na_filesid[0] &&
2589 				    nfsva.na_filesid[1] ==
2590 				    dnp->n_vattr.na_filesid[1]) {
2591 				    dotdotfileid = nfsva.na_fileid;
2592 				} else {
2593 				    do {
2594 					fakefileno--;
2595 				    } while (fakefileno ==
2596 					nfsva.na_fileid);
2597 				    dotdotfileid = fakefileno;
2598 				}
2599 			    }
2600 			} else if (nd->nd_repstat == NFSERR_NOENT) {
2601 			    /*
2602 			     * Lookupp returns NFSERR_NOENT when we are
2603 			     * at the root, so just use the current dir.
2604 			     */
2605 			    nd->nd_repstat = 0;
2606 			    dotdotfileid = dotfileid;
2607 			} else {
2608 			    error = nd->nd_repstat;
2609 			}
2610 			mbuf_freem(nd->nd_mrep);
2611 			if (error)
2612 			    return (error);
2613 			nd->nd_mrep = NULL;
2614 			dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
2615 			dp->d_type = DT_DIR;
2616 			dp->d_fileno = dotfileid;
2617 			dp->d_namlen = 1;
2618 			dp->d_name[0] = '.';
2619 			dp->d_name[1] = '\0';
2620 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
2621 			/*
2622 			 * Just make these offset cookie 0.
2623 			 */
2624 			tl = (u_int32_t *)&dp->d_name[4];
2625 			*tl++ = 0;
2626 			*tl = 0;
2627 			blksiz += dp->d_reclen;
2628 			uio_uio_resid_add(uiop, -(dp->d_reclen));
2629 			uiop->uio_offset += dp->d_reclen;
2630 			uio_iov_base_add(uiop, dp->d_reclen);
2631 			uio_iov_len_add(uiop, -(dp->d_reclen));
2632 			dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
2633 			dp->d_type = DT_DIR;
2634 			dp->d_fileno = dotdotfileid;
2635 			dp->d_namlen = 2;
2636 			dp->d_name[0] = '.';
2637 			dp->d_name[1] = '.';
2638 			dp->d_name[2] = '\0';
2639 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
2640 			/*
2641 			 * Just make these offset cookie 0.
2642 			 */
2643 			tl = (u_int32_t *)&dp->d_name[4];
2644 			*tl++ = 0;
2645 			*tl = 0;
2646 			blksiz += dp->d_reclen;
2647 			uio_uio_resid_add(uiop, -(dp->d_reclen));
2648 			uiop->uio_offset += dp->d_reclen;
2649 			uio_iov_base_add(uiop, dp->d_reclen);
2650 			uio_iov_len_add(uiop, -(dp->d_reclen));
2651 		}
2652 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_RDATTRERROR);
2653 	} else {
2654 		reqsize = 5 * NFSX_UNSIGNED;
2655 	}
2656 
2657 
2658 	/*
2659 	 * Loop around doing readdir rpc's of size readsize.
2660 	 * The stopping criteria is EOF or buffer full.
2661 	 */
2662 	while (more_dirs && bigenough) {
2663 		*attrflagp = 0;
2664 		NFSCL_REQSTART(nd, NFSPROC_READDIR, vp);
2665 		if (nd->nd_flag & ND_NFSV2) {
2666 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2667 			*tl++ = cookie.lval[1];
2668 			*tl = txdr_unsigned(readsize);
2669 		} else {
2670 			NFSM_BUILD(tl, u_int32_t *, reqsize);
2671 			*tl++ = cookie.lval[0];
2672 			*tl++ = cookie.lval[1];
2673 			if (cookie.qval == 0) {
2674 				*tl++ = 0;
2675 				*tl++ = 0;
2676 			} else {
2677 				NFSLOCKNODE(dnp);
2678 				*tl++ = dnp->n_cookieverf.nfsuquad[0];
2679 				*tl++ = dnp->n_cookieverf.nfsuquad[1];
2680 				NFSUNLOCKNODE(dnp);
2681 			}
2682 			if (nd->nd_flag & ND_NFSV4) {
2683 				*tl++ = txdr_unsigned(readsize);
2684 				*tl = txdr_unsigned(readsize);
2685 				(void) nfsrv_putattrbit(nd, &attrbits);
2686 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2687 				*tl = txdr_unsigned(NFSV4OP_GETATTR);
2688 				(void) nfsrv_putattrbit(nd, &dattrbits);
2689 			} else {
2690 				*tl = txdr_unsigned(readsize);
2691 			}
2692 		}
2693 		error = nfscl_request(nd, vp, p, cred, stuff);
2694 		if (error)
2695 			return (error);
2696 		if (!(nd->nd_flag & ND_NFSV2)) {
2697 			if (nd->nd_flag & ND_NFSV3)
2698 				error = nfscl_postop_attr(nd, nap, attrflagp,
2699 				    stuff);
2700 			if (!nd->nd_repstat && !error) {
2701 				NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
2702 				NFSLOCKNODE(dnp);
2703 				dnp->n_cookieverf.nfsuquad[0] = *tl++;
2704 				dnp->n_cookieverf.nfsuquad[1] = *tl;
2705 				NFSUNLOCKNODE(dnp);
2706 			}
2707 		}
2708 		if (nd->nd_repstat || error) {
2709 			if (!error)
2710 				error = nd->nd_repstat;
2711 			goto nfsmout;
2712 		}
2713 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2714 		more_dirs = fxdr_unsigned(int, *tl);
2715 		if (!more_dirs)
2716 			tryformoredirs = 0;
2717 
2718 		/* loop thru the dir entries, doctoring them to 4bsd form */
2719 		while (more_dirs && bigenough) {
2720 			if (nd->nd_flag & ND_NFSV4) {
2721 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
2722 				ncookie.lval[0] = *tl++;
2723 				ncookie.lval[1] = *tl++;
2724 				len = fxdr_unsigned(int, *tl);
2725 			} else if (nd->nd_flag & ND_NFSV3) {
2726 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
2727 				nfsva.na_fileid =
2728 				    fxdr_unsigned(long, *++tl);
2729 				len = fxdr_unsigned(int, *++tl);
2730 			} else {
2731 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
2732 				nfsva.na_fileid =
2733 				    fxdr_unsigned(long, *tl++);
2734 				len = fxdr_unsigned(int, *tl);
2735 			}
2736 			if (len <= 0 || len > NFS_MAXNAMLEN) {
2737 				error = EBADRPC;
2738 				goto nfsmout;
2739 			}
2740 			tlen = NFSM_RNDUP(len);
2741 			if (tlen == len)
2742 				tlen += 4;  /* To ensure null termination */
2743 			left = DIRBLKSIZ - blksiz;
2744 			if ((int)(tlen + DIRHDSIZ + NFSX_HYPER) > left) {
2745 				dp->d_reclen += left;
2746 				uio_iov_base_add(uiop, left);
2747 				uio_iov_len_add(uiop, -(left));
2748 				uio_uio_resid_add(uiop, -(left));
2749 				uiop->uio_offset += left;
2750 				blksiz = 0;
2751 			}
2752 			if ((int)(tlen + DIRHDSIZ + NFSX_HYPER) > uio_uio_resid(uiop))
2753 				bigenough = 0;
2754 			if (bigenough) {
2755 				dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
2756 				dp->d_namlen = len;
2757 				dp->d_reclen = tlen + DIRHDSIZ + NFSX_HYPER;
2758 				dp->d_type = DT_UNKNOWN;
2759 				blksiz += dp->d_reclen;
2760 				if (blksiz == DIRBLKSIZ)
2761 					blksiz = 0;
2762 				uio_uio_resid_add(uiop, -(DIRHDSIZ));
2763 				uiop->uio_offset += DIRHDSIZ;
2764 				uio_iov_base_add(uiop, DIRHDSIZ);
2765 				uio_iov_len_add(uiop, -(DIRHDSIZ));
2766 				error = nfsm_mbufuio(nd, uiop, len);
2767 				if (error)
2768 					goto nfsmout;
2769 				cp = CAST_DOWN(caddr_t, uio_iov_base(uiop));
2770 				tlen -= len;
2771 				*cp = '\0';	/* null terminate */
2772 				cp += tlen;	/* points to cookie storage */
2773 				tl2 = (u_int32_t *)cp;
2774 				uio_iov_base_add(uiop, (tlen + NFSX_HYPER));
2775 				uio_iov_len_add(uiop, -(tlen + NFSX_HYPER));
2776 				uio_uio_resid_add(uiop, -(tlen + NFSX_HYPER));
2777 				uiop->uio_offset += (tlen + NFSX_HYPER);
2778 			} else {
2779 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
2780 				if (error)
2781 					goto nfsmout;
2782 			}
2783 			if (nd->nd_flag & ND_NFSV4) {
2784 				rderr = 0;
2785 				nfsva.na_mntonfileno = 0xffffffff;
2786 				error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
2787 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
2788 				    NULL, NULL, &rderr, p, cred);
2789 				if (error)
2790 					goto nfsmout;
2791 				NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2792 			} else if (nd->nd_flag & ND_NFSV3) {
2793 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
2794 				ncookie.lval[0] = *tl++;
2795 				ncookie.lval[1] = *tl++;
2796 			} else {
2797 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
2798 				ncookie.lval[0] = 0;
2799 				ncookie.lval[1] = *tl++;
2800 			}
2801 			if (bigenough) {
2802 			    if (nd->nd_flag & ND_NFSV4) {
2803 				if (rderr) {
2804 				    dp->d_fileno = 0;
2805 				} else {
2806 				    if (gotmnton) {
2807 					if (nfsva.na_mntonfileno != 0xffffffff)
2808 					    dp->d_fileno = nfsva.na_mntonfileno;
2809 					else
2810 					    dp->d_fileno = nfsva.na_fileid;
2811 				    } else if (nfsva.na_filesid[0] ==
2812 					dnp->n_vattr.na_filesid[0] &&
2813 					nfsva.na_filesid[1] ==
2814 					dnp->n_vattr.na_filesid[1]) {
2815 					dp->d_fileno = nfsva.na_fileid;
2816 				    } else {
2817 					do {
2818 					    fakefileno--;
2819 					} while (fakefileno ==
2820 					    nfsva.na_fileid);
2821 					dp->d_fileno = fakefileno;
2822 				    }
2823 				    dp->d_type = vtonfs_dtype(nfsva.na_type);
2824 				}
2825 			    } else {
2826 				dp->d_fileno = nfsva.na_fileid;
2827 			    }
2828 			    *tl2++ = cookiep->nfsuquad[0] = cookie.lval[0] =
2829 				ncookie.lval[0];
2830 			    *tl2 = cookiep->nfsuquad[1] = cookie.lval[1] =
2831 				ncookie.lval[1];
2832 			}
2833 			more_dirs = fxdr_unsigned(int, *tl);
2834 		}
2835 		/*
2836 		 * If at end of rpc data, get the eof boolean
2837 		 */
2838 		if (!more_dirs) {
2839 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2840 			eof = fxdr_unsigned(int, *tl);
2841 			if (tryformoredirs)
2842 				more_dirs = !eof;
2843 			if (nd->nd_flag & ND_NFSV4) {
2844 				error = nfscl_postop_attr(nd, nap, attrflagp,
2845 				    stuff);
2846 				if (error)
2847 					goto nfsmout;
2848 			}
2849 		}
2850 		mbuf_freem(nd->nd_mrep);
2851 		nd->nd_mrep = NULL;
2852 	}
2853 	/*
2854 	 * Fill last record, iff any, out to a multiple of DIRBLKSIZ
2855 	 * by increasing d_reclen for the last record.
2856 	 */
2857 	if (blksiz > 0) {
2858 		left = DIRBLKSIZ - blksiz;
2859 		dp->d_reclen += left;
2860 		uio_iov_base_add(uiop, left);
2861 		uio_iov_len_add(uiop, -(left));
2862 		uio_uio_resid_add(uiop, -(left));
2863 		uiop->uio_offset += left;
2864 	}
2865 
2866 	/*
2867 	 * If returning no data, assume end of file.
2868 	 * If not bigenough, return not end of file, since you aren't
2869 	 *    returning all the data
2870 	 * Otherwise, return the eof flag from the server.
2871 	 */
2872 	if (eofp) {
2873 		if (tresid == ((size_t)(uio_uio_resid(uiop))))
2874 			*eofp = 1;
2875 		else if (!bigenough)
2876 			*eofp = 0;
2877 		else
2878 			*eofp = eof;
2879 	}
2880 
2881 	/*
2882 	 * Add extra empty records to any remaining DIRBLKSIZ chunks.
2883 	 */
2884 	while (uio_uio_resid(uiop) > 0 && ((size_t)(uio_uio_resid(uiop))) != tresid) {
2885 		dp = (struct dirent *) CAST_DOWN(caddr_t, uio_iov_base(uiop));
2886 		dp->d_type = DT_UNKNOWN;
2887 		dp->d_fileno = 0;
2888 		dp->d_namlen = 0;
2889 		dp->d_name[0] = '\0';
2890 		tl = (u_int32_t *)&dp->d_name[4];
2891 		*tl++ = cookie.lval[0];
2892 		*tl = cookie.lval[1];
2893 		dp->d_reclen = DIRBLKSIZ;
2894 		uio_iov_base_add(uiop, DIRBLKSIZ);
2895 		uio_iov_len_add(uiop, -(DIRBLKSIZ));
2896 		uio_uio_resid_add(uiop, -(DIRBLKSIZ));
2897 		uiop->uio_offset += DIRBLKSIZ;
2898 	}
2899 
2900 nfsmout:
2901 	if (nd->nd_mrep != NULL)
2902 		mbuf_freem(nd->nd_mrep);
2903 	return (error);
2904 }
2905 
2906 #ifndef APPLE
2907 /*
2908  * NFS V3 readdir plus RPC. Used in place of nfsrpc_readdir().
2909  * (Also used for NFS V4 when mount flag set.)
2910  * (ditto above w.r.t. multiple of DIRBLKSIZ, etc.)
2911  */
2912 APPLESTATIC int
2913 nfsrpc_readdirplus(vnode_t vp, struct uio *uiop, nfsuint64 *cookiep,
2914     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
2915     int *eofp, void *stuff)
2916 {
2917 	int len, left;
2918 	struct dirent *dp = NULL;
2919 	u_int32_t *tl;
2920 	vnode_t newvp = NULLVP;
2921 	struct nfsrv_descript nfsd, *nd = &nfsd;
2922 	struct nameidata nami, *ndp = &nami;
2923 	struct componentname *cnp = &ndp->ni_cnd;
2924 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
2925 	struct nfsnode *dnp = VTONFS(vp), *np;
2926 	struct nfsvattr nfsva;
2927 	struct nfsfh *nfhp;
2928 	nfsquad_t cookie, ncookie;
2929 	int error = 0, tlen, more_dirs = 1, blksiz = 0, bigenough = 1;
2930 	int attrflag, tryformoredirs = 1, eof = 0, gotmnton = 0;
2931 	int unlocknewvp = 0;
2932 	long dotfileid, dotdotfileid = 0, fileno = 0;
2933 	char *cp;
2934 	nfsattrbit_t attrbits, dattrbits;
2935 	size_t tresid;
2936 	u_int32_t *tl2 = NULL, fakefileno = 0xffffffff, rderr;
2937 
2938 	KASSERT(uiop->uio_iovcnt == 1 &&
2939 	    (uio_uio_resid(uiop) & (DIRBLKSIZ - 1)) == 0,
2940 	    ("nfs readdirplusrpc bad uio"));
2941 	*attrflagp = 0;
2942 	if (eofp != NULL)
2943 		*eofp = 0;
2944 	ndp->ni_dvp = vp;
2945 	nd->nd_mrep = NULL;
2946 	cookie.lval[0] = cookiep->nfsuquad[0];
2947 	cookie.lval[1] = cookiep->nfsuquad[1];
2948 	tresid = uio_uio_resid(uiop);
2949 
2950 	/*
2951 	 * For NFSv4, first create the "." and ".." entries.
2952 	 */
2953 	if (NFSHASNFSV4(nmp)) {
2954 		NFSGETATTR_ATTRBIT(&dattrbits);
2955 		NFSZERO_ATTRBIT(&attrbits);
2956 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FILEID);
2957 		if (NFSISSET_ATTRBIT(&dnp->n_vattr.na_suppattr,
2958 		    NFSATTRBIT_MOUNTEDONFILEID)) {
2959 			NFSSETBIT_ATTRBIT(&attrbits,
2960 			    NFSATTRBIT_MOUNTEDONFILEID);
2961 			gotmnton = 1;
2962 		} else {
2963 			/*
2964 			 * Must fake it. Use the fileno, except when the
2965 			 * fsid is != to that of the directory. For that
2966 			 * case, generate a fake fileno that is not the same.
2967 			 */
2968 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_FSID);
2969 			gotmnton = 0;
2970 		}
2971 
2972 		/*
2973 		 * Joy, oh joy. For V4 we get to hand craft '.' and '..'.
2974 		 */
2975 		if (uiop->uio_offset == 0) {
2976 #if defined(__FreeBSD_version) && __FreeBSD_version >= 800000
2977 			error = VOP_GETATTR(vp, &nfsva.na_vattr, cred);
2978 #else
2979 			error = VOP_GETATTR(vp, &nfsva.na_vattr, cred, p);
2980 #endif
2981 			if (error)
2982 			    return (error);
2983 			dotfileid = nfsva.na_fileid;
2984 			NFSCL_REQSTART(nd, NFSPROC_LOOKUPP, vp);
2985 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2986 			*tl++ = txdr_unsigned(NFSV4OP_GETFH);
2987 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
2988 			(void) nfsrv_putattrbit(nd, &attrbits);
2989 			error = nfscl_request(nd, vp, p, cred, stuff);
2990 			if (error)
2991 			    return (error);
2992 			if (nd->nd_repstat == 0) {
2993 			    NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
2994 			    len = fxdr_unsigned(int, *(tl + 2));
2995 			    if (len > 0 && len <= NFSX_V4FHMAX)
2996 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
2997 			    else
2998 				error = EPERM;
2999 			    if (!error) {
3000 				NFSM_DISSECT(tl, u_int32_t *, 2*NFSX_UNSIGNED);
3001 				nfsva.na_mntonfileno = 0xffffffff;
3002 				error = nfsv4_loadattr(nd, NULL, &nfsva, NULL,
3003 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
3004 				    NULL, NULL, NULL, p, cred);
3005 				if (error) {
3006 				    dotdotfileid = dotfileid;
3007 				} else if (gotmnton) {
3008 				    if (nfsva.na_mntonfileno != 0xffffffff)
3009 					dotdotfileid = nfsva.na_mntonfileno;
3010 				    else
3011 					dotdotfileid = nfsva.na_fileid;
3012 				} else if (nfsva.na_filesid[0] ==
3013 				    dnp->n_vattr.na_filesid[0] &&
3014 				    nfsva.na_filesid[1] ==
3015 				    dnp->n_vattr.na_filesid[1]) {
3016 				    dotdotfileid = nfsva.na_fileid;
3017 				} else {
3018 				    do {
3019 					fakefileno--;
3020 				    } while (fakefileno ==
3021 					nfsva.na_fileid);
3022 				    dotdotfileid = fakefileno;
3023 				}
3024 			    }
3025 			} else if (nd->nd_repstat == NFSERR_NOENT) {
3026 			    /*
3027 			     * Lookupp returns NFSERR_NOENT when we are
3028 			     * at the root, so just use the current dir.
3029 			     */
3030 			    nd->nd_repstat = 0;
3031 			    dotdotfileid = dotfileid;
3032 			} else {
3033 			    error = nd->nd_repstat;
3034 			}
3035 			mbuf_freem(nd->nd_mrep);
3036 			if (error)
3037 			    return (error);
3038 			nd->nd_mrep = NULL;
3039 			dp = (struct dirent *)uio_iov_base(uiop);
3040 			dp->d_type = DT_DIR;
3041 			dp->d_fileno = dotfileid;
3042 			dp->d_namlen = 1;
3043 			dp->d_name[0] = '.';
3044 			dp->d_name[1] = '\0';
3045 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
3046 			/*
3047 			 * Just make these offset cookie 0.
3048 			 */
3049 			tl = (u_int32_t *)&dp->d_name[4];
3050 			*tl++ = 0;
3051 			*tl = 0;
3052 			blksiz += dp->d_reclen;
3053 			uio_uio_resid_add(uiop, -(dp->d_reclen));
3054 			uiop->uio_offset += dp->d_reclen;
3055 			uio_iov_base_add(uiop, dp->d_reclen);
3056 			uio_iov_len_add(uiop, -(dp->d_reclen));
3057 			dp = (struct dirent *)uio_iov_base(uiop);
3058 			dp->d_type = DT_DIR;
3059 			dp->d_fileno = dotdotfileid;
3060 			dp->d_namlen = 2;
3061 			dp->d_name[0] = '.';
3062 			dp->d_name[1] = '.';
3063 			dp->d_name[2] = '\0';
3064 			dp->d_reclen = DIRENT_SIZE(dp) + NFSX_HYPER;
3065 			/*
3066 			 * Just make these offset cookie 0.
3067 			 */
3068 			tl = (u_int32_t *)&dp->d_name[4];
3069 			*tl++ = 0;
3070 			*tl = 0;
3071 			blksiz += dp->d_reclen;
3072 			uio_uio_resid_add(uiop, -(dp->d_reclen));
3073 			uiop->uio_offset += dp->d_reclen;
3074 			uio_iov_base_add(uiop, dp->d_reclen);
3075 			uio_iov_len_add(uiop, -(dp->d_reclen));
3076 		}
3077 		NFSREADDIRPLUS_ATTRBIT(&attrbits);
3078 		if (gotmnton)
3079 			NFSSETBIT_ATTRBIT(&attrbits,
3080 			    NFSATTRBIT_MOUNTEDONFILEID);
3081 	}
3082 
3083 	/*
3084 	 * Loop around doing readdir rpc's of size nm_readdirsize.
3085 	 * The stopping criteria is EOF or buffer full.
3086 	 */
3087 	while (more_dirs && bigenough) {
3088 		*attrflagp = 0;
3089 		NFSCL_REQSTART(nd, NFSPROC_READDIRPLUS, vp);
3090  		NFSM_BUILD(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
3091 		*tl++ = cookie.lval[0];
3092 		*tl++ = cookie.lval[1];
3093 		if (cookie.qval == 0) {
3094 			*tl++ = 0;
3095 			*tl++ = 0;
3096 		} else {
3097 			NFSLOCKNODE(dnp);
3098 			*tl++ = dnp->n_cookieverf.nfsuquad[0];
3099 			*tl++ = dnp->n_cookieverf.nfsuquad[1];
3100 			NFSUNLOCKNODE(dnp);
3101 		}
3102 		*tl++ = txdr_unsigned(nmp->nm_readdirsize);
3103 		*tl = txdr_unsigned(nmp->nm_readdirsize);
3104 		if (nd->nd_flag & ND_NFSV4) {
3105 			(void) nfsrv_putattrbit(nd, &attrbits);
3106 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3107 			*tl = txdr_unsigned(NFSV4OP_GETATTR);
3108 			(void) nfsrv_putattrbit(nd, &dattrbits);
3109 		}
3110 		error = nfscl_request(nd, vp, p, cred, stuff);
3111 		if (error)
3112 			return (error);
3113 		if (nd->nd_flag & ND_NFSV3)
3114 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
3115 		if (nd->nd_repstat || error) {
3116 			if (!error)
3117 				error = nd->nd_repstat;
3118 			goto nfsmout;
3119 		}
3120 		NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3121 		NFSLOCKNODE(dnp);
3122 		dnp->n_cookieverf.nfsuquad[0] = *tl++;
3123 		dnp->n_cookieverf.nfsuquad[1] = *tl++;
3124 		NFSUNLOCKNODE(dnp);
3125 		more_dirs = fxdr_unsigned(int, *tl);
3126 		if (!more_dirs)
3127 			tryformoredirs = 0;
3128 
3129 		/* loop thru the dir entries, doctoring them to 4bsd form */
3130 		while (more_dirs && bigenough) {
3131 			NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3132 			if (nd->nd_flag & ND_NFSV4) {
3133 				ncookie.lval[0] = *tl++;
3134 				ncookie.lval[1] = *tl++;
3135 			} else {
3136 				fileno = fxdr_unsigned(long, *++tl);
3137 				tl++;
3138 			}
3139 			len = fxdr_unsigned(int, *tl);
3140 			if (len <= 0 || len > NFS_MAXNAMLEN) {
3141 				error = EBADRPC;
3142 				goto nfsmout;
3143 			}
3144 			tlen = NFSM_RNDUP(len);
3145 			if (tlen == len)
3146 				tlen += 4;  /* To ensure null termination */
3147 			left = DIRBLKSIZ - blksiz;
3148 			if ((tlen + DIRHDSIZ + NFSX_HYPER) > left) {
3149 				dp->d_reclen += left;
3150 				uio_iov_base_add(uiop, left);
3151 				uio_iov_len_add(uiop, -(left));
3152 				uio_uio_resid_add(uiop, -(left));
3153 				uiop->uio_offset += left;
3154 				blksiz = 0;
3155 			}
3156 			if ((tlen + DIRHDSIZ + NFSX_HYPER) > uio_uio_resid(uiop))
3157 				bigenough = 0;
3158 			if (bigenough) {
3159 				dp = (struct dirent *)uio_iov_base(uiop);
3160 				dp->d_namlen = len;
3161 				dp->d_reclen = tlen + DIRHDSIZ + NFSX_HYPER;
3162 				dp->d_type = DT_UNKNOWN;
3163 				blksiz += dp->d_reclen;
3164 				if (blksiz == DIRBLKSIZ)
3165 					blksiz = 0;
3166 				uio_uio_resid_add(uiop, -(DIRHDSIZ));
3167 				uiop->uio_offset += DIRHDSIZ;
3168 				uio_iov_base_add(uiop, DIRHDSIZ);
3169 				uio_iov_len_add(uiop, -(DIRHDSIZ));
3170 				cnp->cn_nameptr = uio_iov_base(uiop);
3171 				cnp->cn_namelen = len;
3172 				NFSCNHASHZERO(cnp);
3173 				error = nfsm_mbufuio(nd, uiop, len);
3174 				if (error)
3175 					goto nfsmout;
3176 				cp = uio_iov_base(uiop);
3177 				tlen -= len;
3178 				*cp = '\0';
3179 				cp += tlen;	/* points to cookie storage */
3180 				tl2 = (u_int32_t *)cp;
3181 				uio_iov_base_add(uiop, (tlen + NFSX_HYPER));
3182 				uio_iov_len_add(uiop, -(tlen + NFSX_HYPER));
3183 				uio_uio_resid_add(uiop, -(tlen + NFSX_HYPER));
3184 				uiop->uio_offset += (tlen + NFSX_HYPER);
3185 			} else {
3186 				error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
3187 				if (error)
3188 					goto nfsmout;
3189 			}
3190 			nfhp = NULL;
3191 			if (nd->nd_flag & ND_NFSV3) {
3192 				NFSM_DISSECT(tl, u_int32_t *, 3*NFSX_UNSIGNED);
3193 				ncookie.lval[0] = *tl++;
3194 				ncookie.lval[1] = *tl++;
3195 				attrflag = fxdr_unsigned(int, *tl);
3196 				if (attrflag) {
3197 				  error = nfsm_loadattr(nd, &nfsva);
3198 				  if (error)
3199 					goto nfsmout;
3200 				}
3201 				NFSM_DISSECT(tl,u_int32_t *,NFSX_UNSIGNED);
3202 				if (*tl) {
3203 					error = nfsm_getfh(nd, &nfhp);
3204 					if (error)
3205 					    goto nfsmout;
3206 				}
3207 				if (!attrflag && nfhp != NULL) {
3208 					FREE((caddr_t)nfhp, M_NFSFH);
3209 					nfhp = NULL;
3210 				}
3211 			} else {
3212 				rderr = 0;
3213 				nfsva.na_mntonfileno = 0xffffffff;
3214 				error = nfsv4_loadattr(nd, NULL, &nfsva, &nfhp,
3215 				    NULL, 0, NULL, NULL, NULL, NULL, NULL, 0,
3216 				    NULL, NULL, &rderr, p, cred);
3217 				if (error)
3218 					goto nfsmout;
3219 			}
3220 
3221 			if (bigenough) {
3222 			    if (nd->nd_flag & ND_NFSV4) {
3223 				if (rderr) {
3224 				    dp->d_fileno = 0;
3225 				} else if (gotmnton) {
3226 				    if (nfsva.na_mntonfileno != 0xffffffff)
3227 					dp->d_fileno = nfsva.na_mntonfileno;
3228 				    else
3229 					dp->d_fileno = nfsva.na_fileid;
3230 				} else if (nfsva.na_filesid[0] ==
3231 				    dnp->n_vattr.na_filesid[0] &&
3232 				    nfsva.na_filesid[1] ==
3233 				    dnp->n_vattr.na_filesid[1]) {
3234 				    dp->d_fileno = nfsva.na_fileid;
3235 				} else {
3236 				    do {
3237 					fakefileno--;
3238 				    } while (fakefileno ==
3239 					nfsva.na_fileid);
3240 				    dp->d_fileno = fakefileno;
3241 				}
3242 			    } else {
3243 				dp->d_fileno = fileno;
3244 			    }
3245 			    *tl2++ = cookiep->nfsuquad[0] = cookie.lval[0] =
3246 				ncookie.lval[0];
3247 			    *tl2 = cookiep->nfsuquad[1] = cookie.lval[1] =
3248 				ncookie.lval[1];
3249 
3250 			    if (nfhp != NULL) {
3251 				if (NFSRV_CMPFH(nfhp->nfh_fh, nfhp->nfh_len,
3252 				    dnp->n_fhp->nfh_fh, dnp->n_fhp->nfh_len)) {
3253 				    VREF(vp);
3254 				    newvp = vp;
3255 				    unlocknewvp = 0;
3256 				    FREE((caddr_t)nfhp, M_NFSFH);
3257 				    np = dnp;
3258 				} else {
3259 				    error = nfscl_nget(vnode_mount(vp), vp,
3260 				      nfhp, cnp, p, &np, NULL);
3261 				    if (!error) {
3262 					newvp = NFSTOV(np);
3263 					unlocknewvp = 1;
3264 				    }
3265 				}
3266 				nfhp = NULL;
3267 				if (newvp != NULLVP) {
3268 				    error = nfscl_loadattrcache(&newvp,
3269 					&nfsva, NULL, NULL, 0, 0);
3270 				    if (error) {
3271 					if (unlocknewvp)
3272 					    vput(newvp);
3273 					else
3274 					    vrele(newvp);
3275 					goto nfsmout;
3276 				    }
3277 				    dp->d_type =
3278 					vtonfs_dtype(np->n_vattr.na_type);
3279 				    ndp->ni_vp = newvp;
3280 				    NFSCNHASH(cnp, HASHINIT);
3281 				    if (cnp->cn_namelen <= NCHNAMLEN) {
3282 					np->n_ctime =
3283 					  np->n_vattr.na_ctime.tv_sec;
3284 					cache_enter(ndp->ni_dvp,ndp->ni_vp,cnp);
3285 				    }
3286 				    if (unlocknewvp)
3287 					vput(newvp);
3288 				    else
3289 					vrele(newvp);
3290 				    newvp = NULLVP;
3291 				}
3292 			    }
3293 			} else if (nfhp != NULL) {
3294 			    FREE((caddr_t)nfhp, M_NFSFH);
3295 			}
3296 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3297 			more_dirs = fxdr_unsigned(int, *tl);
3298 		}
3299 		/*
3300 		 * If at end of rpc data, get the eof boolean
3301 		 */
3302 		if (!more_dirs) {
3303 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3304 			eof = fxdr_unsigned(int, *tl);
3305 			if (tryformoredirs)
3306 				more_dirs = !eof;
3307 			if (nd->nd_flag & ND_NFSV4) {
3308 				error = nfscl_postop_attr(nd, nap, attrflagp,
3309 				    stuff);
3310 				if (error)
3311 					goto nfsmout;
3312 			}
3313 		}
3314 		mbuf_freem(nd->nd_mrep);
3315 		nd->nd_mrep = NULL;
3316 	}
3317 	/*
3318 	 * Fill last record, iff any, out to a multiple of DIRBLKSIZ
3319 	 * by increasing d_reclen for the last record.
3320 	 */
3321 	if (blksiz > 0) {
3322 		left = DIRBLKSIZ - blksiz;
3323 		dp->d_reclen += left;
3324 		uio_iov_base_add(uiop, left);
3325 		uio_iov_len_add(uiop, -(left));
3326 		uio_uio_resid_add(uiop, -(left));
3327 		uiop->uio_offset += left;
3328 	}
3329 
3330 	/*
3331 	 * If returning no data, assume end of file.
3332 	 * If not bigenough, return not end of file, since you aren't
3333 	 *    returning all the data
3334 	 * Otherwise, return the eof flag from the server.
3335 	 */
3336 	if (eofp != NULL) {
3337 		if (tresid == uio_uio_resid(uiop))
3338 			*eofp = 1;
3339 		else if (!bigenough)
3340 			*eofp = 0;
3341 		else
3342 			*eofp = eof;
3343 	}
3344 
3345 	/*
3346 	 * Add extra empty records to any remaining DIRBLKSIZ chunks.
3347 	 */
3348 	while (uio_uio_resid(uiop) > 0 && uio_uio_resid(uiop) != tresid) {
3349 		dp = (struct dirent *)uio_iov_base(uiop);
3350 		dp->d_type = DT_UNKNOWN;
3351 		dp->d_fileno = 0;
3352 		dp->d_namlen = 0;
3353 		dp->d_name[0] = '\0';
3354 		tl = (u_int32_t *)&dp->d_name[4];
3355 		*tl++ = cookie.lval[0];
3356 		*tl = cookie.lval[1];
3357 		dp->d_reclen = DIRBLKSIZ;
3358 		uio_iov_base_add(uiop, DIRBLKSIZ);
3359 		uio_iov_len_add(uiop, -(DIRBLKSIZ));
3360 		uio_uio_resid_add(uiop, -(DIRBLKSIZ));
3361 		uiop->uio_offset += DIRBLKSIZ;
3362 	}
3363 
3364 nfsmout:
3365 	if (nd->nd_mrep != NULL)
3366 		mbuf_freem(nd->nd_mrep);
3367 	return (error);
3368 }
3369 #endif	/* !APPLE */
3370 
3371 /*
3372  * Nfs commit rpc
3373  */
3374 APPLESTATIC int
3375 nfsrpc_commit(vnode_t vp, u_quad_t offset, int cnt, struct ucred *cred,
3376     NFSPROC_T *p, u_char *verfp, struct nfsvattr *nap, int *attrflagp,
3377     void *stuff)
3378 {
3379 	u_int32_t *tl;
3380 	struct nfsrv_descript nfsd, *nd = &nfsd;
3381 	nfsattrbit_t attrbits;
3382 	int error;
3383 
3384 	*attrflagp = 0;
3385 	NFSCL_REQSTART(nd, NFSPROC_COMMIT, vp);
3386 	NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3387 	txdr_hyper(offset, tl);
3388 	tl += 2;
3389 	*tl = txdr_unsigned(cnt);
3390 	if (nd->nd_flag & ND_NFSV4) {
3391 		/*
3392 		 * And do a Getattr op.
3393 		 */
3394 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3395 		*tl = txdr_unsigned(NFSV4OP_GETATTR);
3396 		NFSGETATTR_ATTRBIT(&attrbits);
3397 		(void) nfsrv_putattrbit(nd, &attrbits);
3398 	}
3399 	error = nfscl_request(nd, vp, p, cred, stuff);
3400 	if (error)
3401 		return (error);
3402 	error = nfscl_wcc_data(nd, vp, nap, attrflagp, NULL, stuff);
3403 	if (!error && !nd->nd_repstat) {
3404 		NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
3405 		NFSBCOPY((caddr_t)tl, verfp, NFSX_VERF);
3406 		if (nd->nd_flag & ND_NFSV4)
3407 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
3408 	}
3409 nfsmout:
3410 	if (!error && nd->nd_repstat)
3411 		error = nd->nd_repstat;
3412 	mbuf_freem(nd->nd_mrep);
3413 	return (error);
3414 }
3415 
3416 /*
3417  * NFS byte range lock rpc.
3418  * (Mostly just calls one of the three lower level RPC routines.)
3419  */
3420 APPLESTATIC int
3421 nfsrpc_advlock(vnode_t vp, off_t size, int op, struct flock *fl,
3422     int reclaim, struct ucred *cred, NFSPROC_T *p)
3423 {
3424 	struct nfscllockowner *lp;
3425 	struct nfsclclient *clp;
3426 	struct nfsfh *nfhp;
3427 	struct nfsrv_descript nfsd, *nd = &nfsd;
3428 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
3429 	u_int64_t off, len;
3430 	off_t start, end;
3431 	u_int32_t clidrev = 0;
3432 	int error = 0, newone = 0, expireret = 0, retrycnt, donelocally;
3433 	int callcnt, dorpc;
3434 
3435 	/*
3436 	 * Convert the flock structure into a start and end and do POSIX
3437 	 * bounds checking.
3438 	 */
3439 	switch (fl->l_whence) {
3440 	case SEEK_SET:
3441 	case SEEK_CUR:
3442 		/*
3443 		 * Caller is responsible for adding any necessary offset
3444 		 * when SEEK_CUR is used.
3445 		 */
3446 		start = fl->l_start;
3447 		off = fl->l_start;
3448 		break;
3449 	case SEEK_END:
3450 		start = size + fl->l_start;
3451 		off = size + fl->l_start;
3452 		break;
3453 	default:
3454 		return (EINVAL);
3455 	};
3456 	if (start < 0)
3457 		return (EINVAL);
3458 	if (fl->l_len != 0) {
3459 		end = start + fl->l_len - 1;
3460 		if (end < start)
3461 			return (EINVAL);
3462 	}
3463 
3464 	len = fl->l_len;
3465 	if (len == 0)
3466 		len = NFS64BITSSET;
3467 	retrycnt = 0;
3468 	do {
3469 	    nd->nd_repstat = 0;
3470 	    if (op == F_GETLK) {
3471 		error = nfscl_getcl(vp, cred, p, &clp);
3472 		if (error)
3473 			return (error);
3474 		error = nfscl_lockt(vp, clp, off, len, fl, p);
3475 		if (!error) {
3476 			clidrev = clp->nfsc_clientidrev;
3477 			error = nfsrpc_lockt(nd, vp, clp, off, len, fl, cred,
3478 			    p);
3479 		} else if (error == -1) {
3480 			error = 0;
3481 		}
3482 		nfscl_clientrelease(clp);
3483 	    } else if (op == F_UNLCK && fl->l_type == F_UNLCK) {
3484 		/*
3485 		 * We must loop around for all lockowner cases.
3486 		 */
3487 		callcnt = 0;
3488 		error = nfscl_getcl(vp, cred, p, &clp);
3489 		if (error)
3490 			return (error);
3491 		do {
3492 		    error = nfscl_relbytelock(vp, off, len, cred, p, callcnt,
3493 			clp, &lp, &dorpc);
3494 		    /*
3495 		     * If it returns a NULL lp, we're done.
3496 		     */
3497 		    if (lp == NULL) {
3498 			if (callcnt == 0)
3499 			    nfscl_clientrelease(clp);
3500 			else
3501 			    nfscl_releasealllocks(clp, vp, p);
3502 			return (error);
3503 		    }
3504 		    if (nmp->nm_clp != NULL)
3505 			clidrev = nmp->nm_clp->nfsc_clientidrev;
3506 		    else
3507 			clidrev = 0;
3508 		    /*
3509 		     * If the server doesn't support Posix lock semantics,
3510 		     * only allow locks on the entire file, since it won't
3511 		     * handle overlapping byte ranges.
3512 		     * There might still be a problem when a lock
3513 		     * upgrade/downgrade (read<->write) occurs, since the
3514 		     * server "might" expect an unlock first?
3515 		     */
3516 		    if (dorpc && (lp->nfsl_open->nfso_posixlock ||
3517 			(off == 0 && len == NFS64BITSSET))) {
3518 			/*
3519 			 * Since the lock records will go away, we must
3520 			 * wait for grace and delay here.
3521 			 */
3522 			do {
3523 			    error = nfsrpc_locku(nd, nmp, lp, off, len,
3524 				NFSV4LOCKT_READ, cred, p, 0);
3525 			    if ((nd->nd_repstat == NFSERR_GRACE ||
3526 				 nd->nd_repstat == NFSERR_DELAY) &&
3527 				error == 0)
3528 				(void) nfs_catnap(PZERO, (int)nd->nd_repstat,
3529 				    "nfs_advlock");
3530 			} while ((nd->nd_repstat == NFSERR_GRACE ||
3531 			    nd->nd_repstat == NFSERR_DELAY) && error == 0);
3532 		    }
3533 		    callcnt++;
3534 		} while (error == 0 && nd->nd_repstat == 0);
3535 		nfscl_releasealllocks(clp, vp, p);
3536 	    } else if (op == F_SETLK) {
3537 		error = nfscl_getbytelock(vp, off, len, fl->l_type, cred, p,
3538 		    NULL, 0, NULL, NULL, &lp, &newone, &donelocally);
3539 		if (error || donelocally) {
3540 			return (error);
3541 		}
3542 		if (nmp->nm_clp != NULL)
3543 			clidrev = nmp->nm_clp->nfsc_clientidrev;
3544 		else
3545 			clidrev = 0;
3546 		nfhp = VTONFS(vp)->n_fhp;
3547 		if (!lp->nfsl_open->nfso_posixlock &&
3548 		    (off != 0 || len != NFS64BITSSET)) {
3549 			error = EINVAL;
3550 		} else {
3551 			error = nfsrpc_lock(nd, nmp, vp, nfhp->nfh_fh,
3552 			    nfhp->nfh_len, lp, newone, reclaim, off,
3553 			    len, fl->l_type, cred, p, 0);
3554 		}
3555 		if (!error)
3556 			error = nd->nd_repstat;
3557 		nfscl_lockrelease(lp, error, newone);
3558 	    } else {
3559 		error = EINVAL;
3560 	    }
3561 	    if (!error)
3562 	        error = nd->nd_repstat;
3563 	    if (error == NFSERR_GRACE || error == NFSERR_STALESTATEID ||
3564 		error == NFSERR_STALEDONTRECOVER ||
3565 		error == NFSERR_STALECLIENTID || error == NFSERR_DELAY) {
3566 		(void) nfs_catnap(PZERO, error, "nfs_advlock");
3567 	    } else if ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID)
3568 		&& clidrev != 0) {
3569 		expireret = nfscl_hasexpired(nmp->nm_clp, clidrev, p);
3570 		retrycnt++;
3571 	    }
3572 	} while (error == NFSERR_GRACE ||
3573 	    error == NFSERR_STALECLIENTID || error == NFSERR_DELAY ||
3574 	    error == NFSERR_STALEDONTRECOVER || error == NFSERR_STALESTATEID ||
3575 	    ((error == NFSERR_EXPIRED || error == NFSERR_BADSTATEID) &&
3576 	     expireret == 0 && clidrev != 0 && retrycnt < 4));
3577 	if (error && retrycnt >= 4)
3578 		error = EIO;
3579 	return (error);
3580 }
3581 
3582 /*
3583  * The lower level routine for the LockT case.
3584  */
3585 APPLESTATIC int
3586 nfsrpc_lockt(struct nfsrv_descript *nd, vnode_t vp,
3587     struct nfsclclient *clp, u_int64_t off, u_int64_t len, struct flock *fl,
3588     struct ucred *cred, NFSPROC_T *p)
3589 {
3590 	u_int32_t *tl;
3591 	int error, type, size;
3592 	u_int8_t own[NFSV4CL_LOCKNAMELEN];
3593 
3594 	NFSCL_REQSTART(nd, NFSPROC_LOCKT, vp);
3595 	NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
3596 	if (fl->l_type == F_RDLCK)
3597 		*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
3598 	else
3599 		*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
3600 	txdr_hyper(off, tl);
3601 	tl += 2;
3602 	txdr_hyper(len, tl);
3603 	tl += 2;
3604 	*tl++ = clp->nfsc_clientid.lval[0];
3605 	*tl = clp->nfsc_clientid.lval[1];
3606 	nfscl_filllockowner(p, own);
3607 	(void) nfsm_strtom(nd, own, NFSV4CL_LOCKNAMELEN);
3608 	error = nfscl_request(nd, vp, p, cred, NULL);
3609 	if (error)
3610 		return (error);
3611 	if (nd->nd_repstat == 0) {
3612 		fl->l_type = F_UNLCK;
3613 	} else if (nd->nd_repstat == NFSERR_DENIED) {
3614 		nd->nd_repstat = 0;
3615 		fl->l_whence = SEEK_SET;
3616 		NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
3617 		fl->l_start = fxdr_hyper(tl);
3618 		tl += 2;
3619 		len = fxdr_hyper(tl);
3620 		tl += 2;
3621 		if (len == NFS64BITSSET)
3622 			fl->l_len = 0;
3623 		else
3624 			fl->l_len = len;
3625 		type = fxdr_unsigned(int, *tl++);
3626 		if (type == NFSV4LOCKT_WRITE)
3627 			fl->l_type = F_WRLCK;
3628 		else
3629 			fl->l_type = F_RDLCK;
3630 		/*
3631 		 * XXX For now, I have no idea what to do with the
3632 		 * conflicting lock_owner, so I'll just set the pid == 0
3633 		 * and skip over the lock_owner.
3634 		 */
3635 		fl->l_pid = (pid_t)0;
3636 		tl += 2;
3637 		size = fxdr_unsigned(int, *tl);
3638 		if (size < 0 || size > NFSV4_OPAQUELIMIT)
3639 			error = EBADRPC;
3640 		if (!error)
3641 			error = nfsm_advance(nd, NFSM_RNDUP(size), -1);
3642 	} else if (nd->nd_repstat == NFSERR_STALECLIENTID)
3643 		nfscl_initiate_recovery(clp);
3644 nfsmout:
3645 	mbuf_freem(nd->nd_mrep);
3646 	return (error);
3647 }
3648 
3649 /*
3650  * Lower level function that performs the LockU RPC.
3651  */
3652 static int
3653 nfsrpc_locku(struct nfsrv_descript *nd, struct nfsmount *nmp,
3654     struct nfscllockowner *lp, u_int64_t off, u_int64_t len,
3655     u_int32_t type, struct ucred *cred, NFSPROC_T *p, int syscred)
3656 {
3657 	u_int32_t *tl;
3658 	int error;
3659 
3660 	nfscl_reqstart(nd, NFSPROC_LOCKU, nmp, lp->nfsl_open->nfso_fh,
3661 	    lp->nfsl_open->nfso_fhlen, NULL);
3662 	NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 6 * NFSX_UNSIGNED);
3663 	*tl++ = txdr_unsigned(type);
3664 	*tl = txdr_unsigned(lp->nfsl_seqid);
3665 	if (nfstest_outofseq &&
3666 	    (arc4random() % nfstest_outofseq) == 0)
3667 		*tl = txdr_unsigned(lp->nfsl_seqid + 1);
3668 	tl++;
3669 	*tl++ = lp->nfsl_stateid.seqid;
3670 	*tl++ = lp->nfsl_stateid.other[0];
3671 	*tl++ = lp->nfsl_stateid.other[1];
3672 	*tl++ = lp->nfsl_stateid.other[2];
3673 	txdr_hyper(off, tl);
3674 	tl += 2;
3675 	txdr_hyper(len, tl);
3676 	if (syscred)
3677 		nd->nd_flag |= ND_USEGSSNAME;
3678 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
3679 	    NFS_PROG, NFS_VER4, NULL, 1, NULL);
3680 	NFSCL_INCRSEQID(lp->nfsl_seqid, nd);
3681 	if (error)
3682 		return (error);
3683 	if (nd->nd_repstat == 0) {
3684 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
3685 		lp->nfsl_stateid.seqid = *tl++;
3686 		lp->nfsl_stateid.other[0] = *tl++;
3687 		lp->nfsl_stateid.other[1] = *tl++;
3688 		lp->nfsl_stateid.other[2] = *tl;
3689 	} else if (nd->nd_repstat == NFSERR_STALESTATEID)
3690 		nfscl_initiate_recovery(lp->nfsl_open->nfso_own->nfsow_clp);
3691 nfsmout:
3692 	mbuf_freem(nd->nd_mrep);
3693 	return (error);
3694 }
3695 
3696 /*
3697  * The actual Lock RPC.
3698  */
3699 APPLESTATIC int
3700 nfsrpc_lock(struct nfsrv_descript *nd, struct nfsmount *nmp, vnode_t vp,
3701     u_int8_t *nfhp, int fhlen, struct nfscllockowner *lp, int newone,
3702     int reclaim, u_int64_t off, u_int64_t len, short type, struct ucred *cred,
3703     NFSPROC_T *p, int syscred)
3704 {
3705 	u_int32_t *tl;
3706 	int error, size;
3707 
3708 	nfscl_reqstart(nd, NFSPROC_LOCK, nmp, nfhp, fhlen, NULL);
3709 	NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
3710 	if (type == F_RDLCK)
3711 		*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
3712 	else
3713 		*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
3714 	*tl++ = txdr_unsigned(reclaim);
3715 	txdr_hyper(off, tl);
3716 	tl += 2;
3717 	txdr_hyper(len, tl);
3718 	tl += 2;
3719 	if (newone) {
3720 	    *tl = newnfs_true;
3721 	    NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID +
3722 		2 * NFSX_UNSIGNED + NFSX_HYPER);
3723 	    *tl++ = txdr_unsigned(lp->nfsl_open->nfso_own->nfsow_seqid);
3724 	    *tl++ = lp->nfsl_open->nfso_stateid.seqid;
3725 	    *tl++ = lp->nfsl_open->nfso_stateid.other[0];
3726 	    *tl++ = lp->nfsl_open->nfso_stateid.other[1];
3727 	    *tl++ = lp->nfsl_open->nfso_stateid.other[2];
3728 	    *tl++ = txdr_unsigned(lp->nfsl_seqid);
3729 	    *tl++ = lp->nfsl_open->nfso_own->nfsow_clp->nfsc_clientid.lval[0];
3730 	    *tl = lp->nfsl_open->nfso_own->nfsow_clp->nfsc_clientid.lval[1];
3731 	    (void) nfsm_strtom(nd, lp->nfsl_owner, NFSV4CL_LOCKNAMELEN);
3732 	} else {
3733 	    *tl = newnfs_false;
3734 	    NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
3735 	    *tl++ = lp->nfsl_stateid.seqid;
3736 	    *tl++ = lp->nfsl_stateid.other[0];
3737 	    *tl++ = lp->nfsl_stateid.other[1];
3738 	    *tl++ = lp->nfsl_stateid.other[2];
3739 	    *tl = txdr_unsigned(lp->nfsl_seqid);
3740 	    if (nfstest_outofseq &&
3741 		(arc4random() % nfstest_outofseq) == 0)
3742 		    *tl = txdr_unsigned(lp->nfsl_seqid + 1);
3743 	}
3744 	if (syscred)
3745 		nd->nd_flag |= ND_USEGSSNAME;
3746 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, vp, p, cred,
3747 	    NFS_PROG, NFS_VER4, NULL, 1, NULL);
3748 	if (error)
3749 		return (error);
3750 	if (newone)
3751 	    NFSCL_INCRSEQID(lp->nfsl_open->nfso_own->nfsow_seqid, nd);
3752 	NFSCL_INCRSEQID(lp->nfsl_seqid, nd);
3753 	if (nd->nd_repstat == 0) {
3754 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
3755 		lp->nfsl_stateid.seqid = *tl++;
3756 		lp->nfsl_stateid.other[0] = *tl++;
3757 		lp->nfsl_stateid.other[1] = *tl++;
3758 		lp->nfsl_stateid.other[2] = *tl;
3759 	} else if (nd->nd_repstat == NFSERR_DENIED) {
3760 		NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
3761 		size = fxdr_unsigned(int, *(tl + 7));
3762 		if (size < 0 || size > NFSV4_OPAQUELIMIT)
3763 			error = EBADRPC;
3764 		if (!error)
3765 			error = nfsm_advance(nd, NFSM_RNDUP(size), -1);
3766 	} else if (nd->nd_repstat == NFSERR_STALESTATEID)
3767 		nfscl_initiate_recovery(lp->nfsl_open->nfso_own->nfsow_clp);
3768 nfsmout:
3769 	mbuf_freem(nd->nd_mrep);
3770 	return (error);
3771 }
3772 
3773 /*
3774  * nfs statfs rpc
3775  * (always called with the vp for the mount point)
3776  */
3777 APPLESTATIC int
3778 nfsrpc_statfs(vnode_t vp, struct nfsstatfs *sbp, struct nfsfsinfo *fsp,
3779     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
3780     void *stuff)
3781 {
3782 	u_int32_t *tl = NULL;
3783 	struct nfsrv_descript nfsd, *nd = &nfsd;
3784 	struct nfsmount *nmp;
3785 	nfsattrbit_t attrbits;
3786 	int error;
3787 
3788 	*attrflagp = 0;
3789 	nmp = VFSTONFS(vnode_mount(vp));
3790 	if (NFSHASNFSV4(nmp)) {
3791 		/*
3792 		 * For V4, you actually do a getattr.
3793 		 */
3794 		NFSCL_REQSTART(nd, NFSPROC_GETATTR, vp);
3795 		NFSSTATFS_GETATTRBIT(&attrbits);
3796 		(void) nfsrv_putattrbit(nd, &attrbits);
3797 		nd->nd_flag |= ND_USEGSSNAME;
3798 		error = nfscl_request(nd, vp, p, cred, stuff);
3799 		if (error)
3800 			return (error);
3801 		if (nd->nd_repstat == 0) {
3802 			error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0,
3803 			    NULL, NULL, sbp, fsp, NULL, 0, NULL, NULL, NULL, p,
3804 			    cred);
3805 			if (!error) {
3806 				nmp->nm_fsid[0] = nap->na_filesid[0];
3807 				nmp->nm_fsid[1] = nap->na_filesid[1];
3808 				NFSSETHASSETFSID(nmp);
3809 				*attrflagp = 1;
3810 			}
3811 		} else {
3812 			error = nd->nd_repstat;
3813 		}
3814 		if (error)
3815 			goto nfsmout;
3816 	} else {
3817 		NFSCL_REQSTART(nd, NFSPROC_FSSTAT, vp);
3818 		error = nfscl_request(nd, vp, p, cred, stuff);
3819 		if (error)
3820 			return (error);
3821 		if (nd->nd_flag & ND_NFSV3) {
3822 			error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
3823 			if (error)
3824 				goto nfsmout;
3825 		}
3826 		if (nd->nd_repstat) {
3827 			error = nd->nd_repstat;
3828 			goto nfsmout;
3829 		}
3830 		NFSM_DISSECT(tl, u_int32_t *,
3831 		    NFSX_STATFS(nd->nd_flag & ND_NFSV3));
3832 	}
3833 	if (NFSHASNFSV3(nmp)) {
3834 		sbp->sf_tbytes = fxdr_hyper(tl); tl += 2;
3835 		sbp->sf_fbytes = fxdr_hyper(tl); tl += 2;
3836 		sbp->sf_abytes = fxdr_hyper(tl); tl += 2;
3837 		sbp->sf_tfiles = fxdr_hyper(tl); tl += 2;
3838 		sbp->sf_ffiles = fxdr_hyper(tl); tl += 2;
3839 		sbp->sf_afiles = fxdr_hyper(tl); tl += 2;
3840 		sbp->sf_invarsec = fxdr_unsigned(u_int32_t, *tl);
3841 	} else if (NFSHASNFSV4(nmp) == 0) {
3842 		sbp->sf_tsize = fxdr_unsigned(u_int32_t, *tl++);
3843 		sbp->sf_bsize = fxdr_unsigned(u_int32_t, *tl++);
3844 		sbp->sf_blocks = fxdr_unsigned(u_int32_t, *tl++);
3845 		sbp->sf_bfree = fxdr_unsigned(u_int32_t, *tl++);
3846 		sbp->sf_bavail = fxdr_unsigned(u_int32_t, *tl);
3847 	}
3848 nfsmout:
3849 	mbuf_freem(nd->nd_mrep);
3850 	return (error);
3851 }
3852 
3853 /*
3854  * nfs pathconf rpc
3855  */
3856 APPLESTATIC int
3857 nfsrpc_pathconf(vnode_t vp, struct nfsv3_pathconf *pc,
3858     struct ucred *cred, NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp,
3859     void *stuff)
3860 {
3861 	struct nfsrv_descript nfsd, *nd = &nfsd;
3862 	struct nfsmount *nmp;
3863 	u_int32_t *tl;
3864 	nfsattrbit_t attrbits;
3865 	int error;
3866 
3867 	*attrflagp = 0;
3868 	nmp = VFSTONFS(vnode_mount(vp));
3869 	if (NFSHASNFSV4(nmp)) {
3870 		/*
3871 		 * For V4, you actually do a getattr.
3872 		 */
3873 		NFSCL_REQSTART(nd, NFSPROC_GETATTR, vp);
3874 		NFSPATHCONF_GETATTRBIT(&attrbits);
3875 		(void) nfsrv_putattrbit(nd, &attrbits);
3876 		nd->nd_flag |= ND_USEGSSNAME;
3877 		error = nfscl_request(nd, vp, p, cred, stuff);
3878 		if (error)
3879 			return (error);
3880 		if (nd->nd_repstat == 0) {
3881 			error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0,
3882 			    pc, NULL, NULL, NULL, NULL, 0, NULL, NULL, NULL, p,
3883 			    cred);
3884 			if (!error)
3885 				*attrflagp = 1;
3886 		} else {
3887 			error = nd->nd_repstat;
3888 		}
3889 	} else {
3890 		NFSCL_REQSTART(nd, NFSPROC_PATHCONF, vp);
3891 		error = nfscl_request(nd, vp, p, cred, stuff);
3892 		if (error)
3893 			return (error);
3894 		error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
3895 		if (nd->nd_repstat && !error)
3896 			error = nd->nd_repstat;
3897 		if (!error) {
3898 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V3PATHCONF);
3899 			pc->pc_linkmax = fxdr_unsigned(u_int32_t, *tl++);
3900 			pc->pc_namemax = fxdr_unsigned(u_int32_t, *tl++);
3901 			pc->pc_notrunc = fxdr_unsigned(u_int32_t, *tl++);
3902 			pc->pc_chownrestricted =
3903 			    fxdr_unsigned(u_int32_t, *tl++);
3904 			pc->pc_caseinsensitive =
3905 			    fxdr_unsigned(u_int32_t, *tl++);
3906 			pc->pc_casepreserving = fxdr_unsigned(u_int32_t, *tl);
3907 		}
3908 	}
3909 nfsmout:
3910 	mbuf_freem(nd->nd_mrep);
3911 	return (error);
3912 }
3913 
3914 /*
3915  * nfs version 3 fsinfo rpc call
3916  */
3917 APPLESTATIC int
3918 nfsrpc_fsinfo(vnode_t vp, struct nfsfsinfo *fsp, struct ucred *cred,
3919     NFSPROC_T *p, struct nfsvattr *nap, int *attrflagp, void *stuff)
3920 {
3921 	u_int32_t *tl;
3922 	struct nfsrv_descript nfsd, *nd = &nfsd;
3923 	int error;
3924 
3925 	*attrflagp = 0;
3926 	NFSCL_REQSTART(nd, NFSPROC_FSINFO, vp);
3927 	error = nfscl_request(nd, vp, p, cred, stuff);
3928 	if (error)
3929 		return (error);
3930 	error = nfscl_postop_attr(nd, nap, attrflagp, stuff);
3931 	if (nd->nd_repstat && !error)
3932 		error = nd->nd_repstat;
3933 	if (!error) {
3934 		NFSM_DISSECT(tl, u_int32_t *, NFSX_V3FSINFO);
3935 		fsp->fs_rtmax = fxdr_unsigned(u_int32_t, *tl++);
3936 		fsp->fs_rtpref = fxdr_unsigned(u_int32_t, *tl++);
3937 		fsp->fs_rtmult = fxdr_unsigned(u_int32_t, *tl++);
3938 		fsp->fs_wtmax = fxdr_unsigned(u_int32_t, *tl++);
3939 		fsp->fs_wtpref = fxdr_unsigned(u_int32_t, *tl++);
3940 		fsp->fs_wtmult = fxdr_unsigned(u_int32_t, *tl++);
3941 		fsp->fs_dtpref = fxdr_unsigned(u_int32_t, *tl++);
3942 		fsp->fs_maxfilesize = fxdr_hyper(tl);
3943 		tl += 2;
3944 		fxdr_nfsv3time(tl, &fsp->fs_timedelta);
3945 		tl += 2;
3946 		fsp->fs_properties = fxdr_unsigned(u_int32_t, *tl);
3947 	}
3948 nfsmout:
3949 	mbuf_freem(nd->nd_mrep);
3950 	return (error);
3951 }
3952 
3953 /*
3954  * This function performs the Renew RPC.
3955  */
3956 APPLESTATIC int
3957 nfsrpc_renew(struct nfsclclient *clp, struct ucred *cred, NFSPROC_T *p)
3958 {
3959 	u_int32_t *tl;
3960 	struct nfsrv_descript nfsd;
3961 	struct nfsrv_descript *nd = &nfsd;
3962 	struct nfsmount *nmp;
3963 	int error;
3964 
3965 	nmp = clp->nfsc_nmp;
3966 	if (nmp == NULL)
3967 		return (0);
3968 	nfscl_reqstart(nd, NFSPROC_RENEW, nmp, NULL, 0, NULL);
3969 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3970 	*tl++ = clp->nfsc_clientid.lval[0];
3971 	*tl = clp->nfsc_clientid.lval[1];
3972 	nd->nd_flag |= ND_USEGSSNAME;
3973 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
3974 		NFS_PROG, NFS_VER4, NULL, 1, NULL);
3975 	if (error)
3976 		return (error);
3977 	error = nd->nd_repstat;
3978 	mbuf_freem(nd->nd_mrep);
3979 	return (error);
3980 }
3981 
3982 /*
3983  * This function performs the Releaselockowner RPC.
3984  */
3985 APPLESTATIC int
3986 nfsrpc_rellockown(struct nfsmount *nmp, struct nfscllockowner *lp,
3987     struct ucred *cred, NFSPROC_T *p)
3988 {
3989 	struct nfsrv_descript nfsd, *nd = &nfsd;
3990 	u_int32_t *tl;
3991 	int error;
3992 
3993 	nfscl_reqstart(nd, NFSPROC_RELEASELCKOWN, nmp, NULL, 0, NULL);
3994 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3995 	*tl++ = nmp->nm_clp->nfsc_clientid.lval[0];
3996 	*tl = nmp->nm_clp->nfsc_clientid.lval[1];
3997 	(void) nfsm_strtom(nd, lp->nfsl_owner, NFSV4CL_LOCKNAMELEN);
3998 	nd->nd_flag |= ND_USEGSSNAME;
3999 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
4000 	    NFS_PROG, NFS_VER4, NULL, 1, NULL);
4001 	if (error)
4002 		return (error);
4003 	error = nd->nd_repstat;
4004 	mbuf_freem(nd->nd_mrep);
4005 	return (error);
4006 }
4007 
4008 /*
4009  * This function performs the Compound to get the mount pt FH.
4010  */
4011 APPLESTATIC int
4012 nfsrpc_getdirpath(struct nfsmount *nmp, u_char *dirpath, struct ucred *cred,
4013     NFSPROC_T *p)
4014 {
4015 	u_int32_t *tl;
4016 	struct nfsrv_descript nfsd;
4017 	struct nfsrv_descript *nd = &nfsd;
4018 	u_char *cp, *cp2;
4019 	int error, cnt, len, setnil;
4020 	u_int32_t *opcntp;
4021 
4022 	nfscl_reqstart(nd, NFSPROC_PUTROOTFH, nmp, NULL, 0, &opcntp);
4023 	cp = dirpath;
4024 	cnt = 0;
4025 	do {
4026 		setnil = 0;
4027 		while (*cp == '/')
4028 			cp++;
4029 		cp2 = cp;
4030 		while (*cp2 != '\0' && *cp2 != '/')
4031 			cp2++;
4032 		if (*cp2 == '/') {
4033 			setnil = 1;
4034 			*cp2 = '\0';
4035 		}
4036 		if (cp2 != cp) {
4037 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
4038 			*tl = txdr_unsigned(NFSV4OP_LOOKUP);
4039 			nfsm_strtom(nd, cp, strlen(cp));
4040 			cnt++;
4041 		}
4042 		if (setnil)
4043 			*cp2++ = '/';
4044 		cp = cp2;
4045 	} while (*cp != '\0');
4046 	*opcntp = txdr_unsigned(2 + cnt);
4047 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
4048 	*tl = txdr_unsigned(NFSV4OP_GETFH);
4049 	nd->nd_flag |= ND_USEGSSNAME;
4050 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
4051 		NFS_PROG, NFS_VER4, NULL, 1, NULL);
4052 	if (error)
4053 		return (error);
4054 	if (nd->nd_repstat == 0) {
4055 		NFSM_DISSECT(tl, u_int32_t *, (3 + 2 * cnt) * NFSX_UNSIGNED);
4056 		tl += (2 + 2 * cnt);
4057 		if ((len = fxdr_unsigned(int, *tl)) <= 0 ||
4058 			len > NFSX_FHMAX) {
4059 			nd->nd_repstat = NFSERR_BADXDR;
4060 		} else {
4061 			nd->nd_repstat = nfsrv_mtostr(nd, nmp->nm_fh, len);
4062 			if (nd->nd_repstat == 0)
4063 				nmp->nm_fhsize = len;
4064 		}
4065 	}
4066 	error = nd->nd_repstat;
4067 nfsmout:
4068 	mbuf_freem(nd->nd_mrep);
4069 	return (error);
4070 }
4071 
4072 /*
4073  * This function performs the Delegreturn RPC.
4074  */
4075 APPLESTATIC int
4076 nfsrpc_delegreturn(struct nfscldeleg *dp, struct ucred *cred,
4077     struct nfsmount *nmp, NFSPROC_T *p, int syscred)
4078 {
4079 	u_int32_t *tl;
4080 	struct nfsrv_descript nfsd;
4081 	struct nfsrv_descript *nd = &nfsd;
4082 	int error;
4083 
4084 	nfscl_reqstart(nd, NFSPROC_DELEGRETURN, nmp, dp->nfsdl_fh,
4085 	    dp->nfsdl_fhlen, NULL);
4086 	NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
4087 	*tl++ = dp->nfsdl_stateid.seqid;
4088 	*tl++ = dp->nfsdl_stateid.other[0];
4089 	*tl++ = dp->nfsdl_stateid.other[1];
4090 	*tl = dp->nfsdl_stateid.other[2];
4091 	if (syscred)
4092 		nd->nd_flag |= ND_USEGSSNAME;
4093 	error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
4094 	    NFS_PROG, NFS_VER4, NULL, 1, NULL);
4095 	if (error)
4096 		return (error);
4097 	error = nd->nd_repstat;
4098 	mbuf_freem(nd->nd_mrep);
4099 	return (error);
4100 }
4101 
4102 /*
4103  * nfs getacl call.
4104  */
4105 APPLESTATIC int
4106 nfsrpc_getacl(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
4107     struct acl *aclp, void *stuff)
4108 {
4109 	struct nfsrv_descript nfsd, *nd = &nfsd;
4110 	int error;
4111 	nfsattrbit_t attrbits;
4112 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
4113 
4114 	if (nfsrv_useacl == 0 || !NFSHASNFSV4(nmp))
4115 		return (EOPNOTSUPP);
4116 	NFSCL_REQSTART(nd, NFSPROC_GETACL, vp);
4117 	NFSZERO_ATTRBIT(&attrbits);
4118 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_ACL);
4119 	(void) nfsrv_putattrbit(nd, &attrbits);
4120 	error = nfscl_request(nd, vp, p, cred, stuff);
4121 	if (error)
4122 		return (error);
4123 	if (!nd->nd_repstat)
4124 		error = nfsv4_loadattr(nd, vp, NULL, NULL, NULL, 0, NULL,
4125 		    NULL, NULL, NULL, aclp, 0, NULL, NULL, NULL, p, cred);
4126 	else
4127 		error = nd->nd_repstat;
4128 	mbuf_freem(nd->nd_mrep);
4129 	return (error);
4130 }
4131 
4132 /*
4133  * nfs setacl call.
4134  */
4135 APPLESTATIC int
4136 nfsrpc_setacl(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
4137     struct acl *aclp, void *stuff)
4138 {
4139 	int error;
4140 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
4141 
4142 	if (nfsrv_useacl == 0 || !NFSHASNFSV4(nmp))
4143 		return (EOPNOTSUPP);
4144 	error = nfsrpc_setattr(vp, NULL, aclp, cred, p, NULL, NULL, stuff);
4145 	return (error);
4146 }
4147 
4148 /*
4149  * nfs setacl call.
4150  */
4151 static int
4152 nfsrpc_setaclrpc(vnode_t vp, struct ucred *cred, NFSPROC_T *p,
4153     struct acl *aclp, nfsv4stateid_t *stateidp, void *stuff)
4154 {
4155 	struct nfsrv_descript nfsd, *nd = &nfsd;
4156 	int error;
4157 	nfsattrbit_t attrbits;
4158 	struct nfsmount *nmp = VFSTONFS(vnode_mount(vp));
4159 
4160 	if (!NFSHASNFSV4(nmp))
4161 		return (EOPNOTSUPP);
4162 	NFSCL_REQSTART(nd, NFSPROC_SETACL, vp);
4163 	nfsm_stateidtom(nd, stateidp, NFSSTATEID_PUTSTATEID);
4164 	NFSZERO_ATTRBIT(&attrbits);
4165 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_ACL);
4166 	(void) nfsv4_fillattr(nd, vp, aclp, NULL, NULL, 0, &attrbits,
4167 	    NULL, NULL, 0, 0);
4168 	error = nfscl_request(nd, vp, p, cred, stuff);
4169 	if (error)
4170 		return (error);
4171 	/* Don't care about the pre/postop attributes */
4172 	mbuf_freem(nd->nd_mrep);
4173 	return (nd->nd_repstat);
4174 }
4175