xref: /freebsd/sys/fs/nfsclient/nfs_clstate.c (revision 194242604ae4644ced49fac03d9ddc6994ea9e95)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright (c) 2009 Rick Macklem, University of Guelph
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  *
28  */
29 
30 #include <sys/cdefs.h>
31 /*
32  * These functions implement the client side state handling for NFSv4.
33  * NFSv4 state handling:
34  * - A lockowner is used to determine lock contention, so it
35  *   corresponds directly to a Posix pid. (1 to 1 mapping)
36  * - The correct granularity of an OpenOwner is not nearly so
37  *   obvious. An OpenOwner does the following:
38  *   - provides a serial sequencing of Open/Close/Lock-with-new-lockowner
39  *   - is used to check for Open/Share contention (not applicable to
40  *     this client, since all Opens are Deny_None)
41  *   As such, I considered both extreme.
42  *   1 OpenOwner per ClientID - Simple to manage, but fully serializes
43  *   all Open, Close and Lock (with a new lockowner) Ops.
44  *   1 OpenOwner for each Open - This one results in an OpenConfirm for
45  *   every Open, for most servers.
46  *   So, I chose to use the same mapping as I did for LockOwnwers.
47  *   The main concern here is that you can end up with multiple Opens
48  *   for the same File Handle, but on different OpenOwners (opens
49  *   inherited from parents, grandparents...) and you do not know
50  *   which of these the vnodeop close applies to. This is handled by
51  *   delaying the Close Op(s) until all of the Opens have been closed.
52  *   (It is not yet obvious if this is the correct granularity.)
53  * - How the code handles serialization:
54  *   - For the ClientId, it uses an exclusive lock while getting its
55  *     SetClientId and during recovery. Otherwise, it uses a shared
56  *     lock via a reference count.
57  *   - For the rest of the data structures, it uses an SMP mutex
58  *     (once the nfs client is SMP safe) and doesn't sleep while
59  *     manipulating the linked lists.
60  *   - The serialization of Open/Close/Lock/LockU falls out in the
61  *     "wash", since OpenOwners and LockOwners are both mapped from
62  *     Posix pid. In other words, there is only one Posix pid using
63  *     any given owner, so that owner is serialized. (If you change
64  *     the granularity of the OpenOwner, then code must be added to
65  *     serialize Ops on the OpenOwner.)
66  * - When to get rid of OpenOwners and LockOwners.
67  *   - The function nfscl_cleanup_common() is executed after a process exits.
68  *     It goes through the client list looking for all Open and Lock Owners.
69  *     When one is found, it is marked "defunct" or in the case of
70  *     an OpenOwner without any Opens, freed.
71  *     The renew thread scans for defunct Owners and gets rid of them,
72  *     if it can. The LockOwners will also be deleted when the
73  *     associated Open is closed.
74  *   - If the LockU or Close Op(s) fail during close in a way
75  *     that could be recovered upon retry, they are relinked to the
76  *     ClientId's defunct open list and retried by the renew thread
77  *     until they succeed or an unmount/recovery occurs.
78  *     (Since we are done with them, they do not need to be recovered.)
79  */
80 
81 #include <fs/nfs/nfsport.h>
82 
83 /*
84  * Global variables
85  */
86 extern struct nfsstatsv1 nfsstatsv1;
87 extern struct nfsreqhead nfsd_reqq;
88 extern u_int32_t newnfs_false, newnfs_true;
89 extern int nfscl_debuglevel;
90 extern int nfscl_enablecallb;
91 extern int nfs_numnfscbd;
92 NFSREQSPINLOCK;
93 NFSCLSTATEMUTEX;
94 int nfscl_inited = 0;
95 struct nfsclhead nfsclhead;	/* Head of clientid list */
96 
97 static int nfscl_deleghighwater = NFSCLDELEGHIGHWATER;
98 static int nfscl_delegcnt = 0;
99 static int nfscl_layoutcnt = 0;
100 static int nfscl_getopen(struct nfsclownerhead *, struct nfsclopenhash *,
101     u_int8_t *, int, u_int8_t *, u_int8_t *, u_int32_t,
102     struct nfscllockowner **, struct nfsclopen **);
103 static bool nfscl_checkown(struct nfsclowner *, struct nfsclopen *, uint8_t *,
104     uint8_t *, struct nfscllockowner **, struct nfsclopen **,
105     struct nfsclopen **);
106 static void nfscl_clrelease(struct nfsclclient *);
107 static void nfscl_unlinkopen(struct nfsclopen *);
108 static void nfscl_cleanclient(struct nfsclclient *);
109 static void nfscl_expireclient(struct nfsclclient *, struct nfsmount *,
110     struct ucred *, NFSPROC_T *);
111 static int nfscl_expireopen(struct nfsclclient *, struct nfsclopen *,
112     struct nfsmount *, struct ucred *, NFSPROC_T *);
113 static void nfscl_recover(struct nfsclclient *, bool *, struct ucred *,
114     NFSPROC_T *);
115 static void nfscl_insertlock(struct nfscllockowner *, struct nfscllock *,
116     struct nfscllock *, int);
117 static int nfscl_updatelock(struct nfscllockowner *, struct nfscllock **,
118     struct nfscllock **, int);
119 static void nfscl_delegreturnall(struct nfsclclient *, NFSPROC_T *,
120     struct nfscldeleghead *);
121 static u_int32_t nfscl_nextcbident(void);
122 static mount_t nfscl_getmnt(int, uint8_t *, u_int32_t, struct nfsclclient **);
123 static struct nfsclclient *nfscl_getclnt(u_int32_t);
124 static struct nfsclclient *nfscl_getclntsess(uint8_t *);
125 static struct nfscldeleg *nfscl_finddeleg(struct nfsclclient *, u_int8_t *,
126     int);
127 static void nfscl_retoncloselayout(vnode_t, struct nfsclclient *, uint8_t *,
128     int, struct nfsclrecalllayout **, struct nfscllayout **);
129 static void nfscl_reldevinfo_locked(struct nfscldevinfo *);
130 static struct nfscllayout *nfscl_findlayout(struct nfsclclient *, u_int8_t *,
131     int);
132 static struct nfscldevinfo *nfscl_finddevinfo(struct nfsclclient *, uint8_t *);
133 static int nfscl_checkconflict(struct nfscllockownerhead *, struct nfscllock *,
134     u_int8_t *, struct nfscllock **);
135 static void nfscl_freealllocks(struct nfscllockownerhead *, int);
136 static int nfscl_localconflict(struct nfsclclient *, u_int8_t *, int,
137     struct nfscllock *, u_int8_t *, struct nfscldeleg *, struct nfscllock **);
138 static void nfscl_newopen(struct nfsclclient *, struct nfscldeleg *,
139     struct nfsclowner **, struct nfsclowner **, struct nfsclopen **,
140     struct nfsclopen **, u_int8_t *, u_int8_t *, int, struct ucred *, int *);
141 static int nfscl_moveopen(vnode_t , struct nfsclclient *,
142     struct nfsmount *, struct nfsclopen *, struct nfsclowner *,
143     struct nfscldeleg *, struct ucred *, NFSPROC_T *);
144 static void nfscl_totalrecall(struct nfsclclient *);
145 static int nfscl_relock(vnode_t , struct nfsclclient *, struct nfsmount *,
146     struct nfscllockowner *, struct nfscllock *, struct ucred *, NFSPROC_T *);
147 static int nfscl_tryopen(struct nfsmount *, vnode_t , u_int8_t *, int,
148     u_int8_t *, int, u_int32_t, struct nfsclopen *, u_int8_t *, int,
149     struct nfscldeleg **, int, u_int32_t, struct ucred *, NFSPROC_T *);
150 static int nfscl_trylock(struct nfsmount *, vnode_t , u_int8_t *,
151     int, struct nfscllockowner *, int, int, u_int64_t, u_int64_t, short,
152     struct ucred *, NFSPROC_T *);
153 static int nfsrpc_reopen(struct nfsmount *, u_int8_t *, int, u_int32_t,
154     struct nfsclopen *, struct nfscldeleg **, struct ucred *, NFSPROC_T *);
155 static void nfscl_freedeleg(struct nfscldeleghead *, struct nfscldeleg *,
156     bool);
157 static int nfscl_errmap(struct nfsrv_descript *, u_int32_t);
158 static void nfscl_cleanup_common(struct nfsclclient *, u_int8_t *);
159 static int nfscl_recalldeleg(struct nfsclclient *, struct nfsmount *,
160     struct nfscldeleg *, vnode_t, struct ucred *, NFSPROC_T *, int,
161     vnode_t *);
162 static void nfscl_freeopenowner(struct nfsclowner *, int);
163 static void nfscl_cleandeleg(struct nfscldeleg *);
164 static void nfscl_emptylockowner(struct nfscllockowner *,
165     struct nfscllockownerfhhead *);
166 static void nfscl_mergeflayouts(struct nfsclflayouthead *,
167     struct nfsclflayouthead *);
168 static int nfscl_layoutrecall(int, struct nfscllayout *, uint32_t, uint64_t,
169     uint64_t, uint32_t, uint32_t, uint32_t, char *, struct nfsclrecalllayout *);
170 static int nfscl_seq(uint32_t, uint32_t);
171 static void nfscl_layoutreturn(struct nfsmount *, struct nfscllayout *,
172     struct ucred *, NFSPROC_T *);
173 static void nfscl_dolayoutcommit(struct nfsmount *, struct nfscllayout *,
174     struct ucred *, NFSPROC_T *);
175 
176 static short nfscberr_null[] = {
177 	0,
178 	0,
179 };
180 
181 static short nfscberr_getattr[] = {
182 	NFSERR_RESOURCE,
183 	NFSERR_BADHANDLE,
184 	NFSERR_BADXDR,
185 	NFSERR_RESOURCE,
186 	NFSERR_SERVERFAULT,
187 	0,
188 };
189 
190 static short nfscberr_recall[] = {
191 	NFSERR_RESOURCE,
192 	NFSERR_BADHANDLE,
193 	NFSERR_BADSTATEID,
194 	NFSERR_BADXDR,
195 	NFSERR_RESOURCE,
196 	NFSERR_SERVERFAULT,
197 	0,
198 };
199 
200 static short *nfscl_cberrmap[] = {
201 	nfscberr_null,
202 	nfscberr_null,
203 	nfscberr_null,
204 	nfscberr_getattr,
205 	nfscberr_recall
206 };
207 
208 #define	NETFAMILY(clp) \
209 		(((clp)->nfsc_flags & NFSCLFLAGS_AFINET6) ? AF_INET6 : AF_INET)
210 
211 /*
212  * Called for an open operation.
213  * If the nfhp argument is NULL, just get an openowner.
214  */
215 int
216 nfscl_open(vnode_t vp, u_int8_t *nfhp, int fhlen, u_int32_t amode, int usedeleg,
217     struct ucred *cred, NFSPROC_T *p, struct nfsclowner **owpp,
218     struct nfsclopen **opp, int *newonep, int *retp, int lockit, bool firstref)
219 {
220 	struct nfsclclient *clp;
221 	struct nfsclowner *owp, *nowp;
222 	struct nfsclopen *op = NULL, *nop = NULL;
223 	struct nfscldeleg *dp;
224 	struct nfsclownerhead *ohp;
225 	u_int8_t own[NFSV4CL_LOCKNAMELEN];
226 	int ret;
227 
228 	if (newonep != NULL)
229 		*newonep = 0;
230 	if (opp != NULL)
231 		*opp = NULL;
232 	if (owpp != NULL)
233 		*owpp = NULL;
234 
235 	/*
236 	 * Might need one or both of these, so MALLOC them now, to
237 	 * avoid a tsleep() in MALLOC later.
238 	 */
239 	nowp = malloc(sizeof (struct nfsclowner),
240 	    M_NFSCLOWNER, M_WAITOK);
241 	if (nfhp != NULL) {
242 	    nop = malloc(sizeof (struct nfsclopen) +
243 		fhlen - 1, M_NFSCLOPEN, M_WAITOK);
244 	    nop->nfso_hash.le_prev = NULL;
245 	}
246 	ret = nfscl_getcl(vp->v_mount, cred, p, false, firstref, &clp);
247 	if (ret != 0) {
248 		free(nowp, M_NFSCLOWNER);
249 		if (nop != NULL)
250 			free(nop, M_NFSCLOPEN);
251 		return (ret);
252 	}
253 
254 	/*
255 	 * Get the Open iff it already exists.
256 	 * If none found, add the new one or return error, depending upon
257 	 * "create".
258 	 */
259 	NFSLOCKCLSTATE();
260 	dp = NULL;
261 	/* First check the delegation list */
262 	if (nfhp != NULL && usedeleg) {
263 		LIST_FOREACH(dp, NFSCLDELEGHASH(clp, nfhp, fhlen), nfsdl_hash) {
264 			if (dp->nfsdl_fhlen == fhlen &&
265 			    !NFSBCMP(nfhp, dp->nfsdl_fh, fhlen)) {
266 				if (!(amode & NFSV4OPEN_ACCESSWRITE) ||
267 				    (dp->nfsdl_flags & NFSCLDL_WRITE))
268 					break;
269 				dp = NULL;
270 				break;
271 			}
272 		}
273 	}
274 
275 	/* For NFSv4.1/4.2 and this option, use a single open_owner. */
276 	if (NFSHASONEOPENOWN(VFSTONFS(vp->v_mount)))
277 		nfscl_filllockowner(NULL, own, F_POSIX);
278 	else
279 		nfscl_filllockowner(p->td_proc, own, F_POSIX);
280 	if (dp != NULL)
281 		ohp = &dp->nfsdl_owner;
282 	else
283 		ohp = &clp->nfsc_owner;
284 	/* Now, search for an openowner */
285 	LIST_FOREACH(owp, ohp, nfsow_list) {
286 		if (!NFSBCMP(owp->nfsow_owner, own, NFSV4CL_LOCKNAMELEN))
287 			break;
288 	}
289 
290 	/*
291 	 * Create a new open, as required.
292 	 */
293 	nfscl_newopen(clp, dp, &owp, &nowp, &op, &nop, own, nfhp, fhlen,
294 	    cred, newonep);
295 
296 	/*
297 	 * Now, check the mode on the open and return the appropriate
298 	 * value.
299 	 */
300 	if (retp != NULL) {
301 		if (nfhp != NULL && dp != NULL && nop == NULL)
302 			/* new local open on delegation */
303 			*retp = NFSCLOPEN_SETCRED;
304 		else
305 			*retp = NFSCLOPEN_OK;
306 	}
307 	if (op != NULL && (amode & ~(op->nfso_mode))) {
308 		op->nfso_mode |= amode;
309 		if (retp != NULL && dp == NULL)
310 			*retp = NFSCLOPEN_DOOPEN;
311 	}
312 
313 	/*
314 	 * Serialize modifications to the open owner for multiple threads
315 	 * within the same process using a read/write sleep lock.
316 	 * For NFSv4.1 and a single OpenOwner, allow concurrent open operations
317 	 * by acquiring a shared lock.  The close operations still use an
318 	 * exclusive lock for this case.
319 	 */
320 	if (lockit != 0) {
321 		if (NFSHASONEOPENOWN(VFSTONFS(vp->v_mount))) {
322 			/*
323 			 * Get a shared lock on the OpenOwner, but first
324 			 * wait for any pending exclusive lock, so that the
325 			 * exclusive locker gets priority.
326 			 */
327 			nfsv4_lock(&owp->nfsow_rwlock, 0, NULL,
328 			    NFSCLSTATEMUTEXPTR, NULL);
329 			nfsv4_getref(&owp->nfsow_rwlock, NULL,
330 			    NFSCLSTATEMUTEXPTR, NULL);
331 		} else
332 			nfscl_lockexcl(&owp->nfsow_rwlock, NFSCLSTATEMUTEXPTR);
333 	}
334 	NFSUNLOCKCLSTATE();
335 	if (nowp != NULL)
336 		free(nowp, M_NFSCLOWNER);
337 	if (nop != NULL)
338 		free(nop, M_NFSCLOPEN);
339 	if (owpp != NULL)
340 		*owpp = owp;
341 	if (opp != NULL)
342 		*opp = op;
343 	return (0);
344 }
345 
346 /*
347  * Create a new open, as required.
348  */
349 static void
350 nfscl_newopen(struct nfsclclient *clp, struct nfscldeleg *dp,
351     struct nfsclowner **owpp, struct nfsclowner **nowpp, struct nfsclopen **opp,
352     struct nfsclopen **nopp, u_int8_t *own, u_int8_t *fhp, int fhlen,
353     struct ucred *cred, int *newonep)
354 {
355 	struct nfsclowner *owp = *owpp, *nowp;
356 	struct nfsclopen *op, *nop;
357 
358 	if (nowpp != NULL)
359 		nowp = *nowpp;
360 	else
361 		nowp = NULL;
362 	if (nopp != NULL)
363 		nop = *nopp;
364 	else
365 		nop = NULL;
366 	if (owp == NULL && nowp != NULL) {
367 		NFSBCOPY(own, nowp->nfsow_owner, NFSV4CL_LOCKNAMELEN);
368 		LIST_INIT(&nowp->nfsow_open);
369 		nowp->nfsow_clp = clp;
370 		nowp->nfsow_seqid = 0;
371 		nowp->nfsow_defunct = 0;
372 		nfscl_lockinit(&nowp->nfsow_rwlock);
373 		if (dp != NULL) {
374 			nfsstatsv1.cllocalopenowners++;
375 			LIST_INSERT_HEAD(&dp->nfsdl_owner, nowp, nfsow_list);
376 		} else {
377 			nfsstatsv1.clopenowners++;
378 			LIST_INSERT_HEAD(&clp->nfsc_owner, nowp, nfsow_list);
379 		}
380 		owp = *owpp = nowp;
381 		*nowpp = NULL;
382 		if (newonep != NULL)
383 			*newonep = 1;
384 	}
385 
386 	 /* If an fhp has been specified, create an Open as well. */
387 	if (fhp != NULL) {
388 		/* and look for the correct open, based upon FH */
389 		LIST_FOREACH(op, &owp->nfsow_open, nfso_list) {
390 			if (op->nfso_fhlen == fhlen &&
391 			    !NFSBCMP(op->nfso_fh, fhp, fhlen))
392 				break;
393 		}
394 		if (op == NULL && nop != NULL) {
395 			nop->nfso_own = owp;
396 			nop->nfso_mode = 0;
397 			nop->nfso_opencnt = 0;
398 			nop->nfso_posixlock = 1;
399 			nop->nfso_fhlen = fhlen;
400 			NFSBCOPY(fhp, nop->nfso_fh, fhlen);
401 			LIST_INIT(&nop->nfso_lock);
402 			nop->nfso_stateid.seqid = 0;
403 			nop->nfso_stateid.other[0] = 0;
404 			nop->nfso_stateid.other[1] = 0;
405 			nop->nfso_stateid.other[2] = 0;
406 			KASSERT(cred != NULL, ("%s: cred NULL\n", __func__));
407 			newnfs_copyincred(cred, &nop->nfso_cred);
408 			if (dp != NULL) {
409 				TAILQ_REMOVE(&clp->nfsc_deleg, dp, nfsdl_list);
410 				TAILQ_INSERT_HEAD(&clp->nfsc_deleg, dp,
411 				    nfsdl_list);
412 				dp->nfsdl_timestamp = NFSD_MONOSEC + 120;
413 				nfsstatsv1.cllocalopens++;
414 			} else {
415 				LIST_INSERT_HEAD(NFSCLOPENHASH(clp, fhp, fhlen),
416 				    nop, nfso_hash);
417 				nfsstatsv1.clopens++;
418 			}
419 			LIST_INSERT_HEAD(&owp->nfsow_open, nop, nfso_list);
420 			*opp = nop;
421 			*nopp = NULL;
422 			if (newonep != NULL)
423 				*newonep = 1;
424 		} else {
425 			*opp = op;
426 		}
427 	}
428 }
429 
430 /*
431  * Called to find/add a delegation to a client.
432  */
433 int
434 nfscl_deleg(mount_t mp, struct nfsclclient *clp, u_int8_t *nfhp,
435     int fhlen, struct ucred *cred, NFSPROC_T *p, struct nfscldeleg *dp)
436 {
437 	struct nfscldeleg *tdp;
438 	struct nfsmount *nmp;
439 
440 	KASSERT(mp != NULL, ("nfscl_deleg: mp NULL"));
441 	nmp = VFSTONFS(mp);
442 
443 	/*
444 	 * Since a delegation might be added to the mount,
445 	 * set NFSMNTP_DELEGISSUED now.  If a delegation already
446 	 * exagain ists, setting this flag is harmless.
447 	 */
448 	NFSLOCKMNT(nmp);
449 	nmp->nm_privflag |= NFSMNTP_DELEGISSUED;
450 	NFSUNLOCKMNT(nmp);
451 
452 	/* Look for the correct deleg, based upon FH */
453 	NFSLOCKCLSTATE();
454 	tdp = nfscl_finddeleg(clp, nfhp, fhlen);
455 	if (tdp == NULL) {
456 		if (dp == NULL) {
457 			NFSUNLOCKCLSTATE();
458 			return (NFSERR_BADSTATEID);
459 		}
460 		TAILQ_INSERT_HEAD(&clp->nfsc_deleg, dp, nfsdl_list);
461 		LIST_INSERT_HEAD(NFSCLDELEGHASH(clp, nfhp, fhlen), dp,
462 		    nfsdl_hash);
463 		dp->nfsdl_timestamp = NFSD_MONOSEC + 120;
464 		nfsstatsv1.cldelegates++;
465 		nfscl_delegcnt++;
466 	} else {
467 		/*
468 		 * A delegation already exists.  If the new one is a Write
469 		 * delegation and the old one a Read delegation, return the
470 		 * Read delegation.  Otherwise, return the new delegation.
471 		 */
472 		if (dp != NULL) {
473 			if ((dp->nfsdl_flags & NFSCLDL_WRITE) != 0 &&
474 			    (tdp->nfsdl_flags & NFSCLDL_READ) != 0) {
475 				TAILQ_REMOVE(&clp->nfsc_deleg, tdp, nfsdl_list);
476 				LIST_REMOVE(tdp, nfsdl_hash);
477 				TAILQ_INSERT_HEAD(&clp->nfsc_deleg, dp,
478 				    nfsdl_list);
479 				LIST_INSERT_HEAD(NFSCLDELEGHASH(clp, nfhp,
480 				    fhlen), dp, nfsdl_hash);
481 				dp->nfsdl_timestamp = NFSD_MONOSEC + 120;
482 			} else {
483 				tdp = dp;	/* Return this one. */
484 			}
485 		} else {
486 			tdp = NULL;
487 		}
488 	}
489 	NFSUNLOCKCLSTATE();
490 	if (tdp != NULL) {
491 		nfscl_trydelegreturn(tdp, cred, nmp, p);
492 		free(tdp, M_NFSCLDELEG);
493 	}
494 	return (0);
495 }
496 
497 /*
498  * Find a delegation for this file handle. Return NULL upon failure.
499  */
500 static struct nfscldeleg *
501 nfscl_finddeleg(struct nfsclclient *clp, u_int8_t *fhp, int fhlen)
502 {
503 	struct nfscldeleg *dp;
504 
505 	LIST_FOREACH(dp, NFSCLDELEGHASH(clp, fhp, fhlen), nfsdl_hash) {
506 	    if (dp->nfsdl_fhlen == fhlen &&
507 		!NFSBCMP(dp->nfsdl_fh, fhp, fhlen))
508 		break;
509 	}
510 	return (dp);
511 }
512 
513 /*
514  * Get a stateid for an I/O operation. First, look for an open and iff
515  * found, return either a lockowner stateid or the open stateid.
516  * If no Open is found, just return error and the special stateid of all zeros.
517  */
518 int
519 nfscl_getstateid(vnode_t vp, u_int8_t *nfhp, int fhlen, u_int32_t mode,
520     int fords, struct ucred *cred, NFSPROC_T *p, nfsv4stateid_t *stateidp,
521     void **lckpp)
522 {
523 	struct nfsclclient *clp;
524 	struct nfsclopen *op = NULL, *top;
525 	struct nfsclopenhash *oph;
526 	struct nfscllockowner *lp;
527 	struct nfscldeleg *dp;
528 	struct nfsnode *np;
529 	struct nfsmount *nmp;
530 	struct nfscred ncr;
531 	u_int8_t own[NFSV4CL_LOCKNAMELEN], lockown[NFSV4CL_LOCKNAMELEN];
532 	int error;
533 	bool done;
534 
535 	*lckpp = NULL;
536 	/*
537 	 * Initially, just set the special stateid of all zeros.
538 	 * (Don't do this for a DS, since the special stateid can't be used.)
539 	 */
540 	if (fords == 0) {
541 		stateidp->seqid = 0;
542 		stateidp->other[0] = 0;
543 		stateidp->other[1] = 0;
544 		stateidp->other[2] = 0;
545 	}
546 	if (vp->v_type != VREG)
547 		return (EISDIR);
548 	np = VTONFS(vp);
549 	nmp = VFSTONFS(vp->v_mount);
550 
551 	/*
552 	 * For "oneopenown" mounts, first check for a cached open in the
553 	 * NFS vnode, that can be used as a stateid.  This can only be
554 	 * done if no delegations have been issued to the mount and no
555 	 * byte range file locking has been done for the file.
556 	 */
557 	if (NFSHASNFSV4N(nmp) && NFSHASONEOPENOWN(nmp) && fords == 0) {
558 		NFSLOCKMNT(nmp);
559 		NFSLOCKNODE(np);
560 		if ((nmp->nm_privflag & NFSMNTP_DELEGISSUED) == 0 &&
561 		    (np->n_flag & NMIGHTBELOCKED) == 0 &&
562 		    np->n_openstateid != NULL) {
563 			stateidp->seqid = 0;
564 			stateidp->other[0] =
565 			    np->n_openstateid->nfso_stateid.other[0];
566 			stateidp->other[1] =
567 			    np->n_openstateid->nfso_stateid.other[1];
568 			stateidp->other[2] =
569 			    np->n_openstateid->nfso_stateid.other[2];
570 			NFSUNLOCKNODE(np);
571 			NFSUNLOCKMNT(nmp);
572 			return (0);
573 		}
574 		NFSUNLOCKNODE(np);
575 		NFSUNLOCKMNT(nmp);
576 	}
577 
578 	NFSLOCKCLSTATE();
579 	clp = nfscl_findcl(nmp);
580 	if (clp == NULL) {
581 		NFSUNLOCKCLSTATE();
582 		return (EACCES);
583 	}
584 
585 	/*
586 	 * Wait for recovery to complete.
587 	 */
588 	while ((clp->nfsc_flags & NFSCLFLAGS_RECVRINPROG))
589 		(void) nfsmsleep(&clp->nfsc_flags, NFSCLSTATEMUTEXPTR,
590 		    PZERO, "nfsrecvr", NULL);
591 
592 	/*
593 	 * First, look for a delegation.
594 	 */
595 	LIST_FOREACH(dp, NFSCLDELEGHASH(clp, nfhp, fhlen), nfsdl_hash) {
596 		if (dp->nfsdl_fhlen == fhlen &&
597 		    !NFSBCMP(nfhp, dp->nfsdl_fh, fhlen)) {
598 			if (!(mode & NFSV4OPEN_ACCESSWRITE) ||
599 			    (dp->nfsdl_flags & NFSCLDL_WRITE)) {
600 				if (NFSHASNFSV4N(nmp))
601 					stateidp->seqid = 0;
602 				else
603 					stateidp->seqid =
604 					    dp->nfsdl_stateid.seqid;
605 				stateidp->other[0] = dp->nfsdl_stateid.other[0];
606 				stateidp->other[1] = dp->nfsdl_stateid.other[1];
607 				stateidp->other[2] = dp->nfsdl_stateid.other[2];
608 				if (!(np->n_flag & NDELEGRECALL)) {
609 					TAILQ_REMOVE(&clp->nfsc_deleg, dp,
610 					    nfsdl_list);
611 					TAILQ_INSERT_HEAD(&clp->nfsc_deleg, dp,
612 					    nfsdl_list);
613 					dp->nfsdl_timestamp = NFSD_MONOSEC +
614 					    120;
615 					dp->nfsdl_rwlock.nfslock_usecnt++;
616 					*lckpp = (void *)&dp->nfsdl_rwlock;
617 				}
618 				NFSUNLOCKCLSTATE();
619 				return (0);
620 			}
621 			break;
622 		}
623 	}
624 
625 	if (p != NULL) {
626 		/*
627 		 * If p != NULL, we want to search the parentage tree
628 		 * for a matching OpenOwner and use that.
629 		 */
630 		if (NFSHASONEOPENOWN(VFSTONFS(vp->v_mount)))
631 			nfscl_filllockowner(NULL, own, F_POSIX);
632 		else
633 			nfscl_filllockowner(p->td_proc, own, F_POSIX);
634 		nfscl_filllockowner(p->td_proc, lockown, F_POSIX);
635 		lp = NULL;
636 		error = nfscl_getopen(NULL, clp->nfsc_openhash, nfhp, fhlen,
637 		    own, lockown, mode, &lp, &op);
638 		if (error == 0 && lp != NULL && fords == 0) {
639 			/* Don't return a lock stateid for a DS. */
640 			if (NFSHASNFSV4N(nmp))
641 				stateidp->seqid = 0;
642 			else
643 				stateidp->seqid = lp->nfsl_stateid.seqid;
644 			stateidp->other[0] =
645 			    lp->nfsl_stateid.other[0];
646 			stateidp->other[1] =
647 			    lp->nfsl_stateid.other[1];
648 			stateidp->other[2] =
649 			    lp->nfsl_stateid.other[2];
650 			NFSUNLOCKCLSTATE();
651 			return (0);
652 		}
653 	}
654 	if (op == NULL) {
655 		/* If not found, just look for any OpenOwner that will work. */
656 		top = NULL;
657 		done = false;
658 		oph = NFSCLOPENHASH(clp, nfhp, fhlen);
659 		LIST_FOREACH(op, oph, nfso_hash) {
660 			if (op->nfso_fhlen == fhlen &&
661 			    !NFSBCMP(op->nfso_fh, nfhp, fhlen)) {
662 				if (top == NULL && (op->nfso_mode &
663 				    NFSV4OPEN_ACCESSWRITE) != 0 &&
664 				    (mode & NFSV4OPEN_ACCESSREAD) != 0)
665 					top = op;
666 				if ((mode & op->nfso_mode) == mode) {
667 					/* LRU order the hash list. */
668 					LIST_REMOVE(op, nfso_hash);
669 					LIST_INSERT_HEAD(oph, op, nfso_hash);
670 					done = true;
671 					break;
672 				}
673 			}
674 		}
675 		if (!done) {
676 			NFSCL_DEBUG(2, "openmode top=%p\n", top);
677 			if (top == NULL || NFSHASOPENMODE(nmp)) {
678 				NFSUNLOCKCLSTATE();
679 				return (ENOENT);
680 			} else
681 				op = top;
682 		}
683 		/*
684 		 * For read aheads or write behinds, use the open cred.
685 		 * A read ahead or write behind is indicated by p == NULL.
686 		 */
687 		if (p == NULL)
688 			memcpy(&ncr, &op->nfso_cred, sizeof(ncr));
689 	}
690 
691 	/*
692 	 * No lock stateid, so return the open stateid.
693 	 */
694 	if (NFSHASNFSV4N(nmp))
695 		stateidp->seqid = 0;
696 	else
697 		stateidp->seqid = op->nfso_stateid.seqid;
698 	stateidp->other[0] = op->nfso_stateid.other[0];
699 	stateidp->other[1] = op->nfso_stateid.other[1];
700 	stateidp->other[2] = op->nfso_stateid.other[2];
701 	NFSUNLOCKCLSTATE();
702 	if (p == NULL)
703 		newnfs_copycred(&ncr, cred);
704 	return (0);
705 }
706 
707 /*
708  * Search for a matching file, mode and, optionally, lockowner.
709  */
710 static int
711 nfscl_getopen(struct nfsclownerhead *ohp, struct nfsclopenhash *ohashp,
712     u_int8_t *nfhp, int fhlen, u_int8_t *openown, u_int8_t *lockown,
713     u_int32_t mode, struct nfscllockowner **lpp, struct nfsclopen **opp)
714 {
715 	struct nfsclowner *owp;
716 	struct nfsclopen *op, *rop, *rop2;
717 	struct nfsclopenhash *oph;
718 	bool keep_looping;
719 
720 	KASSERT(ohp == NULL || ohashp == NULL, ("nfscl_getopen: "
721 	    "only one of ohp and ohashp can be set"));
722 	if (lpp != NULL)
723 		*lpp = NULL;
724 	/*
725 	 * rop will be set to the open to be returned. There are three
726 	 * variants of this, all for an open of the correct file:
727 	 * 1 - A match of lockown.
728 	 * 2 - A match of the openown, when no lockown match exists.
729 	 * 3 - A match for any open, if no openown or lockown match exists.
730 	 * Looking for #2 over #3 probably isn't necessary, but since
731 	 * RFC3530 is vague w.r.t. the relationship between openowners and
732 	 * lockowners, I think this is the safer way to go.
733 	 */
734 	rop = NULL;
735 	rop2 = NULL;
736 	keep_looping = true;
737 	/* Search the client list */
738 	if (ohashp == NULL) {
739 		/* Search the local opens on the delegation. */
740 		LIST_FOREACH(owp, ohp, nfsow_list) {
741 			/* and look for the correct open */
742 			LIST_FOREACH(op, &owp->nfsow_open, nfso_list) {
743 				if (op->nfso_fhlen == fhlen &&
744 				    !NFSBCMP(op->nfso_fh, nfhp, fhlen)
745 				    && (op->nfso_mode & mode) == mode)
746 					keep_looping = nfscl_checkown(owp, op, openown,
747 					    lockown, lpp, &rop, &rop2);
748 				if (!keep_looping)
749 					break;
750 			}
751 			if (!keep_looping)
752 				break;
753 		}
754 	} else {
755 		/* Search for matching opens on the hash list. */
756 		oph = &ohashp[NFSCLOPENHASHFUNC(nfhp, fhlen)];
757 		LIST_FOREACH(op, oph, nfso_hash) {
758 			if (op->nfso_fhlen == fhlen &&
759 			    !NFSBCMP(op->nfso_fh, nfhp, fhlen)
760 			    && (op->nfso_mode & mode) == mode)
761 				keep_looping = nfscl_checkown(op->nfso_own, op,
762 				    openown, lockown, lpp, &rop, &rop2);
763 			if (!keep_looping) {
764 				/* LRU order the hash list. */
765 				LIST_REMOVE(op, nfso_hash);
766 				LIST_INSERT_HEAD(oph, op, nfso_hash);
767 				break;
768 			}
769 		}
770 	}
771 	if (rop == NULL)
772 		rop = rop2;
773 	if (rop == NULL)
774 		return (EBADF);
775 	*opp = rop;
776 	return (0);
777 }
778 
779 /* Check for an owner match. */
780 static bool
781 nfscl_checkown(struct nfsclowner *owp, struct nfsclopen *op, uint8_t *openown,
782     uint8_t *lockown, struct nfscllockowner **lpp, struct nfsclopen **ropp,
783     struct nfsclopen **ropp2)
784 {
785 	struct nfscllockowner *lp;
786 	bool keep_looping;
787 
788 	keep_looping = true;
789 	if (lpp != NULL) {
790 		/* Now look for a matching lockowner. */
791 		LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
792 			if (!NFSBCMP(lp->nfsl_owner, lockown,
793 			    NFSV4CL_LOCKNAMELEN)) {
794 				*lpp = lp;
795 				*ropp = op;
796 				return (false);
797 			}
798 		}
799 	}
800 	if (*ropp == NULL && !NFSBCMP(owp->nfsow_owner, openown,
801 	    NFSV4CL_LOCKNAMELEN)) {
802 		*ropp = op;
803 		if (lpp == NULL)
804 			keep_looping = false;
805 	}
806 	if (*ropp2 == NULL)
807 		*ropp2 = op;
808 	return (keep_looping);
809 }
810 
811 /*
812  * Release use of an open owner. Called when open operations are done
813  * with the open owner.
814  */
815 void
816 nfscl_ownerrelease(struct nfsmount *nmp, struct nfsclowner *owp,
817     __unused int error, __unused int candelete, int unlocked)
818 {
819 
820 	if (owp == NULL)
821 		return;
822 	NFSLOCKCLSTATE();
823 	if (unlocked == 0) {
824 		if (NFSHASONEOPENOWN(nmp))
825 			nfsv4_relref(&owp->nfsow_rwlock);
826 		else
827 			nfscl_lockunlock(&owp->nfsow_rwlock);
828 	}
829 	nfscl_clrelease(owp->nfsow_clp);
830 	NFSUNLOCKCLSTATE();
831 }
832 
833 /*
834  * Release use of an open structure under an open owner.
835  */
836 void
837 nfscl_openrelease(struct nfsmount *nmp, struct nfsclopen *op, int error,
838     int candelete)
839 {
840 	struct nfsclclient *clp;
841 	struct nfsclowner *owp;
842 
843 	if (op == NULL)
844 		return;
845 	NFSLOCKCLSTATE();
846 	owp = op->nfso_own;
847 	if (NFSHASONEOPENOWN(nmp))
848 		nfsv4_relref(&owp->nfsow_rwlock);
849 	else
850 		nfscl_lockunlock(&owp->nfsow_rwlock);
851 	clp = owp->nfsow_clp;
852 	if (error && candelete && op->nfso_opencnt == 0)
853 		nfscl_freeopen(op, 0, true);
854 	nfscl_clrelease(clp);
855 	NFSUNLOCKCLSTATE();
856 }
857 
858 /*
859  * Called to get a clientid structure. It will optionally lock the
860  * client data structures to do the SetClientId/SetClientId_confirm,
861  * but will release that lock and return the clientid with a reference
862  * count on it.
863  * If the "cred" argument is NULL, a new clientid should not be created.
864  * If the "p" argument is NULL, a SetClientID/SetClientIDConfirm cannot
865  * be done.
866  * It always clpp with a reference count on it, unless returning an error.
867  */
868 int
869 nfscl_getcl(struct mount *mp, struct ucred *cred, NFSPROC_T *p,
870     bool tryminvers, bool firstref, struct nfsclclient **clpp)
871 {
872 	struct nfsclclient *clp;
873 	struct nfsclclient *newclp = NULL;
874 	struct nfsmount *nmp;
875 	char uuid[HOSTUUIDLEN];
876 	int igotlock = 0, error, trystalecnt, clidinusedelay, i;
877 	u_int16_t idlen = 0;
878 
879 	nmp = VFSTONFS(mp);
880 	if (cred != NULL) {
881 		getcredhostuuid(cred, uuid, sizeof uuid);
882 		idlen = strlen(uuid);
883 		if (idlen > 0)
884 			idlen += sizeof (u_int64_t);
885 		else
886 			idlen += sizeof (u_int64_t) + 16; /* 16 random bytes */
887 		newclp = malloc(
888 		    sizeof (struct nfsclclient) + idlen - 1, M_NFSCLCLIENT,
889 		    M_WAITOK | M_ZERO);
890 	}
891 	NFSLOCKCLSTATE();
892 	/*
893 	 * If a forced dismount is already in progress, don't
894 	 * allocate a new clientid and get out now. For the case where
895 	 * clp != NULL, this is a harmless optimization.
896 	 */
897 	if (NFSCL_FORCEDISM(mp)) {
898 		NFSUNLOCKCLSTATE();
899 		if (newclp != NULL)
900 			free(newclp, M_NFSCLCLIENT);
901 		return (EBADF);
902 	}
903 	clp = nmp->nm_clp;
904 	if (clp == NULL) {
905 		if (newclp == NULL) {
906 			NFSUNLOCKCLSTATE();
907 			return (EACCES);
908 		}
909 		clp = newclp;
910 		clp->nfsc_idlen = idlen;
911 		LIST_INIT(&clp->nfsc_owner);
912 		TAILQ_INIT(&clp->nfsc_deleg);
913 		TAILQ_INIT(&clp->nfsc_layout);
914 		LIST_INIT(&clp->nfsc_devinfo);
915 		for (i = 0; i < NFSCLDELEGHASHSIZE; i++)
916 			LIST_INIT(&clp->nfsc_deleghash[i]);
917 		for (i = 0; i < NFSCLOPENHASHSIZE; i++)
918 			LIST_INIT(&clp->nfsc_openhash[i]);
919 		for (i = 0; i < NFSCLLAYOUTHASHSIZE; i++)
920 			LIST_INIT(&clp->nfsc_layouthash[i]);
921 		clp->nfsc_flags = NFSCLFLAGS_INITED;
922 		clp->nfsc_clientidrev = 1;
923 		clp->nfsc_cbident = nfscl_nextcbident();
924 		nfscl_fillclid(nmp->nm_clval, uuid, clp->nfsc_id,
925 		    clp->nfsc_idlen);
926 		LIST_INSERT_HEAD(&nfsclhead, clp, nfsc_list);
927 		nmp->nm_clp = clp;
928 		clp->nfsc_nmp = nmp;
929 	} else {
930 		if (newclp != NULL)
931 			free(newclp, M_NFSCLCLIENT);
932 	}
933 	while ((clp->nfsc_flags & NFSCLFLAGS_HASCLIENTID) == 0 && !igotlock &&
934 	    !NFSCL_FORCEDISM(mp))
935 		igotlock = nfsv4_lock(&clp->nfsc_lock, 1, NULL,
936 		    NFSCLSTATEMUTEXPTR, mp);
937 	if (igotlock == 0) {
938 		/*
939 		 * Call nfsv4_lock() with "iwantlock == 0" on the firstref so
940 		 * that it will wait for a pending exclusive lock request.
941 		 * This gives the exclusive lock request priority over this
942 		 * shared lock request.
943 		 * An exclusive lock on nfsc_lock is used mainly for server
944 		 * crash recoveries and delegation recalls.
945 		 */
946 		if (firstref)
947 			nfsv4_lock(&clp->nfsc_lock, 0, NULL, NFSCLSTATEMUTEXPTR,
948 			    mp);
949 		nfsv4_getref(&clp->nfsc_lock, NULL, NFSCLSTATEMUTEXPTR, mp);
950 	}
951 	if (igotlock == 0 && NFSCL_FORCEDISM(mp)) {
952 		/*
953 		 * Both nfsv4_lock() and nfsv4_getref() know to check
954 		 * for NFSCL_FORCEDISM() and return without sleeping to
955 		 * wait for the exclusive lock to be released, since it
956 		 * might be held by nfscl_umount() and we need to get out
957 		 * now for that case and not wait until nfscl_umount()
958 		 * releases it.
959 		 */
960 		NFSUNLOCKCLSTATE();
961 		return (EBADF);
962 	}
963 	NFSUNLOCKCLSTATE();
964 
965 	/*
966 	 * If it needs a clientid, do the setclientid now.
967 	 */
968 	if ((clp->nfsc_flags & NFSCLFLAGS_HASCLIENTID) == 0) {
969 		if (!igotlock)
970 			panic("nfscl_clget");
971 		if (p == NULL || cred == NULL) {
972 			NFSLOCKCLSTATE();
973 			nfsv4_unlock(&clp->nfsc_lock, 0);
974 			NFSUNLOCKCLSTATE();
975 			return (EACCES);
976 		}
977 		/*
978 		 * If RFC3530 Sec. 14.2.33 is taken literally,
979 		 * NFSERR_CLIDINUSE will be returned persistently for the
980 		 * case where a new mount of the same file system is using
981 		 * a different principal. In practice, NFSERR_CLIDINUSE is
982 		 * only returned when there is outstanding unexpired state
983 		 * on the clientid. As such, try for twice the lease
984 		 * interval, if we know what that is. Otherwise, make a
985 		 * wild ass guess.
986 		 * The case of returning NFSERR_STALECLIENTID is far less
987 		 * likely, but might occur if there is a significant delay
988 		 * between doing the SetClientID and SetClientIDConfirm Ops,
989 		 * such that the server throws away the clientid before
990 		 * receiving the SetClientIDConfirm.
991 		 */
992 		if (clp->nfsc_renew > 0)
993 			clidinusedelay = NFSCL_LEASE(clp->nfsc_renew) * 2;
994 		else
995 			clidinusedelay = 120;
996 		trystalecnt = 3;
997 		do {
998 			error = nfsrpc_setclient(nmp, clp, 0, NULL, cred, p);
999 			if (error == NFSERR_STALECLIENTID ||
1000 			    error == NFSERR_STALEDONTRECOVER ||
1001 			    error == NFSERR_BADSESSION ||
1002 			    error == NFSERR_CLIDINUSE) {
1003 				(void) nfs_catnap(PZERO, error, "nfs_setcl");
1004 			} else if (error == NFSERR_MINORVERMISMATCH &&
1005 			    tryminvers) {
1006 				if (nmp->nm_minorvers > 0)
1007 					nmp->nm_minorvers--;
1008 				else
1009 					tryminvers = false;
1010 			}
1011 		} while (((error == NFSERR_STALECLIENTID ||
1012 		     error == NFSERR_BADSESSION ||
1013 		     error == NFSERR_STALEDONTRECOVER) && --trystalecnt > 0) ||
1014 		    (error == NFSERR_CLIDINUSE && --clidinusedelay > 0) ||
1015 		    (error == NFSERR_MINORVERMISMATCH && tryminvers));
1016 		if (error) {
1017 			NFSLOCKCLSTATE();
1018 			nfsv4_unlock(&clp->nfsc_lock, 0);
1019 			NFSUNLOCKCLSTATE();
1020 			return (error);
1021 		}
1022 		clp->nfsc_flags |= NFSCLFLAGS_HASCLIENTID;
1023 	}
1024 	if (igotlock) {
1025 		NFSLOCKCLSTATE();
1026 		nfsv4_unlock(&clp->nfsc_lock, 1);
1027 		NFSUNLOCKCLSTATE();
1028 	}
1029 
1030 	*clpp = clp;
1031 	return (0);
1032 }
1033 
1034 /*
1035  * Get a reference to a clientid and return it, if valid.
1036  */
1037 struct nfsclclient *
1038 nfscl_findcl(struct nfsmount *nmp)
1039 {
1040 	struct nfsclclient *clp;
1041 
1042 	clp = nmp->nm_clp;
1043 	if (clp == NULL || !(clp->nfsc_flags & NFSCLFLAGS_HASCLIENTID))
1044 		return (NULL);
1045 	return (clp);
1046 }
1047 
1048 /*
1049  * Release the clientid structure. It may be locked or reference counted.
1050  */
1051 static void
1052 nfscl_clrelease(struct nfsclclient *clp)
1053 {
1054 
1055 	if (clp->nfsc_lock.nfslock_lock & NFSV4LOCK_LOCK)
1056 		nfsv4_unlock(&clp->nfsc_lock, 0);
1057 	else
1058 		nfsv4_relref(&clp->nfsc_lock);
1059 }
1060 
1061 /*
1062  * External call for nfscl_clrelease.
1063  */
1064 void
1065 nfscl_clientrelease(struct nfsclclient *clp)
1066 {
1067 
1068 	NFSLOCKCLSTATE();
1069 	if (clp->nfsc_lock.nfslock_lock & NFSV4LOCK_LOCK)
1070 		nfsv4_unlock(&clp->nfsc_lock, 0);
1071 	else
1072 		nfsv4_relref(&clp->nfsc_lock);
1073 	NFSUNLOCKCLSTATE();
1074 }
1075 
1076 /*
1077  * Called when wanting to lock a byte region.
1078  */
1079 int
1080 nfscl_getbytelock(vnode_t vp, u_int64_t off, u_int64_t len,
1081     short type, struct ucred *cred, NFSPROC_T *p, struct nfsclclient *rclp,
1082     int recovery, void *id, int flags, u_int8_t *rownp, u_int8_t *ropenownp,
1083     struct nfscllockowner **lpp, int *newonep, int *donelocallyp)
1084 {
1085 	struct nfscllockowner *lp;
1086 	struct nfsclopen *op;
1087 	struct nfsclclient *clp;
1088 	struct nfscllockowner *nlp;
1089 	struct nfscllock *nlop, *otherlop;
1090 	struct nfscldeleg *dp = NULL, *ldp = NULL;
1091 	struct nfscllockownerhead *lhp = NULL;
1092 	struct nfsnode *np;
1093 	u_int8_t own[NFSV4CL_LOCKNAMELEN], *ownp, openown[NFSV4CL_LOCKNAMELEN];
1094 	u_int8_t *openownp;
1095 	int error = 0, ret, donelocally = 0;
1096 	u_int32_t mode;
1097 
1098 	/* For Lock Ops, the open mode doesn't matter, so use 0 to match any. */
1099 	mode = 0;
1100 	np = VTONFS(vp);
1101 	*lpp = NULL;
1102 	lp = NULL;
1103 	*newonep = 0;
1104 	*donelocallyp = 0;
1105 
1106 	/*
1107 	 * Might need these, so MALLOC them now, to
1108 	 * avoid a tsleep() in MALLOC later.
1109 	 */
1110 	nlp = malloc(
1111 	    sizeof (struct nfscllockowner), M_NFSCLLOCKOWNER, M_WAITOK);
1112 	otherlop = malloc(
1113 	    sizeof (struct nfscllock), M_NFSCLLOCK, M_WAITOK);
1114 	nlop = malloc(
1115 	    sizeof (struct nfscllock), M_NFSCLLOCK, M_WAITOK);
1116 	nlop->nfslo_type = type;
1117 	nlop->nfslo_first = off;
1118 	if (len == NFS64BITSSET) {
1119 		nlop->nfslo_end = NFS64BITSSET;
1120 	} else {
1121 		nlop->nfslo_end = off + len;
1122 		if (nlop->nfslo_end <= nlop->nfslo_first)
1123 			error = NFSERR_INVAL;
1124 	}
1125 
1126 	if (!error) {
1127 		if (recovery)
1128 			clp = rclp;
1129 		else
1130 			error = nfscl_getcl(vp->v_mount, cred, p, false, true,
1131 			    &clp);
1132 	}
1133 	if (error) {
1134 		free(nlp, M_NFSCLLOCKOWNER);
1135 		free(otherlop, M_NFSCLLOCK);
1136 		free(nlop, M_NFSCLLOCK);
1137 		return (error);
1138 	}
1139 
1140 	op = NULL;
1141 	if (recovery) {
1142 		ownp = rownp;
1143 		openownp = ropenownp;
1144 	} else {
1145 		nfscl_filllockowner(id, own, flags);
1146 		ownp = own;
1147 		if (NFSHASONEOPENOWN(VFSTONFS(vp->v_mount)))
1148 			nfscl_filllockowner(NULL, openown, F_POSIX);
1149 		else
1150 			nfscl_filllockowner(p->td_proc, openown, F_POSIX);
1151 		openownp = openown;
1152 	}
1153 	if (!recovery) {
1154 		NFSLOCKCLSTATE();
1155 		/*
1156 		 * First, search for a delegation. If one exists for this file,
1157 		 * the lock can be done locally against it, so long as there
1158 		 * isn't a local lock conflict.
1159 		 */
1160 		ldp = dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh,
1161 		    np->n_fhp->nfh_len);
1162 		/* Just sanity check for correct type of delegation */
1163 		if (dp != NULL && ((dp->nfsdl_flags &
1164 		    (NFSCLDL_RECALL | NFSCLDL_DELEGRET)) != 0 ||
1165 		     (type == F_WRLCK &&
1166 		      (dp->nfsdl_flags & NFSCLDL_WRITE) == 0)))
1167 			dp = NULL;
1168 	}
1169 	if (dp != NULL) {
1170 		/* Now, find an open and maybe a lockowner. */
1171 		ret = nfscl_getopen(&dp->nfsdl_owner, NULL, np->n_fhp->nfh_fh,
1172 		    np->n_fhp->nfh_len, openownp, ownp, mode, NULL, &op);
1173 		if (ret)
1174 			ret = nfscl_getopen(NULL, clp->nfsc_openhash,
1175 			    np->n_fhp->nfh_fh, np->n_fhp->nfh_len, openownp,
1176 			    ownp, mode, NULL, &op);
1177 		if (!ret) {
1178 			lhp = &dp->nfsdl_lock;
1179 			TAILQ_REMOVE(&clp->nfsc_deleg, dp, nfsdl_list);
1180 			TAILQ_INSERT_HEAD(&clp->nfsc_deleg, dp, nfsdl_list);
1181 			dp->nfsdl_timestamp = NFSD_MONOSEC + 120;
1182 			donelocally = 1;
1183 		} else {
1184 			dp = NULL;
1185 		}
1186 	}
1187 	if (!donelocally) {
1188 		/*
1189 		 * Get the related Open and maybe lockowner.
1190 		 */
1191 		error = nfscl_getopen(NULL, clp->nfsc_openhash,
1192 		    np->n_fhp->nfh_fh, np->n_fhp->nfh_len, openownp,
1193 		    ownp, mode, &lp, &op);
1194 		if (!error)
1195 			lhp = &op->nfso_lock;
1196 	}
1197 	if (!error && !recovery)
1198 		error = nfscl_localconflict(clp, np->n_fhp->nfh_fh,
1199 		    np->n_fhp->nfh_len, nlop, ownp, ldp, NULL);
1200 	if (error) {
1201 		if (!recovery) {
1202 			nfscl_clrelease(clp);
1203 			NFSUNLOCKCLSTATE();
1204 		}
1205 		free(nlp, M_NFSCLLOCKOWNER);
1206 		free(otherlop, M_NFSCLLOCK);
1207 		free(nlop, M_NFSCLLOCK);
1208 		return (error);
1209 	}
1210 
1211 	/*
1212 	 * Ok, see if a lockowner exists and create one, as required.
1213 	 */
1214 	if (lp == NULL)
1215 		LIST_FOREACH(lp, lhp, nfsl_list) {
1216 			if (!NFSBCMP(lp->nfsl_owner, ownp, NFSV4CL_LOCKNAMELEN))
1217 				break;
1218 		}
1219 	if (lp == NULL) {
1220 		NFSBCOPY(ownp, nlp->nfsl_owner, NFSV4CL_LOCKNAMELEN);
1221 		if (recovery)
1222 			NFSBCOPY(ropenownp, nlp->nfsl_openowner,
1223 			    NFSV4CL_LOCKNAMELEN);
1224 		else
1225 			NFSBCOPY(op->nfso_own->nfsow_owner, nlp->nfsl_openowner,
1226 			    NFSV4CL_LOCKNAMELEN);
1227 		nlp->nfsl_seqid = 0;
1228 		nlp->nfsl_lockflags = flags;
1229 		nlp->nfsl_inprog = NULL;
1230 		nfscl_lockinit(&nlp->nfsl_rwlock);
1231 		LIST_INIT(&nlp->nfsl_lock);
1232 		if (donelocally) {
1233 			nlp->nfsl_open = NULL;
1234 			nfsstatsv1.cllocallockowners++;
1235 		} else {
1236 			nlp->nfsl_open = op;
1237 			nfsstatsv1.cllockowners++;
1238 		}
1239 		LIST_INSERT_HEAD(lhp, nlp, nfsl_list);
1240 		lp = nlp;
1241 		nlp = NULL;
1242 		*newonep = 1;
1243 	}
1244 
1245 	/*
1246 	 * Now, update the byte ranges for locks.
1247 	 */
1248 	ret = nfscl_updatelock(lp, &nlop, &otherlop, donelocally);
1249 	if (!ret)
1250 		donelocally = 1;
1251 	if (donelocally) {
1252 		*donelocallyp = 1;
1253 		if (!recovery)
1254 			nfscl_clrelease(clp);
1255 	} else {
1256 		/*
1257 		 * Serial modifications on the lock owner for multiple threads
1258 		 * for the same process using a read/write lock.
1259 		 */
1260 		if (!recovery)
1261 			nfscl_lockexcl(&lp->nfsl_rwlock, NFSCLSTATEMUTEXPTR);
1262 	}
1263 	if (!recovery)
1264 		NFSUNLOCKCLSTATE();
1265 
1266 	if (nlp)
1267 		free(nlp, M_NFSCLLOCKOWNER);
1268 	if (nlop)
1269 		free(nlop, M_NFSCLLOCK);
1270 	if (otherlop)
1271 		free(otherlop, M_NFSCLLOCK);
1272 
1273 	*lpp = lp;
1274 	return (0);
1275 }
1276 
1277 /*
1278  * Called to unlock a byte range, for LockU.
1279  */
1280 int
1281 nfscl_relbytelock(vnode_t vp, u_int64_t off, u_int64_t len,
1282     __unused struct ucred *cred, NFSPROC_T *p, int callcnt,
1283     struct nfsclclient *clp, void *id, int flags,
1284     struct nfscllockowner **lpp, int *dorpcp)
1285 {
1286 	struct nfscllockowner *lp;
1287 	struct nfsclopen *op;
1288 	struct nfscllock *nlop, *other_lop = NULL;
1289 	struct nfscldeleg *dp;
1290 	struct nfsnode *np;
1291 	u_int8_t own[NFSV4CL_LOCKNAMELEN];
1292 	int ret = 0, fnd;
1293 
1294 	np = VTONFS(vp);
1295 	*lpp = NULL;
1296 	*dorpcp = 0;
1297 
1298 	/*
1299 	 * Might need these, so MALLOC them now, to
1300 	 * avoid a tsleep() in MALLOC later.
1301 	 */
1302 	nlop = malloc(
1303 	    sizeof (struct nfscllock), M_NFSCLLOCK, M_WAITOK);
1304 	nlop->nfslo_type = F_UNLCK;
1305 	nlop->nfslo_first = off;
1306 	if (len == NFS64BITSSET) {
1307 		nlop->nfslo_end = NFS64BITSSET;
1308 	} else {
1309 		nlop->nfslo_end = off + len;
1310 		if (nlop->nfslo_end <= nlop->nfslo_first) {
1311 			free(nlop, M_NFSCLLOCK);
1312 			return (NFSERR_INVAL);
1313 		}
1314 	}
1315 	if (callcnt == 0) {
1316 		other_lop = malloc(
1317 		    sizeof (struct nfscllock), M_NFSCLLOCK, M_WAITOK);
1318 		*other_lop = *nlop;
1319 	}
1320 	nfscl_filllockowner(id, own, flags);
1321 	dp = NULL;
1322 	NFSLOCKCLSTATE();
1323 	if (callcnt == 0)
1324 		dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh,
1325 		    np->n_fhp->nfh_len);
1326 
1327 	/*
1328 	 * First, unlock any local regions on a delegation.
1329 	 */
1330 	if (dp != NULL) {
1331 		/* Look for this lockowner. */
1332 		LIST_FOREACH(lp, &dp->nfsdl_lock, nfsl_list) {
1333 			if (!NFSBCMP(lp->nfsl_owner, own,
1334 			    NFSV4CL_LOCKNAMELEN))
1335 				break;
1336 		}
1337 		if (lp != NULL)
1338 			/* Use other_lop, so nlop is still available */
1339 			(void)nfscl_updatelock(lp, &other_lop, NULL, 1);
1340 	}
1341 
1342 	/*
1343 	 * Now, find a matching open/lockowner that hasn't already been done,
1344 	 * as marked by nfsl_inprog.
1345 	 */
1346 	lp = NULL;
1347 	fnd = 0;
1348 	LIST_FOREACH(op, NFSCLOPENHASH(clp, np->n_fhp->nfh_fh,
1349 	    np->n_fhp->nfh_len), nfso_hash) {
1350 		if (op->nfso_fhlen == np->n_fhp->nfh_len &&
1351 		    !NFSBCMP(op->nfso_fh, np->n_fhp->nfh_fh, op->nfso_fhlen)) {
1352 			LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
1353 				if (lp->nfsl_inprog == NULL &&
1354 				    !NFSBCMP(lp->nfsl_owner, own,
1355 				     NFSV4CL_LOCKNAMELEN)) {
1356 					fnd = 1;
1357 					break;
1358 				}
1359 			}
1360 		}
1361 		if (fnd)
1362 			break;
1363 	}
1364 
1365 	if (lp != NULL) {
1366 		ret = nfscl_updatelock(lp, &nlop, NULL, 0);
1367 		if (ret)
1368 			*dorpcp = 1;
1369 		/*
1370 		 * Serial modifications on the lock owner for multiple
1371 		 * threads for the same process using a read/write lock.
1372 		 */
1373 		lp->nfsl_inprog = p;
1374 		nfscl_lockexcl(&lp->nfsl_rwlock, NFSCLSTATEMUTEXPTR);
1375 		*lpp = lp;
1376 	}
1377 	NFSUNLOCKCLSTATE();
1378 	if (nlop)
1379 		free(nlop, M_NFSCLLOCK);
1380 	if (other_lop)
1381 		free(other_lop, M_NFSCLLOCK);
1382 	return (0);
1383 }
1384 
1385 /*
1386  * Release all lockowners marked in progess for this process and file.
1387  */
1388 void
1389 nfscl_releasealllocks(struct nfsclclient *clp, vnode_t vp, NFSPROC_T *p,
1390     void *id, int flags)
1391 {
1392 	struct nfsclopen *op;
1393 	struct nfscllockowner *lp;
1394 	struct nfsnode *np;
1395 	u_int8_t own[NFSV4CL_LOCKNAMELEN];
1396 
1397 	np = VTONFS(vp);
1398 	nfscl_filllockowner(id, own, flags);
1399 	NFSLOCKCLSTATE();
1400 	LIST_FOREACH(op, NFSCLOPENHASH(clp, np->n_fhp->nfh_fh,
1401 	    np->n_fhp->nfh_len), nfso_hash) {
1402 		if (op->nfso_fhlen == np->n_fhp->nfh_len &&
1403 		    !NFSBCMP(op->nfso_fh, np->n_fhp->nfh_fh, op->nfso_fhlen)) {
1404 			LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
1405 				if (lp->nfsl_inprog == p &&
1406 				    !NFSBCMP(lp->nfsl_owner, own,
1407 				    NFSV4CL_LOCKNAMELEN)) {
1408 					lp->nfsl_inprog = NULL;
1409 					nfscl_lockunlock(&lp->nfsl_rwlock);
1410 				}
1411 			}
1412 		}
1413 	}
1414 	nfscl_clrelease(clp);
1415 	NFSUNLOCKCLSTATE();
1416 }
1417 
1418 /*
1419  * Called to find out if any bytes within the byte range specified are
1420  * write locked by the calling process. Used to determine if flushing
1421  * is required before a LockU.
1422  * If in doubt, return 1, so the flush will occur.
1423  */
1424 int
1425 nfscl_checkwritelocked(vnode_t vp, struct flock *fl,
1426     struct ucred *cred, NFSPROC_T *p, void *id, int flags)
1427 {
1428 	struct nfscllockowner *lp;
1429 	struct nfsclopen *op;
1430 	struct nfsclclient *clp;
1431 	struct nfscllock *lop;
1432 	struct nfscldeleg *dp;
1433 	struct nfsnode *np;
1434 	u_int64_t off, end;
1435 	u_int8_t own[NFSV4CL_LOCKNAMELEN];
1436 	int error = 0;
1437 
1438 	np = VTONFS(vp);
1439 	switch (fl->l_whence) {
1440 	case SEEK_SET:
1441 	case SEEK_CUR:
1442 		/*
1443 		 * Caller is responsible for adding any necessary offset
1444 		 * when SEEK_CUR is used.
1445 		 */
1446 		off = fl->l_start;
1447 		break;
1448 	case SEEK_END:
1449 		off = np->n_size + fl->l_start;
1450 		break;
1451 	default:
1452 		return (1);
1453 	}
1454 	if (fl->l_len != 0) {
1455 		end = off + fl->l_len;
1456 		if (end < off)
1457 			return (1);
1458 	} else {
1459 		end = NFS64BITSSET;
1460 	}
1461 
1462 	error = nfscl_getcl(vp->v_mount, cred, p, false, true, &clp);
1463 	if (error)
1464 		return (1);
1465 	nfscl_filllockowner(id, own, flags);
1466 	NFSLOCKCLSTATE();
1467 
1468 	/*
1469 	 * First check the delegation locks.
1470 	 */
1471 	dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len);
1472 	if (dp != NULL) {
1473 		/* No need to flush if it is a write delegation. */
1474 		if ((dp->nfsdl_flags & NFSCLDL_WRITE) != 0) {
1475 			nfscl_clrelease(clp);
1476 			NFSUNLOCKCLSTATE();
1477 			return (0);
1478 		}
1479 		LIST_FOREACH(lp, &dp->nfsdl_lock, nfsl_list) {
1480 			if (!NFSBCMP(lp->nfsl_owner, own,
1481 			    NFSV4CL_LOCKNAMELEN))
1482 				break;
1483 		}
1484 		if (lp != NULL) {
1485 			LIST_FOREACH(lop, &lp->nfsl_lock, nfslo_list) {
1486 				if (lop->nfslo_first >= end)
1487 					break;
1488 				if (lop->nfslo_end <= off)
1489 					continue;
1490 				if (lop->nfslo_type == F_WRLCK) {
1491 					nfscl_clrelease(clp);
1492 					NFSUNLOCKCLSTATE();
1493 					return (1);
1494 				}
1495 			}
1496 		}
1497 	}
1498 
1499 	/*
1500 	 * Now, check state against the server.
1501 	 */
1502 	LIST_FOREACH(op, NFSCLOPENHASH(clp, np->n_fhp->nfh_fh,
1503 	    np->n_fhp->nfh_len), nfso_hash) {
1504 		if (op->nfso_fhlen == np->n_fhp->nfh_len &&
1505 		    !NFSBCMP(op->nfso_fh, np->n_fhp->nfh_fh, op->nfso_fhlen)) {
1506 			LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
1507 				if (!NFSBCMP(lp->nfsl_owner, own,
1508 				    NFSV4CL_LOCKNAMELEN))
1509 					break;
1510 			}
1511 			if (lp != NULL) {
1512 				LIST_FOREACH(lop, &lp->nfsl_lock, nfslo_list) {
1513 					if (lop->nfslo_first >= end)
1514 						break;
1515 					if (lop->nfslo_end <= off)
1516 						continue;
1517 					if (lop->nfslo_type == F_WRLCK) {
1518 						nfscl_clrelease(clp);
1519 						NFSUNLOCKCLSTATE();
1520 						return (1);
1521 					}
1522 				}
1523 			}
1524 		}
1525 	}
1526 	nfscl_clrelease(clp);
1527 	NFSUNLOCKCLSTATE();
1528 	return (0);
1529 }
1530 
1531 /*
1532  * Release a byte range lock owner structure.
1533  */
1534 void
1535 nfscl_lockrelease(struct nfscllockowner *lp, int error, int candelete)
1536 {
1537 	struct nfsclclient *clp;
1538 
1539 	if (lp == NULL)
1540 		return;
1541 	NFSLOCKCLSTATE();
1542 	clp = lp->nfsl_open->nfso_own->nfsow_clp;
1543 	if (error != 0 && candelete &&
1544 	    (lp->nfsl_rwlock.nfslock_lock & NFSV4LOCK_WANTED) == 0)
1545 		nfscl_freelockowner(lp, 0);
1546 	else
1547 		nfscl_lockunlock(&lp->nfsl_rwlock);
1548 	nfscl_clrelease(clp);
1549 	NFSUNLOCKCLSTATE();
1550 }
1551 
1552 /*
1553  * Unlink the open structure.
1554  */
1555 static void
1556 nfscl_unlinkopen(struct nfsclopen *op)
1557 {
1558 
1559 	LIST_REMOVE(op, nfso_list);
1560 	if (op->nfso_hash.le_prev != NULL)
1561 		LIST_REMOVE(op, nfso_hash);
1562 }
1563 
1564 /*
1565  * Free up an open structure and any associated byte range lock structures.
1566  */
1567 void
1568 nfscl_freeopen(struct nfsclopen *op, int local, bool unlink)
1569 {
1570 
1571 	if (unlink)
1572 		nfscl_unlinkopen(op);
1573 	nfscl_freealllocks(&op->nfso_lock, local);
1574 	free(op, M_NFSCLOPEN);
1575 	if (local)
1576 		nfsstatsv1.cllocalopens--;
1577 	else
1578 		nfsstatsv1.clopens--;
1579 }
1580 
1581 /*
1582  * Free up all lock owners and associated locks.
1583  */
1584 static void
1585 nfscl_freealllocks(struct nfscllockownerhead *lhp, int local)
1586 {
1587 	struct nfscllockowner *lp, *nlp;
1588 
1589 	LIST_FOREACH_SAFE(lp, lhp, nfsl_list, nlp) {
1590 		if ((lp->nfsl_rwlock.nfslock_lock & NFSV4LOCK_WANTED))
1591 			panic("nfscllckw");
1592 		nfscl_freelockowner(lp, local);
1593 	}
1594 }
1595 
1596 /*
1597  * Called for an Open when NFSERR_EXPIRED is received from the server.
1598  * If there are no byte range locks nor a Share Deny lost, try to do a
1599  * fresh Open. Otherwise, free the open.
1600  */
1601 static int
1602 nfscl_expireopen(struct nfsclclient *clp, struct nfsclopen *op,
1603     struct nfsmount *nmp, struct ucred *cred, NFSPROC_T *p)
1604 {
1605 	struct nfscllockowner *lp;
1606 	struct nfscldeleg *dp;
1607 	int mustdelete = 0, error;
1608 
1609 	/*
1610 	 * Look for any byte range lock(s).
1611 	 */
1612 	LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
1613 		if (!LIST_EMPTY(&lp->nfsl_lock)) {
1614 			mustdelete = 1;
1615 			break;
1616 		}
1617 	}
1618 
1619 	/*
1620 	 * If no byte range lock(s) nor a Share deny, try to re-open.
1621 	 */
1622 	if (!mustdelete && (op->nfso_mode & NFSLCK_DENYBITS) == 0) {
1623 		newnfs_copycred(&op->nfso_cred, cred);
1624 		dp = NULL;
1625 		error = nfsrpc_reopen(nmp, op->nfso_fh,
1626 		    op->nfso_fhlen, op->nfso_mode, op, &dp, cred, p);
1627 		if (error) {
1628 			mustdelete = 1;
1629 			if (dp != NULL) {
1630 				free(dp, M_NFSCLDELEG);
1631 				dp = NULL;
1632 			}
1633 		}
1634 		if (dp != NULL)
1635 			nfscl_deleg(nmp->nm_mountp, clp, op->nfso_fh,
1636 			    op->nfso_fhlen, cred, p, dp);
1637 	}
1638 
1639 	/*
1640 	 * If a byte range lock or Share deny or couldn't re-open, free it.
1641 	 */
1642 	if (mustdelete)
1643 		nfscl_freeopen(op, 0, true);
1644 	return (mustdelete);
1645 }
1646 
1647 /*
1648  * Free up an open owner structure.
1649  */
1650 static void
1651 nfscl_freeopenowner(struct nfsclowner *owp, int local)
1652 {
1653 	int owned;
1654 
1655 	/*
1656 	 * Make sure the NFSCLSTATE mutex is held, to avoid races with
1657 	 * calls in nfscl_renewthread() that do not hold a reference
1658 	 * count on the nfsclclient and just the mutex.
1659 	 * The mutex will not be held for calls done with the exclusive
1660 	 * nfsclclient lock held, in particular, nfscl_hasexpired()
1661 	 * and nfscl_recalldeleg() might do this.
1662 	 */
1663 	owned = mtx_owned(NFSCLSTATEMUTEXPTR);
1664 	if (owned == 0)
1665 		NFSLOCKCLSTATE();
1666 	LIST_REMOVE(owp, nfsow_list);
1667 	if (owned == 0)
1668 		NFSUNLOCKCLSTATE();
1669 	free(owp, M_NFSCLOWNER);
1670 	if (local)
1671 		nfsstatsv1.cllocalopenowners--;
1672 	else
1673 		nfsstatsv1.clopenowners--;
1674 }
1675 
1676 /*
1677  * Free up a byte range lock owner structure.
1678  */
1679 void
1680 nfscl_freelockowner(struct nfscllockowner *lp, int local)
1681 {
1682 	struct nfscllock *lop, *nlop;
1683 	int owned;
1684 
1685 	/*
1686 	 * Make sure the NFSCLSTATE mutex is held, to avoid races with
1687 	 * calls in nfscl_renewthread() that do not hold a reference
1688 	 * count on the nfsclclient and just the mutex.
1689 	 * The mutex will not be held for calls done with the exclusive
1690 	 * nfsclclient lock held, in particular, nfscl_hasexpired()
1691 	 * and nfscl_recalldeleg() might do this.
1692 	 */
1693 	owned = mtx_owned(NFSCLSTATEMUTEXPTR);
1694 	if (owned == 0)
1695 		NFSLOCKCLSTATE();
1696 	LIST_REMOVE(lp, nfsl_list);
1697 	if (owned == 0)
1698 		NFSUNLOCKCLSTATE();
1699 	LIST_FOREACH_SAFE(lop, &lp->nfsl_lock, nfslo_list, nlop) {
1700 		nfscl_freelock(lop, local);
1701 	}
1702 	free(lp, M_NFSCLLOCKOWNER);
1703 	if (local)
1704 		nfsstatsv1.cllocallockowners--;
1705 	else
1706 		nfsstatsv1.cllockowners--;
1707 }
1708 
1709 /*
1710  * Free up a byte range lock structure.
1711  */
1712 void
1713 nfscl_freelock(struct nfscllock *lop, int local)
1714 {
1715 
1716 	LIST_REMOVE(lop, nfslo_list);
1717 	free(lop, M_NFSCLLOCK);
1718 	if (local)
1719 		nfsstatsv1.cllocallocks--;
1720 	else
1721 		nfsstatsv1.cllocks--;
1722 }
1723 
1724 /*
1725  * Clean out the state related to a delegation.
1726  */
1727 static void
1728 nfscl_cleandeleg(struct nfscldeleg *dp)
1729 {
1730 	struct nfsclowner *owp, *nowp;
1731 	struct nfsclopen *op;
1732 
1733 	LIST_FOREACH_SAFE(owp, &dp->nfsdl_owner, nfsow_list, nowp) {
1734 		op = LIST_FIRST(&owp->nfsow_open);
1735 		if (op != NULL) {
1736 			if (LIST_NEXT(op, nfso_list) != NULL)
1737 				panic("nfscleandel");
1738 			nfscl_freeopen(op, 1, true);
1739 		}
1740 		nfscl_freeopenowner(owp, 1);
1741 	}
1742 	nfscl_freealllocks(&dp->nfsdl_lock, 1);
1743 }
1744 
1745 /*
1746  * Free a delegation.
1747  */
1748 static void
1749 nfscl_freedeleg(struct nfscldeleghead *hdp, struct nfscldeleg *dp, bool freeit)
1750 {
1751 
1752 	TAILQ_REMOVE(hdp, dp, nfsdl_list);
1753 	LIST_REMOVE(dp, nfsdl_hash);
1754 	if (freeit)
1755 		free(dp, M_NFSCLDELEG);
1756 	nfsstatsv1.cldelegates--;
1757 	nfscl_delegcnt--;
1758 }
1759 
1760 /*
1761  * Free up all state related to this client structure.
1762  */
1763 static void
1764 nfscl_cleanclient(struct nfsclclient *clp)
1765 {
1766 	struct nfsclowner *owp, *nowp;
1767 	struct nfsclopen *op, *nop;
1768 	struct nfscllayout *lyp, *nlyp;
1769 	struct nfscldevinfo *dip, *ndip;
1770 
1771 	TAILQ_FOREACH_SAFE(lyp, &clp->nfsc_layout, nfsly_list, nlyp)
1772 		nfscl_freelayout(lyp);
1773 
1774 	LIST_FOREACH_SAFE(dip, &clp->nfsc_devinfo, nfsdi_list, ndip)
1775 		nfscl_freedevinfo(dip);
1776 
1777 	/* Now, all the OpenOwners, etc. */
1778 	LIST_FOREACH_SAFE(owp, &clp->nfsc_owner, nfsow_list, nowp) {
1779 		LIST_FOREACH_SAFE(op, &owp->nfsow_open, nfso_list, nop) {
1780 			nfscl_freeopen(op, 0, true);
1781 		}
1782 		nfscl_freeopenowner(owp, 0);
1783 	}
1784 }
1785 
1786 /*
1787  * Called when an NFSERR_EXPIRED is received from the server.
1788  */
1789 static void
1790 nfscl_expireclient(struct nfsclclient *clp, struct nfsmount *nmp,
1791     struct ucred *cred, NFSPROC_T *p)
1792 {
1793 	struct nfsclowner *owp, *nowp, *towp;
1794 	struct nfsclopen *op, *nop, *top;
1795 	struct nfscldeleg *dp, *ndp;
1796 	int ret, printed = 0;
1797 
1798 	/*
1799 	 * First, merge locally issued Opens into the list for the server.
1800 	 */
1801 	dp = TAILQ_FIRST(&clp->nfsc_deleg);
1802 	while (dp != NULL) {
1803 	    ndp = TAILQ_NEXT(dp, nfsdl_list);
1804 	    owp = LIST_FIRST(&dp->nfsdl_owner);
1805 	    while (owp != NULL) {
1806 		nowp = LIST_NEXT(owp, nfsow_list);
1807 		op = LIST_FIRST(&owp->nfsow_open);
1808 		if (op != NULL) {
1809 		    if (LIST_NEXT(op, nfso_list) != NULL)
1810 			panic("nfsclexp");
1811 		    LIST_FOREACH(towp, &clp->nfsc_owner, nfsow_list) {
1812 			if (!NFSBCMP(towp->nfsow_owner, owp->nfsow_owner,
1813 			    NFSV4CL_LOCKNAMELEN))
1814 			    break;
1815 		    }
1816 		    if (towp != NULL) {
1817 			/* Merge opens in */
1818 			LIST_FOREACH(top, &towp->nfsow_open, nfso_list) {
1819 			    if (top->nfso_fhlen == op->nfso_fhlen &&
1820 				!NFSBCMP(top->nfso_fh, op->nfso_fh,
1821 				 op->nfso_fhlen)) {
1822 				top->nfso_mode |= op->nfso_mode;
1823 				top->nfso_opencnt += op->nfso_opencnt;
1824 				break;
1825 			    }
1826 			}
1827 			if (top == NULL) {
1828 			    /* Just add the open to the owner list */
1829 			    LIST_REMOVE(op, nfso_list);
1830 			    op->nfso_own = towp;
1831 			    LIST_INSERT_HEAD(&towp->nfsow_open, op, nfso_list);
1832 			    LIST_INSERT_HEAD(NFSCLOPENHASH(clp, op->nfso_fh,
1833 				op->nfso_fhlen), op, nfso_hash);
1834 			    nfsstatsv1.cllocalopens--;
1835 			    nfsstatsv1.clopens++;
1836 			}
1837 		    } else {
1838 			/* Just add the openowner to the client list */
1839 			LIST_REMOVE(owp, nfsow_list);
1840 			owp->nfsow_clp = clp;
1841 			LIST_INSERT_HEAD(&clp->nfsc_owner, owp, nfsow_list);
1842 			LIST_INSERT_HEAD(NFSCLOPENHASH(clp, op->nfso_fh,
1843 			    op->nfso_fhlen), op, nfso_hash);
1844 			nfsstatsv1.cllocalopenowners--;
1845 			nfsstatsv1.clopenowners++;
1846 			nfsstatsv1.cllocalopens--;
1847 			nfsstatsv1.clopens++;
1848 		    }
1849 		}
1850 		owp = nowp;
1851 	    }
1852 	    if (!printed && !LIST_EMPTY(&dp->nfsdl_lock)) {
1853 		printed = 1;
1854 		printf("nfsv4 expired locks lost\n");
1855 	    }
1856 	    nfscl_cleandeleg(dp);
1857 	    nfscl_freedeleg(&clp->nfsc_deleg, dp, true);
1858 	    dp = ndp;
1859 	}
1860 	if (!TAILQ_EMPTY(&clp->nfsc_deleg))
1861 	    panic("nfsclexp");
1862 
1863 	/*
1864 	 * Now, try and reopen against the server.
1865 	 */
1866 	LIST_FOREACH_SAFE(owp, &clp->nfsc_owner, nfsow_list, nowp) {
1867 		owp->nfsow_seqid = 0;
1868 		LIST_FOREACH_SAFE(op, &owp->nfsow_open, nfso_list, nop) {
1869 			ret = nfscl_expireopen(clp, op, nmp, cred, p);
1870 			if (ret && !printed) {
1871 				printed = 1;
1872 				printf("nfsv4 expired locks lost\n");
1873 			}
1874 		}
1875 		if (LIST_EMPTY(&owp->nfsow_open))
1876 			nfscl_freeopenowner(owp, 0);
1877 	}
1878 }
1879 
1880 /*
1881  * This function must be called after the process represented by "own" has
1882  * exited. Must be called with CLSTATE lock held.
1883  */
1884 static void
1885 nfscl_cleanup_common(struct nfsclclient *clp, u_int8_t *own)
1886 {
1887 	struct nfsclowner *owp, *nowp;
1888 	struct nfscllockowner *lp;
1889 	struct nfscldeleg *dp;
1890 
1891 	/* First, get rid of local locks on delegations. */
1892 	TAILQ_FOREACH(dp, &clp->nfsc_deleg, nfsdl_list) {
1893 		LIST_FOREACH(lp, &dp->nfsdl_lock, nfsl_list) {
1894 		    if (!NFSBCMP(lp->nfsl_owner, own, NFSV4CL_LOCKNAMELEN)) {
1895 			if ((lp->nfsl_rwlock.nfslock_lock & NFSV4LOCK_WANTED))
1896 			    panic("nfscllckw");
1897 			nfscl_freelockowner(lp, 1);
1898 			break;
1899 		    }
1900 		}
1901 	}
1902 	owp = LIST_FIRST(&clp->nfsc_owner);
1903 	while (owp != NULL) {
1904 		nowp = LIST_NEXT(owp, nfsow_list);
1905 		if (!NFSBCMP(owp->nfsow_owner, own,
1906 		    NFSV4CL_LOCKNAMELEN)) {
1907 			/*
1908 			 * If there are children that haven't closed the
1909 			 * file descriptors yet, the opens will still be
1910 			 * here. For that case, let the renew thread clear
1911 			 * out the OpenOwner later.
1912 			 */
1913 			if (LIST_EMPTY(&owp->nfsow_open))
1914 				nfscl_freeopenowner(owp, 0);
1915 			else
1916 				owp->nfsow_defunct = 1;
1917 			break;
1918 		}
1919 		owp = nowp;
1920 	}
1921 }
1922 
1923 /*
1924  * Find open/lock owners for processes that have exited.
1925  */
1926 static void
1927 nfscl_cleanupkext(struct nfsclclient *clp, struct nfscllockownerfhhead *lhp)
1928 {
1929 	struct nfsclowner *owp, *nowp;
1930 	struct nfsclopen *op;
1931 	struct nfscllockowner *lp, *nlp;
1932 	struct nfscldeleg *dp;
1933 	uint8_t own[NFSV4CL_LOCKNAMELEN];
1934 
1935 	/*
1936 	 * All the pidhash locks must be acquired, since they are sx locks
1937 	 * and must be acquired before the mutexes.  The pid(s) that will
1938 	 * be used aren't known yet, so all the locks need to be acquired.
1939 	 * Fortunately, this function is only performed once/sec.
1940 	 */
1941 	pidhash_slockall();
1942 	NFSLOCKCLSTATE();
1943 	LIST_FOREACH_SAFE(owp, &clp->nfsc_owner, nfsow_list, nowp) {
1944 		LIST_FOREACH(op, &owp->nfsow_open, nfso_list) {
1945 			LIST_FOREACH_SAFE(lp, &op->nfso_lock, nfsl_list, nlp) {
1946 				if (LIST_EMPTY(&lp->nfsl_lock))
1947 					nfscl_emptylockowner(lp, lhp);
1948 			}
1949 		}
1950 		if (nfscl_procdoesntexist(owp->nfsow_owner)) {
1951 			memcpy(own, owp->nfsow_owner, NFSV4CL_LOCKNAMELEN);
1952 			nfscl_cleanup_common(clp, own);
1953 		}
1954 	}
1955 
1956 	/*
1957 	 * For the single open_owner case, these lock owners need to be
1958 	 * checked to see if they still exist separately.
1959 	 * This is because nfscl_procdoesntexist() never returns true for
1960 	 * the single open_owner so that the above doesn't ever call
1961 	 * nfscl_cleanup_common().
1962 	 */
1963 	TAILQ_FOREACH(dp, &clp->nfsc_deleg, nfsdl_list) {
1964 		LIST_FOREACH_SAFE(lp, &dp->nfsdl_lock, nfsl_list, nlp) {
1965 			if (nfscl_procdoesntexist(lp->nfsl_owner)) {
1966 				memcpy(own, lp->nfsl_owner,
1967 				    NFSV4CL_LOCKNAMELEN);
1968 				nfscl_cleanup_common(clp, own);
1969 			}
1970 		}
1971 	}
1972 	NFSUNLOCKCLSTATE();
1973 	pidhash_sunlockall();
1974 }
1975 
1976 /*
1977  * Take the empty lock owner and move it to the local lhp list if the
1978  * associated process no longer exists.
1979  */
1980 static void
1981 nfscl_emptylockowner(struct nfscllockowner *lp,
1982     struct nfscllockownerfhhead *lhp)
1983 {
1984 	struct nfscllockownerfh *lfhp, *mylfhp;
1985 	struct nfscllockowner *nlp;
1986 	int fnd_it;
1987 
1988 	/* If not a Posix lock owner, just return. */
1989 	if ((lp->nfsl_lockflags & F_POSIX) == 0)
1990 		return;
1991 
1992 	fnd_it = 0;
1993 	mylfhp = NULL;
1994 	/*
1995 	 * First, search to see if this lock owner is already in the list.
1996 	 * If it is, then the associated process no longer exists.
1997 	 */
1998 	SLIST_FOREACH(lfhp, lhp, nfslfh_list) {
1999 		if (lfhp->nfslfh_len == lp->nfsl_open->nfso_fhlen &&
2000 		    !NFSBCMP(lfhp->nfslfh_fh, lp->nfsl_open->nfso_fh,
2001 		    lfhp->nfslfh_len))
2002 			mylfhp = lfhp;
2003 		LIST_FOREACH(nlp, &lfhp->nfslfh_lock, nfsl_list)
2004 			if (!NFSBCMP(nlp->nfsl_owner, lp->nfsl_owner,
2005 			    NFSV4CL_LOCKNAMELEN))
2006 				fnd_it = 1;
2007 	}
2008 	/* If not found, check if process still exists. */
2009 	if (fnd_it == 0 && nfscl_procdoesntexist(lp->nfsl_owner) == 0)
2010 		return;
2011 
2012 	/* Move the lock owner over to the local list. */
2013 	if (mylfhp == NULL) {
2014 		mylfhp = malloc(sizeof(struct nfscllockownerfh), M_TEMP,
2015 		    M_NOWAIT);
2016 		if (mylfhp == NULL)
2017 			return;
2018 		mylfhp->nfslfh_len = lp->nfsl_open->nfso_fhlen;
2019 		NFSBCOPY(lp->nfsl_open->nfso_fh, mylfhp->nfslfh_fh,
2020 		    mylfhp->nfslfh_len);
2021 		LIST_INIT(&mylfhp->nfslfh_lock);
2022 		SLIST_INSERT_HEAD(lhp, mylfhp, nfslfh_list);
2023 	}
2024 	LIST_REMOVE(lp, nfsl_list);
2025 	LIST_INSERT_HEAD(&mylfhp->nfslfh_lock, lp, nfsl_list);
2026 }
2027 
2028 static int	fake_global;	/* Used to force visibility of MNTK_UNMOUNTF */
2029 /*
2030  * Called from nfs umount to free up the clientid.
2031  */
2032 void
2033 nfscl_umount(struct nfsmount *nmp, NFSPROC_T *p, struct nfscldeleghead *dhp)
2034 {
2035 	struct nfsclclient *clp;
2036 	struct ucred *cred;
2037 	int igotlock;
2038 
2039 	/*
2040 	 * For the case that matters, this is the thread that set
2041 	 * MNTK_UNMOUNTF, so it will see it set. The code that follows is
2042 	 * done to ensure that any thread executing nfscl_getcl() after
2043 	 * this time, will see MNTK_UNMOUNTF set. nfscl_getcl() uses the
2044 	 * mutex for NFSLOCKCLSTATE(), so it is "m" for the following
2045 	 * explanation, courtesy of Alan Cox.
2046 	 * What follows is a snippet from Alan Cox's email at:
2047 	 * https://docs.FreeBSD.org/cgi/mid.cgi?BANLkTikR3d65zPHo9==08ZfJ2vmqZucEvw
2048 	 *
2049 	 * 1. Set MNTK_UNMOUNTF
2050 	 * 2. Acquire a standard FreeBSD mutex "m".
2051 	 * 3. Update some data structures.
2052 	 * 4. Release mutex "m".
2053 	 *
2054 	 * Then, other threads that acquire "m" after step 4 has occurred will
2055 	 * see MNTK_UNMOUNTF as set.  But, other threads that beat thread X to
2056 	 * step 2 may or may not see MNTK_UNMOUNTF as set.
2057 	 */
2058 	NFSLOCKCLSTATE();
2059 	if ((nmp->nm_mountp->mnt_kern_flag & MNTK_UNMOUNTF) != 0) {
2060 		fake_global++;
2061 		NFSUNLOCKCLSTATE();
2062 		NFSLOCKCLSTATE();
2063 	}
2064 
2065 	clp = nmp->nm_clp;
2066 	if (clp != NULL) {
2067 		if ((clp->nfsc_flags & NFSCLFLAGS_INITED) == 0)
2068 			panic("nfscl umount");
2069 
2070 		/*
2071 		 * First, handshake with the nfscl renew thread, to terminate
2072 		 * it.
2073 		 */
2074 		clp->nfsc_flags |= NFSCLFLAGS_UMOUNT;
2075 		while (clp->nfsc_flags & NFSCLFLAGS_HASTHREAD)
2076 			(void)mtx_sleep(clp, NFSCLSTATEMUTEXPTR, PWAIT,
2077 			    "nfsclumnt", hz);
2078 
2079 		/*
2080 		 * Now, get the exclusive lock on the client state, so
2081 		 * that no uses of the state are still in progress.
2082 		 */
2083 		do {
2084 			igotlock = nfsv4_lock(&clp->nfsc_lock, 1, NULL,
2085 			    NFSCLSTATEMUTEXPTR, NULL);
2086 		} while (!igotlock);
2087 		NFSUNLOCKCLSTATE();
2088 
2089 		/*
2090 		 * Free up all the state. It will expire on the server, but
2091 		 * maybe we should do a SetClientId/SetClientIdConfirm so
2092 		 * the server throws it away?
2093 		 */
2094 		LIST_REMOVE(clp, nfsc_list);
2095 		nfscl_delegreturnall(clp, p, dhp);
2096 		cred = newnfs_getcred();
2097 		if (NFSHASNFSV4N(nmp)) {
2098 			nfsrpc_destroysession(nmp, NULL, cred, p);
2099 			nfsrpc_destroyclient(nmp, clp, cred, p);
2100 		} else
2101 			nfsrpc_setclient(nmp, clp, 0, NULL, cred, p);
2102 		nfscl_cleanclient(clp);
2103 		nmp->nm_clp = NULL;
2104 		NFSFREECRED(cred);
2105 		free(clp, M_NFSCLCLIENT);
2106 	} else
2107 		NFSUNLOCKCLSTATE();
2108 }
2109 
2110 /*
2111  * This function is called when a server replies with NFSERR_STALECLIENTID
2112  * NFSERR_STALESTATEID or NFSERR_BADSESSION. It traverses the clientid lists,
2113  * doing Opens and Locks with reclaim. If these fail, it deletes the
2114  * corresponding state.
2115  */
2116 static void
2117 nfscl_recover(struct nfsclclient *clp, bool *retokp, struct ucred *cred,
2118     NFSPROC_T *p)
2119 {
2120 	struct nfsclowner *owp, *nowp;
2121 	struct nfsclopen *op, *nop;
2122 	struct nfscllockowner *lp, *nlp;
2123 	struct nfscllock *lop, *nlop;
2124 	struct nfscldeleg *dp, *ndp, *tdp;
2125 	struct nfsmount *nmp;
2126 	struct ucred *tcred;
2127 	struct nfsclopenhead extra_open;
2128 	struct nfscldeleghead extra_deleg;
2129 	struct nfsreq *rep;
2130 	u_int64_t len;
2131 	u_int32_t delegtype = NFSV4OPEN_DELEGATEWRITE, mode;
2132 	int i, igotlock = 0, error, trycnt, firstlock;
2133 	struct nfscllayout *lyp, *nlyp;
2134 	bool recovered_one;
2135 
2136 	/*
2137 	 * First, lock the client structure, so everyone else will
2138 	 * block when trying to use state.
2139 	 */
2140 	NFSLOCKCLSTATE();
2141 	clp->nfsc_flags |= NFSCLFLAGS_RECVRINPROG;
2142 	do {
2143 		igotlock = nfsv4_lock(&clp->nfsc_lock, 1, NULL,
2144 		    NFSCLSTATEMUTEXPTR, NULL);
2145 	} while (!igotlock);
2146 	NFSUNLOCKCLSTATE();
2147 
2148 	nmp = clp->nfsc_nmp;
2149 	if (nmp == NULL)
2150 		panic("nfscl recover");
2151 
2152 	/*
2153 	 * For now, just get rid of all layouts. There may be a need
2154 	 * to do LayoutCommit Ops with reclaim == true later.
2155 	 */
2156 	TAILQ_FOREACH_SAFE(lyp, &clp->nfsc_layout, nfsly_list, nlyp)
2157 		nfscl_freelayout(lyp);
2158 	TAILQ_INIT(&clp->nfsc_layout);
2159 	for (i = 0; i < NFSCLLAYOUTHASHSIZE; i++)
2160 		LIST_INIT(&clp->nfsc_layouthash[i]);
2161 
2162 	trycnt = 5;
2163 	tcred = NULL;
2164 	do {
2165 		error = nfsrpc_setclient(nmp, clp, 1, retokp, cred, p);
2166 	} while ((error == NFSERR_STALECLIENTID ||
2167 	     error == NFSERR_BADSESSION ||
2168 	     error == NFSERR_STALEDONTRECOVER) && --trycnt > 0);
2169 	if (error) {
2170 		NFSLOCKCLSTATE();
2171 		clp->nfsc_flags &= ~(NFSCLFLAGS_RECOVER |
2172 		    NFSCLFLAGS_RECVRINPROG);
2173 		wakeup(&clp->nfsc_flags);
2174 		nfsv4_unlock(&clp->nfsc_lock, 0);
2175 		NFSUNLOCKCLSTATE();
2176 		return;
2177 	}
2178 	clp->nfsc_flags |= NFSCLFLAGS_HASCLIENTID;
2179 	clp->nfsc_flags &= ~NFSCLFLAGS_RECOVER;
2180 
2181 	/*
2182 	 * Mark requests already queued on the server, so that they don't
2183 	 * initiate another recovery cycle. Any requests already in the
2184 	 * queue that handle state information will have the old stale
2185 	 * clientid/stateid and will get a NFSERR_STALESTATEID,
2186 	 * NFSERR_STALECLIENTID or NFSERR_BADSESSION reply from the server.
2187 	 * This will be translated to NFSERR_STALEDONTRECOVER when
2188 	 * R_DONTRECOVER is set.
2189 	 */
2190 	NFSLOCKREQ();
2191 	TAILQ_FOREACH(rep, &nfsd_reqq, r_chain) {
2192 		if (rep->r_nmp == nmp)
2193 			rep->r_flags |= R_DONTRECOVER;
2194 	}
2195 	NFSUNLOCKREQ();
2196 
2197 	/*
2198 	 * If nfsrpc_setclient() returns *retokp == true,
2199 	 * no more recovery is needed.
2200 	 */
2201 	if (*retokp)
2202 		goto out;
2203 
2204 	/*
2205 	 * Now, mark all delegations "need reclaim".
2206 	 */
2207 	TAILQ_FOREACH(dp, &clp->nfsc_deleg, nfsdl_list)
2208 		dp->nfsdl_flags |= NFSCLDL_NEEDRECLAIM;
2209 
2210 	TAILQ_INIT(&extra_deleg);
2211 	LIST_INIT(&extra_open);
2212 	/*
2213 	 * Now traverse the state lists, doing Open and Lock Reclaims.
2214 	 */
2215 	tcred = newnfs_getcred();
2216 	recovered_one = false;
2217 	owp = LIST_FIRST(&clp->nfsc_owner);
2218 	while (owp != NULL) {
2219 	    nowp = LIST_NEXT(owp, nfsow_list);
2220 	    owp->nfsow_seqid = 0;
2221 	    op = LIST_FIRST(&owp->nfsow_open);
2222 	    while (op != NULL) {
2223 		nop = LIST_NEXT(op, nfso_list);
2224 		if (error != NFSERR_NOGRACE && error != NFSERR_BADSESSION) {
2225 		    /* Search for a delegation to reclaim with the open */
2226 		    TAILQ_FOREACH(dp, &clp->nfsc_deleg, nfsdl_list) {
2227 			if (!(dp->nfsdl_flags & NFSCLDL_NEEDRECLAIM))
2228 			    continue;
2229 			if ((dp->nfsdl_flags & NFSCLDL_WRITE)) {
2230 			    mode = NFSV4OPEN_ACCESSWRITE;
2231 			    delegtype = NFSV4OPEN_DELEGATEWRITE;
2232 			} else {
2233 			    mode = NFSV4OPEN_ACCESSREAD;
2234 			    delegtype = NFSV4OPEN_DELEGATEREAD;
2235 			}
2236 			if ((op->nfso_mode & mode) == mode &&
2237 			    op->nfso_fhlen == dp->nfsdl_fhlen &&
2238 			    !NFSBCMP(op->nfso_fh, dp->nfsdl_fh, op->nfso_fhlen))
2239 			    break;
2240 		    }
2241 		    ndp = dp;
2242 		    if (dp == NULL)
2243 			delegtype = NFSV4OPEN_DELEGATENONE;
2244 		    newnfs_copycred(&op->nfso_cred, tcred);
2245 		    error = nfscl_tryopen(nmp, NULL, op->nfso_fh,
2246 			op->nfso_fhlen, op->nfso_fh, op->nfso_fhlen,
2247 			op->nfso_mode, op, NULL, 0, &ndp, 1, delegtype,
2248 			tcred, p);
2249 		    if (!error) {
2250 			recovered_one = true;
2251 			/* Handle any replied delegation */
2252 			if (ndp != NULL && ((ndp->nfsdl_flags & NFSCLDL_WRITE)
2253 			    || NFSMNT_RDONLY(nmp->nm_mountp))) {
2254 			    if ((ndp->nfsdl_flags & NFSCLDL_WRITE))
2255 				mode = NFSV4OPEN_ACCESSWRITE;
2256 			    else
2257 				mode = NFSV4OPEN_ACCESSREAD;
2258 			    TAILQ_FOREACH(dp, &clp->nfsc_deleg, nfsdl_list) {
2259 				if (!(dp->nfsdl_flags & NFSCLDL_NEEDRECLAIM))
2260 				    continue;
2261 				if ((op->nfso_mode & mode) == mode &&
2262 				    op->nfso_fhlen == dp->nfsdl_fhlen &&
2263 				    !NFSBCMP(op->nfso_fh, dp->nfsdl_fh,
2264 				    op->nfso_fhlen)) {
2265 				    dp->nfsdl_stateid = ndp->nfsdl_stateid;
2266 				    dp->nfsdl_sizelimit = ndp->nfsdl_sizelimit;
2267 				    dp->nfsdl_ace = ndp->nfsdl_ace;
2268 				    dp->nfsdl_change = ndp->nfsdl_change;
2269 				    dp->nfsdl_flags &= ~NFSCLDL_NEEDRECLAIM;
2270 				    if ((ndp->nfsdl_flags & NFSCLDL_RECALL))
2271 					dp->nfsdl_flags |= NFSCLDL_RECALL;
2272 				    free(ndp, M_NFSCLDELEG);
2273 				    ndp = NULL;
2274 				    break;
2275 				}
2276 			    }
2277 			}
2278 			if (ndp != NULL)
2279 			    TAILQ_INSERT_HEAD(&extra_deleg, ndp, nfsdl_list);
2280 
2281 			/* and reclaim all byte range locks */
2282 			lp = LIST_FIRST(&op->nfso_lock);
2283 			while (lp != NULL) {
2284 			    nlp = LIST_NEXT(lp, nfsl_list);
2285 			    lp->nfsl_seqid = 0;
2286 			    firstlock = 1;
2287 			    lop = LIST_FIRST(&lp->nfsl_lock);
2288 			    while (lop != NULL) {
2289 				nlop = LIST_NEXT(lop, nfslo_list);
2290 				if (lop->nfslo_end == NFS64BITSSET)
2291 				    len = NFS64BITSSET;
2292 				else
2293 				    len = lop->nfslo_end - lop->nfslo_first;
2294 				error = nfscl_trylock(nmp, NULL,
2295 				    op->nfso_fh, op->nfso_fhlen, lp,
2296 				    firstlock, 1, lop->nfslo_first, len,
2297 				    lop->nfslo_type, tcred, p);
2298 				if (error != 0)
2299 				    nfscl_freelock(lop, 0);
2300 				else
2301 				    firstlock = 0;
2302 				lop = nlop;
2303 			    }
2304 			    /* If no locks, but a lockowner, just delete it. */
2305 			    if (LIST_EMPTY(&lp->nfsl_lock))
2306 				nfscl_freelockowner(lp, 0);
2307 			    lp = nlp;
2308 			}
2309 		    } else if (error == NFSERR_NOGRACE && !recovered_one &&
2310 			NFSHASNFSV4N(nmp)) {
2311 			/*
2312 			 * For NFSv4.1/4.2, the NFSERR_EXPIRED case will
2313 			 * actually end up here, since the client will do
2314 			 * a recovery for NFSERR_BADSESSION, but will get
2315 			 * an NFSERR_NOGRACE reply for the first "reclaim"
2316 			 * attempt.
2317 			 * So, call nfscl_expireclient() to recover the
2318 			 * opens as best we can and then do a reclaim
2319 			 * complete and return.
2320 			 */
2321 			nfsrpc_reclaimcomplete(nmp, cred, p);
2322 			nfscl_expireclient(clp, nmp, tcred, p);
2323 			goto out;
2324 		    }
2325 		}
2326 		if (error != 0 && error != NFSERR_BADSESSION)
2327 		    nfscl_freeopen(op, 0, true);
2328 		op = nop;
2329 	    }
2330 	    owp = nowp;
2331 	}
2332 
2333 	/*
2334 	 * Now, try and get any delegations not yet reclaimed by cobbling
2335 	 * to-gether an appropriate open.
2336 	 */
2337 	nowp = NULL;
2338 	dp = TAILQ_FIRST(&clp->nfsc_deleg);
2339 	while (dp != NULL) {
2340 	    ndp = TAILQ_NEXT(dp, nfsdl_list);
2341 	    if ((dp->nfsdl_flags & NFSCLDL_NEEDRECLAIM)) {
2342 		if (nowp == NULL) {
2343 		    nowp = malloc(
2344 			sizeof (struct nfsclowner), M_NFSCLOWNER, M_WAITOK);
2345 		    /*
2346 		     * Name must be as long an largest possible
2347 		     * NFSV4CL_LOCKNAMELEN. 12 for now.
2348 		     */
2349 		    NFSBCOPY("RECLAIMDELEG", nowp->nfsow_owner,
2350 			NFSV4CL_LOCKNAMELEN);
2351 		    LIST_INIT(&nowp->nfsow_open);
2352 		    nowp->nfsow_clp = clp;
2353 		    nowp->nfsow_seqid = 0;
2354 		    nowp->nfsow_defunct = 0;
2355 		    nfscl_lockinit(&nowp->nfsow_rwlock);
2356 		}
2357 		nop = NULL;
2358 		if (error != NFSERR_NOGRACE && error != NFSERR_BADSESSION) {
2359 		    nop = malloc(sizeof (struct nfsclopen) +
2360 			dp->nfsdl_fhlen - 1, M_NFSCLOPEN, M_WAITOK);
2361 		    nop->nfso_own = nowp;
2362 		    if ((dp->nfsdl_flags & NFSCLDL_WRITE)) {
2363 			nop->nfso_mode = NFSV4OPEN_ACCESSWRITE;
2364 			delegtype = NFSV4OPEN_DELEGATEWRITE;
2365 		    } else {
2366 			nop->nfso_mode = NFSV4OPEN_ACCESSREAD;
2367 			delegtype = NFSV4OPEN_DELEGATEREAD;
2368 		    }
2369 		    nop->nfso_opencnt = 0;
2370 		    nop->nfso_posixlock = 1;
2371 		    nop->nfso_fhlen = dp->nfsdl_fhlen;
2372 		    NFSBCOPY(dp->nfsdl_fh, nop->nfso_fh, dp->nfsdl_fhlen);
2373 		    LIST_INIT(&nop->nfso_lock);
2374 		    nop->nfso_stateid.seqid = 0;
2375 		    nop->nfso_stateid.other[0] = 0;
2376 		    nop->nfso_stateid.other[1] = 0;
2377 		    nop->nfso_stateid.other[2] = 0;
2378 		    newnfs_copycred(&dp->nfsdl_cred, tcred);
2379 		    newnfs_copyincred(tcred, &nop->nfso_cred);
2380 		    tdp = NULL;
2381 		    error = nfscl_tryopen(nmp, NULL, nop->nfso_fh,
2382 			nop->nfso_fhlen, nop->nfso_fh, nop->nfso_fhlen,
2383 			nop->nfso_mode, nop, NULL, 0, &tdp, 1,
2384 			delegtype, tcred, p);
2385 		    if (tdp != NULL) {
2386 			if ((tdp->nfsdl_flags & NFSCLDL_WRITE))
2387 			    mode = NFSV4OPEN_ACCESSWRITE;
2388 			else
2389 			    mode = NFSV4OPEN_ACCESSREAD;
2390 			if ((nop->nfso_mode & mode) == mode &&
2391 			    nop->nfso_fhlen == tdp->nfsdl_fhlen &&
2392 			    !NFSBCMP(nop->nfso_fh, tdp->nfsdl_fh,
2393 			    nop->nfso_fhlen)) {
2394 			    dp->nfsdl_stateid = tdp->nfsdl_stateid;
2395 			    dp->nfsdl_sizelimit = tdp->nfsdl_sizelimit;
2396 			    dp->nfsdl_ace = tdp->nfsdl_ace;
2397 			    dp->nfsdl_change = tdp->nfsdl_change;
2398 			    dp->nfsdl_flags &= ~NFSCLDL_NEEDRECLAIM;
2399 			    if ((tdp->nfsdl_flags & NFSCLDL_RECALL))
2400 				dp->nfsdl_flags |= NFSCLDL_RECALL;
2401 			    free(tdp, M_NFSCLDELEG);
2402 			} else {
2403 			    TAILQ_INSERT_HEAD(&extra_deleg, tdp, nfsdl_list);
2404 			}
2405 		    }
2406 		}
2407 		if (error) {
2408 		    if (nop != NULL)
2409 			free(nop, M_NFSCLOPEN);
2410 		    if (error == NFSERR_NOGRACE && !recovered_one &&
2411 			NFSHASNFSV4N(nmp)) {
2412 			/*
2413 			 * For NFSv4.1/4.2, the NFSERR_EXPIRED case will
2414 			 * actually end up here, since the client will do
2415 			 * a recovery for NFSERR_BADSESSION, but will get
2416 			 * an NFSERR_NOGRACE reply for the first "reclaim"
2417 			 * attempt.
2418 			 * So, call nfscl_expireclient() to recover the
2419 			 * opens as best we can and then do a reclaim
2420 			 * complete and return.
2421 			 */
2422 			nfsrpc_reclaimcomplete(nmp, cred, p);
2423 			nfscl_expireclient(clp, nmp, tcred, p);
2424 			free(nowp, M_NFSCLOWNER);
2425 			goto out;
2426 		    }
2427 		    /*
2428 		     * Couldn't reclaim it, so throw the state
2429 		     * away. Ouch!!
2430 		     */
2431 		    nfscl_cleandeleg(dp);
2432 		    nfscl_freedeleg(&clp->nfsc_deleg, dp, true);
2433 		} else {
2434 		    recovered_one = true;
2435 		    LIST_INSERT_HEAD(&extra_open, nop, nfso_list);
2436 		}
2437 	    }
2438 	    dp = ndp;
2439 	}
2440 
2441 	/*
2442 	 * Now, get rid of extra Opens and Delegations.
2443 	 */
2444 	LIST_FOREACH_SAFE(op, &extra_open, nfso_list, nop) {
2445 		do {
2446 			newnfs_copycred(&op->nfso_cred, tcred);
2447 			error = nfscl_tryclose(op, tcred, nmp, p, true);
2448 			if (error == NFSERR_GRACE)
2449 				(void) nfs_catnap(PZERO, error, "nfsexcls");
2450 		} while (error == NFSERR_GRACE);
2451 		LIST_REMOVE(op, nfso_list);
2452 		free(op, M_NFSCLOPEN);
2453 	}
2454 	if (nowp != NULL)
2455 		free(nowp, M_NFSCLOWNER);
2456 
2457 	TAILQ_FOREACH_SAFE(dp, &extra_deleg, nfsdl_list, ndp) {
2458 		do {
2459 			newnfs_copycred(&dp->nfsdl_cred, tcred);
2460 			error = nfscl_trydelegreturn(dp, tcred, nmp, p);
2461 			if (error == NFSERR_GRACE)
2462 				(void) nfs_catnap(PZERO, error, "nfsexdlg");
2463 		} while (error == NFSERR_GRACE);
2464 		TAILQ_REMOVE(&extra_deleg, dp, nfsdl_list);
2465 		free(dp, M_NFSCLDELEG);
2466 	}
2467 
2468 	/* For NFSv4.1 or later, do a RECLAIM_COMPLETE. */
2469 	if (NFSHASNFSV4N(nmp))
2470 		(void)nfsrpc_reclaimcomplete(nmp, cred, p);
2471 
2472 out:
2473 	NFSLOCKCLSTATE();
2474 	clp->nfsc_flags &= ~NFSCLFLAGS_RECVRINPROG;
2475 	wakeup(&clp->nfsc_flags);
2476 	nfsv4_unlock(&clp->nfsc_lock, 0);
2477 	NFSUNLOCKCLSTATE();
2478 	if (tcred != NULL)
2479 		NFSFREECRED(tcred);
2480 }
2481 
2482 /*
2483  * This function is called when a server replies with NFSERR_EXPIRED.
2484  * It deletes all state for the client and does a fresh SetClientId/confirm.
2485  * XXX Someday it should post a signal to the process(es) that hold the
2486  * state, so they know that lock state has been lost.
2487  */
2488 int
2489 nfscl_hasexpired(struct nfsclclient *clp, u_int32_t clidrev, NFSPROC_T *p)
2490 {
2491 	struct nfsmount *nmp;
2492 	struct ucred *cred;
2493 	int igotlock = 0, error, trycnt;
2494 
2495 	/*
2496 	 * If the clientid has gone away or a new SetClientid has already
2497 	 * been done, just return ok.
2498 	 */
2499 	if (clp == NULL || clidrev != clp->nfsc_clientidrev)
2500 		return (0);
2501 
2502 	/*
2503 	 * First, lock the client structure, so everyone else will
2504 	 * block when trying to use state. Also, use NFSCLFLAGS_EXPIREIT so
2505 	 * that only one thread does the work.
2506 	 */
2507 	NFSLOCKCLSTATE();
2508 	clp->nfsc_flags |= NFSCLFLAGS_EXPIREIT;
2509 	do {
2510 		igotlock = nfsv4_lock(&clp->nfsc_lock, 1, NULL,
2511 		    NFSCLSTATEMUTEXPTR, NULL);
2512 	} while (!igotlock && (clp->nfsc_flags & NFSCLFLAGS_EXPIREIT));
2513 	if ((clp->nfsc_flags & NFSCLFLAGS_EXPIREIT) == 0) {
2514 		if (igotlock)
2515 			nfsv4_unlock(&clp->nfsc_lock, 0);
2516 		NFSUNLOCKCLSTATE();
2517 		return (0);
2518 	}
2519 	clp->nfsc_flags |= NFSCLFLAGS_RECVRINPROG;
2520 	NFSUNLOCKCLSTATE();
2521 
2522 	nmp = clp->nfsc_nmp;
2523 	if (nmp == NULL)
2524 		panic("nfscl expired");
2525 	cred = newnfs_getcred();
2526 	trycnt = 5;
2527 	do {
2528 		error = nfsrpc_setclient(nmp, clp, 0, NULL, cred, p);
2529 	} while ((error == NFSERR_STALECLIENTID ||
2530 	     error == NFSERR_BADSESSION ||
2531 	     error == NFSERR_STALEDONTRECOVER) && --trycnt > 0);
2532 	if (error) {
2533 		NFSLOCKCLSTATE();
2534 		clp->nfsc_flags &= ~NFSCLFLAGS_RECOVER;
2535 	} else {
2536 		/*
2537 		 * Expire the state for the client.
2538 		 */
2539 		nfscl_expireclient(clp, nmp, cred, p);
2540 		NFSLOCKCLSTATE();
2541 		clp->nfsc_flags |= NFSCLFLAGS_HASCLIENTID;
2542 		clp->nfsc_flags &= ~NFSCLFLAGS_RECOVER;
2543 	}
2544 	clp->nfsc_flags &= ~(NFSCLFLAGS_EXPIREIT | NFSCLFLAGS_RECVRINPROG);
2545 	wakeup(&clp->nfsc_flags);
2546 	nfsv4_unlock(&clp->nfsc_lock, 0);
2547 	NFSUNLOCKCLSTATE();
2548 	NFSFREECRED(cred);
2549 	return (error);
2550 }
2551 
2552 /*
2553  * This function inserts a lock in the list after insert_lop.
2554  */
2555 static void
2556 nfscl_insertlock(struct nfscllockowner *lp, struct nfscllock *new_lop,
2557     struct nfscllock *insert_lop, int local)
2558 {
2559 
2560 	if ((struct nfscllockowner *)insert_lop == lp)
2561 		LIST_INSERT_HEAD(&lp->nfsl_lock, new_lop, nfslo_list);
2562 	else
2563 		LIST_INSERT_AFTER(insert_lop, new_lop, nfslo_list);
2564 	if (local)
2565 		nfsstatsv1.cllocallocks++;
2566 	else
2567 		nfsstatsv1.cllocks++;
2568 }
2569 
2570 /*
2571  * This function updates the locking for a lock owner and given file. It
2572  * maintains a list of lock ranges ordered on increasing file offset that
2573  * are NFSCLLOCK_READ or NFSCLLOCK_WRITE and non-overlapping (aka POSIX style).
2574  * It always adds new_lop to the list and sometimes uses the one pointed
2575  * at by other_lopp.
2576  * Returns 1 if the locks were modified, 0 otherwise.
2577  */
2578 static int
2579 nfscl_updatelock(struct nfscllockowner *lp, struct nfscllock **new_lopp,
2580     struct nfscllock **other_lopp, int local)
2581 {
2582 	struct nfscllock *new_lop = *new_lopp;
2583 	struct nfscllock *lop, *tlop, *ilop;
2584 	struct nfscllock *other_lop;
2585 	int unlock = 0, modified = 0;
2586 	u_int64_t tmp;
2587 
2588 	/*
2589 	 * Work down the list until the lock is merged.
2590 	 */
2591 	if (new_lop->nfslo_type == F_UNLCK)
2592 		unlock = 1;
2593 	ilop = (struct nfscllock *)lp;
2594 	lop = LIST_FIRST(&lp->nfsl_lock);
2595 	while (lop != NULL) {
2596 	    /*
2597 	     * Only check locks for this file that aren't before the start of
2598 	     * new lock's range.
2599 	     */
2600 	    if (lop->nfslo_end >= new_lop->nfslo_first) {
2601 		if (new_lop->nfslo_end < lop->nfslo_first) {
2602 		    /*
2603 		     * If the new lock ends before the start of the
2604 		     * current lock's range, no merge, just insert
2605 		     * the new lock.
2606 		     */
2607 		    break;
2608 		}
2609 		if (new_lop->nfslo_type == lop->nfslo_type ||
2610 		    (new_lop->nfslo_first <= lop->nfslo_first &&
2611 		     new_lop->nfslo_end >= lop->nfslo_end)) {
2612 		    /*
2613 		     * This lock can be absorbed by the new lock/unlock.
2614 		     * This happens when it covers the entire range
2615 		     * of the old lock or is contiguous
2616 		     * with the old lock and is of the same type or an
2617 		     * unlock.
2618 		     */
2619 		    if (new_lop->nfslo_type != lop->nfslo_type ||
2620 			new_lop->nfslo_first != lop->nfslo_first ||
2621 			new_lop->nfslo_end != lop->nfslo_end)
2622 			modified = 1;
2623 		    if (lop->nfslo_first < new_lop->nfslo_first)
2624 			new_lop->nfslo_first = lop->nfslo_first;
2625 		    if (lop->nfslo_end > new_lop->nfslo_end)
2626 			new_lop->nfslo_end = lop->nfslo_end;
2627 		    tlop = lop;
2628 		    lop = LIST_NEXT(lop, nfslo_list);
2629 		    nfscl_freelock(tlop, local);
2630 		    continue;
2631 		}
2632 
2633 		/*
2634 		 * All these cases are for contiguous locks that are not the
2635 		 * same type, so they can't be merged.
2636 		 */
2637 		if (new_lop->nfslo_first <= lop->nfslo_first) {
2638 		    /*
2639 		     * This case is where the new lock overlaps with the
2640 		     * first part of the old lock. Move the start of the
2641 		     * old lock to just past the end of the new lock. The
2642 		     * new lock will be inserted in front of the old, since
2643 		     * ilop hasn't been updated. (We are done now.)
2644 		     */
2645 		    if (lop->nfslo_first != new_lop->nfslo_end) {
2646 			lop->nfslo_first = new_lop->nfslo_end;
2647 			modified = 1;
2648 		    }
2649 		    break;
2650 		}
2651 		if (new_lop->nfslo_end >= lop->nfslo_end) {
2652 		    /*
2653 		     * This case is where the new lock overlaps with the
2654 		     * end of the old lock's range. Move the old lock's
2655 		     * end to just before the new lock's first and insert
2656 		     * the new lock after the old lock.
2657 		     * Might not be done yet, since the new lock could
2658 		     * overlap further locks with higher ranges.
2659 		     */
2660 		    if (lop->nfslo_end != new_lop->nfslo_first) {
2661 			lop->nfslo_end = new_lop->nfslo_first;
2662 			modified = 1;
2663 		    }
2664 		    ilop = lop;
2665 		    lop = LIST_NEXT(lop, nfslo_list);
2666 		    continue;
2667 		}
2668 		/*
2669 		 * The final case is where the new lock's range is in the
2670 		 * middle of the current lock's and splits the current lock
2671 		 * up. Use *other_lopp to handle the second part of the
2672 		 * split old lock range. (We are done now.)
2673 		 * For unlock, we use new_lop as other_lop and tmp, since
2674 		 * other_lop and new_lop are the same for this case.
2675 		 * We noted the unlock case above, so we don't need
2676 		 * new_lop->nfslo_type any longer.
2677 		 */
2678 		tmp = new_lop->nfslo_first;
2679 		if (unlock) {
2680 		    other_lop = new_lop;
2681 		    *new_lopp = NULL;
2682 		} else {
2683 		    other_lop = *other_lopp;
2684 		    *other_lopp = NULL;
2685 		}
2686 		other_lop->nfslo_first = new_lop->nfslo_end;
2687 		other_lop->nfslo_end = lop->nfslo_end;
2688 		other_lop->nfslo_type = lop->nfslo_type;
2689 		lop->nfslo_end = tmp;
2690 		nfscl_insertlock(lp, other_lop, lop, local);
2691 		ilop = lop;
2692 		modified = 1;
2693 		break;
2694 	    }
2695 	    ilop = lop;
2696 	    lop = LIST_NEXT(lop, nfslo_list);
2697 	    if (lop == NULL)
2698 		break;
2699 	}
2700 
2701 	/*
2702 	 * Insert the new lock in the list at the appropriate place.
2703 	 */
2704 	if (!unlock) {
2705 		nfscl_insertlock(lp, new_lop, ilop, local);
2706 		*new_lopp = NULL;
2707 		modified = 1;
2708 	}
2709 	return (modified);
2710 }
2711 
2712 /*
2713  * This function must be run as a kernel thread.
2714  * It does Renew Ops and recovery, when required.
2715  */
2716 void
2717 nfscl_renewthread(struct nfsclclient *clp, NFSPROC_T *p)
2718 {
2719 	struct nfsclowner *owp, *nowp;
2720 	struct nfsclopen *op;
2721 	struct nfscllockowner *lp, *nlp;
2722 	struct nfscldeleghead dh;
2723 	struct nfscldeleg *dp, *ndp;
2724 	struct ucred *cred;
2725 	u_int32_t clidrev;
2726 	int error, cbpathdown, islept, igotlock, ret, clearok;
2727 	uint32_t recover_done_time = 0;
2728 	time_t mytime;
2729 	static time_t prevsec = 0;
2730 	struct nfscllockownerfh *lfhp, *nlfhp;
2731 	struct nfscllockownerfhhead lfh;
2732 	struct nfscllayout *lyp, *nlyp;
2733 	struct nfscldevinfo *dip, *ndip;
2734 	struct nfscllayouthead rlh;
2735 	struct nfsclrecalllayout *recallp;
2736 	struct nfsclds *dsp;
2737 	bool retok;
2738 	struct mount *mp;
2739 	vnode_t vp;
2740 
2741 	cred = newnfs_getcred();
2742 	NFSLOCKCLSTATE();
2743 	clp->nfsc_flags |= NFSCLFLAGS_HASTHREAD;
2744 	mp = clp->nfsc_nmp->nm_mountp;
2745 	NFSUNLOCKCLSTATE();
2746 	for(;;) {
2747 		newnfs_setroot(cred);
2748 		cbpathdown = 0;
2749 		if (clp->nfsc_flags & NFSCLFLAGS_RECOVER) {
2750 			/*
2751 			 * Only allow one full recover within 1/2 of the lease
2752 			 * duration (nfsc_renew).
2753 			 * retok is value/result.  If passed in set to true,
2754 			 * it indicates only a CreateSession operation should
2755 			 * be attempted.
2756 			 * If it is returned true, it indicates that the
2757 			 * recovery only required a CreateSession.
2758 			 */
2759 			retok = true;
2760 			if (recover_done_time < NFSD_MONOSEC) {
2761 				recover_done_time = NFSD_MONOSEC +
2762 				    clp->nfsc_renew;
2763 				retok = false;
2764 			}
2765 			NFSCL_DEBUG(1, "Doing recovery, only "
2766 			    "createsession=%d\n", retok);
2767 			nfscl_recover(clp, &retok, cred, p);
2768 		}
2769 		if (clp->nfsc_expire <= NFSD_MONOSEC &&
2770 		    (clp->nfsc_flags & NFSCLFLAGS_HASCLIENTID)) {
2771 			clp->nfsc_expire = NFSD_MONOSEC + clp->nfsc_renew;
2772 			clidrev = clp->nfsc_clientidrev;
2773 			error = nfsrpc_renew(clp, NULL, cred, p);
2774 			if (error == NFSERR_CBPATHDOWN)
2775 			    cbpathdown = 1;
2776 			else if (error == NFSERR_STALECLIENTID) {
2777 			    NFSLOCKCLSTATE();
2778 			    clp->nfsc_flags |= NFSCLFLAGS_RECOVER;
2779 			    NFSUNLOCKCLSTATE();
2780 			} else if (error == NFSERR_EXPIRED)
2781 			    (void) nfscl_hasexpired(clp, clidrev, p);
2782 		}
2783 
2784 checkdsrenew:
2785 		if (NFSHASNFSV4N(clp->nfsc_nmp)) {
2786 			/* Do renews for any DS sessions. */
2787 			NFSLOCKMNT(clp->nfsc_nmp);
2788 			/* Skip first entry, since the MDS is handled above. */
2789 			dsp = TAILQ_FIRST(&clp->nfsc_nmp->nm_sess);
2790 			if (dsp != NULL)
2791 				dsp = TAILQ_NEXT(dsp, nfsclds_list);
2792 			while (dsp != NULL) {
2793 				if (dsp->nfsclds_expire <= NFSD_MONOSEC &&
2794 				    dsp->nfsclds_sess.nfsess_defunct == 0) {
2795 					dsp->nfsclds_expire = NFSD_MONOSEC +
2796 					    clp->nfsc_renew;
2797 					NFSUNLOCKMNT(clp->nfsc_nmp);
2798 					(void)nfsrpc_renew(clp, dsp, cred, p);
2799 					goto checkdsrenew;
2800 				}
2801 				dsp = TAILQ_NEXT(dsp, nfsclds_list);
2802 			}
2803 			NFSUNLOCKMNT(clp->nfsc_nmp);
2804 		}
2805 
2806 		TAILQ_INIT(&dh);
2807 		NFSLOCKCLSTATE();
2808 		if (cbpathdown)
2809 			/* It's a Total Recall! */
2810 			nfscl_totalrecall(clp);
2811 
2812 		/*
2813 		 * Now, handle defunct owners.
2814 		 */
2815 		LIST_FOREACH_SAFE(owp, &clp->nfsc_owner, nfsow_list, nowp) {
2816 			if (LIST_EMPTY(&owp->nfsow_open)) {
2817 				if (owp->nfsow_defunct != 0)
2818 					nfscl_freeopenowner(owp, 0);
2819 			}
2820 		}
2821 
2822 		/*
2823 		 * Do the recall on any delegations. To avoid trouble, always
2824 		 * come back up here after having slept.
2825 		 */
2826 		igotlock = 0;
2827 tryagain:
2828 		dp = TAILQ_FIRST(&clp->nfsc_deleg);
2829 		while (dp != NULL) {
2830 			ndp = TAILQ_NEXT(dp, nfsdl_list);
2831 			if ((dp->nfsdl_flags & NFSCLDL_RECALL)) {
2832 				/*
2833 				 * Wait for outstanding I/O ops to be done.
2834 				 */
2835 				if (dp->nfsdl_rwlock.nfslock_usecnt > 0) {
2836 				    if (igotlock) {
2837 					nfsv4_unlock(&clp->nfsc_lock, 0);
2838 					igotlock = 0;
2839 				    }
2840 				    dp->nfsdl_rwlock.nfslock_lock |=
2841 					NFSV4LOCK_WANTED;
2842 				    msleep(&dp->nfsdl_rwlock,
2843 					NFSCLSTATEMUTEXPTR, PVFS, "nfscld",
2844 					5 * hz);
2845 				    if (NFSCL_FORCEDISM(mp))
2846 					goto terminate;
2847 				    goto tryagain;
2848 				}
2849 				while (!igotlock) {
2850 				    igotlock = nfsv4_lock(&clp->nfsc_lock, 1,
2851 					&islept, NFSCLSTATEMUTEXPTR, mp);
2852 				    if (igotlock == 0 && NFSCL_FORCEDISM(mp))
2853 					goto terminate;
2854 				    if (islept)
2855 					goto tryagain;
2856 				}
2857 				NFSUNLOCKCLSTATE();
2858 				newnfs_copycred(&dp->nfsdl_cred, cred);
2859 				ret = nfscl_recalldeleg(clp, clp->nfsc_nmp, dp,
2860 				    NULL, cred, p, 1, &vp);
2861 				if (!ret) {
2862 				    nfscl_cleandeleg(dp);
2863 				    TAILQ_REMOVE(&clp->nfsc_deleg, dp,
2864 					nfsdl_list);
2865 				    LIST_REMOVE(dp, nfsdl_hash);
2866 				    TAILQ_INSERT_HEAD(&dh, dp, nfsdl_list);
2867 				    nfscl_delegcnt--;
2868 				    nfsstatsv1.cldelegates--;
2869 				}
2870 				NFSLOCKCLSTATE();
2871 				/*
2872 				 * The nfsc_lock must be released before doing
2873 				 * vrele(), since it might call nfs_inactive().
2874 				 * For the unlikely case where the vnode failed
2875 				 * to be acquired by nfscl_recalldeleg(), a
2876 				 * VOP_RECLAIM() should be in progress and it
2877 				 * will return the delegation.
2878 				 */
2879 				nfsv4_unlock(&clp->nfsc_lock, 0);
2880 				igotlock = 0;
2881 				if (vp != NULL) {
2882 					NFSUNLOCKCLSTATE();
2883 					vrele(vp);
2884 					NFSLOCKCLSTATE();
2885 				}
2886 				goto tryagain;
2887 			}
2888 			dp = ndp;
2889 		}
2890 
2891 		/*
2892 		 * Clear out old delegations, if we are above the high water
2893 		 * mark. Only clear out ones with no state related to them.
2894 		 * The tailq list is in LRU order.
2895 		 */
2896 		dp = TAILQ_LAST(&clp->nfsc_deleg, nfscldeleghead);
2897 		while (nfscl_delegcnt > nfscl_deleghighwater && dp != NULL) {
2898 		    ndp = TAILQ_PREV(dp, nfscldeleghead, nfsdl_list);
2899 		    if (dp->nfsdl_rwlock.nfslock_usecnt == 0 &&
2900 			dp->nfsdl_rwlock.nfslock_lock == 0 &&
2901 			dp->nfsdl_timestamp < NFSD_MONOSEC &&
2902 			(dp->nfsdl_flags & (NFSCLDL_RECALL | NFSCLDL_ZAPPED |
2903 			  NFSCLDL_NEEDRECLAIM | NFSCLDL_DELEGRET)) == 0) {
2904 			clearok = 1;
2905 			LIST_FOREACH(owp, &dp->nfsdl_owner, nfsow_list) {
2906 			    op = LIST_FIRST(&owp->nfsow_open);
2907 			    if (op != NULL) {
2908 				clearok = 0;
2909 				break;
2910 			    }
2911 			}
2912 			if (clearok) {
2913 			    LIST_FOREACH(lp, &dp->nfsdl_lock, nfsl_list) {
2914 				if (!LIST_EMPTY(&lp->nfsl_lock)) {
2915 				    clearok = 0;
2916 				    break;
2917 				}
2918 			    }
2919 			}
2920 			if (clearok) {
2921 			    TAILQ_REMOVE(&clp->nfsc_deleg, dp, nfsdl_list);
2922 			    LIST_REMOVE(dp, nfsdl_hash);
2923 			    TAILQ_INSERT_HEAD(&dh, dp, nfsdl_list);
2924 			    nfscl_delegcnt--;
2925 			    nfsstatsv1.cldelegates--;
2926 			}
2927 		    }
2928 		    dp = ndp;
2929 		}
2930 		if (igotlock)
2931 			nfsv4_unlock(&clp->nfsc_lock, 0);
2932 
2933 		/*
2934 		 * Do the recall on any layouts. To avoid trouble, always
2935 		 * come back up here after having slept.
2936 		 */
2937 		TAILQ_INIT(&rlh);
2938 tryagain2:
2939 		TAILQ_FOREACH_SAFE(lyp, &clp->nfsc_layout, nfsly_list, nlyp) {
2940 			if ((lyp->nfsly_flags & NFSLY_RECALL) != 0) {
2941 				/*
2942 				 * Wait for outstanding I/O ops to be done.
2943 				 */
2944 				if (lyp->nfsly_lock.nfslock_usecnt > 0 ||
2945 				    (lyp->nfsly_lock.nfslock_lock &
2946 				     NFSV4LOCK_LOCK) != 0) {
2947 					lyp->nfsly_lock.nfslock_lock |=
2948 					    NFSV4LOCK_WANTED;
2949 					msleep(&lyp->nfsly_lock.nfslock_lock,
2950 					    NFSCLSTATEMUTEXPTR, PVFS, "nfslyp",
2951 					    5 * hz);
2952 					if (NFSCL_FORCEDISM(mp))
2953 					    goto terminate;
2954 					goto tryagain2;
2955 				}
2956 				/* Move the layout to the recall list. */
2957 				TAILQ_REMOVE(&clp->nfsc_layout, lyp,
2958 				    nfsly_list);
2959 				LIST_REMOVE(lyp, nfsly_hash);
2960 				TAILQ_INSERT_HEAD(&rlh, lyp, nfsly_list);
2961 
2962 				/* Handle any layout commits. */
2963 				if (!NFSHASNOLAYOUTCOMMIT(clp->nfsc_nmp) &&
2964 				    (lyp->nfsly_flags & NFSLY_WRITTEN) != 0) {
2965 					lyp->nfsly_flags &= ~NFSLY_WRITTEN;
2966 					NFSUNLOCKCLSTATE();
2967 					NFSCL_DEBUG(3, "do layoutcommit\n");
2968 					nfscl_dolayoutcommit(clp->nfsc_nmp, lyp,
2969 					    cred, p);
2970 					NFSLOCKCLSTATE();
2971 					goto tryagain2;
2972 				}
2973 			}
2974 		}
2975 
2976 		/* Now, look for stale layouts. */
2977 		lyp = TAILQ_LAST(&clp->nfsc_layout, nfscllayouthead);
2978 		while (lyp != NULL) {
2979 			nlyp = TAILQ_PREV(lyp, nfscllayouthead, nfsly_list);
2980 			if (lyp->nfsly_timestamp < NFSD_MONOSEC &&
2981 			    (lyp->nfsly_flags & (NFSLY_RECALL |
2982 			     NFSLY_RETONCLOSE)) == 0 &&
2983 			    lyp->nfsly_lock.nfslock_usecnt == 0 &&
2984 			    lyp->nfsly_lock.nfslock_lock == 0) {
2985 				NFSCL_DEBUG(4, "ret stale lay=%d\n",
2986 				    nfscl_layoutcnt);
2987 				recallp = malloc(sizeof(*recallp),
2988 				    M_NFSLAYRECALL, M_NOWAIT);
2989 				if (recallp == NULL)
2990 					break;
2991 				(void)nfscl_layoutrecall(NFSLAYOUTRETURN_FILE,
2992 				    lyp, NFSLAYOUTIOMODE_ANY, 0, UINT64_MAX,
2993 				    lyp->nfsly_stateid.seqid, 0, 0, NULL,
2994 				    recallp);
2995 			}
2996 			lyp = nlyp;
2997 		}
2998 
2999 		/*
3000 		 * Free up any unreferenced device info structures.
3001 		 */
3002 		LIST_FOREACH_SAFE(dip, &clp->nfsc_devinfo, nfsdi_list, ndip) {
3003 			if (dip->nfsdi_layoutrefs == 0 &&
3004 			    dip->nfsdi_refcnt == 0) {
3005 				NFSCL_DEBUG(4, "freeing devinfo\n");
3006 				LIST_REMOVE(dip, nfsdi_list);
3007 				nfscl_freedevinfo(dip);
3008 			}
3009 		}
3010 		NFSUNLOCKCLSTATE();
3011 
3012 		/* Do layout return(s), as required. */
3013 		TAILQ_FOREACH_SAFE(lyp, &rlh, nfsly_list, nlyp) {
3014 			TAILQ_REMOVE(&rlh, lyp, nfsly_list);
3015 			NFSCL_DEBUG(4, "ret layout\n");
3016 			nfscl_layoutreturn(clp->nfsc_nmp, lyp, cred, p);
3017 			if ((lyp->nfsly_flags & NFSLY_RETONCLOSE) != 0) {
3018 				NFSLOCKCLSTATE();
3019 				lyp->nfsly_flags |= NFSLY_RETURNED;
3020 				wakeup(lyp);
3021 				NFSUNLOCKCLSTATE();
3022 			} else
3023 				nfscl_freelayout(lyp);
3024 		}
3025 
3026 		/*
3027 		 * Delegreturn any delegations cleaned out or recalled.
3028 		 */
3029 		TAILQ_FOREACH_SAFE(dp, &dh, nfsdl_list, ndp) {
3030 			newnfs_copycred(&dp->nfsdl_cred, cred);
3031 			(void) nfscl_trydelegreturn(dp, cred, clp->nfsc_nmp, p);
3032 			TAILQ_REMOVE(&dh, dp, nfsdl_list);
3033 			free(dp, M_NFSCLDELEG);
3034 		}
3035 
3036 		SLIST_INIT(&lfh);
3037 		/*
3038 		 * Call nfscl_cleanupkext() once per second to check for
3039 		 * open/lock owners where the process has exited.
3040 		 */
3041 		mytime = NFSD_MONOSEC;
3042 		if (prevsec != mytime) {
3043 			prevsec = mytime;
3044 			nfscl_cleanupkext(clp, &lfh);
3045 		}
3046 
3047 		/*
3048 		 * Do a ReleaseLockOwner for all lock owners where the
3049 		 * associated process no longer exists, as found by
3050 		 * nfscl_cleanupkext().
3051 		 */
3052 		newnfs_setroot(cred);
3053 		SLIST_FOREACH_SAFE(lfhp, &lfh, nfslfh_list, nlfhp) {
3054 			LIST_FOREACH_SAFE(lp, &lfhp->nfslfh_lock, nfsl_list,
3055 			    nlp) {
3056 				(void)nfsrpc_rellockown(clp->nfsc_nmp, lp,
3057 				    lfhp->nfslfh_fh, lfhp->nfslfh_len, cred,
3058 				    p);
3059 				nfscl_freelockowner(lp, 0);
3060 			}
3061 			free(lfhp, M_TEMP);
3062 		}
3063 		SLIST_INIT(&lfh);
3064 
3065 		NFSLOCKCLSTATE();
3066 		if ((clp->nfsc_flags & NFSCLFLAGS_RECOVER) == 0)
3067 			(void)mtx_sleep(clp, NFSCLSTATEMUTEXPTR, PWAIT, "nfscl",
3068 			    hz);
3069 terminate:
3070 		if (clp->nfsc_flags & NFSCLFLAGS_UMOUNT) {
3071 			clp->nfsc_flags &= ~NFSCLFLAGS_HASTHREAD;
3072 			NFSUNLOCKCLSTATE();
3073 			NFSFREECRED(cred);
3074 			wakeup((caddr_t)clp);
3075 			return;
3076 		}
3077 		NFSUNLOCKCLSTATE();
3078 	}
3079 }
3080 
3081 /*
3082  * Initiate state recovery. Called when NFSERR_STALECLIENTID,
3083  * NFSERR_STALESTATEID or NFSERR_BADSESSION is received.
3084  */
3085 void
3086 nfscl_initiate_recovery(struct nfsclclient *clp)
3087 {
3088 
3089 	if (clp == NULL)
3090 		return;
3091 	NFSLOCKCLSTATE();
3092 	clp->nfsc_flags |= NFSCLFLAGS_RECOVER;
3093 	NFSUNLOCKCLSTATE();
3094 	wakeup((caddr_t)clp);
3095 }
3096 
3097 /*
3098  * Dump out the state stuff for debugging.
3099  */
3100 void
3101 nfscl_dumpstate(struct nfsmount *nmp, int openowner, int opens,
3102     int lockowner, int locks)
3103 {
3104 	struct nfsclclient *clp;
3105 	struct nfsclowner *owp;
3106 	struct nfsclopen *op;
3107 	struct nfscllockowner *lp;
3108 	struct nfscllock *lop;
3109 	struct nfscldeleg *dp;
3110 
3111 	clp = nmp->nm_clp;
3112 	if (clp == NULL) {
3113 		printf("nfscl dumpstate NULL clp\n");
3114 		return;
3115 	}
3116 	NFSLOCKCLSTATE();
3117 	TAILQ_FOREACH(dp, &clp->nfsc_deleg, nfsdl_list) {
3118 	  LIST_FOREACH(owp, &dp->nfsdl_owner, nfsow_list) {
3119 	    if (openowner && !LIST_EMPTY(&owp->nfsow_open))
3120 		printf("owner=0x%x 0x%x 0x%x 0x%x seqid=%d\n",
3121 		    owp->nfsow_owner[0], owp->nfsow_owner[1],
3122 		    owp->nfsow_owner[2], owp->nfsow_owner[3],
3123 		    owp->nfsow_seqid);
3124 	    LIST_FOREACH(op, &owp->nfsow_open, nfso_list) {
3125 		if (opens)
3126 		    printf("open st=0x%x 0x%x 0x%x cnt=%d fh12=0x%x\n",
3127 			op->nfso_stateid.other[0], op->nfso_stateid.other[1],
3128 			op->nfso_stateid.other[2], op->nfso_opencnt,
3129 			op->nfso_fh[12]);
3130 		LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
3131 		    if (lockowner)
3132 			printf("lckown=0x%x 0x%x 0x%x 0x%x seqid=%d st=0x%x 0x%x 0x%x\n",
3133 			    lp->nfsl_owner[0], lp->nfsl_owner[1],
3134 			    lp->nfsl_owner[2], lp->nfsl_owner[3],
3135 			    lp->nfsl_seqid,
3136 			    lp->nfsl_stateid.other[0], lp->nfsl_stateid.other[1],
3137 			    lp->nfsl_stateid.other[2]);
3138 		    LIST_FOREACH(lop, &lp->nfsl_lock, nfslo_list) {
3139 			if (locks)
3140 #ifdef __FreeBSD__
3141 			    printf("lck typ=%d fst=%ju end=%ju\n",
3142 				lop->nfslo_type, (intmax_t)lop->nfslo_first,
3143 				(intmax_t)lop->nfslo_end);
3144 #else
3145 			    printf("lck typ=%d fst=%qd end=%qd\n",
3146 				lop->nfslo_type, lop->nfslo_first,
3147 				lop->nfslo_end);
3148 #endif
3149 		    }
3150 		}
3151 	    }
3152 	  }
3153 	}
3154 	LIST_FOREACH(owp, &clp->nfsc_owner, nfsow_list) {
3155 	    if (openowner && !LIST_EMPTY(&owp->nfsow_open))
3156 		printf("owner=0x%x 0x%x 0x%x 0x%x seqid=%d\n",
3157 		    owp->nfsow_owner[0], owp->nfsow_owner[1],
3158 		    owp->nfsow_owner[2], owp->nfsow_owner[3],
3159 		    owp->nfsow_seqid);
3160 	    LIST_FOREACH(op, &owp->nfsow_open, nfso_list) {
3161 		if (opens)
3162 		    printf("open st=0x%x 0x%x 0x%x cnt=%d fh12=0x%x\n",
3163 			op->nfso_stateid.other[0], op->nfso_stateid.other[1],
3164 			op->nfso_stateid.other[2], op->nfso_opencnt,
3165 			op->nfso_fh[12]);
3166 		LIST_FOREACH(lp, &op->nfso_lock, nfsl_list) {
3167 		    if (lockowner)
3168 			printf("lckown=0x%x 0x%x 0x%x 0x%x seqid=%d st=0x%x 0x%x 0x%x\n",
3169 			    lp->nfsl_owner[0], lp->nfsl_owner[1],
3170 			    lp->nfsl_owner[2], lp->nfsl_owner[3],
3171 			    lp->nfsl_seqid,
3172 			    lp->nfsl_stateid.other[0], lp->nfsl_stateid.other[1],
3173 			    lp->nfsl_stateid.other[2]);
3174 		    LIST_FOREACH(lop, &lp->nfsl_lock, nfslo_list) {
3175 			if (locks)
3176 #ifdef __FreeBSD__
3177 			    printf("lck typ=%d fst=%ju end=%ju\n",
3178 				lop->nfslo_type, (intmax_t)lop->nfslo_first,
3179 				(intmax_t)lop->nfslo_end);
3180 #else
3181 			    printf("lck typ=%d fst=%qd end=%qd\n",
3182 				lop->nfslo_type, lop->nfslo_first,
3183 				lop->nfslo_end);
3184 #endif
3185 		    }
3186 		}
3187 	    }
3188 	}
3189 	NFSUNLOCKCLSTATE();
3190 }
3191 
3192 /*
3193  * Check for duplicate open owners and opens.
3194  * (Only used as a diagnostic aid.)
3195  */
3196 void
3197 nfscl_dupopen(vnode_t vp, int dupopens)
3198 {
3199 	struct nfsclclient *clp;
3200 	struct nfsclowner *owp, *owp2;
3201 	struct nfsclopen *op, *op2;
3202 	struct nfsfh *nfhp;
3203 
3204 	clp = VFSTONFS(vp->v_mount)->nm_clp;
3205 	if (clp == NULL) {
3206 		printf("nfscl dupopen NULL clp\n");
3207 		return;
3208 	}
3209 	nfhp = VTONFS(vp)->n_fhp;
3210 	NFSLOCKCLSTATE();
3211 
3212 	/*
3213 	 * First, search for duplicate owners.
3214 	 * These should never happen!
3215 	 */
3216 	LIST_FOREACH(owp2, &clp->nfsc_owner, nfsow_list) {
3217 	    LIST_FOREACH(owp, &clp->nfsc_owner, nfsow_list) {
3218 		if (owp != owp2 &&
3219 		    !NFSBCMP(owp->nfsow_owner, owp2->nfsow_owner,
3220 		    NFSV4CL_LOCKNAMELEN)) {
3221 			NFSUNLOCKCLSTATE();
3222 			printf("DUP OWNER\n");
3223 			nfscl_dumpstate(VFSTONFS(vp->v_mount), 1, 1, 0, 0);
3224 			return;
3225 		}
3226 	    }
3227 	}
3228 
3229 	/*
3230 	 * Now, search for duplicate stateids.
3231 	 * These shouldn't happen, either.
3232 	 */
3233 	LIST_FOREACH(owp2, &clp->nfsc_owner, nfsow_list) {
3234 	    LIST_FOREACH(op2, &owp2->nfsow_open, nfso_list) {
3235 		LIST_FOREACH(owp, &clp->nfsc_owner, nfsow_list) {
3236 		    LIST_FOREACH(op, &owp->nfsow_open, nfso_list) {
3237 			if (op != op2 &&
3238 			    (op->nfso_stateid.other[0] != 0 ||
3239 			     op->nfso_stateid.other[1] != 0 ||
3240 			     op->nfso_stateid.other[2] != 0) &&
3241 			    op->nfso_stateid.other[0] == op2->nfso_stateid.other[0] &&
3242 			    op->nfso_stateid.other[1] == op2->nfso_stateid.other[1] &&
3243 			    op->nfso_stateid.other[2] == op2->nfso_stateid.other[2]) {
3244 			    NFSUNLOCKCLSTATE();
3245 			    printf("DUP STATEID\n");
3246 			    nfscl_dumpstate(VFSTONFS(vp->v_mount), 1, 1, 0, 0);
3247 			    return;
3248 			}
3249 		    }
3250 		}
3251 	    }
3252 	}
3253 
3254 	/*
3255 	 * Now search for duplicate opens.
3256 	 * Duplicate opens for the same owner
3257 	 * should never occur. Other duplicates are
3258 	 * possible and are checked for if "dupopens"
3259 	 * is true.
3260 	 */
3261 	LIST_FOREACH(owp2, &clp->nfsc_owner, nfsow_list) {
3262 	    LIST_FOREACH(op2, &owp2->nfsow_open, nfso_list) {
3263 		if (nfhp->nfh_len == op2->nfso_fhlen &&
3264 		    !NFSBCMP(nfhp->nfh_fh, op2->nfso_fh, nfhp->nfh_len)) {
3265 		    LIST_FOREACH(owp, &clp->nfsc_owner, nfsow_list) {
3266 			LIST_FOREACH(op, &owp->nfsow_open, nfso_list) {
3267 			    if (op != op2 && nfhp->nfh_len == op->nfso_fhlen &&
3268 				!NFSBCMP(nfhp->nfh_fh, op->nfso_fh, nfhp->nfh_len) &&
3269 				(!NFSBCMP(op->nfso_own->nfsow_owner,
3270 				 op2->nfso_own->nfsow_owner, NFSV4CL_LOCKNAMELEN) ||
3271 				 dupopens)) {
3272 				if (!NFSBCMP(op->nfso_own->nfsow_owner,
3273 				    op2->nfso_own->nfsow_owner, NFSV4CL_LOCKNAMELEN)) {
3274 				    NFSUNLOCKCLSTATE();
3275 				    printf("BADDUP OPEN\n");
3276 				} else {
3277 				    NFSUNLOCKCLSTATE();
3278 				    printf("DUP OPEN\n");
3279 				}
3280 				nfscl_dumpstate(VFSTONFS(vp->v_mount), 1, 1, 0,
3281 				    0);
3282 				return;
3283 			    }
3284 			}
3285 		    }
3286 		}
3287 	    }
3288 	}
3289 	NFSUNLOCKCLSTATE();
3290 }
3291 
3292 /*
3293  * During close, find an open that needs to be dereferenced and
3294  * dereference it. If there are no more opens for this file,
3295  * log a message to that effect.
3296  * Opens aren't actually Close'd until VOP_INACTIVE() is performed
3297  * on the file's vnode.
3298  * This is the safe way, since it is difficult to identify
3299  * which open the close is for and I/O can be performed after the
3300  * close(2) system call when a file is mmap'd.
3301  * If it returns 0 for success, there will be a referenced
3302  * clp returned via clpp.
3303  */
3304 int
3305 nfscl_getclose(vnode_t vp, struct nfsclclient **clpp)
3306 {
3307 	struct nfsclclient *clp;
3308 	struct nfsclowner *owp;
3309 	struct nfsclopen *op;
3310 	struct nfscldeleg *dp;
3311 	struct nfsfh *nfhp;
3312 	int error, notdecr;
3313 
3314 	error = nfscl_getcl(vp->v_mount, NULL, NULL, false, true, &clp);
3315 	if (error)
3316 		return (error);
3317 	*clpp = clp;
3318 
3319 	nfhp = VTONFS(vp)->n_fhp;
3320 	notdecr = 1;
3321 	NFSLOCKCLSTATE();
3322 	/*
3323 	 * First, look for one under a delegation that was locally issued
3324 	 * and just decrement the opencnt for it. Since all my Opens against
3325 	 * the server are DENY_NONE, I don't see a problem with hanging
3326 	 * onto them. (It is much easier to use one of the extant Opens
3327 	 * that I already have on the server when a Delegation is recalled
3328 	 * than to do fresh Opens.) Someday, I might need to rethink this, but.
3329 	 */
3330 	dp = nfscl_finddeleg(clp, nfhp->nfh_fh, nfhp->nfh_len);
3331 	if (dp != NULL) {
3332 		LIST_FOREACH(owp, &dp->nfsdl_owner, nfsow_list) {
3333 			op = LIST_FIRST(&owp->nfsow_open);
3334 			if (op != NULL) {
3335 				/*
3336 				 * Since a delegation is for a file, there
3337 				 * should never be more than one open for
3338 				 * each openowner.
3339 				 */
3340 				if (LIST_NEXT(op, nfso_list) != NULL)
3341 					panic("nfscdeleg opens");
3342 				if (notdecr && op->nfso_opencnt > 0) {
3343 					notdecr = 0;
3344 					op->nfso_opencnt--;
3345 					break;
3346 				}
3347 			}
3348 		}
3349 	}
3350 
3351 	/* Now process the opens against the server. */
3352 	LIST_FOREACH(op, NFSCLOPENHASH(clp, nfhp->nfh_fh, nfhp->nfh_len),
3353 	    nfso_hash) {
3354 		if (op->nfso_fhlen == nfhp->nfh_len &&
3355 		    !NFSBCMP(op->nfso_fh, nfhp->nfh_fh,
3356 		    nfhp->nfh_len)) {
3357 			/* Found an open, decrement cnt if possible */
3358 			if (notdecr && op->nfso_opencnt > 0) {
3359 				notdecr = 0;
3360 				op->nfso_opencnt--;
3361 			}
3362 			/*
3363 			 * There are more opens, so just return.
3364 			 */
3365 			if (op->nfso_opencnt > 0) {
3366 				NFSUNLOCKCLSTATE();
3367 				return (0);
3368 			}
3369 		}
3370 	}
3371 	NFSUNLOCKCLSTATE();
3372 	if (notdecr)
3373 		printf("nfscl: never fnd open\n");
3374 	return (0);
3375 }
3376 
3377 int
3378 nfscl_doclose(vnode_t vp, struct nfsclclient **clpp, NFSPROC_T *p)
3379 {
3380 	struct nfsclclient *clp;
3381 	struct nfsmount *nmp;
3382 	struct nfsclowner *owp, *nowp;
3383 	struct nfsclopen *op, *nop;
3384 	struct nfsclopenhead delayed;
3385 	struct nfscldeleg *dp;
3386 	struct nfsfh *nfhp;
3387 	struct nfsclrecalllayout *recallp;
3388 	struct nfscllayout *lyp;
3389 	int error;
3390 
3391 	error = nfscl_getcl(vp->v_mount, NULL, NULL, false, true, &clp);
3392 	if (error)
3393 		return (error);
3394 	*clpp = clp;
3395 
3396 	nmp = VFSTONFS(vp->v_mount);
3397 	nfhp = VTONFS(vp)->n_fhp;
3398 	recallp = malloc(sizeof(*recallp), M_NFSLAYRECALL, M_WAITOK);
3399 	NFSLOCKCLSTATE();
3400 	/*
3401 	 * First get rid of the local Open structures, which should be no
3402 	 * longer in use.
3403 	 */
3404 	dp = nfscl_finddeleg(clp, nfhp->nfh_fh, nfhp->nfh_len);
3405 	if (dp != NULL) {
3406 		LIST_FOREACH_SAFE(owp, &dp->nfsdl_owner, nfsow_list, nowp) {
3407 			op = LIST_FIRST(&owp->nfsow_open);
3408 			if (op != NULL) {
3409 				KASSERT((op->nfso_opencnt == 0),
3410 				    ("nfscl: bad open cnt on deleg"));
3411 				nfscl_freeopen(op, 1, true);
3412 			}
3413 			nfscl_freeopenowner(owp, 1);
3414 		}
3415 	}
3416 
3417 	/* Return any layouts marked return on close. */
3418 	nfscl_retoncloselayout(vp, clp, nfhp->nfh_fh, nfhp->nfh_len, &recallp,
3419 	    &lyp);
3420 
3421 	/* Now process the opens against the server. */
3422 	LIST_INIT(&delayed);
3423 lookformore:
3424 	LIST_FOREACH(op, NFSCLOPENHASH(clp, nfhp->nfh_fh, nfhp->nfh_len),
3425 	    nfso_hash) {
3426 		if (op->nfso_fhlen == nfhp->nfh_len &&
3427 		    !NFSBCMP(op->nfso_fh, nfhp->nfh_fh,
3428 		    nfhp->nfh_len)) {
3429 			/* Found an open, close it. */
3430 #ifdef DIAGNOSTIC
3431 			KASSERT((op->nfso_opencnt == 0),
3432 			    ("nfscl: bad open cnt on server (%d)",
3433 			     op->nfso_opencnt));
3434 #endif
3435 			NFSUNLOCKCLSTATE();
3436 			if (NFSHASNFSV4N(nmp))
3437 				error = nfsrpc_doclose(nmp, op, p, false, true);
3438 			else
3439 				error = nfsrpc_doclose(nmp, op, p, true, true);
3440 			NFSLOCKCLSTATE();
3441 			if (error == NFSERR_DELAY) {
3442 				nfscl_unlinkopen(op);
3443 				op->nfso_own = NULL;
3444 				LIST_INSERT_HEAD(&delayed, op, nfso_list);
3445 			}
3446 			goto lookformore;
3447 		}
3448 	}
3449 	nfscl_clrelease(clp);
3450 
3451 	/* Now, wait for any layout that is returned upon close. */
3452 	if (lyp != NULL) {
3453 		while ((lyp->nfsly_flags & NFSLY_RETURNED) == 0) {
3454 			if (NFSCL_FORCEDISM(nmp->nm_mountp)) {
3455 				lyp = NULL;
3456 				break;
3457 			}
3458 			msleep(lyp, NFSCLSTATEMUTEXPTR, PZERO, "nfslroc", hz);
3459 		}
3460 		if (lyp != NULL)
3461 			nfscl_freelayout(lyp);
3462 	}
3463 
3464 	NFSUNLOCKCLSTATE();
3465 	/*
3466 	 * recallp has been set NULL by nfscl_retoncloselayout() if it was
3467 	 * used by the function, but calling free() with a NULL pointer is ok.
3468 	 */
3469 	free(recallp, M_NFSLAYRECALL);
3470 
3471 	/* Now, loop retrying the delayed closes. */
3472 	LIST_FOREACH_SAFE(op, &delayed, nfso_list, nop) {
3473 		nfsrpc_doclose(nmp, op, p, true, false);
3474 		LIST_REMOVE(op, nfso_list);
3475 		nfscl_freeopen(op, 0, false);
3476 	}
3477 	return (0);
3478 }
3479 
3480 /*
3481  * Return all delegations on this client.
3482  * (Must be called with client sleep lock.)
3483  */
3484 static void
3485 nfscl_delegreturnall(struct nfsclclient *clp, NFSPROC_T *p,
3486     struct nfscldeleghead *dhp)
3487 {
3488 	struct nfscldeleg *dp, *ndp;
3489 	struct ucred *cred;
3490 
3491 	cred = newnfs_getcred();
3492 	TAILQ_FOREACH_SAFE(dp, &clp->nfsc_deleg, nfsdl_list, ndp) {
3493 		nfscl_cleandeleg(dp);
3494 		(void) nfscl_trydelegreturn(dp, cred, clp->nfsc_nmp, p);
3495 		if (dhp != NULL) {
3496 			nfscl_freedeleg(&clp->nfsc_deleg, dp, false);
3497 			TAILQ_INSERT_HEAD(dhp, dp, nfsdl_list);
3498 		} else
3499 			nfscl_freedeleg(&clp->nfsc_deleg, dp, true);
3500 	}
3501 	NFSFREECRED(cred);
3502 }
3503 
3504 /*
3505  * Return any delegation for this vp.
3506  */
3507 void
3508 nfscl_delegreturnvp(vnode_t vp, NFSPROC_T *p)
3509 {
3510 	struct nfsclclient *clp;
3511 	struct nfscldeleg *dp;
3512 	struct ucred *cred;
3513 	struct nfsnode *np;
3514 	struct nfsmount *nmp;
3515 
3516 	nmp = VFSTONFS(vp->v_mount);
3517 	NFSLOCKMNT(nmp);
3518 	if ((nmp->nm_privflag & NFSMNTP_DELEGISSUED) == 0) {
3519 		NFSUNLOCKMNT(nmp);
3520 		return;
3521 	}
3522 	NFSUNLOCKMNT(nmp);
3523 	np = VTONFS(vp);
3524 	cred = newnfs_getcred();
3525 	dp = NULL;
3526 	NFSLOCKCLSTATE();
3527 	clp = nmp->nm_clp;
3528 	if (clp != NULL)
3529 		dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh,
3530 		    np->n_fhp->nfh_len);
3531 	if (dp != NULL) {
3532 		nfscl_cleandeleg(dp);
3533 		nfscl_freedeleg(&clp->nfsc_deleg, dp, false);
3534 		NFSUNLOCKCLSTATE();
3535 		newnfs_copycred(&dp->nfsdl_cred, cred);
3536 		nfscl_trydelegreturn(dp, cred, clp->nfsc_nmp, p);
3537 		free(dp, M_NFSCLDELEG);
3538 	} else
3539 		NFSUNLOCKCLSTATE();
3540 	NFSFREECRED(cred);
3541 }
3542 
3543 /*
3544  * Do a callback RPC.
3545  */
3546 void
3547 nfscl_docb(struct nfsrv_descript *nd, NFSPROC_T *p)
3548 {
3549 	int clist, gotseq_ok, i, j, k, op, rcalls;
3550 	u_int32_t *tl;
3551 	struct nfsclclient *clp;
3552 	struct nfscldeleg *dp = NULL;
3553 	int numops, taglen = -1, error = 0, trunc __unused;
3554 	u_int32_t minorvers = 0, retops = 0, *retopsp = NULL, *repp, cbident;
3555 	u_char tag[NFSV4_SMALLSTR + 1], *tagstr;
3556 	vnode_t vp = NULL;
3557 	struct nfsnode *np;
3558 	struct vattr va;
3559 	struct nfsfh *nfhp;
3560 	mount_t mp;
3561 	nfsattrbit_t attrbits, rattrbits;
3562 	nfsv4stateid_t stateid;
3563 	uint32_t seqid, slotid = 0, highslot, cachethis __unused;
3564 	uint8_t sessionid[NFSX_V4SESSIONID];
3565 	struct mbuf *rep;
3566 	struct nfscllayout *lyp;
3567 	uint64_t filesid[2], len, off;
3568 	int changed, gotone, laytype, recalltype;
3569 	uint32_t iomode;
3570 	struct nfsclrecalllayout *recallp = NULL;
3571 	struct nfsclsession *tsep;
3572 
3573 	gotseq_ok = 0;
3574 	nfsrvd_rephead(nd);
3575 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3576 	taglen = fxdr_unsigned(int, *tl);
3577 	if (taglen < 0 || taglen > NFSV4_OPAQUELIMIT) {
3578 		error = EBADRPC;
3579 		taglen = -1;
3580 		goto nfsmout;
3581 	}
3582 	if (taglen <= NFSV4_SMALLSTR)
3583 		tagstr = tag;
3584 	else
3585 		tagstr = malloc(taglen + 1, M_TEMP, M_WAITOK);
3586 	error = nfsrv_mtostr(nd, tagstr, taglen);
3587 	if (error) {
3588 		if (taglen > NFSV4_SMALLSTR)
3589 			free(tagstr, M_TEMP);
3590 		taglen = -1;
3591 		goto nfsmout;
3592 	}
3593 	(void) nfsm_strtom(nd, tag, taglen);
3594 	if (taglen > NFSV4_SMALLSTR) {
3595 		free(tagstr, M_TEMP);
3596 	}
3597 	NFSM_BUILD(retopsp, u_int32_t *, NFSX_UNSIGNED);
3598 	NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3599 	minorvers = fxdr_unsigned(u_int32_t, *tl++);
3600 	if (minorvers != NFSV4_MINORVERSION &&
3601 	    minorvers != NFSV41_MINORVERSION &&
3602 	    minorvers != NFSV42_MINORVERSION)
3603 		nd->nd_repstat = NFSERR_MINORVERMISMATCH;
3604 	cbident = fxdr_unsigned(u_int32_t, *tl++);
3605 	if (nd->nd_repstat)
3606 		numops = 0;
3607 	else
3608 		numops = fxdr_unsigned(int, *tl);
3609 	/*
3610 	 * Loop around doing the sub ops.
3611 	 */
3612 	for (i = 0; i < numops; i++) {
3613 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3614 		NFSM_BUILD(repp, u_int32_t *, 2 * NFSX_UNSIGNED);
3615 		*repp++ = *tl;
3616 		op = fxdr_unsigned(int, *tl);
3617 		nd->nd_procnum = op;
3618 		if (i == 0 && op != NFSV4OP_CBSEQUENCE && minorvers !=
3619 		    NFSV4_MINORVERSION) {
3620 		    nd->nd_repstat = NFSERR_OPNOTINSESS;
3621 		    *repp = nfscl_errmap(nd, minorvers);
3622 		    retops++;
3623 		    break;
3624 		}
3625 		if (op < NFSV4OP_CBGETATTR ||
3626 		   (op > NFSV4OP_CBRECALL && minorvers == NFSV4_MINORVERSION) ||
3627 		   (op > NFSV4OP_CBNOTIFYDEVID &&
3628 		    minorvers == NFSV41_MINORVERSION) ||
3629 		   (op > NFSV4OP_CBOFFLOAD &&
3630 		    minorvers == NFSV42_MINORVERSION)) {
3631 		    nd->nd_repstat = NFSERR_OPILLEGAL;
3632 		    *repp = nfscl_errmap(nd, minorvers);
3633 		    retops++;
3634 		    break;
3635 		}
3636 		if (op < NFSV42_CBNOPS)
3637 			nfsstatsv1.cbrpccnt[nd->nd_procnum]++;
3638 		switch (op) {
3639 		case NFSV4OP_CBGETATTR:
3640 			NFSCL_DEBUG(4, "cbgetattr\n");
3641 			mp = NULL;
3642 			vp = NULL;
3643 			error = nfsm_getfh(nd, &nfhp);
3644 			if (!error)
3645 				error = nfsrv_getattrbits(nd, &attrbits,
3646 				    NULL, NULL);
3647 			if (!error) {
3648 				mp = nfscl_getmnt(minorvers, sessionid, cbident,
3649 				    &clp);
3650 				if (mp == NULL)
3651 					error = NFSERR_SERVERFAULT;
3652 			}
3653 			if (!error) {
3654 				error = nfscl_ngetreopen(mp, nfhp->nfh_fh,
3655 				    nfhp->nfh_len, p, &np);
3656 				if (!error)
3657 					vp = NFSTOV(np);
3658 			}
3659 			if (!error) {
3660 				NFSZERO_ATTRBIT(&rattrbits);
3661 				NFSLOCKCLSTATE();
3662 				dp = nfscl_finddeleg(clp, nfhp->nfh_fh,
3663 				    nfhp->nfh_len);
3664 				if (dp != NULL) {
3665 					if (NFSISSET_ATTRBIT(&attrbits,
3666 					    NFSATTRBIT_SIZE)) {
3667 						if (vp != NULL)
3668 							va.va_size = np->n_size;
3669 						else
3670 							va.va_size =
3671 							    dp->nfsdl_size;
3672 						NFSSETBIT_ATTRBIT(&rattrbits,
3673 						    NFSATTRBIT_SIZE);
3674 					}
3675 					if (NFSISSET_ATTRBIT(&attrbits,
3676 					    NFSATTRBIT_CHANGE)) {
3677 						va.va_filerev =
3678 						    dp->nfsdl_change;
3679 						if (vp == NULL ||
3680 						    (np->n_flag & NDELEGMOD))
3681 							va.va_filerev++;
3682 						NFSSETBIT_ATTRBIT(&rattrbits,
3683 						    NFSATTRBIT_CHANGE);
3684 					}
3685 				} else
3686 					error = NFSERR_SERVERFAULT;
3687 				NFSUNLOCKCLSTATE();
3688 			}
3689 			if (vp != NULL)
3690 				vrele(vp);
3691 			if (mp != NULL)
3692 				vfs_unbusy(mp);
3693 			if (nfhp != NULL)
3694 				free(nfhp, M_NFSFH);
3695 			if (!error)
3696 				(void) nfsv4_fillattr(nd, NULL, NULL, NULL, &va,
3697 				    NULL, 0, &rattrbits, NULL, p, 0, 0, 0, 0,
3698 				    (uint64_t)0, NULL);
3699 			break;
3700 		case NFSV4OP_CBRECALL:
3701 			NFSCL_DEBUG(4, "cbrecall\n");
3702 			NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID +
3703 			    NFSX_UNSIGNED);
3704 			stateid.seqid = *tl++;
3705 			NFSBCOPY((caddr_t)tl, (caddr_t)stateid.other,
3706 			    NFSX_STATEIDOTHER);
3707 			tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3708 			trunc = fxdr_unsigned(int, *tl);
3709 			error = nfsm_getfh(nd, &nfhp);
3710 			if (!error) {
3711 				NFSLOCKCLSTATE();
3712 				if (minorvers == NFSV4_MINORVERSION)
3713 					clp = nfscl_getclnt(cbident);
3714 				else
3715 					clp = nfscl_getclntsess(sessionid);
3716 				if (clp != NULL) {
3717 					dp = nfscl_finddeleg(clp, nfhp->nfh_fh,
3718 					    nfhp->nfh_len);
3719 					if (dp != NULL && (dp->nfsdl_flags &
3720 					    NFSCLDL_DELEGRET) == 0) {
3721 						dp->nfsdl_flags |=
3722 						    NFSCLDL_RECALL;
3723 						wakeup((caddr_t)clp);
3724 					}
3725 				} else {
3726 					error = NFSERR_SERVERFAULT;
3727 				}
3728 				NFSUNLOCKCLSTATE();
3729 			}
3730 			if (nfhp != NULL)
3731 				free(nfhp, M_NFSFH);
3732 			break;
3733 		case NFSV4OP_CBLAYOUTRECALL:
3734 			NFSCL_DEBUG(4, "cblayrec\n");
3735 			nfhp = NULL;
3736 			NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED);
3737 			laytype = fxdr_unsigned(int, *tl++);
3738 			iomode = fxdr_unsigned(uint32_t, *tl++);
3739 			if (newnfs_true == *tl++)
3740 				changed = 1;
3741 			else
3742 				changed = 0;
3743 			recalltype = fxdr_unsigned(int, *tl);
3744 			NFSCL_DEBUG(4, "layt=%d iom=%d ch=%d rectyp=%d\n",
3745 			    laytype, iomode, changed, recalltype);
3746 			recallp = malloc(sizeof(*recallp), M_NFSLAYRECALL,
3747 			    M_WAITOK);
3748 			if (laytype != NFSLAYOUT_NFSV4_1_FILES &&
3749 			    laytype != NFSLAYOUT_FLEXFILE)
3750 				error = NFSERR_NOMATCHLAYOUT;
3751 			else if (recalltype == NFSLAYOUTRETURN_FILE) {
3752 				error = nfsm_getfh(nd, &nfhp);
3753 				NFSCL_DEBUG(4, "retfile getfh=%d\n", error);
3754 				if (error != 0)
3755 					goto nfsmout;
3756 				NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_HYPER +
3757 				    NFSX_STATEID);
3758 				off = fxdr_hyper(tl); tl += 2;
3759 				len = fxdr_hyper(tl); tl += 2;
3760 				stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
3761 				NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
3762 				if (minorvers == NFSV4_MINORVERSION)
3763 					error = NFSERR_NOTSUPP;
3764 				NFSCL_DEBUG(4, "off=%ju len=%ju sq=%u err=%d\n",
3765 				    (uintmax_t)off, (uintmax_t)len,
3766 				    stateid.seqid, error);
3767 				if (error == 0) {
3768 					NFSLOCKCLSTATE();
3769 					clp = nfscl_getclntsess(sessionid);
3770 					NFSCL_DEBUG(4, "cbly clp=%p\n", clp);
3771 					if (clp != NULL) {
3772 						lyp = nfscl_findlayout(clp,
3773 						    nfhp->nfh_fh,
3774 						    nfhp->nfh_len);
3775 						NFSCL_DEBUG(4, "cblyp=%p\n",
3776 						    lyp);
3777 						if (lyp != NULL &&
3778 						    (lyp->nfsly_flags &
3779 						     (NFSLY_FILES |
3780 						      NFSLY_FLEXFILE)) != 0 &&
3781 						    !NFSBCMP(stateid.other,
3782 						    lyp->nfsly_stateid.other,
3783 						    NFSX_STATEIDOTHER)) {
3784 							error =
3785 							    nfscl_layoutrecall(
3786 							    recalltype,
3787 							    lyp, iomode, off,
3788 							    len, stateid.seqid,
3789 							    0, 0, NULL,
3790 							    recallp);
3791 							if (error == 0 &&
3792 							    stateid.seqid >
3793 							    lyp->nfsly_stateid.seqid)
3794 								lyp->nfsly_stateid.seqid =
3795 								    stateid.seqid;
3796 							recallp = NULL;
3797 							wakeup(clp);
3798 							NFSCL_DEBUG(4,
3799 							    "aft layrcal=%d "
3800 							    "layseqid=%d\n",
3801 							    error,
3802 							    lyp->nfsly_stateid.seqid);
3803 						} else
3804 							error =
3805 							  NFSERR_NOMATCHLAYOUT;
3806 					} else
3807 						error = NFSERR_NOMATCHLAYOUT;
3808 					NFSUNLOCKCLSTATE();
3809 				}
3810 				free(nfhp, M_NFSFH);
3811 			} else if (recalltype == NFSLAYOUTRETURN_FSID) {
3812 				NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_HYPER);
3813 				filesid[0] = fxdr_hyper(tl); tl += 2;
3814 				filesid[1] = fxdr_hyper(tl); tl += 2;
3815 				gotone = 0;
3816 				NFSLOCKCLSTATE();
3817 				clp = nfscl_getclntsess(sessionid);
3818 				if (clp != NULL) {
3819 					TAILQ_FOREACH(lyp, &clp->nfsc_layout,
3820 					    nfsly_list) {
3821 						if (lyp->nfsly_filesid[0] ==
3822 						    filesid[0] &&
3823 						    lyp->nfsly_filesid[1] ==
3824 						    filesid[1]) {
3825 							error =
3826 							    nfscl_layoutrecall(
3827 							    recalltype,
3828 							    lyp, iomode, 0,
3829 							    UINT64_MAX,
3830 							    lyp->nfsly_stateid.seqid,
3831 							    0, 0, NULL,
3832 							    recallp);
3833 							recallp = NULL;
3834 							gotone = 1;
3835 						}
3836 					}
3837 					if (gotone != 0)
3838 						wakeup(clp);
3839 					else
3840 						error = NFSERR_NOMATCHLAYOUT;
3841 				} else
3842 					error = NFSERR_NOMATCHLAYOUT;
3843 				NFSUNLOCKCLSTATE();
3844 			} else if (recalltype == NFSLAYOUTRETURN_ALL) {
3845 				gotone = 0;
3846 				NFSLOCKCLSTATE();
3847 				clp = nfscl_getclntsess(sessionid);
3848 				if (clp != NULL) {
3849 					TAILQ_FOREACH(lyp, &clp->nfsc_layout,
3850 					    nfsly_list) {
3851 						error = nfscl_layoutrecall(
3852 						    recalltype, lyp, iomode, 0,
3853 						    UINT64_MAX,
3854 						    lyp->nfsly_stateid.seqid,
3855 						    0, 0, NULL, recallp);
3856 						recallp = NULL;
3857 						gotone = 1;
3858 					}
3859 					if (gotone != 0)
3860 						wakeup(clp);
3861 					else
3862 						error = NFSERR_NOMATCHLAYOUT;
3863 				} else
3864 					error = NFSERR_NOMATCHLAYOUT;
3865 				NFSUNLOCKCLSTATE();
3866 			} else
3867 				error = NFSERR_NOMATCHLAYOUT;
3868 			if (recallp != NULL) {
3869 				free(recallp, M_NFSLAYRECALL);
3870 				recallp = NULL;
3871 			}
3872 			break;
3873 		case NFSV4OP_CBSEQUENCE:
3874 			if (i != 0) {
3875 			    error = NFSERR_SEQUENCEPOS;
3876 			    break;
3877 			}
3878 			NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID +
3879 			    5 * NFSX_UNSIGNED);
3880 			bcopy(tl, sessionid, NFSX_V4SESSIONID);
3881 			tl += NFSX_V4SESSIONID / NFSX_UNSIGNED;
3882 			seqid = fxdr_unsigned(uint32_t, *tl++);
3883 			slotid = fxdr_unsigned(uint32_t, *tl++);
3884 			highslot = fxdr_unsigned(uint32_t, *tl++);
3885 			cachethis = *tl++;
3886 			/* Throw away the referring call stuff. */
3887 			clist = fxdr_unsigned(int, *tl);
3888 			for (j = 0; j < clist; j++) {
3889 				NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID +
3890 				    NFSX_UNSIGNED);
3891 				tl += NFSX_V4SESSIONID / NFSX_UNSIGNED;
3892 				rcalls = fxdr_unsigned(int, *tl);
3893 				for (k = 0; k < rcalls; k++) {
3894 					NFSM_DISSECT(tl, uint32_t *,
3895 					    2 * NFSX_UNSIGNED);
3896 				}
3897 			}
3898 			NFSLOCKCLSTATE();
3899 			clp = nfscl_getclntsess(sessionid);
3900 			if (clp == NULL)
3901 				error = NFSERR_SERVERFAULT;
3902 			if (error == 0) {
3903 				tsep = nfsmnt_mdssession(clp->nfsc_nmp);
3904 				error = nfsv4_seqsession(seqid, slotid,
3905 				    highslot, tsep->nfsess_cbslots, &rep,
3906 				    tsep->nfsess_backslots);
3907 			}
3908 			NFSUNLOCKCLSTATE();
3909 			if (error == 0 || error == NFSERR_REPLYFROMCACHE) {
3910 				gotseq_ok = 1;
3911 				if (rep != NULL) {
3912 					/*
3913 					 * Handle a reply for a retried
3914 					 * callback.  The reply will be
3915 					 * re-inserted in the session cache
3916 					 * by the nfsv4_seqsess_cacherep() call
3917 					 * after out:
3918 					 */
3919 					KASSERT(error == NFSERR_REPLYFROMCACHE,
3920 					    ("cbsequence: non-NULL rep"));
3921 					NFSCL_DEBUG(4, "Got cbretry\n");
3922 					m_freem(nd->nd_mreq);
3923 					nd->nd_mreq = rep;
3924 					rep = NULL;
3925 					goto out;
3926 				}
3927 				NFSM_BUILD(tl, uint32_t *,
3928 				    NFSX_V4SESSIONID + 4 * NFSX_UNSIGNED);
3929 				bcopy(sessionid, tl, NFSX_V4SESSIONID);
3930 				tl += NFSX_V4SESSIONID / NFSX_UNSIGNED;
3931 				*tl++ = txdr_unsigned(seqid);
3932 				*tl++ = txdr_unsigned(slotid);
3933 				*tl++ = txdr_unsigned(NFSV4_CBSLOTS - 1);
3934 				*tl = txdr_unsigned(NFSV4_CBSLOTS - 1);
3935 			}
3936 			break;
3937 		default:
3938 			if (i == 0 && minorvers != NFSV4_MINORVERSION)
3939 				error = NFSERR_OPNOTINSESS;
3940 			else {
3941 				NFSCL_DEBUG(1, "unsupp callback %d\n", op);
3942 				error = NFSERR_NOTSUPP;
3943 			}
3944 			break;
3945 		}
3946 		if (error) {
3947 			if (error == EBADRPC || error == NFSERR_BADXDR) {
3948 				nd->nd_repstat = NFSERR_BADXDR;
3949 			} else {
3950 				nd->nd_repstat = error;
3951 			}
3952 			error = 0;
3953 		}
3954 		retops++;
3955 		if (nd->nd_repstat) {
3956 			*repp = nfscl_errmap(nd, minorvers);
3957 			break;
3958 		} else
3959 			*repp = 0;	/* NFS4_OK */
3960 	}
3961 nfsmout:
3962 	if (recallp != NULL)
3963 		free(recallp, M_NFSLAYRECALL);
3964 	if (error) {
3965 		if (error == EBADRPC || error == NFSERR_BADXDR)
3966 			nd->nd_repstat = NFSERR_BADXDR;
3967 		else
3968 			printf("nfsv4 comperr1=%d\n", error);
3969 	}
3970 	if (taglen == -1) {
3971 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3972 		*tl++ = 0;
3973 		*tl = 0;
3974 	} else {
3975 		*retopsp = txdr_unsigned(retops);
3976 	}
3977 	*nd->nd_errp = nfscl_errmap(nd, minorvers);
3978 out:
3979 	if (gotseq_ok != 0) {
3980 		rep = m_copym(nd->nd_mreq, 0, M_COPYALL, M_WAITOK);
3981 		NFSLOCKCLSTATE();
3982 		clp = nfscl_getclntsess(sessionid);
3983 		if (clp != NULL) {
3984 			tsep = nfsmnt_mdssession(clp->nfsc_nmp);
3985 			nfsv4_seqsess_cacherep(slotid, tsep->nfsess_cbslots,
3986 			    NFSERR_OK, &rep);
3987 			NFSUNLOCKCLSTATE();
3988 		} else {
3989 			NFSUNLOCKCLSTATE();
3990 			m_freem(rep);
3991 		}
3992 	}
3993 }
3994 
3995 /*
3996  * Generate the next cbident value. Basically just increment a static value
3997  * and then check that it isn't already in the list, if it has wrapped around.
3998  */
3999 static u_int32_t
4000 nfscl_nextcbident(void)
4001 {
4002 	struct nfsclclient *clp;
4003 	int matched;
4004 	static u_int32_t nextcbident = 0;
4005 	static int haswrapped = 0;
4006 
4007 	nextcbident++;
4008 	if (nextcbident == 0)
4009 		haswrapped = 1;
4010 	if (haswrapped) {
4011 		/*
4012 		 * Search the clientid list for one already using this cbident.
4013 		 */
4014 		do {
4015 			matched = 0;
4016 			NFSLOCKCLSTATE();
4017 			LIST_FOREACH(clp, &nfsclhead, nfsc_list) {
4018 				if (clp->nfsc_cbident == nextcbident) {
4019 					matched = 1;
4020 					break;
4021 				}
4022 			}
4023 			NFSUNLOCKCLSTATE();
4024 			if (matched == 1)
4025 				nextcbident++;
4026 		} while (matched);
4027 	}
4028 	return (nextcbident);
4029 }
4030 
4031 /*
4032  * Get the mount point related to a given cbident or session and busy it.
4033  */
4034 static mount_t
4035 nfscl_getmnt(int minorvers, uint8_t *sessionid, u_int32_t cbident,
4036     struct nfsclclient **clpp)
4037 {
4038 	struct nfsclclient *clp;
4039 	mount_t mp;
4040 	int error;
4041 	struct nfsclsession *tsep;
4042 
4043 	*clpp = NULL;
4044 	NFSLOCKCLSTATE();
4045 	LIST_FOREACH(clp, &nfsclhead, nfsc_list) {
4046 		tsep = nfsmnt_mdssession(clp->nfsc_nmp);
4047 		if (minorvers == NFSV4_MINORVERSION) {
4048 			if (clp->nfsc_cbident == cbident)
4049 				break;
4050 		} else if (!NFSBCMP(tsep->nfsess_sessionid, sessionid,
4051 		    NFSX_V4SESSIONID))
4052 			break;
4053 	}
4054 	if (clp == NULL) {
4055 		NFSUNLOCKCLSTATE();
4056 		return (NULL);
4057 	}
4058 	mp = clp->nfsc_nmp->nm_mountp;
4059 	vfs_ref(mp);
4060 	NFSUNLOCKCLSTATE();
4061 	error = vfs_busy(mp, 0);
4062 	vfs_rel(mp);
4063 	if (error != 0)
4064 		return (NULL);
4065 	*clpp = clp;
4066 	return (mp);
4067 }
4068 
4069 /*
4070  * Get the clientid pointer related to a given cbident.
4071  */
4072 static struct nfsclclient *
4073 nfscl_getclnt(u_int32_t cbident)
4074 {
4075 	struct nfsclclient *clp;
4076 
4077 	LIST_FOREACH(clp, &nfsclhead, nfsc_list)
4078 		if (clp->nfsc_cbident == cbident)
4079 			break;
4080 	return (clp);
4081 }
4082 
4083 /*
4084  * Get the clientid pointer related to a given sessionid.
4085  */
4086 static struct nfsclclient *
4087 nfscl_getclntsess(uint8_t *sessionid)
4088 {
4089 	struct nfsclclient *clp;
4090 	struct nfsclsession *tsep;
4091 
4092 	LIST_FOREACH(clp, &nfsclhead, nfsc_list) {
4093 		tsep = nfsmnt_mdssession(clp->nfsc_nmp);
4094 		if (!NFSBCMP(tsep->nfsess_sessionid, sessionid,
4095 		    NFSX_V4SESSIONID))
4096 			break;
4097 	}
4098 	return (clp);
4099 }
4100 
4101 /*
4102  * Search for a lock conflict locally on the client. A conflict occurs if
4103  * - not same owner and overlapping byte range and at least one of them is
4104  *   a write lock or this is an unlock.
4105  */
4106 static int
4107 nfscl_localconflict(struct nfsclclient *clp, u_int8_t *fhp, int fhlen,
4108     struct nfscllock *nlop, u_int8_t *own, struct nfscldeleg *dp,
4109     struct nfscllock **lopp)
4110 {
4111 	struct nfsclopen *op;
4112 	int ret;
4113 
4114 	if (dp != NULL) {
4115 		ret = nfscl_checkconflict(&dp->nfsdl_lock, nlop, own, lopp);
4116 		if (ret)
4117 			return (ret);
4118 	}
4119 	LIST_FOREACH(op, NFSCLOPENHASH(clp, fhp, fhlen), nfso_hash) {
4120 		if (op->nfso_fhlen == fhlen &&
4121 		    !NFSBCMP(op->nfso_fh, fhp, fhlen)) {
4122 			ret = nfscl_checkconflict(&op->nfso_lock, nlop,
4123 			    own, lopp);
4124 			if (ret)
4125 				return (ret);
4126 		}
4127 	}
4128 	return (0);
4129 }
4130 
4131 static int
4132 nfscl_checkconflict(struct nfscllockownerhead *lhp, struct nfscllock *nlop,
4133     u_int8_t *own, struct nfscllock **lopp)
4134 {
4135 	struct nfscllockowner *lp;
4136 	struct nfscllock *lop;
4137 
4138 	LIST_FOREACH(lp, lhp, nfsl_list) {
4139 		if (NFSBCMP(lp->nfsl_owner, own, NFSV4CL_LOCKNAMELEN)) {
4140 			LIST_FOREACH(lop, &lp->nfsl_lock, nfslo_list) {
4141 				if (lop->nfslo_first >= nlop->nfslo_end)
4142 					break;
4143 				if (lop->nfslo_end <= nlop->nfslo_first)
4144 					continue;
4145 				if (lop->nfslo_type == F_WRLCK ||
4146 				    nlop->nfslo_type == F_WRLCK ||
4147 				    nlop->nfslo_type == F_UNLCK) {
4148 					if (lopp != NULL)
4149 						*lopp = lop;
4150 					return (NFSERR_DENIED);
4151 				}
4152 			}
4153 		}
4154 	}
4155 	return (0);
4156 }
4157 
4158 /*
4159  * Check for a local conflicting lock.
4160  */
4161 int
4162 nfscl_lockt(vnode_t vp, struct nfsclclient *clp, u_int64_t off,
4163     u_int64_t len, struct flock *fl, NFSPROC_T *p, void *id, int flags)
4164 {
4165 	struct nfscllock *lop, nlck;
4166 	struct nfscldeleg *dp;
4167 	struct nfsnode *np;
4168 	u_int8_t own[NFSV4CL_LOCKNAMELEN];
4169 	int error;
4170 
4171 	nlck.nfslo_type = fl->l_type;
4172 	nlck.nfslo_first = off;
4173 	if (len == NFS64BITSSET) {
4174 		nlck.nfslo_end = NFS64BITSSET;
4175 	} else {
4176 		nlck.nfslo_end = off + len;
4177 		if (nlck.nfslo_end <= nlck.nfslo_first)
4178 			return (NFSERR_INVAL);
4179 	}
4180 	np = VTONFS(vp);
4181 	nfscl_filllockowner(id, own, flags);
4182 	NFSLOCKCLSTATE();
4183 	dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len);
4184 	error = nfscl_localconflict(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len,
4185 	    &nlck, own, dp, &lop);
4186 	if (error != 0) {
4187 		fl->l_whence = SEEK_SET;
4188 		fl->l_start = lop->nfslo_first;
4189 		if (lop->nfslo_end == NFS64BITSSET)
4190 			fl->l_len = 0;
4191 		else
4192 			fl->l_len = lop->nfslo_end - lop->nfslo_first;
4193 		fl->l_pid = (pid_t)0;
4194 		fl->l_type = lop->nfslo_type;
4195 		error = -1;			/* no RPC required */
4196 	} else if (dp != NULL && ((dp->nfsdl_flags & NFSCLDL_WRITE) ||
4197 	    fl->l_type == F_RDLCK)) {
4198 		/*
4199 		 * The delegation ensures that there isn't a conflicting
4200 		 * lock on the server, so return -1 to indicate an RPC
4201 		 * isn't required.
4202 		 */
4203 		fl->l_type = F_UNLCK;
4204 		error = -1;
4205 	}
4206 	NFSUNLOCKCLSTATE();
4207 	return (error);
4208 }
4209 
4210 /*
4211  * Handle Recall of a delegation.
4212  * The clp must be exclusive locked when this is called.
4213  */
4214 static int
4215 nfscl_recalldeleg(struct nfsclclient *clp, struct nfsmount *nmp,
4216     struct nfscldeleg *dp, vnode_t vp, struct ucred *cred, NFSPROC_T *p,
4217     int called_from_renewthread, vnode_t *vpp)
4218 {
4219 	struct nfsclowner *owp, *lowp, *nowp;
4220 	struct nfsclopen *op, *lop;
4221 	struct nfscllockowner *lp;
4222 	struct nfscllock *lckp;
4223 	struct nfsnode *np;
4224 	int error = 0, ret;
4225 
4226 	if (vp == NULL) {
4227 		KASSERT(vpp != NULL, ("nfscl_recalldeleg: vpp NULL"));
4228 		*vpp = NULL;
4229 		/*
4230 		 * First, get a vnode for the file. This is needed to do RPCs.
4231 		 */
4232 		ret = nfscl_ngetreopen(nmp->nm_mountp, dp->nfsdl_fh,
4233 		    dp->nfsdl_fhlen, p, &np);
4234 		if (ret) {
4235 			/*
4236 			 * File isn't open, so nothing to move over to the
4237 			 * server.
4238 			 */
4239 			return (0);
4240 		}
4241 		vp = NFSTOV(np);
4242 		*vpp = vp;
4243 	} else {
4244 		np = VTONFS(vp);
4245 	}
4246 	dp->nfsdl_flags &= ~NFSCLDL_MODTIMESET;
4247 
4248 	/*
4249 	 * Ok, if it's a write delegation, flush data to the server, so
4250 	 * that close/open consistency is retained.
4251 	 */
4252 	ret = 0;
4253 	NFSLOCKNODE(np);
4254 	if ((dp->nfsdl_flags & NFSCLDL_WRITE) && (np->n_flag & NMODIFIED)) {
4255 		np->n_flag |= NDELEGRECALL;
4256 		NFSUNLOCKNODE(np);
4257 		ret = ncl_flush(vp, MNT_WAIT, p, 1, called_from_renewthread);
4258 		NFSLOCKNODE(np);
4259 		np->n_flag &= ~NDELEGRECALL;
4260 	}
4261 	NFSINVALATTRCACHE(np);
4262 	NFSUNLOCKNODE(np);
4263 	if (ret == EIO && called_from_renewthread != 0) {
4264 		/*
4265 		 * If the flush failed with EIO for the renew thread,
4266 		 * return now, so that the dirty buffer will be flushed
4267 		 * later.
4268 		 */
4269 		return (ret);
4270 	}
4271 
4272 	/*
4273 	 * Now, for each openowner with opens issued locally, move them
4274 	 * over to state against the server.
4275 	 */
4276 	LIST_FOREACH(lowp, &dp->nfsdl_owner, nfsow_list) {
4277 		lop = LIST_FIRST(&lowp->nfsow_open);
4278 		if (lop != NULL) {
4279 			if (LIST_NEXT(lop, nfso_list) != NULL)
4280 				panic("nfsdlg mult opens");
4281 			/*
4282 			 * Look for the same openowner against the server.
4283 			 */
4284 			LIST_FOREACH(owp, &clp->nfsc_owner, nfsow_list) {
4285 				if (!NFSBCMP(lowp->nfsow_owner,
4286 				    owp->nfsow_owner, NFSV4CL_LOCKNAMELEN)) {
4287 					newnfs_copycred(&dp->nfsdl_cred, cred);
4288 					ret = nfscl_moveopen(vp, clp, nmp, lop,
4289 					    owp, dp, cred, p);
4290 					if (ret == NFSERR_STALECLIENTID ||
4291 					    ret == NFSERR_STALEDONTRECOVER ||
4292 					    ret == NFSERR_BADSESSION)
4293 						return (ret);
4294 					if (ret) {
4295 						nfscl_freeopen(lop, 1, true);
4296 						if (!error)
4297 							error = ret;
4298 					}
4299 					break;
4300 				}
4301 			}
4302 
4303 			/*
4304 			 * If no openowner found, create one and get an open
4305 			 * for it.
4306 			 */
4307 			if (owp == NULL) {
4308 				nowp = malloc(
4309 				    sizeof (struct nfsclowner), M_NFSCLOWNER,
4310 				    M_WAITOK);
4311 				nfscl_newopen(clp, NULL, &owp, &nowp, &op,
4312 				    NULL, lowp->nfsow_owner, dp->nfsdl_fh,
4313 				    dp->nfsdl_fhlen, NULL, NULL);
4314 				newnfs_copycred(&dp->nfsdl_cred, cred);
4315 				ret = nfscl_moveopen(vp, clp, nmp, lop,
4316 				    owp, dp, cred, p);
4317 				if (ret) {
4318 					nfscl_freeopenowner(owp, 0);
4319 					if (ret == NFSERR_STALECLIENTID ||
4320 					    ret == NFSERR_STALEDONTRECOVER ||
4321 					    ret == NFSERR_BADSESSION)
4322 						return (ret);
4323 					if (ret) {
4324 						nfscl_freeopen(lop, 1, true);
4325 						if (!error)
4326 							error = ret;
4327 					}
4328 				}
4329 			}
4330 		}
4331 	}
4332 
4333 	/*
4334 	 * Now, get byte range locks for any locks done locally.
4335 	 */
4336 	LIST_FOREACH(lp, &dp->nfsdl_lock, nfsl_list) {
4337 		LIST_FOREACH(lckp, &lp->nfsl_lock, nfslo_list) {
4338 			newnfs_copycred(&dp->nfsdl_cred, cred);
4339 			ret = nfscl_relock(vp, clp, nmp, lp, lckp, cred, p);
4340 			if (ret == NFSERR_STALESTATEID ||
4341 			    ret == NFSERR_STALEDONTRECOVER ||
4342 			    ret == NFSERR_STALECLIENTID ||
4343 			    ret == NFSERR_BADSESSION)
4344 				return (ret);
4345 			if (ret && !error)
4346 				error = ret;
4347 		}
4348 	}
4349 	return (error);
4350 }
4351 
4352 /*
4353  * Move a locally issued open over to an owner on the state list.
4354  * SIDE EFFECT: If it needs to sleep (do an rpc), it unlocks clstate and
4355  * returns with it unlocked.
4356  */
4357 static int
4358 nfscl_moveopen(vnode_t vp, struct nfsclclient *clp, struct nfsmount *nmp,
4359     struct nfsclopen *lop, struct nfsclowner *owp, struct nfscldeleg *dp,
4360     struct ucred *cred, NFSPROC_T *p)
4361 {
4362 	struct nfsclopen *op, *nop;
4363 	struct nfscldeleg *ndp;
4364 	struct nfsnode *np;
4365 	int error = 0, newone;
4366 
4367 	/*
4368 	 * First, look for an appropriate open, If found, just increment the
4369 	 * opencnt in it.
4370 	 */
4371 	LIST_FOREACH(op, &owp->nfsow_open, nfso_list) {
4372 		if ((op->nfso_mode & lop->nfso_mode) == lop->nfso_mode &&
4373 		    op->nfso_fhlen == lop->nfso_fhlen &&
4374 		    !NFSBCMP(op->nfso_fh, lop->nfso_fh, op->nfso_fhlen)) {
4375 			op->nfso_opencnt += lop->nfso_opencnt;
4376 			nfscl_freeopen(lop, 1, true);
4377 			return (0);
4378 		}
4379 	}
4380 
4381 	/* No appropriate open, so we have to do one against the server. */
4382 	np = VTONFS(vp);
4383 	nop = malloc(sizeof (struct nfsclopen) +
4384 	    lop->nfso_fhlen - 1, M_NFSCLOPEN, M_WAITOK);
4385 	nop->nfso_hash.le_prev = NULL;
4386 	newone = 0;
4387 	nfscl_newopen(clp, NULL, &owp, NULL, &op, &nop, owp->nfsow_owner,
4388 	    lop->nfso_fh, lop->nfso_fhlen, cred, &newone);
4389 	ndp = dp;
4390 	if (NFSHASNFSV4N(nmp))
4391 		error = nfscl_tryopen(nmp, vp, lop->nfso_fh, lop->nfso_fhlen,
4392 		    lop->nfso_fh, lop->nfso_fhlen, lop->nfso_mode, op,
4393 		    NULL, 0, &ndp, 0, 0, cred, p);
4394 	else
4395 		error = nfscl_tryopen(nmp, vp, np->n_v4->n4_data,
4396 		    np->n_v4->n4_fhlen, lop->nfso_fh, lop->nfso_fhlen,
4397 		    lop->nfso_mode, op, NFS4NODENAME(np->n_v4),
4398 		    np->n_v4->n4_namelen, &ndp, 0, 0, cred, p);
4399 	if (error) {
4400 		if (newone)
4401 			nfscl_freeopen(op, 0, true);
4402 	} else {
4403 		op->nfso_mode |= lop->nfso_mode;
4404 		op->nfso_opencnt += lop->nfso_opencnt;
4405 		nfscl_freeopen(lop, 1, true);
4406 	}
4407 	if (nop != NULL)
4408 		free(nop, M_NFSCLOPEN);
4409 	if (ndp != NULL) {
4410 		/*
4411 		 * What should I do with the returned delegation, since the
4412 		 * delegation is being recalled? For now, just printf and
4413 		 * through it away.
4414 		 */
4415 		printf("Moveopen returned deleg\n");
4416 		free(ndp, M_NFSCLDELEG);
4417 	}
4418 	return (error);
4419 }
4420 
4421 /*
4422  * Recall all delegations on this client.
4423  */
4424 static void
4425 nfscl_totalrecall(struct nfsclclient *clp)
4426 {
4427 	struct nfscldeleg *dp;
4428 
4429 	TAILQ_FOREACH(dp, &clp->nfsc_deleg, nfsdl_list) {
4430 		if ((dp->nfsdl_flags & NFSCLDL_DELEGRET) == 0)
4431 			dp->nfsdl_flags |= NFSCLDL_RECALL;
4432 	}
4433 }
4434 
4435 /*
4436  * Relock byte ranges. Called for delegation recall and state expiry.
4437  */
4438 static int
4439 nfscl_relock(vnode_t vp, struct nfsclclient *clp, struct nfsmount *nmp,
4440     struct nfscllockowner *lp, struct nfscllock *lop, struct ucred *cred,
4441     NFSPROC_T *p)
4442 {
4443 	struct nfscllockowner *nlp;
4444 	struct nfsfh *nfhp;
4445 	struct nfsnode *np;
4446 	u_int64_t off, len;
4447 	int error, newone, donelocally;
4448 
4449 	if (NFSHASNFSV4N(nmp) && NFSHASONEOPENOWN(nmp)) {
4450 		np = VTONFS(vp);
4451 		NFSLOCKNODE(np);
4452 		np->n_flag |= NMIGHTBELOCKED;
4453 		NFSUNLOCKNODE(np);
4454 	}
4455 
4456 	off = lop->nfslo_first;
4457 	len = lop->nfslo_end - lop->nfslo_first;
4458 	error = nfscl_getbytelock(vp, off, len, lop->nfslo_type, cred, p,
4459 	    clp, 1, NULL, lp->nfsl_lockflags, lp->nfsl_owner,
4460 	    lp->nfsl_openowner, &nlp, &newone, &donelocally);
4461 	if (error || donelocally)
4462 		return (error);
4463 	nfhp = VTONFS(vp)->n_fhp;
4464 	error = nfscl_trylock(nmp, vp, nfhp->nfh_fh,
4465 	    nfhp->nfh_len, nlp, newone, 0, off,
4466 	    len, lop->nfslo_type, cred, p);
4467 	if (error)
4468 		nfscl_freelockowner(nlp, 0);
4469 	return (error);
4470 }
4471 
4472 /*
4473  * Called to re-open a file. Basically get a vnode for the file handle
4474  * and then call nfsrpc_openrpc() to do the rest.
4475  */
4476 static int
4477 nfsrpc_reopen(struct nfsmount *nmp, u_int8_t *fhp, int fhlen,
4478     u_int32_t mode, struct nfsclopen *op, struct nfscldeleg **dpp,
4479     struct ucred *cred, NFSPROC_T *p)
4480 {
4481 	struct nfsnode *np;
4482 	vnode_t vp;
4483 	int error;
4484 
4485 	error = nfscl_ngetreopen(nmp->nm_mountp, fhp, fhlen, p, &np);
4486 	if (error)
4487 		return (error);
4488 	vp = NFSTOV(np);
4489 	if (NFSHASNFSV4N(nmp))
4490 		error = nfscl_tryopen(nmp, vp, fhp, fhlen, fhp, fhlen, mode, op,
4491 		    NULL, 0, dpp, 0, 0, cred, p);
4492 	else if (np->n_v4 != NULL)
4493 		error = nfscl_tryopen(nmp, vp, np->n_v4->n4_data,
4494 		    np->n_v4->n4_fhlen, fhp, fhlen, mode, op,
4495 		    NFS4NODENAME(np->n_v4), np->n_v4->n4_namelen, dpp, 0, 0,
4496 		    cred, p);
4497 	else
4498 		error = EINVAL;
4499 	vrele(vp);
4500 	return (error);
4501 }
4502 
4503 /*
4504  * Try an open against the server. Just call nfsrpc_openrpc(), retrying while
4505  * NFSERR_DELAY. Also, try system credentials, if the passed in credentials
4506  * fail.
4507  */
4508 static int
4509 nfscl_tryopen(struct nfsmount *nmp, vnode_t vp, u_int8_t *fhp, int fhlen,
4510     u_int8_t *newfhp, int newfhlen, u_int32_t mode, struct nfsclopen *op,
4511     u_int8_t *name, int namelen, struct nfscldeleg **ndpp,
4512     int reclaim, u_int32_t delegtype, struct ucred *cred, NFSPROC_T *p)
4513 {
4514 	int error;
4515 	struct nfscldeleg *dp;
4516 
4517 	dp = *ndpp;
4518 	do {
4519 		*ndpp = dp;	/* *ndpp needs to be set for retries. */
4520 		error = nfsrpc_openrpc(nmp, vp, fhp, fhlen, newfhp, newfhlen,
4521 		    mode, op, name, namelen, ndpp, reclaim, delegtype, cred, p,
4522 		    0, 0);
4523 		if (error == NFSERR_DELAY)
4524 			(void) nfs_catnap(PZERO, error, "nfstryop");
4525 	} while (error == NFSERR_DELAY);
4526 	if (error == EAUTH || error == EACCES) {
4527 		/* Try again using system credentials */
4528 		newnfs_setroot(cred);
4529 		do {
4530 		    *ndpp = dp;	/* *ndpp needs to be set for retries. */
4531 		    error = nfsrpc_openrpc(nmp, vp, fhp, fhlen, newfhp,
4532 			newfhlen, mode, op, name, namelen, ndpp, reclaim,
4533 			delegtype, cred, p, 1, 0);
4534 		    if (error == NFSERR_DELAY)
4535 			(void) nfs_catnap(PZERO, error, "nfstryop");
4536 		} while (error == NFSERR_DELAY);
4537 	}
4538 	return (error);
4539 }
4540 
4541 /*
4542  * Try a byte range lock. Just loop on nfsrpc_lock() while it returns
4543  * NFSERR_DELAY. Also, retry with system credentials, if the provided
4544  * cred don't work.
4545  */
4546 static int
4547 nfscl_trylock(struct nfsmount *nmp, vnode_t vp, u_int8_t *fhp,
4548     int fhlen, struct nfscllockowner *nlp, int newone, int reclaim,
4549     u_int64_t off, u_int64_t len, short type, struct ucred *cred, NFSPROC_T *p)
4550 {
4551 	struct nfsrv_descript nfsd, *nd = &nfsd;
4552 	int error;
4553 
4554 	do {
4555 		error = nfsrpc_lock(nd, nmp, vp, fhp, fhlen, nlp, newone,
4556 		    reclaim, off, len, type, cred, p, 0);
4557 		if (!error && nd->nd_repstat == NFSERR_DELAY)
4558 			(void) nfs_catnap(PZERO, (int)nd->nd_repstat,
4559 			    "nfstrylck");
4560 	} while (!error && nd->nd_repstat == NFSERR_DELAY);
4561 	if (!error)
4562 		error = nd->nd_repstat;
4563 	if (error == EAUTH || error == EACCES) {
4564 		/* Try again using root credentials */
4565 		newnfs_setroot(cred);
4566 		do {
4567 			error = nfsrpc_lock(nd, nmp, vp, fhp, fhlen, nlp,
4568 			    newone, reclaim, off, len, type, cred, p, 1);
4569 			if (!error && nd->nd_repstat == NFSERR_DELAY)
4570 				(void) nfs_catnap(PZERO, (int)nd->nd_repstat,
4571 				    "nfstrylck");
4572 		} while (!error && nd->nd_repstat == NFSERR_DELAY);
4573 		if (!error)
4574 			error = nd->nd_repstat;
4575 	}
4576 	return (error);
4577 }
4578 
4579 /*
4580  * Try a delegreturn against the server. Just call nfsrpc_delegreturn(),
4581  * retrying while NFSERR_DELAY. Also, try system credentials, if the passed in
4582  * credentials fail.
4583  */
4584 int
4585 nfscl_trydelegreturn(struct nfscldeleg *dp, struct ucred *cred,
4586     struct nfsmount *nmp, NFSPROC_T *p)
4587 {
4588 	int error;
4589 
4590 	do {
4591 		error = nfsrpc_delegreturn(dp, cred, nmp, p, 0);
4592 		if (error == NFSERR_DELAY)
4593 			(void) nfs_catnap(PZERO, error, "nfstrydp");
4594 	} while (error == NFSERR_DELAY);
4595 	if (error == EAUTH || error == EACCES) {
4596 		/* Try again using system credentials */
4597 		newnfs_setroot(cred);
4598 		do {
4599 			error = nfsrpc_delegreturn(dp, cred, nmp, p, 1);
4600 			if (error == NFSERR_DELAY)
4601 				(void) nfs_catnap(PZERO, error, "nfstrydp");
4602 		} while (error == NFSERR_DELAY);
4603 	}
4604 	return (error);
4605 }
4606 
4607 /*
4608  * Try a close against the server. Just call nfsrpc_closerpc(),
4609  * retrying while NFSERR_DELAY. Also, try system credentials, if the passed in
4610  * credentials fail.
4611  */
4612 int
4613 nfscl_tryclose(struct nfsclopen *op, struct ucred *cred,
4614     struct nfsmount *nmp, NFSPROC_T *p, bool loop_on_delayed)
4615 {
4616 	struct nfsrv_descript nfsd, *nd = &nfsd;
4617 	int error;
4618 
4619 	do {
4620 		error = nfsrpc_closerpc(nd, nmp, op, cred, p, 0);
4621 		if (loop_on_delayed && error == NFSERR_DELAY)
4622 			(void) nfs_catnap(PZERO, error, "nfstrycl");
4623 	} while (loop_on_delayed && error == NFSERR_DELAY);
4624 	if (error == EAUTH || error == EACCES) {
4625 		/* Try again using system credentials */
4626 		newnfs_setroot(cred);
4627 		do {
4628 			error = nfsrpc_closerpc(nd, nmp, op, cred, p, 1);
4629 			if (loop_on_delayed && error == NFSERR_DELAY)
4630 				(void) nfs_catnap(PZERO, error, "nfstrycl");
4631 		} while (loop_on_delayed && error == NFSERR_DELAY);
4632 	}
4633 	return (error);
4634 }
4635 
4636 /*
4637  * Decide if a delegation on a file permits close without flushing writes
4638  * to the server. This might be a big performance win in some environments.
4639  * (Not useful until the client does caching on local stable storage.)
4640  */
4641 int
4642 nfscl_mustflush(vnode_t vp)
4643 {
4644 	struct nfsclclient *clp;
4645 	struct nfscldeleg *dp;
4646 	struct nfsnode *np;
4647 	struct nfsmount *nmp;
4648 
4649 	np = VTONFS(vp);
4650 	nmp = VFSTONFS(vp->v_mount);
4651 	if (!NFSHASNFSV4(nmp) || vp->v_type != VREG)
4652 		return (1);
4653 	NFSLOCKMNT(nmp);
4654 	if ((nmp->nm_privflag & NFSMNTP_DELEGISSUED) == 0) {
4655 		NFSUNLOCKMNT(nmp);
4656 		return (1);
4657 	}
4658 	NFSUNLOCKMNT(nmp);
4659 	NFSLOCKCLSTATE();
4660 	clp = nfscl_findcl(nmp);
4661 	if (clp == NULL) {
4662 		NFSUNLOCKCLSTATE();
4663 		return (1);
4664 	}
4665 	dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len);
4666 	if (dp != NULL && (dp->nfsdl_flags &
4667 	    (NFSCLDL_WRITE | NFSCLDL_RECALL | NFSCLDL_DELEGRET)) ==
4668 	     NFSCLDL_WRITE &&
4669 	    (dp->nfsdl_sizelimit >= np->n_size ||
4670 	     !NFSHASSTRICT3530(nmp))) {
4671 		NFSUNLOCKCLSTATE();
4672 		return (0);
4673 	}
4674 	NFSUNLOCKCLSTATE();
4675 	return (1);
4676 }
4677 
4678 /*
4679  * See if a (write) delegation exists for this file.
4680  */
4681 int
4682 nfscl_nodeleg(vnode_t vp, int writedeleg)
4683 {
4684 	struct nfsclclient *clp;
4685 	struct nfscldeleg *dp;
4686 	struct nfsnode *np;
4687 	struct nfsmount *nmp;
4688 
4689 	np = VTONFS(vp);
4690 	nmp = VFSTONFS(vp->v_mount);
4691 	if (!NFSHASNFSV4(nmp) || vp->v_type != VREG)
4692 		return (1);
4693 	NFSLOCKMNT(nmp);
4694 	if ((nmp->nm_privflag & NFSMNTP_DELEGISSUED) == 0) {
4695 		NFSUNLOCKMNT(nmp);
4696 		return (1);
4697 	}
4698 	NFSUNLOCKMNT(nmp);
4699 	NFSLOCKCLSTATE();
4700 	clp = nfscl_findcl(nmp);
4701 	if (clp == NULL) {
4702 		NFSUNLOCKCLSTATE();
4703 		return (1);
4704 	}
4705 	dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len);
4706 	if (dp != NULL &&
4707 	    (dp->nfsdl_flags & (NFSCLDL_RECALL | NFSCLDL_DELEGRET)) == 0 &&
4708 	    (writedeleg == 0 || (dp->nfsdl_flags & NFSCLDL_WRITE) ==
4709 	     NFSCLDL_WRITE)) {
4710 		NFSUNLOCKCLSTATE();
4711 		return (0);
4712 	}
4713 	NFSUNLOCKCLSTATE();
4714 	return (1);
4715 }
4716 
4717 /*
4718  * Look for an associated delegation that should be DelegReturned.
4719  */
4720 int
4721 nfscl_removedeleg(vnode_t vp, NFSPROC_T *p, nfsv4stateid_t *stp)
4722 {
4723 	struct nfsclclient *clp;
4724 	struct nfscldeleg *dp;
4725 	struct nfsclowner *owp;
4726 	struct nfscllockowner *lp;
4727 	struct nfsmount *nmp;
4728 	struct mount *mp;
4729 	struct ucred *cred;
4730 	struct nfsnode *np;
4731 	int igotlock = 0, triedrecall = 0, needsrecall, retcnt = 0, islept;
4732 
4733 	nmp = VFSTONFS(vp->v_mount);
4734 	if (NFSHASPNFS(nmp))
4735 		return (retcnt);
4736 	NFSLOCKMNT(nmp);
4737 	if ((nmp->nm_privflag & NFSMNTP_DELEGISSUED) == 0) {
4738 		NFSUNLOCKMNT(nmp);
4739 		return (retcnt);
4740 	}
4741 	NFSUNLOCKMNT(nmp);
4742 	np = VTONFS(vp);
4743 	mp = nmp->nm_mountp;
4744 	NFSLOCKCLSTATE();
4745 	/*
4746 	 * Loop around waiting for:
4747 	 * - outstanding I/O operations on delegations to complete
4748 	 * - for a delegation on vp that has state, lock the client and
4749 	 *   do a recall
4750 	 * - return delegation with no state
4751 	 */
4752 	while (1) {
4753 		clp = nfscl_findcl(nmp);
4754 		if (clp == NULL) {
4755 			NFSUNLOCKCLSTATE();
4756 			return (retcnt);
4757 		}
4758 		dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh,
4759 		    np->n_fhp->nfh_len);
4760 		if (dp != NULL) {
4761 		    /*
4762 		     * Wait for outstanding I/O ops to be done.
4763 		     */
4764 		    if (dp->nfsdl_rwlock.nfslock_usecnt > 0) {
4765 			if (igotlock) {
4766 			    nfsv4_unlock(&clp->nfsc_lock, 0);
4767 			    igotlock = 0;
4768 			}
4769 			dp->nfsdl_rwlock.nfslock_lock |= NFSV4LOCK_WANTED;
4770 			msleep(&dp->nfsdl_rwlock, NFSCLSTATEMUTEXPTR, PZERO,
4771 			    "nfscld", hz);
4772 			if (NFSCL_FORCEDISM(mp)) {
4773 			    dp->nfsdl_flags &= ~NFSCLDL_DELEGRET;
4774 			    NFSUNLOCKCLSTATE();
4775 			    return (0);
4776 			}
4777 			continue;
4778 		    }
4779 		    needsrecall = 0;
4780 		    LIST_FOREACH(owp, &dp->nfsdl_owner, nfsow_list) {
4781 			if (!LIST_EMPTY(&owp->nfsow_open)) {
4782 			    needsrecall = 1;
4783 			    break;
4784 			}
4785 		    }
4786 		    if (!needsrecall) {
4787 			LIST_FOREACH(lp, &dp->nfsdl_lock, nfsl_list) {
4788 			    if (!LIST_EMPTY(&lp->nfsl_lock)) {
4789 				needsrecall = 1;
4790 				break;
4791 			    }
4792 			}
4793 		    }
4794 		    if (needsrecall && !triedrecall) {
4795 			dp->nfsdl_flags |= NFSCLDL_DELEGRET;
4796 			islept = 0;
4797 			while (!igotlock) {
4798 			    igotlock = nfsv4_lock(&clp->nfsc_lock, 1,
4799 				&islept, NFSCLSTATEMUTEXPTR, mp);
4800 			    if (NFSCL_FORCEDISM(mp)) {
4801 				dp->nfsdl_flags &= ~NFSCLDL_DELEGRET;
4802 				if (igotlock)
4803 				    nfsv4_unlock(&clp->nfsc_lock, 0);
4804 				NFSUNLOCKCLSTATE();
4805 				return (0);
4806 			    }
4807 			    if (islept)
4808 				break;
4809 			}
4810 			if (islept)
4811 			    continue;
4812 			NFSUNLOCKCLSTATE();
4813 			cred = newnfs_getcred();
4814 			newnfs_copycred(&dp->nfsdl_cred, cred);
4815 			nfscl_recalldeleg(clp, nmp, dp, vp, cred, p, 0, NULL);
4816 			NFSFREECRED(cred);
4817 			triedrecall = 1;
4818 			NFSLOCKCLSTATE();
4819 			nfsv4_unlock(&clp->nfsc_lock, 0);
4820 			igotlock = 0;
4821 			continue;
4822 		    }
4823 		    *stp = dp->nfsdl_stateid;
4824 		    retcnt = 1;
4825 		    nfscl_cleandeleg(dp);
4826 		    nfscl_freedeleg(&clp->nfsc_deleg, dp, true);
4827 		}
4828 		if (igotlock)
4829 		    nfsv4_unlock(&clp->nfsc_lock, 0);
4830 		NFSUNLOCKCLSTATE();
4831 		return (retcnt);
4832 	}
4833 }
4834 
4835 /*
4836  * Look for associated delegation(s) that should be DelegReturned.
4837  */
4838 int
4839 nfscl_renamedeleg(vnode_t fvp, nfsv4stateid_t *fstp, int *gotfdp, vnode_t tvp,
4840     nfsv4stateid_t *tstp, int *gottdp, NFSPROC_T *p)
4841 {
4842 	struct nfsclclient *clp;
4843 	struct nfscldeleg *dp;
4844 	struct nfsclowner *owp;
4845 	struct nfscllockowner *lp;
4846 	struct nfsmount *nmp;
4847 	struct mount *mp;
4848 	struct ucred *cred;
4849 	struct nfsnode *np;
4850 	int igotlock = 0, triedrecall = 0, needsrecall, retcnt = 0, islept;
4851 
4852 	nmp = VFSTONFS(fvp->v_mount);
4853 	*gotfdp = 0;
4854 	*gottdp = 0;
4855 	if (NFSHASPNFS(nmp))
4856 		return (retcnt);
4857 	NFSLOCKMNT(nmp);
4858 	if ((nmp->nm_privflag & NFSMNTP_DELEGISSUED) == 0) {
4859 		NFSUNLOCKMNT(nmp);
4860 		return (retcnt);
4861 	}
4862 	NFSUNLOCKMNT(nmp);
4863 	mp = nmp->nm_mountp;
4864 	NFSLOCKCLSTATE();
4865 	/*
4866 	 * Loop around waiting for:
4867 	 * - outstanding I/O operations on delegations to complete
4868 	 * - for a delegation on fvp that has state, lock the client and
4869 	 *   do a recall
4870 	 * - return delegation(s) with no state.
4871 	 */
4872 	while (1) {
4873 		clp = nfscl_findcl(nmp);
4874 		if (clp == NULL) {
4875 			NFSUNLOCKCLSTATE();
4876 			return (retcnt);
4877 		}
4878 		np = VTONFS(fvp);
4879 		dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh,
4880 		    np->n_fhp->nfh_len);
4881 		if (dp != NULL && *gotfdp == 0) {
4882 		    /*
4883 		     * Wait for outstanding I/O ops to be done.
4884 		     */
4885 		    if (dp->nfsdl_rwlock.nfslock_usecnt > 0) {
4886 			if (igotlock) {
4887 			    nfsv4_unlock(&clp->nfsc_lock, 0);
4888 			    igotlock = 0;
4889 			}
4890 			dp->nfsdl_rwlock.nfslock_lock |= NFSV4LOCK_WANTED;
4891 			msleep(&dp->nfsdl_rwlock, NFSCLSTATEMUTEXPTR, PZERO,
4892 			    "nfscld", hz);
4893 			if (NFSCL_FORCEDISM(mp)) {
4894 			    dp->nfsdl_flags &= ~NFSCLDL_DELEGRET;
4895 			    NFSUNLOCKCLSTATE();
4896 			    *gotfdp = 0;
4897 			    *gottdp = 0;
4898 			    return (0);
4899 			}
4900 			continue;
4901 		    }
4902 		    needsrecall = 0;
4903 		    LIST_FOREACH(owp, &dp->nfsdl_owner, nfsow_list) {
4904 			if (!LIST_EMPTY(&owp->nfsow_open)) {
4905 			    needsrecall = 1;
4906 			    break;
4907 			}
4908 		    }
4909 		    if (!needsrecall) {
4910 			LIST_FOREACH(lp, &dp->nfsdl_lock, nfsl_list) {
4911 			    if (!LIST_EMPTY(&lp->nfsl_lock)) {
4912 				needsrecall = 1;
4913 				break;
4914 			    }
4915 			}
4916 		    }
4917 		    if (needsrecall && !triedrecall) {
4918 			dp->nfsdl_flags |= NFSCLDL_DELEGRET;
4919 			islept = 0;
4920 			while (!igotlock) {
4921 			    igotlock = nfsv4_lock(&clp->nfsc_lock, 1,
4922 				&islept, NFSCLSTATEMUTEXPTR, mp);
4923 			    if (NFSCL_FORCEDISM(mp)) {
4924 				dp->nfsdl_flags &= ~NFSCLDL_DELEGRET;
4925 				if (igotlock)
4926 				    nfsv4_unlock(&clp->nfsc_lock, 0);
4927 				NFSUNLOCKCLSTATE();
4928 				*gotfdp = 0;
4929 				*gottdp = 0;
4930 				return (0);
4931 			    }
4932 			    if (islept)
4933 				break;
4934 			}
4935 			if (islept)
4936 			    continue;
4937 			NFSUNLOCKCLSTATE();
4938 			cred = newnfs_getcred();
4939 			newnfs_copycred(&dp->nfsdl_cred, cred);
4940 			nfscl_recalldeleg(clp, nmp, dp, fvp, cred, p, 0, NULL);
4941 			NFSFREECRED(cred);
4942 			triedrecall = 1;
4943 			NFSLOCKCLSTATE();
4944 			nfsv4_unlock(&clp->nfsc_lock, 0);
4945 			igotlock = 0;
4946 			continue;
4947 		    }
4948 		    *fstp = dp->nfsdl_stateid;
4949 		    retcnt++;
4950 		    *gotfdp = 1;
4951 		    nfscl_cleandeleg(dp);
4952 		    nfscl_freedeleg(&clp->nfsc_deleg, dp, true);
4953 		}
4954 		if (igotlock) {
4955 		    nfsv4_unlock(&clp->nfsc_lock, 0);
4956 		    igotlock = 0;
4957 		}
4958 		if (tvp != NULL) {
4959 		    np = VTONFS(tvp);
4960 		    dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh,
4961 			np->n_fhp->nfh_len);
4962 		    if (dp != NULL && *gottdp == 0) {
4963 			/*
4964 			 * Wait for outstanding I/O ops to be done.
4965 			 */
4966 			if (dp->nfsdl_rwlock.nfslock_usecnt > 0) {
4967 			    dp->nfsdl_rwlock.nfslock_lock |= NFSV4LOCK_WANTED;
4968 			    msleep(&dp->nfsdl_rwlock, NFSCLSTATEMUTEXPTR, PZERO,
4969 				"nfscld", hz);
4970 			    if (NFSCL_FORCEDISM(mp)) {
4971 				NFSUNLOCKCLSTATE();
4972 				*gotfdp = 0;
4973 				*gottdp = 0;
4974 				return (0);
4975 			    }
4976 			    continue;
4977 			}
4978 			LIST_FOREACH(owp, &dp->nfsdl_owner, nfsow_list) {
4979 			    if (!LIST_EMPTY(&owp->nfsow_open)) {
4980 				NFSUNLOCKCLSTATE();
4981 				return (retcnt);
4982 			    }
4983 			}
4984 			LIST_FOREACH(lp, &dp->nfsdl_lock, nfsl_list) {
4985 			    if (!LIST_EMPTY(&lp->nfsl_lock)) {
4986 				NFSUNLOCKCLSTATE();
4987 				return (retcnt);
4988 			    }
4989 			}
4990 			*tstp = dp->nfsdl_stateid;
4991 			retcnt++;
4992 			*gottdp = 1;
4993 			nfscl_cleandeleg(dp);
4994 			nfscl_freedeleg(&clp->nfsc_deleg, dp, true);
4995 		    }
4996 		}
4997 		NFSUNLOCKCLSTATE();
4998 		return (retcnt);
4999 	}
5000 }
5001 
5002 /*
5003  * Get a reference on the clientid associated with the mount point.
5004  * Return 1 if success, 0 otherwise.
5005  */
5006 int
5007 nfscl_getref(struct nfsmount *nmp)
5008 {
5009 	struct nfsclclient *clp;
5010 	int ret;
5011 
5012 	NFSLOCKCLSTATE();
5013 	clp = nfscl_findcl(nmp);
5014 	if (clp == NULL) {
5015 		NFSUNLOCKCLSTATE();
5016 		return (0);
5017 	}
5018 	nfsv4_getref(&clp->nfsc_lock, NULL, NFSCLSTATEMUTEXPTR, nmp->nm_mountp);
5019 	ret = 1;
5020 	if (NFSCL_FORCEDISM(nmp->nm_mountp))
5021 		ret = 0;
5022 	NFSUNLOCKCLSTATE();
5023 	return (ret);
5024 }
5025 
5026 /*
5027  * Release a reference on a clientid acquired with the above call.
5028  */
5029 void
5030 nfscl_relref(struct nfsmount *nmp)
5031 {
5032 	struct nfsclclient *clp;
5033 
5034 	NFSLOCKCLSTATE();
5035 	clp = nfscl_findcl(nmp);
5036 	if (clp == NULL) {
5037 		NFSUNLOCKCLSTATE();
5038 		return;
5039 	}
5040 	nfsv4_relref(&clp->nfsc_lock);
5041 	NFSUNLOCKCLSTATE();
5042 }
5043 
5044 /*
5045  * Save the size attribute in the delegation, since the nfsnode
5046  * is going away.
5047  */
5048 void
5049 nfscl_reclaimnode(vnode_t vp)
5050 {
5051 	struct nfsclclient *clp;
5052 	struct nfscldeleg *dp;
5053 	struct nfsnode *np = VTONFS(vp);
5054 	struct nfsmount *nmp;
5055 
5056 	nmp = VFSTONFS(vp->v_mount);
5057 	if (!NFSHASNFSV4(nmp))
5058 		return;
5059 	NFSLOCKCLSTATE();
5060 	clp = nfscl_findcl(nmp);
5061 	if (clp == NULL) {
5062 		NFSUNLOCKCLSTATE();
5063 		return;
5064 	}
5065 	dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len);
5066 	if (dp != NULL && (dp->nfsdl_flags & NFSCLDL_WRITE))
5067 		dp->nfsdl_size = np->n_size;
5068 	NFSUNLOCKCLSTATE();
5069 }
5070 
5071 /*
5072  * Get the saved size attribute in the delegation, since it is a
5073  * newly allocated nfsnode.
5074  */
5075 void
5076 nfscl_newnode(vnode_t vp)
5077 {
5078 	struct nfsclclient *clp;
5079 	struct nfscldeleg *dp;
5080 	struct nfsnode *np = VTONFS(vp);
5081 	struct nfsmount *nmp;
5082 
5083 	nmp = VFSTONFS(vp->v_mount);
5084 	if (!NFSHASNFSV4(nmp))
5085 		return;
5086 	NFSLOCKCLSTATE();
5087 	clp = nfscl_findcl(nmp);
5088 	if (clp == NULL) {
5089 		NFSUNLOCKCLSTATE();
5090 		return;
5091 	}
5092 	dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len);
5093 	if (dp != NULL && (dp->nfsdl_flags & NFSCLDL_WRITE))
5094 		np->n_size = dp->nfsdl_size;
5095 	NFSUNLOCKCLSTATE();
5096 }
5097 
5098 /*
5099  * If there is a valid write delegation for this file, set the modtime
5100  * to the local clock time.
5101  */
5102 void
5103 nfscl_delegmodtime(vnode_t vp)
5104 {
5105 	struct nfsclclient *clp;
5106 	struct nfscldeleg *dp;
5107 	struct nfsnode *np = VTONFS(vp);
5108 	struct nfsmount *nmp;
5109 
5110 	nmp = VFSTONFS(vp->v_mount);
5111 	if (!NFSHASNFSV4(nmp))
5112 		return;
5113 	NFSLOCKMNT(nmp);
5114 	if ((nmp->nm_privflag & NFSMNTP_DELEGISSUED) == 0) {
5115 		NFSUNLOCKMNT(nmp);
5116 		return;
5117 	}
5118 	NFSUNLOCKMNT(nmp);
5119 	NFSLOCKCLSTATE();
5120 	clp = nfscl_findcl(nmp);
5121 	if (clp == NULL) {
5122 		NFSUNLOCKCLSTATE();
5123 		return;
5124 	}
5125 	dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len);
5126 	if (dp != NULL && (dp->nfsdl_flags & NFSCLDL_WRITE)) {
5127 		nanotime(&dp->nfsdl_modtime);
5128 		dp->nfsdl_flags |= NFSCLDL_MODTIMESET;
5129 	}
5130 	NFSUNLOCKCLSTATE();
5131 }
5132 
5133 /*
5134  * If there is a valid write delegation for this file with a modtime set,
5135  * put that modtime in mtime.
5136  */
5137 void
5138 nfscl_deleggetmodtime(vnode_t vp, struct timespec *mtime)
5139 {
5140 	struct nfsclclient *clp;
5141 	struct nfscldeleg *dp;
5142 	struct nfsnode *np = VTONFS(vp);
5143 	struct nfsmount *nmp;
5144 
5145 	nmp = VFSTONFS(vp->v_mount);
5146 	if (!NFSHASNFSV4(nmp))
5147 		return;
5148 	NFSLOCKMNT(nmp);
5149 	if ((nmp->nm_privflag & NFSMNTP_DELEGISSUED) == 0) {
5150 		NFSUNLOCKMNT(nmp);
5151 		return;
5152 	}
5153 	NFSUNLOCKMNT(nmp);
5154 	NFSLOCKCLSTATE();
5155 	clp = nfscl_findcl(nmp);
5156 	if (clp == NULL) {
5157 		NFSUNLOCKCLSTATE();
5158 		return;
5159 	}
5160 	dp = nfscl_finddeleg(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len);
5161 	if (dp != NULL &&
5162 	    (dp->nfsdl_flags & (NFSCLDL_WRITE | NFSCLDL_MODTIMESET)) ==
5163 	    (NFSCLDL_WRITE | NFSCLDL_MODTIMESET))
5164 		*mtime = dp->nfsdl_modtime;
5165 	NFSUNLOCKCLSTATE();
5166 }
5167 
5168 static int
5169 nfscl_errmap(struct nfsrv_descript *nd, u_int32_t minorvers)
5170 {
5171 	short *defaulterrp, *errp;
5172 
5173 	if (!nd->nd_repstat)
5174 		return (0);
5175 	if (nd->nd_procnum == NFSPROC_NOOP)
5176 		return (txdr_unsigned(nd->nd_repstat & 0xffff));
5177 	if (nd->nd_repstat == EBADRPC)
5178 		return (txdr_unsigned(NFSERR_BADXDR));
5179 	if (nd->nd_repstat == NFSERR_MINORVERMISMATCH ||
5180 	    nd->nd_repstat == NFSERR_OPILLEGAL)
5181 		return (txdr_unsigned(nd->nd_repstat));
5182 	if (nd->nd_repstat >= NFSERR_BADIOMODE && nd->nd_repstat < 20000 &&
5183 	    minorvers > NFSV4_MINORVERSION) {
5184 		/* NFSv4.n error. */
5185 		return (txdr_unsigned(nd->nd_repstat));
5186 	}
5187 	if (nd->nd_procnum < NFSV4OP_CBNOPS)
5188 		errp = defaulterrp = nfscl_cberrmap[nd->nd_procnum];
5189 	else
5190 		return (txdr_unsigned(nd->nd_repstat));
5191 	while (*++errp)
5192 		if (*errp == (short)nd->nd_repstat)
5193 			return (txdr_unsigned(nd->nd_repstat));
5194 	return (txdr_unsigned(*defaulterrp));
5195 }
5196 
5197 /*
5198  * Called to find/add a layout to a client.
5199  * This function returns the layout with a refcnt (shared lock) upon
5200  * success (returns 0) or with no lock/refcnt on the layout when an
5201  * error is returned.
5202  * If a layout is passed in via lypp, it is locked (exclusively locked).
5203  */
5204 int
5205 nfscl_layout(struct nfsmount *nmp, vnode_t vp, u_int8_t *fhp, int fhlen,
5206     nfsv4stateid_t *stateidp, int layouttype, int retonclose,
5207     struct nfsclflayouthead *fhlp, struct nfscllayout **lypp,
5208     struct ucred *cred, NFSPROC_T *p)
5209 {
5210 	struct nfsclclient *clp;
5211 	struct nfscllayout *lyp, *tlyp;
5212 	struct nfsclflayout *flp;
5213 	struct nfsnode *np = VTONFS(vp);
5214 	mount_t mp;
5215 	int layout_passed_in;
5216 
5217 	mp = nmp->nm_mountp;
5218 	layout_passed_in = 1;
5219 	tlyp = NULL;
5220 	lyp = *lypp;
5221 	if (lyp == NULL) {
5222 		layout_passed_in = 0;
5223 		tlyp = malloc(sizeof(*tlyp) + fhlen - 1, M_NFSLAYOUT,
5224 		    M_WAITOK | M_ZERO);
5225 	}
5226 
5227 	NFSLOCKCLSTATE();
5228 	clp = nmp->nm_clp;
5229 	if (clp == NULL) {
5230 		if (layout_passed_in != 0)
5231 			nfsv4_unlock(&lyp->nfsly_lock, 0);
5232 		NFSUNLOCKCLSTATE();
5233 		if (tlyp != NULL)
5234 			free(tlyp, M_NFSLAYOUT);
5235 		return (EPERM);
5236 	}
5237 	if (lyp == NULL) {
5238 		/*
5239 		 * Although no lyp was passed in, another thread might have
5240 		 * allocated one. If one is found, just increment it's ref
5241 		 * count and return it.
5242 		 */
5243 		lyp = nfscl_findlayout(clp, fhp, fhlen);
5244 		if (lyp == NULL) {
5245 			lyp = tlyp;
5246 			tlyp = NULL;
5247 			lyp->nfsly_stateid.seqid = stateidp->seqid;
5248 			lyp->nfsly_stateid.other[0] = stateidp->other[0];
5249 			lyp->nfsly_stateid.other[1] = stateidp->other[1];
5250 			lyp->nfsly_stateid.other[2] = stateidp->other[2];
5251 			lyp->nfsly_lastbyte = 0;
5252 			LIST_INIT(&lyp->nfsly_flayread);
5253 			LIST_INIT(&lyp->nfsly_flayrw);
5254 			LIST_INIT(&lyp->nfsly_recall);
5255 			lyp->nfsly_filesid[0] = np->n_vattr.na_filesid[0];
5256 			lyp->nfsly_filesid[1] = np->n_vattr.na_filesid[1];
5257 			lyp->nfsly_clp = clp;
5258 			if (layouttype == NFSLAYOUT_FLEXFILE)
5259 				lyp->nfsly_flags = NFSLY_FLEXFILE;
5260 			else
5261 				lyp->nfsly_flags = NFSLY_FILES;
5262 			if (retonclose != 0)
5263 				lyp->nfsly_flags |= NFSLY_RETONCLOSE;
5264 			lyp->nfsly_fhlen = fhlen;
5265 			NFSBCOPY(fhp, lyp->nfsly_fh, fhlen);
5266 			TAILQ_INSERT_HEAD(&clp->nfsc_layout, lyp, nfsly_list);
5267 			LIST_INSERT_HEAD(NFSCLLAYOUTHASH(clp, fhp, fhlen), lyp,
5268 			    nfsly_hash);
5269 			lyp->nfsly_timestamp = NFSD_MONOSEC + 120;
5270 			nfscl_layoutcnt++;
5271 			nfsstatsv1.cllayouts++;
5272 		} else {
5273 			if (retonclose != 0)
5274 				lyp->nfsly_flags |= NFSLY_RETONCLOSE;
5275 			if (stateidp->seqid > lyp->nfsly_stateid.seqid)
5276 				lyp->nfsly_stateid.seqid = stateidp->seqid;
5277 			TAILQ_REMOVE(&clp->nfsc_layout, lyp, nfsly_list);
5278 			TAILQ_INSERT_HEAD(&clp->nfsc_layout, lyp, nfsly_list);
5279 			lyp->nfsly_timestamp = NFSD_MONOSEC + 120;
5280 		}
5281 		nfsv4_getref(&lyp->nfsly_lock, NULL, NFSCLSTATEMUTEXPTR, mp);
5282 		if (NFSCL_FORCEDISM(mp)) {
5283 			NFSUNLOCKCLSTATE();
5284 			if (tlyp != NULL)
5285 				free(tlyp, M_NFSLAYOUT);
5286 			return (EPERM);
5287 		}
5288 		*lypp = lyp;
5289 	} else if (stateidp->seqid > lyp->nfsly_stateid.seqid)
5290 		lyp->nfsly_stateid.seqid = stateidp->seqid;
5291 
5292 	/* Merge the new list of File Layouts into the list. */
5293 	flp = LIST_FIRST(fhlp);
5294 	if (flp != NULL) {
5295 		if (flp->nfsfl_iomode == NFSLAYOUTIOMODE_READ)
5296 			nfscl_mergeflayouts(&lyp->nfsly_flayread, fhlp);
5297 		else
5298 			nfscl_mergeflayouts(&lyp->nfsly_flayrw, fhlp);
5299 	}
5300 	if (layout_passed_in != 0)
5301 		nfsv4_unlock(&lyp->nfsly_lock, 1);
5302 	NFSUNLOCKCLSTATE();
5303 	if (tlyp != NULL)
5304 		free(tlyp, M_NFSLAYOUT);
5305 	return (0);
5306 }
5307 
5308 /*
5309  * Search for a layout by MDS file handle.
5310  * If one is found, it is returned with a refcnt (shared lock) iff
5311  * retflpp returned non-NULL and locked (exclusive locked) iff retflpp is
5312  * returned NULL.
5313  */
5314 struct nfscllayout *
5315 nfscl_getlayout(struct nfsclclient *clp, uint8_t *fhp, int fhlen,
5316     uint64_t off, uint32_t rwaccess, struct nfsclflayout **retflpp,
5317     int *recalledp)
5318 {
5319 	struct nfscllayout *lyp;
5320 	mount_t mp;
5321 	int error, igotlock;
5322 
5323 	mp = clp->nfsc_nmp->nm_mountp;
5324 	*recalledp = 0;
5325 	*retflpp = NULL;
5326 	NFSLOCKCLSTATE();
5327 	lyp = nfscl_findlayout(clp, fhp, fhlen);
5328 	if (lyp != NULL) {
5329 		if ((lyp->nfsly_flags & NFSLY_RECALL) == 0) {
5330 			TAILQ_REMOVE(&clp->nfsc_layout, lyp, nfsly_list);
5331 			TAILQ_INSERT_HEAD(&clp->nfsc_layout, lyp, nfsly_list);
5332 			lyp->nfsly_timestamp = NFSD_MONOSEC + 120;
5333 			error = nfscl_findlayoutforio(lyp, off, rwaccess,
5334 			    retflpp);
5335 			if (error == 0)
5336 				nfsv4_getref(&lyp->nfsly_lock, NULL,
5337 				    NFSCLSTATEMUTEXPTR, mp);
5338 			else {
5339 				do {
5340 					igotlock = nfsv4_lock(&lyp->nfsly_lock,
5341 					    1, NULL, NFSCLSTATEMUTEXPTR, mp);
5342 				} while (igotlock == 0 && !NFSCL_FORCEDISM(mp));
5343 				*retflpp = NULL;
5344 			}
5345 			if (NFSCL_FORCEDISM(mp)) {
5346 				lyp = NULL;
5347 				*recalledp = 1;
5348 			}
5349 		} else {
5350 			lyp = NULL;
5351 			*recalledp = 1;
5352 		}
5353 	}
5354 	NFSUNLOCKCLSTATE();
5355 	return (lyp);
5356 }
5357 
5358 /*
5359  * Search for a layout by MDS file handle. If one is found, mark in to be
5360  * recalled, if it already marked "return on close".
5361  */
5362 static void
5363 nfscl_retoncloselayout(vnode_t vp, struct nfsclclient *clp, uint8_t *fhp,
5364     int fhlen, struct nfsclrecalllayout **recallpp, struct nfscllayout **lypp)
5365 {
5366 	struct nfscllayout *lyp;
5367 	uint32_t iomode;
5368 
5369 	*lypp = NULL;
5370 	if (vp->v_type != VREG || !NFSHASPNFS(VFSTONFS(vp->v_mount)) ||
5371 	    nfscl_enablecallb == 0 || nfs_numnfscbd == 0 ||
5372 	    (VTONFS(vp)->n_flag & NNOLAYOUT) != 0)
5373 		return;
5374 	lyp = nfscl_findlayout(clp, fhp, fhlen);
5375 	if (lyp != NULL && (lyp->nfsly_flags & NFSLY_RETONCLOSE) != 0) {
5376 		if ((lyp->nfsly_flags & NFSLY_RECALL) == 0) {
5377 			iomode = 0;
5378 			if (!LIST_EMPTY(&lyp->nfsly_flayread))
5379 				iomode |= NFSLAYOUTIOMODE_READ;
5380 			if (!LIST_EMPTY(&lyp->nfsly_flayrw))
5381 				iomode |= NFSLAYOUTIOMODE_RW;
5382 			nfscl_layoutrecall(NFSLAYOUTRETURN_FILE, lyp, iomode,
5383 			    0, UINT64_MAX, lyp->nfsly_stateid.seqid, 0, 0, NULL,
5384 			    *recallpp);
5385 			NFSCL_DEBUG(4, "retoncls recall iomode=%d\n", iomode);
5386 			*recallpp = NULL;
5387 		}
5388 
5389 		/* Now, wake up renew thread to do LayoutReturn. */
5390 		wakeup(clp);
5391 		*lypp = lyp;
5392 	}
5393 }
5394 
5395 /*
5396  * Mark the layout to be recalled and with an error.
5397  * Also, disable the dsp from further use.
5398  */
5399 void
5400 nfscl_dserr(uint32_t op, uint32_t stat, struct nfscldevinfo *dp,
5401     struct nfscllayout *lyp, struct nfsclds *dsp)
5402 {
5403 	struct nfsclrecalllayout *recallp;
5404 	uint32_t iomode;
5405 
5406 	printf("DS being disabled, error=%d\n", stat);
5407 	/* Set up the return of the layout. */
5408 	recallp = malloc(sizeof(*recallp), M_NFSLAYRECALL, M_WAITOK);
5409 	iomode = 0;
5410 	NFSLOCKCLSTATE();
5411 	if ((lyp->nfsly_flags & NFSLY_RECALL) == 0) {
5412 		if (!LIST_EMPTY(&lyp->nfsly_flayread))
5413 			iomode |= NFSLAYOUTIOMODE_READ;
5414 		if (!LIST_EMPTY(&lyp->nfsly_flayrw))
5415 			iomode |= NFSLAYOUTIOMODE_RW;
5416 		(void)nfscl_layoutrecall(NFSLAYOUTRETURN_FILE, lyp, iomode,
5417 		    0, UINT64_MAX, lyp->nfsly_stateid.seqid, stat, op,
5418 		    dp->nfsdi_deviceid, recallp);
5419 		NFSUNLOCKCLSTATE();
5420 		NFSCL_DEBUG(4, "nfscl_dserr recall iomode=%d\n", iomode);
5421 	} else {
5422 		NFSUNLOCKCLSTATE();
5423 		free(recallp, M_NFSLAYRECALL);
5424 	}
5425 
5426 	/* And shut the TCP connection down. */
5427 	nfscl_cancelreqs(dsp);
5428 }
5429 
5430 /*
5431  * Cancel all RPCs for this "dsp" by closing the connection.
5432  * Also, mark the session as defunct.
5433  * If NFSCLDS_SAMECONN is set, the connection is shared with other DSs and
5434  * cannot be shut down.
5435  */
5436 void
5437 nfscl_cancelreqs(struct nfsclds *dsp)
5438 {
5439 	struct __rpc_client *cl;
5440 	static int non_event;
5441 
5442 	NFSLOCKDS(dsp);
5443 	if ((dsp->nfsclds_flags & (NFSCLDS_CLOSED | NFSCLDS_SAMECONN)) == 0 &&
5444 	    dsp->nfsclds_sockp != NULL &&
5445 	    dsp->nfsclds_sockp->nr_client != NULL) {
5446 		dsp->nfsclds_flags |= NFSCLDS_CLOSED;
5447 		cl = dsp->nfsclds_sockp->nr_client;
5448 		dsp->nfsclds_sess.nfsess_defunct = 1;
5449 		NFSUNLOCKDS(dsp);
5450 		CLNT_CLOSE(cl);
5451 		/*
5452 		 * This 1sec sleep is done to reduce the number of reconnect
5453 		 * attempts made on the DS while it has failed.
5454 		 */
5455 		tsleep(&non_event, PVFS, "ndscls", hz);
5456 		return;
5457 	}
5458 	NFSUNLOCKDS(dsp);
5459 }
5460 
5461 /*
5462  * Dereference a layout.
5463  */
5464 void
5465 nfscl_rellayout(struct nfscllayout *lyp, int exclocked)
5466 {
5467 
5468 	NFSLOCKCLSTATE();
5469 	if (exclocked != 0)
5470 		nfsv4_unlock(&lyp->nfsly_lock, 0);
5471 	else
5472 		nfsv4_relref(&lyp->nfsly_lock);
5473 	NFSUNLOCKCLSTATE();
5474 }
5475 
5476 /*
5477  * Search for a devinfo by deviceid. If one is found, return it after
5478  * acquiring a reference count on it.
5479  */
5480 struct nfscldevinfo *
5481 nfscl_getdevinfo(struct nfsclclient *clp, uint8_t *deviceid,
5482     struct nfscldevinfo *dip)
5483 {
5484 
5485 	NFSLOCKCLSTATE();
5486 	if (dip == NULL)
5487 		dip = nfscl_finddevinfo(clp, deviceid);
5488 	if (dip != NULL)
5489 		dip->nfsdi_refcnt++;
5490 	NFSUNLOCKCLSTATE();
5491 	return (dip);
5492 }
5493 
5494 /*
5495  * Dereference a devinfo structure.
5496  */
5497 static void
5498 nfscl_reldevinfo_locked(struct nfscldevinfo *dip)
5499 {
5500 
5501 	dip->nfsdi_refcnt--;
5502 	if (dip->nfsdi_refcnt == 0)
5503 		wakeup(&dip->nfsdi_refcnt);
5504 }
5505 
5506 /*
5507  * Dereference a devinfo structure.
5508  */
5509 void
5510 nfscl_reldevinfo(struct nfscldevinfo *dip)
5511 {
5512 
5513 	NFSLOCKCLSTATE();
5514 	nfscl_reldevinfo_locked(dip);
5515 	NFSUNLOCKCLSTATE();
5516 }
5517 
5518 /*
5519  * Find a layout for this file handle. Return NULL upon failure.
5520  */
5521 static struct nfscllayout *
5522 nfscl_findlayout(struct nfsclclient *clp, u_int8_t *fhp, int fhlen)
5523 {
5524 	struct nfscllayout *lyp;
5525 
5526 	LIST_FOREACH(lyp, NFSCLLAYOUTHASH(clp, fhp, fhlen), nfsly_hash)
5527 		if (lyp->nfsly_fhlen == fhlen &&
5528 		    !NFSBCMP(lyp->nfsly_fh, fhp, fhlen))
5529 			break;
5530 	return (lyp);
5531 }
5532 
5533 /*
5534  * Find a devinfo for this deviceid. Return NULL upon failure.
5535  */
5536 static struct nfscldevinfo *
5537 nfscl_finddevinfo(struct nfsclclient *clp, uint8_t *deviceid)
5538 {
5539 	struct nfscldevinfo *dip;
5540 
5541 	LIST_FOREACH(dip, &clp->nfsc_devinfo, nfsdi_list)
5542 		if (NFSBCMP(dip->nfsdi_deviceid, deviceid, NFSX_V4DEVICEID)
5543 		    == 0)
5544 			break;
5545 	return (dip);
5546 }
5547 
5548 /*
5549  * Merge the new file layout list into the main one, maintaining it in
5550  * increasing offset order.
5551  */
5552 static void
5553 nfscl_mergeflayouts(struct nfsclflayouthead *fhlp,
5554     struct nfsclflayouthead *newfhlp)
5555 {
5556 	struct nfsclflayout *flp, *nflp, *prevflp, *tflp;
5557 
5558 	flp = LIST_FIRST(fhlp);
5559 	prevflp = NULL;
5560 	LIST_FOREACH_SAFE(nflp, newfhlp, nfsfl_list, tflp) {
5561 		while (flp != NULL && flp->nfsfl_off < nflp->nfsfl_off) {
5562 			prevflp = flp;
5563 			flp = LIST_NEXT(flp, nfsfl_list);
5564 		}
5565 		if (prevflp == NULL)
5566 			LIST_INSERT_HEAD(fhlp, nflp, nfsfl_list);
5567 		else
5568 			LIST_INSERT_AFTER(prevflp, nflp, nfsfl_list);
5569 		prevflp = nflp;
5570 	}
5571 }
5572 
5573 /*
5574  * Add this nfscldevinfo to the client, if it doesn't already exist.
5575  * This function consumes the structure pointed at by dip, if not NULL.
5576  */
5577 int
5578 nfscl_adddevinfo(struct nfsmount *nmp, struct nfscldevinfo *dip, int ind,
5579     struct nfsclflayout *flp)
5580 {
5581 	struct nfsclclient *clp;
5582 	struct nfscldevinfo *tdip;
5583 	uint8_t *dev;
5584 
5585 	NFSLOCKCLSTATE();
5586 	clp = nmp->nm_clp;
5587 	if (clp == NULL) {
5588 		NFSUNLOCKCLSTATE();
5589 		if (dip != NULL)
5590 			free(dip, M_NFSDEVINFO);
5591 		return (ENODEV);
5592 	}
5593 	if ((flp->nfsfl_flags & NFSFL_FILE) != 0)
5594 		dev = flp->nfsfl_dev;
5595 	else
5596 		dev = flp->nfsfl_ffm[ind].dev;
5597 	tdip = nfscl_finddevinfo(clp, dev);
5598 	if (tdip != NULL) {
5599 		tdip->nfsdi_layoutrefs++;
5600 		if ((flp->nfsfl_flags & NFSFL_FILE) != 0)
5601 			flp->nfsfl_devp = tdip;
5602 		else
5603 			flp->nfsfl_ffm[ind].devp = tdip;
5604 		nfscl_reldevinfo_locked(tdip);
5605 		NFSUNLOCKCLSTATE();
5606 		if (dip != NULL)
5607 			free(dip, M_NFSDEVINFO);
5608 		return (0);
5609 	}
5610 	if (dip != NULL) {
5611 		LIST_INSERT_HEAD(&clp->nfsc_devinfo, dip, nfsdi_list);
5612 		dip->nfsdi_layoutrefs = 1;
5613 		if ((flp->nfsfl_flags & NFSFL_FILE) != 0)
5614 			flp->nfsfl_devp = dip;
5615 		else
5616 			flp->nfsfl_ffm[ind].devp = dip;
5617 	}
5618 	NFSUNLOCKCLSTATE();
5619 	if (dip == NULL)
5620 		return (ENODEV);
5621 	return (0);
5622 }
5623 
5624 /*
5625  * Free up a layout structure and associated file layout structure(s).
5626  */
5627 void
5628 nfscl_freelayout(struct nfscllayout *layp)
5629 {
5630 	struct nfsclflayout *flp, *nflp;
5631 	struct nfsclrecalllayout *rp, *nrp;
5632 
5633 	LIST_FOREACH_SAFE(flp, &layp->nfsly_flayread, nfsfl_list, nflp) {
5634 		LIST_REMOVE(flp, nfsfl_list);
5635 		nfscl_freeflayout(flp);
5636 	}
5637 	LIST_FOREACH_SAFE(flp, &layp->nfsly_flayrw, nfsfl_list, nflp) {
5638 		LIST_REMOVE(flp, nfsfl_list);
5639 		nfscl_freeflayout(flp);
5640 	}
5641 	LIST_FOREACH_SAFE(rp, &layp->nfsly_recall, nfsrecly_list, nrp) {
5642 		LIST_REMOVE(rp, nfsrecly_list);
5643 		free(rp, M_NFSLAYRECALL);
5644 	}
5645 	nfscl_layoutcnt--;
5646 	nfsstatsv1.cllayouts--;
5647 	free(layp, M_NFSLAYOUT);
5648 }
5649 
5650 /*
5651  * Free up a file layout structure.
5652  */
5653 void
5654 nfscl_freeflayout(struct nfsclflayout *flp)
5655 {
5656 	int i, j;
5657 
5658 	if ((flp->nfsfl_flags & NFSFL_FILE) != 0) {
5659 		for (i = 0; i < flp->nfsfl_fhcnt; i++)
5660 			free(flp->nfsfl_fh[i], M_NFSFH);
5661 		if (flp->nfsfl_devp != NULL)
5662 			flp->nfsfl_devp->nfsdi_layoutrefs--;
5663 	}
5664 	if ((flp->nfsfl_flags & NFSFL_FLEXFILE) != 0)
5665 		for (i = 0; i < flp->nfsfl_mirrorcnt; i++) {
5666 			for (j = 0; j < flp->nfsfl_ffm[i].fhcnt; j++)
5667 				free(flp->nfsfl_ffm[i].fh[j], M_NFSFH);
5668 			if (flp->nfsfl_ffm[i].devp != NULL)
5669 				flp->nfsfl_ffm[i].devp->nfsdi_layoutrefs--;
5670 		}
5671 	free(flp, M_NFSFLAYOUT);
5672 }
5673 
5674 /*
5675  * Free up a file layout devinfo structure.
5676  */
5677 void
5678 nfscl_freedevinfo(struct nfscldevinfo *dip)
5679 {
5680 
5681 	free(dip, M_NFSDEVINFO);
5682 }
5683 
5684 /*
5685  * Mark any layouts that match as recalled.
5686  */
5687 static int
5688 nfscl_layoutrecall(int recalltype, struct nfscllayout *lyp, uint32_t iomode,
5689     uint64_t off, uint64_t len, uint32_t stateseqid, uint32_t stat, uint32_t op,
5690     char *devid, struct nfsclrecalllayout *recallp)
5691 {
5692 	struct nfsclrecalllayout *rp, *orp;
5693 
5694 	recallp->nfsrecly_recalltype = recalltype;
5695 	recallp->nfsrecly_iomode = iomode;
5696 	recallp->nfsrecly_stateseqid = stateseqid;
5697 	recallp->nfsrecly_off = off;
5698 	recallp->nfsrecly_len = len;
5699 	recallp->nfsrecly_stat = stat;
5700 	recallp->nfsrecly_op = op;
5701 	if (devid != NULL)
5702 		NFSBCOPY(devid, recallp->nfsrecly_devid, NFSX_V4DEVICEID);
5703 	/*
5704 	 * Order the list as file returns first, followed by fsid and any
5705 	 * returns, both in increasing stateseqid order.
5706 	 * Note that the seqids wrap around, so 1 is after 0xffffffff.
5707 	 * (I'm not sure this is correct because I find RFC5661 confusing
5708 	 *  on this, but hopefully it will work ok.)
5709 	 */
5710 	orp = NULL;
5711 	LIST_FOREACH(rp, &lyp->nfsly_recall, nfsrecly_list) {
5712 		orp = rp;
5713 		if ((recalltype == NFSLAYOUTRETURN_FILE &&
5714 		     (rp->nfsrecly_recalltype != NFSLAYOUTRETURN_FILE ||
5715 		      nfscl_seq(stateseqid, rp->nfsrecly_stateseqid) != 0)) ||
5716 		    (recalltype != NFSLAYOUTRETURN_FILE &&
5717 		     rp->nfsrecly_recalltype != NFSLAYOUTRETURN_FILE &&
5718 		     nfscl_seq(stateseqid, rp->nfsrecly_stateseqid) != 0)) {
5719 			LIST_INSERT_BEFORE(rp, recallp, nfsrecly_list);
5720 			break;
5721 		}
5722 
5723 		/*
5724 		 * Put any error return on all the file returns that will
5725 		 * preceed this one.
5726 		 */
5727 		if (rp->nfsrecly_recalltype == NFSLAYOUTRETURN_FILE &&
5728 		   stat != 0 && rp->nfsrecly_stat == 0) {
5729 			rp->nfsrecly_stat = stat;
5730 			rp->nfsrecly_op = op;
5731 			if (devid != NULL)
5732 				NFSBCOPY(devid, rp->nfsrecly_devid,
5733 				    NFSX_V4DEVICEID);
5734 		}
5735 	}
5736 	if (rp == NULL) {
5737 		if (orp == NULL)
5738 			LIST_INSERT_HEAD(&lyp->nfsly_recall, recallp,
5739 			    nfsrecly_list);
5740 		else
5741 			LIST_INSERT_AFTER(orp, recallp, nfsrecly_list);
5742 	}
5743 	lyp->nfsly_flags |= NFSLY_RECALL;
5744 	wakeup(lyp->nfsly_clp);
5745 	return (0);
5746 }
5747 
5748 /*
5749  * Compare the two seqids for ordering. The trick is that the seqids can
5750  * wrap around from 0xffffffff->0, so check for the cases where one
5751  * has wrapped around.
5752  * Return 1 if seqid1 comes before seqid2, 0 otherwise.
5753  */
5754 static int
5755 nfscl_seq(uint32_t seqid1, uint32_t seqid2)
5756 {
5757 
5758 	if (seqid2 > seqid1 && (seqid2 - seqid1) >= 0x7fffffff)
5759 		/* seqid2 has wrapped around. */
5760 		return (0);
5761 	if (seqid1 > seqid2 && (seqid1 - seqid2) >= 0x7fffffff)
5762 		/* seqid1 has wrapped around. */
5763 		return (1);
5764 	if (seqid1 <= seqid2)
5765 		return (1);
5766 	return (0);
5767 }
5768 
5769 /*
5770  * Do a layout return for each of the recalls.
5771  */
5772 static void
5773 nfscl_layoutreturn(struct nfsmount *nmp, struct nfscllayout *lyp,
5774     struct ucred *cred, NFSPROC_T *p)
5775 {
5776 	struct nfsclrecalllayout *rp;
5777 	nfsv4stateid_t stateid;
5778 	int layouttype;
5779 
5780 	NFSBCOPY(lyp->nfsly_stateid.other, stateid.other, NFSX_STATEIDOTHER);
5781 	stateid.seqid = lyp->nfsly_stateid.seqid;
5782 	if ((lyp->nfsly_flags & NFSLY_FILES) != 0)
5783 		layouttype = NFSLAYOUT_NFSV4_1_FILES;
5784 	else
5785 		layouttype = NFSLAYOUT_FLEXFILE;
5786 	LIST_FOREACH(rp, &lyp->nfsly_recall, nfsrecly_list) {
5787 		(void)nfsrpc_layoutreturn(nmp, lyp->nfsly_fh,
5788 		    lyp->nfsly_fhlen, 0, layouttype,
5789 		    rp->nfsrecly_iomode, rp->nfsrecly_recalltype,
5790 		    rp->nfsrecly_off, rp->nfsrecly_len,
5791 		    &stateid, cred, p, rp->nfsrecly_stat, rp->nfsrecly_op,
5792 		    rp->nfsrecly_devid);
5793 	}
5794 }
5795 
5796 /*
5797  * Do the layout commit for a file layout.
5798  */
5799 static void
5800 nfscl_dolayoutcommit(struct nfsmount *nmp, struct nfscllayout *lyp,
5801     struct ucred *cred, NFSPROC_T *p)
5802 {
5803 	struct nfsclflayout *flp;
5804 	uint64_t len;
5805 	int error, layouttype;
5806 
5807 	if ((lyp->nfsly_flags & NFSLY_FILES) != 0)
5808 		layouttype = NFSLAYOUT_NFSV4_1_FILES;
5809 	else
5810 		layouttype = NFSLAYOUT_FLEXFILE;
5811 	LIST_FOREACH(flp, &lyp->nfsly_flayrw, nfsfl_list) {
5812 		if (layouttype == NFSLAYOUT_FLEXFILE &&
5813 		    (flp->nfsfl_fflags & NFSFLEXFLAG_NO_LAYOUTCOMMIT) != 0) {
5814 			NFSCL_DEBUG(4, "Flex file: no layoutcommit\n");
5815 			/* If not supported, don't bother doing it. */
5816 			NFSLOCKMNT(nmp);
5817 			nmp->nm_state |= NFSSTA_NOLAYOUTCOMMIT;
5818 			NFSUNLOCKMNT(nmp);
5819 			break;
5820 		} else if (flp->nfsfl_off <= lyp->nfsly_lastbyte) {
5821 			len = flp->nfsfl_end - flp->nfsfl_off;
5822 			error = nfsrpc_layoutcommit(nmp, lyp->nfsly_fh,
5823 			    lyp->nfsly_fhlen, 0, flp->nfsfl_off, len,
5824 			    lyp->nfsly_lastbyte, &lyp->nfsly_stateid,
5825 			    layouttype, cred, p);
5826 			NFSCL_DEBUG(4, "layoutcommit err=%d\n", error);
5827 			if (error == NFSERR_NOTSUPP) {
5828 				/* If not supported, don't bother doing it. */
5829 				NFSLOCKMNT(nmp);
5830 				nmp->nm_state |= NFSSTA_NOLAYOUTCOMMIT;
5831 				NFSUNLOCKMNT(nmp);
5832 				break;
5833 			}
5834 		}
5835 	}
5836 }
5837 
5838 /*
5839  * Commit all layouts for a file (vnode).
5840  */
5841 int
5842 nfscl_layoutcommit(vnode_t vp, NFSPROC_T *p)
5843 {
5844 	struct nfsclclient *clp;
5845 	struct nfscllayout *lyp;
5846 	struct nfsnode *np = VTONFS(vp);
5847 	mount_t mp;
5848 	struct nfsmount *nmp;
5849 
5850 	mp = vp->v_mount;
5851 	nmp = VFSTONFS(mp);
5852 	if (NFSHASNOLAYOUTCOMMIT(nmp))
5853 		return (0);
5854 	NFSLOCKCLSTATE();
5855 	clp = nmp->nm_clp;
5856 	if (clp == NULL) {
5857 		NFSUNLOCKCLSTATE();
5858 		return (EPERM);
5859 	}
5860 	lyp = nfscl_findlayout(clp, np->n_fhp->nfh_fh, np->n_fhp->nfh_len);
5861 	if (lyp == NULL) {
5862 		NFSUNLOCKCLSTATE();
5863 		return (EPERM);
5864 	}
5865 	nfsv4_getref(&lyp->nfsly_lock, NULL, NFSCLSTATEMUTEXPTR, mp);
5866 	if (NFSCL_FORCEDISM(mp)) {
5867 		NFSUNLOCKCLSTATE();
5868 		return (EPERM);
5869 	}
5870 tryagain:
5871 	if ((lyp->nfsly_flags & NFSLY_WRITTEN) != 0) {
5872 		lyp->nfsly_flags &= ~NFSLY_WRITTEN;
5873 		NFSUNLOCKCLSTATE();
5874 		NFSCL_DEBUG(4, "do layoutcommit2\n");
5875 		nfscl_dolayoutcommit(clp->nfsc_nmp, lyp, NFSPROCCRED(p), p);
5876 		NFSLOCKCLSTATE();
5877 		goto tryagain;
5878 	}
5879 	nfsv4_relref(&lyp->nfsly_lock);
5880 	NFSUNLOCKCLSTATE();
5881 	return (0);
5882 }
5883