xref: /freebsd/sys/fs/nfs/nfs_commonsubs.c (revision ce6a89e27cd190313be39bb479880aeda4778436)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 /*
40  * These functions support the macros and help fiddle mbuf chains for
41  * the nfs op functions. They do things like create the rpc header and
42  * copy data between mbuf chains and uio lists.
43  */
44 #ifndef APPLEKEXT
45 #include "opt_inet.h"
46 #include "opt_inet6.h"
47 
48 #include <fs/nfs/nfsport.h>
49 
50 #include <sys/extattr.h>
51 
52 #include <security/mac/mac_framework.h>
53 
54 /*
55  * Data items converted to xdr at startup, since they are constant
56  * This is kinda hokey, but may save a little time doing byte swaps
57  */
58 u_int32_t newnfs_true, newnfs_false, newnfs_xdrneg1;
59 
60 /* And other global data */
61 nfstype nfsv34_type[9] = { NFNON, NFREG, NFDIR, NFBLK, NFCHR, NFLNK, NFSOCK,
62 		      NFFIFO, NFNON };
63 enum vtype newnv2tov_type[8] = { VNON, VREG, VDIR, VBLK, VCHR, VLNK, VNON, VNON };
64 enum vtype nv34tov_type[8]={ VNON, VREG, VDIR, VBLK, VCHR, VLNK, VSOCK, VFIFO };
65 struct timeval nfsboottime;	/* Copy boottime once, so it never changes */
66 int nfscl_ticks;
67 int nfsrv_useacl = 1;
68 struct nfssockreq nfsrv_nfsuserdsock;
69 nfsuserd_state nfsrv_nfsuserd = NOTRUNNING;
70 static int nfsrv_userdupcalls = 0;
71 struct nfsreqhead nfsd_reqq;
72 uid_t nfsrv_defaultuid = UID_NOBODY;
73 gid_t nfsrv_defaultgid = GID_NOGROUP;
74 int nfsrv_lease = NFSRV_LEASE;
75 int ncl_mbuf_mlen = MLEN;
76 int nfsd_enable_stringtouid = 0;
77 int nfsrv_doflexfile = 0;
78 static int nfs_enable_uidtostring = 0;
79 NFSNAMEIDMUTEX;
80 NFSSOCKMUTEX;
81 extern int nfsrv_lughashsize;
82 extern struct mtx nfsrv_dslock_mtx;
83 extern volatile int nfsrv_devidcnt;
84 extern int nfscl_debuglevel;
85 extern struct nfsdevicehead nfsrv_devidhead;
86 extern struct nfsstatsv1 nfsstatsv1;
87 
88 SYSCTL_DECL(_vfs_nfs);
89 SYSCTL_INT(_vfs_nfs, OID_AUTO, enable_uidtostring, CTLFLAG_RW,
90     &nfs_enable_uidtostring, 0, "Make nfs always send numeric owner_names");
91 
92 int nfsrv_maxpnfsmirror = 1;
93 SYSCTL_INT(_vfs_nfs, OID_AUTO, pnfsmirror, CTLFLAG_RD,
94     &nfsrv_maxpnfsmirror, 0, "Mirror level for pNFS service");
95 
96 int nfs_maxcopyrange = 10 * 1024 * 1024;
97 SYSCTL_INT(_vfs_nfs, OID_AUTO, maxcopyrange, CTLFLAG_RW,
98     &nfs_maxcopyrange, 0, "Max size of a Copy so RPC times reasonable");
99 
100 /*
101  * This array of structures indicates, for V4:
102  * retfh - which of 3 types of calling args are used
103  *	0 - doesn't change cfh or use a sfh
104  *	1 - replaces cfh with a new one (unless it returns an error status)
105  *	2 - uses cfh and sfh
106  * needscfh - if the op wants a cfh and premtime
107  *	0 - doesn't use a cfh
108  *	1 - uses a cfh, but doesn't want pre-op attributes
109  *	2 - uses a cfh and wants pre-op attributes
110  * savereply - indicates a non-idempotent Op
111  *	0 - not non-idempotent
112  *	1 - non-idempotent
113  * Ops that are ordered via seqid# are handled separately from these
114  * non-idempotent Ops.
115  * Define it here, since it is used by both the client and server.
116  */
117 struct nfsv4_opflag nfsv4_opflag[NFSV42_NOPS] = {
118 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* undef */
119 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* undef */
120 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* undef */
121 	{ 0, 1, 0, 0, LK_SHARED, 1, 1 },		/* Access */
122 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Close */
123 	{ 0, 2, 0, 1, LK_EXCLUSIVE, 1, 1 },		/* Commit */
124 	{ 1, 2, 1, 1, LK_EXCLUSIVE, 1, 1 },		/* Create */
125 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Delegpurge */
126 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Delegreturn */
127 	{ 0, 1, 0, 0, LK_SHARED, 1, 1 },		/* Getattr */
128 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* GetFH */
129 	{ 2, 1, 1, 1, LK_EXCLUSIVE, 1, 1 },		/* Link */
130 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Lock */
131 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* LockT */
132 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* LockU */
133 	{ 1, 2, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Lookup */
134 	{ 1, 2, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Lookupp */
135 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* NVerify */
136 	{ 1, 1, 0, 1, LK_EXCLUSIVE, 1, 0 },		/* Open */
137 	{ 1, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* OpenAttr */
138 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* OpenConfirm */
139 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* OpenDowngrade */
140 	{ 1, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* PutFH */
141 	{ 1, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* PutPubFH */
142 	{ 1, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* PutRootFH */
143 	{ 0, 1, 0, 0, LK_SHARED, 1, 0 },		/* Read */
144 	{ 0, 1, 0, 0, LK_SHARED, 1, 1 },		/* Readdir */
145 	{ 0, 1, 0, 0, LK_SHARED, 1, 1 },		/* ReadLink */
146 	{ 0, 2, 1, 1, LK_EXCLUSIVE, 1, 1 },		/* Remove */
147 	{ 2, 1, 1, 1, LK_EXCLUSIVE, 1, 1 },		/* Rename */
148 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Renew */
149 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* RestoreFH */
150 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* SaveFH */
151 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* SecInfo */
152 	{ 0, 2, 1, 1, LK_EXCLUSIVE, 1, 0 },		/* Setattr */
153 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* SetClientID */
154 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* SetClientIDConfirm */
155 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Verify */
156 	{ 0, 2, 1, 1, LK_EXCLUSIVE, 1, 0 },		/* Write */
157 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* ReleaseLockOwner */
158 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Backchannel Ctrl */
159 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 0, 0 },		/* Bind Conn to Sess */
160 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 0, 0 },		/* Exchange ID */
161 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 0, 0 },		/* Create Session */
162 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 0, 0 },		/* Destroy Session */
163 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Free StateID */
164 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Get Dir Deleg */
165 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Get Device Info */
166 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Get Device List */
167 	{ 0, 1, 0, 1, LK_EXCLUSIVE, 1, 1 },		/* Layout Commit */
168 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Layout Get */
169 	{ 0, 1, 0, 1, LK_EXCLUSIVE, 1, 0 },		/* Layout Return */
170 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Secinfo No name */
171 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Sequence */
172 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Set SSV */
173 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Test StateID */
174 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Want Delegation */
175 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 0, 0 },		/* Destroy ClientID */
176 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Reclaim Complete */
177 	{ 0, 1, 1, 1, LK_EXCLUSIVE, 1, 0 },		/* Allocate */
178 	{ 2, 1, 1, 0, LK_SHARED, 1, 0 },		/* Copy */
179 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Copy Notify */
180 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Deallocate */
181 	{ 0, 1, 0, 0, LK_SHARED, 1, 0 },		/* IO Advise */
182 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Layout Error */
183 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1, 0 },		/* Layout Stats */
184 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Offload Cancel */
185 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Offload Status */
186 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Read Plus */
187 	{ 0, 1, 0, 0, LK_SHARED, 1, 0 },		/* Seek */
188 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Write Same */
189 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1, 1 },		/* Clone */
190 	{ 0, 1, 0, 0, LK_SHARED, 1, 1 },		/* Getxattr */
191 	{ 0, 1, 1, 1, LK_EXCLUSIVE, 1, 1 },		/* Setxattr */
192 	{ 0, 1, 0, 0, LK_SHARED, 1, 1 },		/* Listxattrs */
193 	{ 0, 1, 1, 1, LK_EXCLUSIVE, 1, 1 },		/* Removexattr */
194 };
195 #endif	/* !APPLEKEXT */
196 
197 static int ncl_mbuf_mhlen = MHLEN;
198 static int nfsrv_usercnt = 0;
199 static int nfsrv_dnsnamelen;
200 static u_char *nfsrv_dnsname = NULL;
201 static int nfsrv_usermax = 999999999;
202 struct nfsrv_lughash {
203 	struct mtx		mtx;
204 	struct nfsuserhashhead	lughead;
205 };
206 static struct nfsrv_lughash	*nfsuserhash;
207 static struct nfsrv_lughash	*nfsusernamehash;
208 static struct nfsrv_lughash	*nfsgrouphash;
209 static struct nfsrv_lughash	*nfsgroupnamehash;
210 
211 /*
212  * This static array indicates whether or not the RPC generates a large
213  * reply. This is used by nfs_reply() to decide whether or not an mbuf
214  * cluster should be allocated. (If a cluster is required by an RPC
215  * marked 0 in this array, the code will still work, just not quite as
216  * efficiently.)
217  */
218 static int nfs_bigreply[NFSV42_NPROCS] = { 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0,
219     0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
220     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0,
221     1, 0, 0, 1 };
222 
223 /* local functions */
224 static int nfsrv_skipace(struct nfsrv_descript *nd, int *acesizep);
225 static void nfsv4_wanted(struct nfsv4lock *lp);
226 static int nfsrv_cmpmixedcase(u_char *cp, u_char *cp2, int len);
227 static int nfsrv_getuser(int procnum, uid_t uid, gid_t gid, char *name);
228 static void nfsrv_removeuser(struct nfsusrgrp *usrp, int isuser);
229 static int nfsrv_getrefstr(struct nfsrv_descript *, u_char **, u_char **,
230     int *, int *);
231 static void nfsrv_refstrbigenough(int, u_char **, u_char **, int *);
232 
233 static struct {
234 	int	op;
235 	int	opcnt;
236 	const u_char *tag;
237 	int	taglen;
238 } nfsv4_opmap[NFSV42_NPROCS] = {
239 	{ 0, 1, "Null", 4 },
240 	{ NFSV4OP_GETATTR, 1, "Getattr", 7, },
241 	{ NFSV4OP_SETATTR, 2, "Setattr", 7, },
242 	{ NFSV4OP_LOOKUP, 3, "Lookup", 6, },
243 	{ NFSV4OP_ACCESS, 2, "Access", 6, },
244 	{ NFSV4OP_READLINK, 2, "Readlink", 8, },
245 	{ NFSV4OP_READ, 1, "Read", 4, },
246 	{ NFSV4OP_WRITE, 2, "Write", 5, },
247 	{ NFSV4OP_OPEN, 5, "Open", 4, },
248 	{ NFSV4OP_CREATE, 5, "Create", 6, },
249 	{ NFSV4OP_CREATE, 1, "Create", 6, },
250 	{ NFSV4OP_CREATE, 3, "Create", 6, },
251 	{ NFSV4OP_REMOVE, 1, "Remove", 6, },
252 	{ NFSV4OP_REMOVE, 1, "Remove", 6, },
253 	{ NFSV4OP_SAVEFH, 5, "Rename", 6, },
254 	{ NFSV4OP_SAVEFH, 4, "Link", 4, },
255 	{ NFSV4OP_READDIR, 2, "Readdir", 7, },
256 	{ NFSV4OP_READDIR, 2, "Readdir", 7, },
257 	{ NFSV4OP_GETATTR, 1, "Getattr", 7, },
258 	{ NFSV4OP_GETATTR, 1, "Getattr", 7, },
259 	{ NFSV4OP_GETATTR, 1, "Getattr", 7, },
260 	{ NFSV4OP_COMMIT, 2, "Commit", 6, },
261 	{ NFSV4OP_LOOKUPP, 3, "Lookupp", 7, },
262 	{ NFSV4OP_SETCLIENTID, 1, "SetClientID", 11, },
263 	{ NFSV4OP_SETCLIENTIDCFRM, 1, "SetClientIDConfirm", 18, },
264 	{ NFSV4OP_LOCK, 1, "Lock", 4, },
265 	{ NFSV4OP_LOCKU, 1, "LockU", 5, },
266 	{ NFSV4OP_OPEN, 2, "Open", 4, },
267 	{ NFSV4OP_CLOSE, 1, "Close", 5, },
268 	{ NFSV4OP_OPENCONFIRM, 1, "Openconfirm", 11, },
269 	{ NFSV4OP_LOCKT, 1, "LockT", 5, },
270 	{ NFSV4OP_OPENDOWNGRADE, 1, "Opendowngrade", 13, },
271 	{ NFSV4OP_RENEW, 1, "Renew", 5, },
272 	{ NFSV4OP_PUTROOTFH, 1, "Dirpath", 7, },
273 	{ NFSV4OP_RELEASELCKOWN, 1, "Rellckown", 9, },
274 	{ NFSV4OP_DELEGRETURN, 1, "Delegret", 8, },
275 	{ NFSV4OP_DELEGRETURN, 3, "DelegRemove", 11, },
276 	{ NFSV4OP_DELEGRETURN, 7, "DelegRename1", 12, },
277 	{ NFSV4OP_DELEGRETURN, 9, "DelegRename2", 12, },
278 	{ NFSV4OP_GETATTR, 1, "Getacl", 6, },
279 	{ NFSV4OP_SETATTR, 1, "Setacl", 6, },
280 	{ NFSV4OP_EXCHANGEID, 1, "ExchangeID", 10, },
281 	{ NFSV4OP_CREATESESSION, 1, "CreateSession", 13, },
282 	{ NFSV4OP_DESTROYSESSION, 1, "DestroySession", 14, },
283 	{ NFSV4OP_DESTROYCLIENTID, 1, "DestroyClient", 13, },
284 	{ NFSV4OP_FREESTATEID, 1, "FreeStateID", 11, },
285 	{ NFSV4OP_LAYOUTGET, 1, "LayoutGet", 9, },
286 	{ NFSV4OP_GETDEVINFO, 1, "GetDeviceInfo", 13, },
287 	{ NFSV4OP_LAYOUTCOMMIT, 1, "LayoutCommit", 12, },
288 	{ NFSV4OP_LAYOUTRETURN, 1, "LayoutReturn", 12, },
289 	{ NFSV4OP_RECLAIMCOMPL, 1, "ReclaimComplete", 15, },
290 	{ NFSV4OP_WRITE, 1, "WriteDS", 7, },
291 	{ NFSV4OP_READ, 1, "ReadDS", 6, },
292 	{ NFSV4OP_COMMIT, 1, "CommitDS", 8, },
293 	{ NFSV4OP_OPEN, 3, "OpenLayoutGet", 13, },
294 	{ NFSV4OP_OPEN, 8, "CreateLayGet", 12, },
295 	{ NFSV4OP_IOADVISE, 1, "Advise", 6, },
296 	{ NFSV4OP_ALLOCATE, 2, "Allocate", 8, },
297 	{ NFSV4OP_SAVEFH, 5, "Copy", 4, },
298 	{ NFSV4OP_SEEK, 2, "Seek", 4, },
299 	{ NFSV4OP_SEEK, 1, "SeekDS", 6, },
300 	{ NFSV4OP_GETXATTR, 2, "Getxattr", 8, },
301 	{ NFSV4OP_SETXATTR, 2, "Setxattr", 8, },
302 	{ NFSV4OP_REMOVEXATTR, 2, "Rmxattr", 7, },
303 	{ NFSV4OP_LISTXATTRS, 2, "Listxattr", 9, },
304 };
305 
306 /*
307  * NFS RPCS that have large request message size.
308  */
309 static int nfs_bigrequest[NFSV42_NPROCS] = {
310 	0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
311 	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
312 	0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0
313 };
314 
315 /*
316  * Start building a request. Mostly just put the first file handle in
317  * place.
318  */
319 APPLESTATIC void
320 nfscl_reqstart(struct nfsrv_descript *nd, int procnum, struct nfsmount *nmp,
321     u_int8_t *nfhp, int fhlen, u_int32_t **opcntpp, struct nfsclsession *sep,
322     int vers, int minorvers)
323 {
324 	struct mbuf *mb;
325 	u_int32_t *tl;
326 	int opcnt;
327 	nfsattrbit_t attrbits;
328 
329 	/*
330 	 * First, fill in some of the fields of nd.
331 	 */
332 	nd->nd_slotseq = NULL;
333 	if (vers == NFS_VER4) {
334 		nd->nd_flag = ND_NFSV4 | ND_NFSCL;
335 		if (minorvers == NFSV41_MINORVERSION)
336 			nd->nd_flag |= ND_NFSV41;
337 		else if (minorvers == NFSV42_MINORVERSION)
338 			nd->nd_flag |= (ND_NFSV41 | ND_NFSV42);
339 	} else if (vers == NFS_VER3)
340 		nd->nd_flag = ND_NFSV3 | ND_NFSCL;
341 	else {
342 		if (NFSHASNFSV4(nmp)) {
343 			nd->nd_flag = ND_NFSV4 | ND_NFSCL;
344 			if (nmp->nm_minorvers == 1)
345 				nd->nd_flag |= ND_NFSV41;
346 			else if (nmp->nm_minorvers == 2)
347 				nd->nd_flag |= (ND_NFSV41 | ND_NFSV42);
348 		} else if (NFSHASNFSV3(nmp))
349 			nd->nd_flag = ND_NFSV3 | ND_NFSCL;
350 		else
351 			nd->nd_flag = ND_NFSV2 | ND_NFSCL;
352 	}
353 	nd->nd_procnum = procnum;
354 	nd->nd_repstat = 0;
355 
356 	/*
357 	 * Get the first mbuf for the request.
358 	 */
359 	if (nfs_bigrequest[procnum])
360 		NFSMCLGET(mb, M_WAITOK);
361 	else
362 		NFSMGET(mb);
363 	mbuf_setlen(mb, 0);
364 	nd->nd_mreq = nd->nd_mb = mb;
365 	nd->nd_bpos = NFSMTOD(mb, caddr_t);
366 
367 	/*
368 	 * And fill the first file handle into the request.
369 	 */
370 	if (nd->nd_flag & ND_NFSV4) {
371 		opcnt = nfsv4_opmap[procnum].opcnt +
372 		    nfsv4_opflag[nfsv4_opmap[procnum].op].needscfh;
373 		if ((nd->nd_flag & ND_NFSV41) != 0) {
374 			opcnt += nfsv4_opflag[nfsv4_opmap[procnum].op].needsseq;
375 			if (procnum == NFSPROC_RENEW)
376 				/*
377 				 * For the special case of Renew, just do a
378 				 * Sequence Op.
379 				 */
380 				opcnt = 1;
381 			else if (procnum == NFSPROC_WRITEDS ||
382 			    procnum == NFSPROC_COMMITDS)
383 				/*
384 				 * For the special case of a Writeor Commit to
385 				 * a DS, the opcnt == 3, for Sequence, PutFH,
386 				 * Write/Commit.
387 				 */
388 				opcnt = 3;
389 		}
390 		/*
391 		 * What should the tag really be?
392 		 */
393 		(void) nfsm_strtom(nd, nfsv4_opmap[procnum].tag,
394 			nfsv4_opmap[procnum].taglen);
395 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
396 		if ((nd->nd_flag & ND_NFSV42) != 0)
397 			*tl++ = txdr_unsigned(NFSV42_MINORVERSION);
398 		else if ((nd->nd_flag & ND_NFSV41) != 0)
399 			*tl++ = txdr_unsigned(NFSV41_MINORVERSION);
400 		else
401 			*tl++ = txdr_unsigned(NFSV4_MINORVERSION);
402 		if (opcntpp != NULL)
403 			*opcntpp = tl;
404 		*tl = txdr_unsigned(opcnt);
405 		if ((nd->nd_flag & ND_NFSV41) != 0 &&
406 		    nfsv4_opflag[nfsv4_opmap[procnum].op].needsseq > 0) {
407 			if (nfsv4_opflag[nfsv4_opmap[procnum].op].loopbadsess >
408 			    0)
409 				nd->nd_flag |= ND_LOOPBADSESS;
410 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
411 			*tl = txdr_unsigned(NFSV4OP_SEQUENCE);
412 			if (sep == NULL) {
413 				sep = nfsmnt_mdssession(nmp);
414 				nfsv4_setsequence(nmp, nd, sep,
415 				    nfs_bigreply[procnum]);
416 			} else
417 				nfsv4_setsequence(nmp, nd, sep,
418 				    nfs_bigreply[procnum]);
419 		}
420 		if (nfsv4_opflag[nfsv4_opmap[procnum].op].needscfh > 0) {
421 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
422 			*tl = txdr_unsigned(NFSV4OP_PUTFH);
423 			(void) nfsm_fhtom(nd, nfhp, fhlen, 0);
424 			if (nfsv4_opflag[nfsv4_opmap[procnum].op].needscfh
425 			    == 2 && procnum != NFSPROC_WRITEDS &&
426 			    procnum != NFSPROC_COMMITDS) {
427 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
428 				*tl = txdr_unsigned(NFSV4OP_GETATTR);
429 				/*
430 				 * For Lookup Ops, we want all the directory
431 				 * attributes, so we can load the name cache.
432 				 */
433 				if (procnum == NFSPROC_LOOKUP ||
434 				    procnum == NFSPROC_LOOKUPP)
435 					NFSGETATTR_ATTRBIT(&attrbits);
436 				else {
437 					NFSWCCATTR_ATTRBIT(&attrbits);
438 					nd->nd_flag |= ND_V4WCCATTR;
439 				}
440 				(void) nfsrv_putattrbit(nd, &attrbits);
441 			}
442 		}
443 		if (procnum != NFSPROC_RENEW ||
444 		    (nd->nd_flag & ND_NFSV41) == 0) {
445 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
446 			*tl = txdr_unsigned(nfsv4_opmap[procnum].op);
447 		}
448 	} else {
449 		(void) nfsm_fhtom(nd, nfhp, fhlen, 0);
450 	}
451 	if (procnum < NFSV42_NPROCS)
452 		NFSINCRGLOBAL(nfsstatsv1.rpccnt[procnum]);
453 }
454 
455 /*
456  * Put a state Id in the mbuf list.
457  */
458 APPLESTATIC void
459 nfsm_stateidtom(struct nfsrv_descript *nd, nfsv4stateid_t *stateidp, int flag)
460 {
461 	nfsv4stateid_t *st;
462 
463 	NFSM_BUILD(st, nfsv4stateid_t *, NFSX_STATEID);
464 	if (flag == NFSSTATEID_PUTALLZERO) {
465 		st->seqid = 0;
466 		st->other[0] = 0;
467 		st->other[1] = 0;
468 		st->other[2] = 0;
469 	} else if (flag == NFSSTATEID_PUTALLONE) {
470 		st->seqid = 0xffffffff;
471 		st->other[0] = 0xffffffff;
472 		st->other[1] = 0xffffffff;
473 		st->other[2] = 0xffffffff;
474 	} else if (flag == NFSSTATEID_PUTSEQIDZERO) {
475 		st->seqid = 0;
476 		st->other[0] = stateidp->other[0];
477 		st->other[1] = stateidp->other[1];
478 		st->other[2] = stateidp->other[2];
479 	} else {
480 		st->seqid = stateidp->seqid;
481 		st->other[0] = stateidp->other[0];
482 		st->other[1] = stateidp->other[1];
483 		st->other[2] = stateidp->other[2];
484 	}
485 }
486 
487 /*
488  * Fill in the setable attributes. The full argument indicates whether
489  * to fill in them all or just mode and time.
490  */
491 void
492 nfscl_fillsattr(struct nfsrv_descript *nd, struct vattr *vap,
493     struct vnode *vp, int flags, u_int32_t rdev)
494 {
495 	u_int32_t *tl;
496 	struct nfsv2_sattr *sp;
497 	nfsattrbit_t attrbits;
498 
499 	switch (nd->nd_flag & (ND_NFSV2 | ND_NFSV3 | ND_NFSV4)) {
500 	case ND_NFSV2:
501 		NFSM_BUILD(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
502 		if (vap->va_mode == (mode_t)VNOVAL)
503 			sp->sa_mode = newnfs_xdrneg1;
504 		else
505 			sp->sa_mode = vtonfsv2_mode(vap->va_type, vap->va_mode);
506 		if (vap->va_uid == (uid_t)VNOVAL)
507 			sp->sa_uid = newnfs_xdrneg1;
508 		else
509 			sp->sa_uid = txdr_unsigned(vap->va_uid);
510 		if (vap->va_gid == (gid_t)VNOVAL)
511 			sp->sa_gid = newnfs_xdrneg1;
512 		else
513 			sp->sa_gid = txdr_unsigned(vap->va_gid);
514 		if (flags & NFSSATTR_SIZE0)
515 			sp->sa_size = 0;
516 		else if (flags & NFSSATTR_SIZENEG1)
517 			sp->sa_size = newnfs_xdrneg1;
518 		else if (flags & NFSSATTR_SIZERDEV)
519 			sp->sa_size = txdr_unsigned(rdev);
520 		else
521 			sp->sa_size = txdr_unsigned(vap->va_size);
522 		txdr_nfsv2time(&vap->va_atime, &sp->sa_atime);
523 		txdr_nfsv2time(&vap->va_mtime, &sp->sa_mtime);
524 		break;
525 	case ND_NFSV3:
526 		if (vap->va_mode != (mode_t)VNOVAL) {
527 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
528 			*tl++ = newnfs_true;
529 			*tl = txdr_unsigned(vap->va_mode);
530 		} else {
531 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
532 			*tl = newnfs_false;
533 		}
534 		if ((flags & NFSSATTR_FULL) && vap->va_uid != (uid_t)VNOVAL) {
535 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
536 			*tl++ = newnfs_true;
537 			*tl = txdr_unsigned(vap->va_uid);
538 		} else {
539 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
540 			*tl = newnfs_false;
541 		}
542 		if ((flags & NFSSATTR_FULL) && vap->va_gid != (gid_t)VNOVAL) {
543 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
544 			*tl++ = newnfs_true;
545 			*tl = txdr_unsigned(vap->va_gid);
546 		} else {
547 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
548 			*tl = newnfs_false;
549 		}
550 		if ((flags & NFSSATTR_FULL) && vap->va_size != VNOVAL) {
551 			NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
552 			*tl++ = newnfs_true;
553 			txdr_hyper(vap->va_size, tl);
554 		} else {
555 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
556 			*tl = newnfs_false;
557 		}
558 		if (vap->va_atime.tv_sec != VNOVAL) {
559 			if ((vap->va_vaflags & VA_UTIMES_NULL) == 0) {
560 				NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
561 				*tl++ = txdr_unsigned(NFSV3SATTRTIME_TOCLIENT);
562 				txdr_nfsv3time(&vap->va_atime, tl);
563 			} else {
564 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
565 				*tl = txdr_unsigned(NFSV3SATTRTIME_TOSERVER);
566 			}
567 		} else {
568 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
569 			*tl = txdr_unsigned(NFSV3SATTRTIME_DONTCHANGE);
570 		}
571 		if (vap->va_mtime.tv_sec != VNOVAL) {
572 			if ((vap->va_vaflags & VA_UTIMES_NULL) == 0) {
573 				NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
574 				*tl++ = txdr_unsigned(NFSV3SATTRTIME_TOCLIENT);
575 				txdr_nfsv3time(&vap->va_mtime, tl);
576 			} else {
577 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
578 				*tl = txdr_unsigned(NFSV3SATTRTIME_TOSERVER);
579 			}
580 		} else {
581 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
582 			*tl = txdr_unsigned(NFSV3SATTRTIME_DONTCHANGE);
583 		}
584 		break;
585 	case ND_NFSV4:
586 		NFSZERO_ATTRBIT(&attrbits);
587 		if (vap->va_mode != (mode_t)VNOVAL)
588 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_MODE);
589 		if ((flags & NFSSATTR_FULL) && vap->va_uid != (uid_t)VNOVAL)
590 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
591 		if ((flags & NFSSATTR_FULL) && vap->va_gid != (gid_t)VNOVAL)
592 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNERGROUP);
593 		if ((flags & NFSSATTR_FULL) && vap->va_size != VNOVAL)
594 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_SIZE);
595 		if (vap->va_atime.tv_sec != VNOVAL)
596 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET);
597 		if (vap->va_mtime.tv_sec != VNOVAL)
598 			NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFYSET);
599 		(void) nfsv4_fillattr(nd, vp->v_mount, vp, NULL, vap, NULL, 0,
600 		    &attrbits, NULL, NULL, 0, 0, 0, 0, (uint64_t)0, NULL);
601 		break;
602 	}
603 }
604 
605 #ifndef APPLE
606 /*
607  * copies mbuf chain to the uio scatter/gather list
608  */
609 int
610 nfsm_mbufuio(struct nfsrv_descript *nd, struct uio *uiop, int siz)
611 {
612 	char *mbufcp, *uiocp;
613 	int xfer, left, len;
614 	mbuf_t mp;
615 	long uiosiz, rem;
616 	int error = 0;
617 
618 	mp = nd->nd_md;
619 	mbufcp = nd->nd_dpos;
620 	len = NFSMTOD(mp, caddr_t) + mbuf_len(mp) - mbufcp;
621 	rem = NFSM_RNDUP(siz) - siz;
622 	while (siz > 0) {
623 		if (uiop->uio_iovcnt <= 0 || uiop->uio_iov == NULL) {
624 			error = EBADRPC;
625 			goto out;
626 		}
627 		left = uiop->uio_iov->iov_len;
628 		uiocp = uiop->uio_iov->iov_base;
629 		if (left > siz)
630 			left = siz;
631 		uiosiz = left;
632 		while (left > 0) {
633 			while (len == 0) {
634 				mp = mbuf_next(mp);
635 				if (mp == NULL) {
636 					error = EBADRPC;
637 					goto out;
638 				}
639 				mbufcp = NFSMTOD(mp, caddr_t);
640 				len = mbuf_len(mp);
641 				KASSERT(len >= 0,
642 				    ("len %d, corrupted mbuf?", len));
643 			}
644 			xfer = (left > len) ? len : left;
645 #ifdef notdef
646 			/* Not Yet.. */
647 			if (uiop->uio_iov->iov_op != NULL)
648 				(*(uiop->uio_iov->iov_op))
649 				(mbufcp, uiocp, xfer);
650 			else
651 #endif
652 			if (uiop->uio_segflg == UIO_SYSSPACE)
653 				NFSBCOPY(mbufcp, uiocp, xfer);
654 			else
655 				copyout(mbufcp, CAST_USER_ADDR_T(uiocp), xfer);
656 			left -= xfer;
657 			len -= xfer;
658 			mbufcp += xfer;
659 			uiocp += xfer;
660 			uiop->uio_offset += xfer;
661 			uiop->uio_resid -= xfer;
662 		}
663 		if (uiop->uio_iov->iov_len <= siz) {
664 			uiop->uio_iovcnt--;
665 			uiop->uio_iov++;
666 		} else {
667 			uiop->uio_iov->iov_base = (void *)
668 				((char *)uiop->uio_iov->iov_base + uiosiz);
669 			uiop->uio_iov->iov_len -= uiosiz;
670 		}
671 		siz -= uiosiz;
672 	}
673 	nd->nd_dpos = mbufcp;
674 	nd->nd_md = mp;
675 	if (rem > 0) {
676 		if (len < rem)
677 			error = nfsm_advance(nd, rem, len);
678 		else
679 			nd->nd_dpos += rem;
680 	}
681 
682 out:
683 	NFSEXITCODE2(error, nd);
684 	return (error);
685 }
686 #endif	/* !APPLE */
687 
688 /*
689  * Help break down an mbuf chain by setting the first siz bytes contiguous
690  * pointed to by returned val.
691  * This is used by the macro NFSM_DISSECT for tough
692  * cases.
693  */
694 APPLESTATIC void *
695 nfsm_dissct(struct nfsrv_descript *nd, int siz, int how)
696 {
697 	mbuf_t mp2;
698 	int siz2, xfer;
699 	caddr_t p;
700 	int left;
701 	caddr_t retp;
702 
703 	retp = NULL;
704 	left = NFSMTOD(nd->nd_md, caddr_t) + mbuf_len(nd->nd_md) - nd->nd_dpos;
705 	while (left == 0) {
706 		nd->nd_md = mbuf_next(nd->nd_md);
707 		if (nd->nd_md == NULL)
708 			return (retp);
709 		left = mbuf_len(nd->nd_md);
710 		nd->nd_dpos = NFSMTOD(nd->nd_md, caddr_t);
711 	}
712 	if (left >= siz) {
713 		retp = nd->nd_dpos;
714 		nd->nd_dpos += siz;
715 	} else if (mbuf_next(nd->nd_md) == NULL) {
716 		return (retp);
717 	} else if (siz > ncl_mbuf_mhlen) {
718 		panic("nfs S too big");
719 	} else {
720 		MGET(mp2, MT_DATA, how);
721 		if (mp2 == NULL)
722 			return (NULL);
723 		mbuf_setnext(mp2, mbuf_next(nd->nd_md));
724 		mbuf_setnext(nd->nd_md, mp2);
725 		mbuf_setlen(nd->nd_md, mbuf_len(nd->nd_md) - left);
726 		nd->nd_md = mp2;
727 		retp = p = NFSMTOD(mp2, caddr_t);
728 		NFSBCOPY(nd->nd_dpos, p, left);	/* Copy what was left */
729 		siz2 = siz - left;
730 		p += left;
731 		mp2 = mbuf_next(mp2);
732 		/* Loop around copying up the siz2 bytes */
733 		while (siz2 > 0) {
734 			if (mp2 == NULL)
735 				return (NULL);
736 			xfer = (siz2 > mbuf_len(mp2)) ? mbuf_len(mp2) : siz2;
737 			if (xfer > 0) {
738 				NFSBCOPY(NFSMTOD(mp2, caddr_t), p, xfer);
739 				NFSM_DATAP(mp2, xfer);
740 				mbuf_setlen(mp2, mbuf_len(mp2) - xfer);
741 				p += xfer;
742 				siz2 -= xfer;
743 			}
744 			if (siz2 > 0)
745 				mp2 = mbuf_next(mp2);
746 		}
747 		mbuf_setlen(nd->nd_md, siz);
748 		nd->nd_md = mp2;
749 		nd->nd_dpos = NFSMTOD(mp2, caddr_t);
750 	}
751 	return (retp);
752 }
753 
754 /*
755  * Advance the position in the mbuf chain.
756  * If offs == 0, this is a no-op, but it is simpler to just return from
757  * here than check for offs > 0 for all calls to nfsm_advance.
758  * If left == -1, it should be calculated here.
759  */
760 APPLESTATIC int
761 nfsm_advance(struct nfsrv_descript *nd, int offs, int left)
762 {
763 	int error = 0;
764 
765 	if (offs == 0)
766 		goto out;
767 	/*
768 	 * A negative offs might indicate a corrupted mbuf chain and,
769 	 * as such, a printf is logged.
770 	 */
771 	if (offs < 0) {
772 		printf("nfsrv_advance: negative offs\n");
773 		error = EBADRPC;
774 		goto out;
775 	}
776 
777 	/*
778 	 * If left == -1, calculate it here.
779 	 */
780 	if (left == -1)
781 		left = NFSMTOD(nd->nd_md, caddr_t) + mbuf_len(nd->nd_md) -
782 		    nd->nd_dpos;
783 
784 	/*
785 	 * Loop around, advancing over the mbuf data.
786 	 */
787 	while (offs > left) {
788 		offs -= left;
789 		nd->nd_md = mbuf_next(nd->nd_md);
790 		if (nd->nd_md == NULL) {
791 			error = EBADRPC;
792 			goto out;
793 		}
794 		left = mbuf_len(nd->nd_md);
795 		nd->nd_dpos = NFSMTOD(nd->nd_md, caddr_t);
796 	}
797 	nd->nd_dpos += offs;
798 
799 out:
800 	NFSEXITCODE(error);
801 	return (error);
802 }
803 
804 /*
805  * Copy a string into mbuf(s).
806  * Return the number of bytes output, including XDR overheads.
807  */
808 APPLESTATIC int
809 nfsm_strtom(struct nfsrv_descript *nd, const char *cp, int siz)
810 {
811 	mbuf_t m2;
812 	int xfer, left;
813 	mbuf_t m1;
814 	int rem, bytesize;
815 	u_int32_t *tl;
816 	char *cp2;
817 
818 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
819 	*tl = txdr_unsigned(siz);
820 	rem = NFSM_RNDUP(siz) - siz;
821 	bytesize = NFSX_UNSIGNED + siz + rem;
822 	m2 = nd->nd_mb;
823 	cp2 = nd->nd_bpos;
824 	left = M_TRAILINGSPACE(m2);
825 
826 	/*
827 	 * Loop around copying the string to mbuf(s).
828 	 */
829 	while (siz > 0) {
830 		if (left == 0) {
831 			if (siz > ncl_mbuf_mlen)
832 				NFSMCLGET(m1, M_WAITOK);
833 			else
834 				NFSMGET(m1);
835 			mbuf_setlen(m1, 0);
836 			mbuf_setnext(m2, m1);
837 			m2 = m1;
838 			cp2 = NFSMTOD(m2, caddr_t);
839 			left = M_TRAILINGSPACE(m2);
840 		}
841 		if (left >= siz)
842 			xfer = siz;
843 		else
844 			xfer = left;
845 		NFSBCOPY(cp, cp2, xfer);
846 		cp += xfer;
847 		mbuf_setlen(m2, mbuf_len(m2) + xfer);
848 		siz -= xfer;
849 		left -= xfer;
850 		if (siz == 0 && rem) {
851 			if (left < rem)
852 				panic("nfsm_strtom");
853 			NFSBZERO(cp2 + xfer, rem);
854 			mbuf_setlen(m2, mbuf_len(m2) + rem);
855 		}
856 	}
857 	nd->nd_mb = m2;
858 	nd->nd_bpos = NFSMTOD(m2, caddr_t) + mbuf_len(m2);
859 	return (bytesize);
860 }
861 
862 /*
863  * Called once to initialize data structures...
864  */
865 APPLESTATIC void
866 newnfs_init(void)
867 {
868 	static int nfs_inited = 0;
869 
870 	if (nfs_inited)
871 		return;
872 	nfs_inited = 1;
873 
874 	newnfs_true = txdr_unsigned(TRUE);
875 	newnfs_false = txdr_unsigned(FALSE);
876 	newnfs_xdrneg1 = txdr_unsigned(-1);
877 	nfscl_ticks = (hz * NFS_TICKINTVL + 500) / 1000;
878 	if (nfscl_ticks < 1)
879 		nfscl_ticks = 1;
880 	NFSSETBOOTTIME(nfsboottime);
881 
882 	/*
883 	 * Initialize reply list and start timer
884 	 */
885 	TAILQ_INIT(&nfsd_reqq);
886 	NFS_TIMERINIT;
887 }
888 
889 /*
890  * Put a file handle in an mbuf list.
891  * If the size argument == 0, just use the default size.
892  * set_true == 1 if there should be an newnfs_true prepended on the file handle.
893  * Return the number of bytes output, including XDR overhead.
894  */
895 APPLESTATIC int
896 nfsm_fhtom(struct nfsrv_descript *nd, u_int8_t *fhp, int size, int set_true)
897 {
898 	u_int32_t *tl;
899 	u_int8_t *cp;
900 	int fullsiz, rem, bytesize = 0;
901 
902 	if (size == 0)
903 		size = NFSX_MYFH;
904 	switch (nd->nd_flag & (ND_NFSV2 | ND_NFSV3 | ND_NFSV4)) {
905 	case ND_NFSV2:
906 		if (size > NFSX_V2FH)
907 			panic("fh size > NFSX_V2FH for NFSv2");
908 		NFSM_BUILD(cp, u_int8_t *, NFSX_V2FH);
909 		NFSBCOPY(fhp, cp, size);
910 		if (size < NFSX_V2FH)
911 			NFSBZERO(cp + size, NFSX_V2FH - size);
912 		bytesize = NFSX_V2FH;
913 		break;
914 	case ND_NFSV3:
915 	case ND_NFSV4:
916 		fullsiz = NFSM_RNDUP(size);
917 		rem = fullsiz - size;
918 		if (set_true) {
919 		    bytesize = 2 * NFSX_UNSIGNED + fullsiz;
920 		    NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
921 		    *tl = newnfs_true;
922 		} else {
923 		    bytesize = NFSX_UNSIGNED + fullsiz;
924 		}
925 		(void) nfsm_strtom(nd, fhp, size);
926 		break;
927 	}
928 	return (bytesize);
929 }
930 
931 /*
932  * This function compares two net addresses by family and returns TRUE
933  * if they are the same host.
934  * If there is any doubt, return FALSE.
935  * The AF_INET family is handled as a special case so that address mbufs
936  * don't need to be saved to store "struct in_addr", which is only 4 bytes.
937  */
938 APPLESTATIC int
939 nfsaddr_match(int family, union nethostaddr *haddr, NFSSOCKADDR_T nam)
940 {
941 #ifdef INET
942 	struct sockaddr_in *inetaddr;
943 #endif
944 
945 	switch (family) {
946 #ifdef INET
947 	case AF_INET:
948 		inetaddr = NFSSOCKADDR(nam, struct sockaddr_in *);
949 		if (inetaddr->sin_family == AF_INET &&
950 		    inetaddr->sin_addr.s_addr == haddr->had_inet.s_addr)
951 			return (1);
952 		break;
953 #endif
954 #ifdef INET6
955 	case AF_INET6:
956 		{
957 		struct sockaddr_in6 *inetaddr6;
958 
959 		inetaddr6 = NFSSOCKADDR(nam, struct sockaddr_in6 *);
960 		/* XXX - should test sin6_scope_id ? */
961 		if (inetaddr6->sin6_family == AF_INET6 &&
962 		    IN6_ARE_ADDR_EQUAL(&inetaddr6->sin6_addr,
963 			  &haddr->had_inet6))
964 			return (1);
965 		}
966 		break;
967 #endif
968 	}
969 	return (0);
970 }
971 
972 /*
973  * Similar to the above, but takes to NFSSOCKADDR_T args.
974  */
975 APPLESTATIC int
976 nfsaddr2_match(NFSSOCKADDR_T nam1, NFSSOCKADDR_T nam2)
977 {
978 	struct sockaddr_in *addr1, *addr2;
979 	struct sockaddr *inaddr;
980 
981 	inaddr = NFSSOCKADDR(nam1, struct sockaddr *);
982 	switch (inaddr->sa_family) {
983 	case AF_INET:
984 		addr1 = NFSSOCKADDR(nam1, struct sockaddr_in *);
985 		addr2 = NFSSOCKADDR(nam2, struct sockaddr_in *);
986 		if (addr2->sin_family == AF_INET &&
987 		    addr1->sin_addr.s_addr == addr2->sin_addr.s_addr)
988 			return (1);
989 		break;
990 #ifdef INET6
991 	case AF_INET6:
992 		{
993 		struct sockaddr_in6 *inet6addr1, *inet6addr2;
994 
995 		inet6addr1 = NFSSOCKADDR(nam1, struct sockaddr_in6 *);
996 		inet6addr2 = NFSSOCKADDR(nam2, struct sockaddr_in6 *);
997 		/* XXX - should test sin6_scope_id ? */
998 		if (inet6addr2->sin6_family == AF_INET6 &&
999 		    IN6_ARE_ADDR_EQUAL(&inet6addr1->sin6_addr,
1000 			  &inet6addr2->sin6_addr))
1001 			return (1);
1002 		}
1003 		break;
1004 #endif
1005 	}
1006 	return (0);
1007 }
1008 
1009 
1010 /*
1011  * Trim the stuff already dissected off the mbuf list.
1012  */
1013 APPLESTATIC void
1014 newnfs_trimleading(nd)
1015 	struct nfsrv_descript *nd;
1016 {
1017 	mbuf_t m, n;
1018 	int offs;
1019 
1020 	/*
1021 	 * First, free up leading mbufs.
1022 	 */
1023 	if (nd->nd_mrep != nd->nd_md) {
1024 		m = nd->nd_mrep;
1025 		while (mbuf_next(m) != nd->nd_md) {
1026 			if (mbuf_next(m) == NULL)
1027 				panic("nfsm trim leading");
1028 			m = mbuf_next(m);
1029 		}
1030 		mbuf_setnext(m, NULL);
1031 		mbuf_freem(nd->nd_mrep);
1032 	}
1033 	m = nd->nd_md;
1034 
1035 	/*
1036 	 * Now, adjust this mbuf, based on nd_dpos.
1037 	 */
1038 	offs = nd->nd_dpos - NFSMTOD(m, caddr_t);
1039 	if (offs == mbuf_len(m)) {
1040 		n = m;
1041 		m = mbuf_next(m);
1042 		if (m == NULL)
1043 			panic("nfsm trim leading2");
1044 		mbuf_setnext(n, NULL);
1045 		mbuf_freem(n);
1046 	} else if (offs > 0) {
1047 		mbuf_setlen(m, mbuf_len(m) - offs);
1048 		NFSM_DATAP(m, offs);
1049 	} else if (offs < 0)
1050 		panic("nfsm trimleading offs");
1051 	nd->nd_mrep = m;
1052 	nd->nd_md = m;
1053 	nd->nd_dpos = NFSMTOD(m, caddr_t);
1054 }
1055 
1056 /*
1057  * Trim trailing data off the mbuf list being built.
1058  */
1059 APPLESTATIC void
1060 newnfs_trimtrailing(nd, mb, bpos)
1061 	struct nfsrv_descript *nd;
1062 	mbuf_t mb;
1063 	caddr_t bpos;
1064 {
1065 
1066 	if (mbuf_next(mb)) {
1067 		mbuf_freem(mbuf_next(mb));
1068 		mbuf_setnext(mb, NULL);
1069 	}
1070 	mbuf_setlen(mb, bpos - NFSMTOD(mb, caddr_t));
1071 	nd->nd_mb = mb;
1072 	nd->nd_bpos = bpos;
1073 }
1074 
1075 /*
1076  * Dissect a file handle on the client.
1077  */
1078 APPLESTATIC int
1079 nfsm_getfh(struct nfsrv_descript *nd, struct nfsfh **nfhpp)
1080 {
1081 	u_int32_t *tl;
1082 	struct nfsfh *nfhp;
1083 	int error, len;
1084 
1085 	*nfhpp = NULL;
1086 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
1087 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1088 		if ((len = fxdr_unsigned(int, *tl)) <= 0 ||
1089 			len > NFSX_FHMAX) {
1090 			error = EBADRPC;
1091 			goto nfsmout;
1092 		}
1093 	} else
1094 		len = NFSX_V2FH;
1095 	nfhp = malloc(sizeof (struct nfsfh) + len,
1096 	    M_NFSFH, M_WAITOK);
1097 	error = nfsrv_mtostr(nd, nfhp->nfh_fh, len);
1098 	if (error) {
1099 		free(nfhp, M_NFSFH);
1100 		goto nfsmout;
1101 	}
1102 	nfhp->nfh_len = len;
1103 	*nfhpp = nfhp;
1104 nfsmout:
1105 	NFSEXITCODE2(error, nd);
1106 	return (error);
1107 }
1108 
1109 /*
1110  * Break down the nfsv4 acl.
1111  * If the aclp == NULL or won't fit in an acl, just discard the acl info.
1112  */
1113 APPLESTATIC int
1114 nfsrv_dissectacl(struct nfsrv_descript *nd, NFSACL_T *aclp, int *aclerrp,
1115     int *aclsizep, __unused NFSPROC_T *p)
1116 {
1117 	u_int32_t *tl;
1118 	int i, aclsize;
1119 	int acecnt, error = 0, aceerr = 0, acesize;
1120 
1121 	*aclerrp = 0;
1122 	if (aclp)
1123 		aclp->acl_cnt = 0;
1124 	/*
1125 	 * Parse out the ace entries and expect them to conform to
1126 	 * what can be supported by R/W/X bits.
1127 	 */
1128 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1129 	aclsize = NFSX_UNSIGNED;
1130 	acecnt = fxdr_unsigned(int, *tl);
1131 	if (acecnt > ACL_MAX_ENTRIES)
1132 		aceerr = NFSERR_ATTRNOTSUPP;
1133 	if (nfsrv_useacl == 0)
1134 		aceerr = NFSERR_ATTRNOTSUPP;
1135 	for (i = 0; i < acecnt; i++) {
1136 		if (aclp && !aceerr)
1137 			error = nfsrv_dissectace(nd, &aclp->acl_entry[i],
1138 			    &aceerr, &acesize, p);
1139 		else
1140 			error = nfsrv_skipace(nd, &acesize);
1141 		if (error)
1142 			goto nfsmout;
1143 		aclsize += acesize;
1144 	}
1145 	if (aclp && !aceerr)
1146 		aclp->acl_cnt = acecnt;
1147 	if (aceerr)
1148 		*aclerrp = aceerr;
1149 	if (aclsizep)
1150 		*aclsizep = aclsize;
1151 nfsmout:
1152 	NFSEXITCODE2(error, nd);
1153 	return (error);
1154 }
1155 
1156 /*
1157  * Skip over an NFSv4 ace entry. Just dissect the xdr and discard it.
1158  */
1159 static int
1160 nfsrv_skipace(struct nfsrv_descript *nd, int *acesizep)
1161 {
1162 	u_int32_t *tl;
1163 	int error, len = 0;
1164 
1165 	NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1166 	len = fxdr_unsigned(int, *(tl + 3));
1167 	error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
1168 nfsmout:
1169 	*acesizep = NFSM_RNDUP(len) + (4 * NFSX_UNSIGNED);
1170 	NFSEXITCODE2(error, nd);
1171 	return (error);
1172 }
1173 
1174 /*
1175  * Get attribute bits from an mbuf list.
1176  * Returns EBADRPC for a parsing error, 0 otherwise.
1177  * If the clearinvalid flag is set, clear the bits not supported.
1178  */
1179 APPLESTATIC int
1180 nfsrv_getattrbits(struct nfsrv_descript *nd, nfsattrbit_t *attrbitp, int *cntp,
1181     int *retnotsupp)
1182 {
1183 	u_int32_t *tl;
1184 	int cnt, i, outcnt;
1185 	int error = 0;
1186 
1187 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1188 	cnt = fxdr_unsigned(int, *tl);
1189 	if (cnt < 0) {
1190 		error = NFSERR_BADXDR;
1191 		goto nfsmout;
1192 	}
1193 	if (cnt > NFSATTRBIT_MAXWORDS)
1194 		outcnt = NFSATTRBIT_MAXWORDS;
1195 	else
1196 		outcnt = cnt;
1197 	NFSZERO_ATTRBIT(attrbitp);
1198 	if (outcnt > 0) {
1199 		NFSM_DISSECT(tl, u_int32_t *, outcnt * NFSX_UNSIGNED);
1200 		for (i = 0; i < outcnt; i++)
1201 			attrbitp->bits[i] = fxdr_unsigned(u_int32_t, *tl++);
1202 	}
1203 	for (i = 0; i < (cnt - outcnt); i++) {
1204 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1205 		if (retnotsupp != NULL && *tl != 0)
1206 			*retnotsupp = NFSERR_ATTRNOTSUPP;
1207 	}
1208 	if (cntp)
1209 		*cntp = NFSX_UNSIGNED + (cnt * NFSX_UNSIGNED);
1210 nfsmout:
1211 	NFSEXITCODE2(error, nd);
1212 	return (error);
1213 }
1214 
1215 /*
1216  * Get the attributes for V4.
1217  * If the compare flag is true, test for any attribute changes,
1218  * otherwise return the attribute values.
1219  * These attributes cover fields in "struct vattr", "struct statfs",
1220  * "struct nfsfsinfo", the file handle and the lease duration.
1221  * The value of retcmpp is set to 1 if all attributes are the same,
1222  * and 0 otherwise.
1223  * Returns EBADRPC if it can't be parsed, 0 otherwise.
1224  */
1225 APPLESTATIC int
1226 nfsv4_loadattr(struct nfsrv_descript *nd, vnode_t vp,
1227     struct nfsvattr *nap, struct nfsfh **nfhpp, fhandle_t *fhp, int fhsize,
1228     struct nfsv3_pathconf *pc, struct statfs *sbp, struct nfsstatfs *sfp,
1229     struct nfsfsinfo *fsp, NFSACL_T *aclp, int compare, int *retcmpp,
1230     u_int32_t *leasep, u_int32_t *rderrp, NFSPROC_T *p, struct ucred *cred)
1231 {
1232 	u_int32_t *tl;
1233 	int i = 0, j, k, l = 0, m, bitpos, attrsum = 0;
1234 	int error, tfhsize, aceerr, attrsize, cnt, retnotsup;
1235 	u_char *cp, *cp2, namestr[NFSV4_SMALLSTR + 1];
1236 	nfsattrbit_t attrbits, retattrbits, checkattrbits;
1237 	struct nfsfh *tnfhp;
1238 	struct nfsreferral *refp;
1239 	u_quad_t tquad;
1240 	nfsquad_t tnfsquad;
1241 	struct timespec temptime;
1242 	uid_t uid;
1243 	gid_t gid;
1244 	u_int32_t freenum = 0, tuint;
1245 	u_int64_t uquad = 0, thyp, thyp2;
1246 #ifdef QUOTA
1247 	struct dqblk dqb;
1248 	uid_t savuid;
1249 #endif
1250 
1251 	CTASSERT(sizeof(ino_t) == sizeof(uint64_t));
1252 	if (compare) {
1253 		retnotsup = 0;
1254 		error = nfsrv_getattrbits(nd, &attrbits, NULL, &retnotsup);
1255 	} else {
1256 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
1257 	}
1258 	if (error)
1259 		goto nfsmout;
1260 
1261 	if (compare) {
1262 		*retcmpp = retnotsup;
1263 	} else {
1264 		/*
1265 		 * Just set default values to some of the important ones.
1266 		 */
1267 		if (nap != NULL) {
1268 			nap->na_type = VREG;
1269 			nap->na_mode = 0;
1270 			nap->na_rdev = (NFSDEV_T)0;
1271 			nap->na_mtime.tv_sec = 0;
1272 			nap->na_mtime.tv_nsec = 0;
1273 			nap->na_gen = 0;
1274 			nap->na_flags = 0;
1275 			nap->na_blocksize = NFS_FABLKSIZE;
1276 		}
1277 		if (sbp != NULL) {
1278 			sbp->f_bsize = NFS_FABLKSIZE;
1279 			sbp->f_blocks = 0;
1280 			sbp->f_bfree = 0;
1281 			sbp->f_bavail = 0;
1282 			sbp->f_files = 0;
1283 			sbp->f_ffree = 0;
1284 		}
1285 		if (fsp != NULL) {
1286 			fsp->fs_rtmax = 8192;
1287 			fsp->fs_rtpref = 8192;
1288 			fsp->fs_maxname = NFS_MAXNAMLEN;
1289 			fsp->fs_wtmax = 8192;
1290 			fsp->fs_wtpref = 8192;
1291 			fsp->fs_wtmult = NFS_FABLKSIZE;
1292 			fsp->fs_dtpref = 8192;
1293 			fsp->fs_maxfilesize = 0xffffffffffffffffull;
1294 			fsp->fs_timedelta.tv_sec = 0;
1295 			fsp->fs_timedelta.tv_nsec = 1;
1296 			fsp->fs_properties = (NFSV3_FSFLINK | NFSV3_FSFSYMLINK |
1297 				NFSV3_FSFHOMOGENEOUS | NFSV3_FSFCANSETTIME);
1298 		}
1299 		if (pc != NULL) {
1300 			pc->pc_linkmax = NFS_LINK_MAX;
1301 			pc->pc_namemax = NAME_MAX;
1302 			pc->pc_notrunc = 0;
1303 			pc->pc_chownrestricted = 0;
1304 			pc->pc_caseinsensitive = 0;
1305 			pc->pc_casepreserving = 1;
1306 		}
1307 		if (sfp != NULL) {
1308 			sfp->sf_ffiles = UINT64_MAX;
1309 			sfp->sf_tfiles = UINT64_MAX;
1310 			sfp->sf_afiles = UINT64_MAX;
1311 			sfp->sf_fbytes = UINT64_MAX;
1312 			sfp->sf_tbytes = UINT64_MAX;
1313 			sfp->sf_abytes = UINT64_MAX;
1314 		}
1315 	}
1316 
1317 	/*
1318 	 * Loop around getting the attributes.
1319 	 */
1320 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1321 	attrsize = fxdr_unsigned(int, *tl);
1322 	for (bitpos = 0; bitpos < NFSATTRBIT_MAX; bitpos++) {
1323 	    if (attrsum > attrsize) {
1324 		error = NFSERR_BADXDR;
1325 		goto nfsmout;
1326 	    }
1327 	    if (NFSISSET_ATTRBIT(&attrbits, bitpos))
1328 		switch (bitpos) {
1329 		case NFSATTRBIT_SUPPORTEDATTRS:
1330 			retnotsup = 0;
1331 			if (compare || nap == NULL)
1332 			    error = nfsrv_getattrbits(nd, &retattrbits,
1333 				&cnt, &retnotsup);
1334 			else
1335 			    error = nfsrv_getattrbits(nd, &nap->na_suppattr,
1336 				&cnt, &retnotsup);
1337 			if (error)
1338 			    goto nfsmout;
1339 			if (compare && !(*retcmpp)) {
1340 			   NFSSETSUPP_ATTRBIT(&checkattrbits, nd);
1341 
1342 			   /* Some filesystem do not support NFSv4ACL   */
1343 			   if (nfsrv_useacl == 0 || nfs_supportsnfsv4acls(vp) == 0) {
1344 				NFSCLRBIT_ATTRBIT(&checkattrbits, NFSATTRBIT_ACL);
1345 				NFSCLRBIT_ATTRBIT(&checkattrbits, NFSATTRBIT_ACLSUPPORT);
1346 		   	   }
1347 			   if (!NFSEQUAL_ATTRBIT(&retattrbits, &checkattrbits)
1348 			       || retnotsup)
1349 				*retcmpp = NFSERR_NOTSAME;
1350 			}
1351 			attrsum += cnt;
1352 			break;
1353 		case NFSATTRBIT_TYPE:
1354 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1355 			if (compare) {
1356 				if (!(*retcmpp)) {
1357 				    if (nap->na_type != nfsv34tov_type(*tl))
1358 					*retcmpp = NFSERR_NOTSAME;
1359 				}
1360 			} else if (nap != NULL) {
1361 				nap->na_type = nfsv34tov_type(*tl);
1362 			}
1363 			attrsum += NFSX_UNSIGNED;
1364 			break;
1365 		case NFSATTRBIT_FHEXPIRETYPE:
1366 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1367 			if (compare && !(*retcmpp)) {
1368 				if (fxdr_unsigned(int, *tl) !=
1369 					NFSV4FHTYPE_PERSISTENT)
1370 					*retcmpp = NFSERR_NOTSAME;
1371 			}
1372 			attrsum += NFSX_UNSIGNED;
1373 			break;
1374 		case NFSATTRBIT_CHANGE:
1375 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1376 			if (compare) {
1377 				if (!(*retcmpp)) {
1378 				    if (nap->na_filerev != fxdr_hyper(tl))
1379 					*retcmpp = NFSERR_NOTSAME;
1380 				}
1381 			} else if (nap != NULL) {
1382 				nap->na_filerev = fxdr_hyper(tl);
1383 			}
1384 			attrsum += NFSX_HYPER;
1385 			break;
1386 		case NFSATTRBIT_SIZE:
1387 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1388 			if (compare) {
1389 				if (!(*retcmpp)) {
1390 				    if (nap->na_size != fxdr_hyper(tl))
1391 					*retcmpp = NFSERR_NOTSAME;
1392 				}
1393 			} else if (nap != NULL) {
1394 				nap->na_size = fxdr_hyper(tl);
1395 			}
1396 			attrsum += NFSX_HYPER;
1397 			break;
1398 		case NFSATTRBIT_LINKSUPPORT:
1399 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1400 			if (compare) {
1401 				if (!(*retcmpp)) {
1402 				    if (fsp->fs_properties & NFSV3_FSFLINK) {
1403 					if (*tl == newnfs_false)
1404 						*retcmpp = NFSERR_NOTSAME;
1405 				    } else {
1406 					if (*tl == newnfs_true)
1407 						*retcmpp = NFSERR_NOTSAME;
1408 				    }
1409 				}
1410 			} else if (fsp != NULL) {
1411 				if (*tl == newnfs_true)
1412 					fsp->fs_properties |= NFSV3_FSFLINK;
1413 				else
1414 					fsp->fs_properties &= ~NFSV3_FSFLINK;
1415 			}
1416 			attrsum += NFSX_UNSIGNED;
1417 			break;
1418 		case NFSATTRBIT_SYMLINKSUPPORT:
1419 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1420 			if (compare) {
1421 				if (!(*retcmpp)) {
1422 				    if (fsp->fs_properties & NFSV3_FSFSYMLINK) {
1423 					if (*tl == newnfs_false)
1424 						*retcmpp = NFSERR_NOTSAME;
1425 				    } else {
1426 					if (*tl == newnfs_true)
1427 						*retcmpp = NFSERR_NOTSAME;
1428 				    }
1429 				}
1430 			} else if (fsp != NULL) {
1431 				if (*tl == newnfs_true)
1432 					fsp->fs_properties |= NFSV3_FSFSYMLINK;
1433 				else
1434 					fsp->fs_properties &= ~NFSV3_FSFSYMLINK;
1435 			}
1436 			attrsum += NFSX_UNSIGNED;
1437 			break;
1438 		case NFSATTRBIT_NAMEDATTR:
1439 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1440 			if (compare && !(*retcmpp)) {
1441 				if (*tl != newnfs_false)
1442 					*retcmpp = NFSERR_NOTSAME;
1443 			}
1444 			attrsum += NFSX_UNSIGNED;
1445 			break;
1446 		case NFSATTRBIT_FSID:
1447 			NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1448 			thyp = fxdr_hyper(tl);
1449 			tl += 2;
1450 			thyp2 = fxdr_hyper(tl);
1451 			if (compare) {
1452 			    if (*retcmpp == 0) {
1453 				if (thyp != (u_int64_t)
1454 				    vfs_statfs(vnode_mount(vp))->f_fsid.val[0] ||
1455 				    thyp2 != (u_int64_t)
1456 				    vfs_statfs(vnode_mount(vp))->f_fsid.val[1])
1457 					*retcmpp = NFSERR_NOTSAME;
1458 			    }
1459 			} else if (nap != NULL) {
1460 				nap->na_filesid[0] = thyp;
1461 				nap->na_filesid[1] = thyp2;
1462 			}
1463 			attrsum += (4 * NFSX_UNSIGNED);
1464 			break;
1465 		case NFSATTRBIT_UNIQUEHANDLES:
1466 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1467 			if (compare && !(*retcmpp)) {
1468 				if (*tl != newnfs_true)
1469 					*retcmpp = NFSERR_NOTSAME;
1470 			}
1471 			attrsum += NFSX_UNSIGNED;
1472 			break;
1473 		case NFSATTRBIT_LEASETIME:
1474 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1475 			if (compare) {
1476 				if (fxdr_unsigned(int, *tl) != nfsrv_lease &&
1477 				    !(*retcmpp))
1478 					*retcmpp = NFSERR_NOTSAME;
1479 			} else if (leasep != NULL) {
1480 				*leasep = fxdr_unsigned(u_int32_t, *tl);
1481 			}
1482 			attrsum += NFSX_UNSIGNED;
1483 			break;
1484 		case NFSATTRBIT_RDATTRERROR:
1485 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1486 			if (compare) {
1487 				 if (!(*retcmpp))
1488 					*retcmpp = NFSERR_INVAL;
1489 			} else if (rderrp != NULL) {
1490 				*rderrp = fxdr_unsigned(u_int32_t, *tl);
1491 			}
1492 			attrsum += NFSX_UNSIGNED;
1493 			break;
1494 		case NFSATTRBIT_ACL:
1495 			if (compare) {
1496 			  if (!(*retcmpp)) {
1497 			    if (nfsrv_useacl && nfs_supportsnfsv4acls(vp)) {
1498 				NFSACL_T *naclp;
1499 
1500 				naclp = acl_alloc(M_WAITOK);
1501 				error = nfsrv_dissectacl(nd, naclp, &aceerr,
1502 				    &cnt, p);
1503 				if (error) {
1504 				    acl_free(naclp);
1505 				    goto nfsmout;
1506 				}
1507 				if (aceerr || aclp == NULL ||
1508 				    nfsrv_compareacl(aclp, naclp))
1509 				    *retcmpp = NFSERR_NOTSAME;
1510 				acl_free(naclp);
1511 			    } else {
1512 				error = nfsrv_dissectacl(nd, NULL, &aceerr,
1513 				    &cnt, p);
1514 				*retcmpp = NFSERR_ATTRNOTSUPP;
1515 			    }
1516 			  }
1517 			} else {
1518 				if (vp != NULL && aclp != NULL)
1519 				    error = nfsrv_dissectacl(nd, aclp, &aceerr,
1520 					&cnt, p);
1521 				else
1522 				    error = nfsrv_dissectacl(nd, NULL, &aceerr,
1523 					&cnt, p);
1524 				if (error)
1525 				    goto nfsmout;
1526 			}
1527 
1528 			attrsum += cnt;
1529 			break;
1530 		case NFSATTRBIT_ACLSUPPORT:
1531 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1532 			if (compare && !(*retcmpp)) {
1533 				if (nfsrv_useacl && nfs_supportsnfsv4acls(vp)) {
1534 					if (fxdr_unsigned(u_int32_t, *tl) !=
1535 					    NFSV4ACE_SUPTYPES)
1536 						*retcmpp = NFSERR_NOTSAME;
1537 				} else {
1538 					*retcmpp = NFSERR_ATTRNOTSUPP;
1539 				}
1540 			}
1541 			attrsum += NFSX_UNSIGNED;
1542 			break;
1543 		case NFSATTRBIT_ARCHIVE:
1544 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1545 			if (compare && !(*retcmpp))
1546 				*retcmpp = NFSERR_ATTRNOTSUPP;
1547 			attrsum += NFSX_UNSIGNED;
1548 			break;
1549 		case NFSATTRBIT_CANSETTIME:
1550 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1551 			if (compare) {
1552 				if (!(*retcmpp)) {
1553 				    if (fsp->fs_properties & NFSV3_FSFCANSETTIME) {
1554 					if (*tl == newnfs_false)
1555 						*retcmpp = NFSERR_NOTSAME;
1556 				    } else {
1557 					if (*tl == newnfs_true)
1558 						*retcmpp = NFSERR_NOTSAME;
1559 				    }
1560 				}
1561 			} else if (fsp != NULL) {
1562 				if (*tl == newnfs_true)
1563 					fsp->fs_properties |= NFSV3_FSFCANSETTIME;
1564 				else
1565 					fsp->fs_properties &= ~NFSV3_FSFCANSETTIME;
1566 			}
1567 			attrsum += NFSX_UNSIGNED;
1568 			break;
1569 		case NFSATTRBIT_CASEINSENSITIVE:
1570 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1571 			if (compare) {
1572 				if (!(*retcmpp)) {
1573 				    if (*tl != newnfs_false)
1574 					*retcmpp = NFSERR_NOTSAME;
1575 				}
1576 			} else if (pc != NULL) {
1577 				pc->pc_caseinsensitive =
1578 				    fxdr_unsigned(u_int32_t, *tl);
1579 			}
1580 			attrsum += NFSX_UNSIGNED;
1581 			break;
1582 		case NFSATTRBIT_CASEPRESERVING:
1583 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1584 			if (compare) {
1585 				if (!(*retcmpp)) {
1586 				    if (*tl != newnfs_true)
1587 					*retcmpp = NFSERR_NOTSAME;
1588 				}
1589 			} else if (pc != NULL) {
1590 				pc->pc_casepreserving =
1591 				    fxdr_unsigned(u_int32_t, *tl);
1592 			}
1593 			attrsum += NFSX_UNSIGNED;
1594 			break;
1595 		case NFSATTRBIT_CHOWNRESTRICTED:
1596 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1597 			if (compare) {
1598 				if (!(*retcmpp)) {
1599 				    if (*tl != newnfs_true)
1600 					*retcmpp = NFSERR_NOTSAME;
1601 				}
1602 			} else if (pc != NULL) {
1603 				pc->pc_chownrestricted =
1604 				    fxdr_unsigned(u_int32_t, *tl);
1605 			}
1606 			attrsum += NFSX_UNSIGNED;
1607 			break;
1608 		case NFSATTRBIT_FILEHANDLE:
1609 			error = nfsm_getfh(nd, &tnfhp);
1610 			if (error)
1611 				goto nfsmout;
1612 			tfhsize = tnfhp->nfh_len;
1613 			if (compare) {
1614 				if (!(*retcmpp) &&
1615 				    !NFSRV_CMPFH(tnfhp->nfh_fh, tfhsize,
1616 				     fhp, fhsize))
1617 					*retcmpp = NFSERR_NOTSAME;
1618 				free(tnfhp, M_NFSFH);
1619 			} else if (nfhpp != NULL) {
1620 				*nfhpp = tnfhp;
1621 			} else {
1622 				free(tnfhp, M_NFSFH);
1623 			}
1624 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(tfhsize));
1625 			break;
1626 		case NFSATTRBIT_FILEID:
1627 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1628 			thyp = fxdr_hyper(tl);
1629 			if (compare) {
1630 				if (!(*retcmpp)) {
1631 					if (nap->na_fileid != thyp)
1632 						*retcmpp = NFSERR_NOTSAME;
1633 				}
1634 			} else if (nap != NULL)
1635 				nap->na_fileid = thyp;
1636 			attrsum += NFSX_HYPER;
1637 			break;
1638 		case NFSATTRBIT_FILESAVAIL:
1639 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1640 			if (compare) {
1641 				if (!(*retcmpp) &&
1642 				    sfp->sf_afiles != fxdr_hyper(tl))
1643 					*retcmpp = NFSERR_NOTSAME;
1644 			} else if (sfp != NULL) {
1645 				sfp->sf_afiles = fxdr_hyper(tl);
1646 			}
1647 			attrsum += NFSX_HYPER;
1648 			break;
1649 		case NFSATTRBIT_FILESFREE:
1650 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1651 			if (compare) {
1652 				if (!(*retcmpp) &&
1653 				    sfp->sf_ffiles != fxdr_hyper(tl))
1654 					*retcmpp = NFSERR_NOTSAME;
1655 			} else if (sfp != NULL) {
1656 				sfp->sf_ffiles = fxdr_hyper(tl);
1657 			}
1658 			attrsum += NFSX_HYPER;
1659 			break;
1660 		case NFSATTRBIT_FILESTOTAL:
1661 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1662 			if (compare) {
1663 				if (!(*retcmpp) &&
1664 				    sfp->sf_tfiles != fxdr_hyper(tl))
1665 					*retcmpp = NFSERR_NOTSAME;
1666 			} else if (sfp != NULL) {
1667 				sfp->sf_tfiles = fxdr_hyper(tl);
1668 			}
1669 			attrsum += NFSX_HYPER;
1670 			break;
1671 		case NFSATTRBIT_FSLOCATIONS:
1672 			error = nfsrv_getrefstr(nd, &cp, &cp2, &l, &m);
1673 			if (error)
1674 				goto nfsmout;
1675 			attrsum += l;
1676 			if (compare && !(*retcmpp)) {
1677 				refp = nfsv4root_getreferral(vp, NULL, 0);
1678 				if (refp != NULL) {
1679 					if (cp == NULL || cp2 == NULL ||
1680 					    strcmp(cp, "/") ||
1681 					    strcmp(cp2, refp->nfr_srvlist))
1682 						*retcmpp = NFSERR_NOTSAME;
1683 				} else if (m == 0) {
1684 					*retcmpp = NFSERR_NOTSAME;
1685 				}
1686 			}
1687 			if (cp != NULL)
1688 				free(cp, M_NFSSTRING);
1689 			if (cp2 != NULL)
1690 				free(cp2, M_NFSSTRING);
1691 			break;
1692 		case NFSATTRBIT_HIDDEN:
1693 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1694 			if (compare && !(*retcmpp))
1695 				*retcmpp = NFSERR_ATTRNOTSUPP;
1696 			attrsum += NFSX_UNSIGNED;
1697 			break;
1698 		case NFSATTRBIT_HOMOGENEOUS:
1699 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1700 			if (compare) {
1701 				if (!(*retcmpp)) {
1702 				    if (fsp->fs_properties &
1703 					NFSV3_FSFHOMOGENEOUS) {
1704 					if (*tl == newnfs_false)
1705 						*retcmpp = NFSERR_NOTSAME;
1706 				    } else {
1707 					if (*tl == newnfs_true)
1708 						*retcmpp = NFSERR_NOTSAME;
1709 				    }
1710 				}
1711 			} else if (fsp != NULL) {
1712 				if (*tl == newnfs_true)
1713 				    fsp->fs_properties |= NFSV3_FSFHOMOGENEOUS;
1714 				else
1715 				    fsp->fs_properties &= ~NFSV3_FSFHOMOGENEOUS;
1716 			}
1717 			attrsum += NFSX_UNSIGNED;
1718 			break;
1719 		case NFSATTRBIT_MAXFILESIZE:
1720 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1721 			tnfsquad.qval = fxdr_hyper(tl);
1722 			if (compare) {
1723 				if (!(*retcmpp)) {
1724 					tquad = NFSRV_MAXFILESIZE;
1725 					if (tquad != tnfsquad.qval)
1726 						*retcmpp = NFSERR_NOTSAME;
1727 				}
1728 			} else if (fsp != NULL) {
1729 				fsp->fs_maxfilesize = tnfsquad.qval;
1730 			}
1731 			attrsum += NFSX_HYPER;
1732 			break;
1733 		case NFSATTRBIT_MAXLINK:
1734 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1735 			if (compare) {
1736 				if (!(*retcmpp)) {
1737 				    if (fxdr_unsigned(int, *tl) != NFS_LINK_MAX)
1738 					*retcmpp = NFSERR_NOTSAME;
1739 				}
1740 			} else if (pc != NULL) {
1741 				pc->pc_linkmax = fxdr_unsigned(u_int32_t, *tl);
1742 			}
1743 			attrsum += NFSX_UNSIGNED;
1744 			break;
1745 		case NFSATTRBIT_MAXNAME:
1746 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1747 			if (compare) {
1748 				if (!(*retcmpp)) {
1749 				    if (fsp->fs_maxname !=
1750 					fxdr_unsigned(u_int32_t, *tl))
1751 						*retcmpp = NFSERR_NOTSAME;
1752 				}
1753 			} else {
1754 				tuint = fxdr_unsigned(u_int32_t, *tl);
1755 				/*
1756 				 * Some Linux NFSv4 servers report this
1757 				 * as 0 or 4billion, so I'll set it to
1758 				 * NFS_MAXNAMLEN. If a server actually creates
1759 				 * a name longer than NFS_MAXNAMLEN, it will
1760 				 * get an error back.
1761 				 */
1762 				if (tuint == 0 || tuint > NFS_MAXNAMLEN)
1763 					tuint = NFS_MAXNAMLEN;
1764 				if (fsp != NULL)
1765 					fsp->fs_maxname = tuint;
1766 				if (pc != NULL)
1767 					pc->pc_namemax = tuint;
1768 			}
1769 			attrsum += NFSX_UNSIGNED;
1770 			break;
1771 		case NFSATTRBIT_MAXREAD:
1772 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1773 			if (compare) {
1774 				if (!(*retcmpp)) {
1775 				    if (fsp->fs_rtmax != fxdr_unsigned(u_int32_t,
1776 					*(tl + 1)) || *tl != 0)
1777 					*retcmpp = NFSERR_NOTSAME;
1778 				}
1779 			} else if (fsp != NULL) {
1780 				fsp->fs_rtmax = fxdr_unsigned(u_int32_t, *++tl);
1781 				fsp->fs_rtpref = fsp->fs_rtmax;
1782 				fsp->fs_dtpref = fsp->fs_rtpref;
1783 			}
1784 			attrsum += NFSX_HYPER;
1785 			break;
1786 		case NFSATTRBIT_MAXWRITE:
1787 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1788 			if (compare) {
1789 				if (!(*retcmpp)) {
1790 				    if (fsp->fs_wtmax != fxdr_unsigned(u_int32_t,
1791 					*(tl + 1)) || *tl != 0)
1792 					*retcmpp = NFSERR_NOTSAME;
1793 				}
1794 			} else if (fsp != NULL) {
1795 				fsp->fs_wtmax = fxdr_unsigned(int, *++tl);
1796 				fsp->fs_wtpref = fsp->fs_wtmax;
1797 			}
1798 			attrsum += NFSX_HYPER;
1799 			break;
1800 		case NFSATTRBIT_MIMETYPE:
1801 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1802 			i = fxdr_unsigned(int, *tl);
1803 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(i));
1804 			error = nfsm_advance(nd, NFSM_RNDUP(i), -1);
1805 			if (error)
1806 				goto nfsmout;
1807 			if (compare && !(*retcmpp))
1808 				*retcmpp = NFSERR_ATTRNOTSUPP;
1809 			break;
1810 		case NFSATTRBIT_MODE:
1811 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1812 			if (compare) {
1813 				if (!(*retcmpp)) {
1814 				    if (nap->na_mode != nfstov_mode(*tl))
1815 					*retcmpp = NFSERR_NOTSAME;
1816 				}
1817 			} else if (nap != NULL) {
1818 				nap->na_mode = nfstov_mode(*tl);
1819 			}
1820 			attrsum += NFSX_UNSIGNED;
1821 			break;
1822 		case NFSATTRBIT_NOTRUNC:
1823 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1824 			if (compare) {
1825 				if (!(*retcmpp)) {
1826 				    if (*tl != newnfs_true)
1827 					*retcmpp = NFSERR_NOTSAME;
1828 				}
1829 			} else if (pc != NULL) {
1830 				pc->pc_notrunc = fxdr_unsigned(u_int32_t, *tl);
1831 			}
1832 			attrsum += NFSX_UNSIGNED;
1833 			break;
1834 		case NFSATTRBIT_NUMLINKS:
1835 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1836 			tuint = fxdr_unsigned(u_int32_t, *tl);
1837 			if (compare) {
1838 			    if (!(*retcmpp)) {
1839 				if ((u_int32_t)nap->na_nlink != tuint)
1840 					*retcmpp = NFSERR_NOTSAME;
1841 			    }
1842 			} else if (nap != NULL) {
1843 				nap->na_nlink = tuint;
1844 			}
1845 			attrsum += NFSX_UNSIGNED;
1846 			break;
1847 		case NFSATTRBIT_OWNER:
1848 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1849 			j = fxdr_unsigned(int, *tl);
1850 			if (j < 0) {
1851 				error = NFSERR_BADXDR;
1852 				goto nfsmout;
1853 			}
1854 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(j));
1855 			if (j > NFSV4_SMALLSTR)
1856 				cp = malloc(j + 1, M_NFSSTRING, M_WAITOK);
1857 			else
1858 				cp = namestr;
1859 			error = nfsrv_mtostr(nd, cp, j);
1860 			if (error) {
1861 				if (j > NFSV4_SMALLSTR)
1862 					free(cp, M_NFSSTRING);
1863 				goto nfsmout;
1864 			}
1865 			if (compare) {
1866 			    if (!(*retcmpp)) {
1867 				if (nfsv4_strtouid(nd, cp, j, &uid) ||
1868 				    nap->na_uid != uid)
1869 				    *retcmpp = NFSERR_NOTSAME;
1870 			    }
1871 			} else if (nap != NULL) {
1872 				if (nfsv4_strtouid(nd, cp, j, &uid))
1873 					nap->na_uid = nfsrv_defaultuid;
1874 				else
1875 					nap->na_uid = uid;
1876 			}
1877 			if (j > NFSV4_SMALLSTR)
1878 				free(cp, M_NFSSTRING);
1879 			break;
1880 		case NFSATTRBIT_OWNERGROUP:
1881 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1882 			j = fxdr_unsigned(int, *tl);
1883 			if (j < 0) {
1884 				error =  NFSERR_BADXDR;
1885 				goto nfsmout;
1886 			}
1887 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(j));
1888 			if (j > NFSV4_SMALLSTR)
1889 				cp = malloc(j + 1, M_NFSSTRING, M_WAITOK);
1890 			else
1891 				cp = namestr;
1892 			error = nfsrv_mtostr(nd, cp, j);
1893 			if (error) {
1894 				if (j > NFSV4_SMALLSTR)
1895 					free(cp, M_NFSSTRING);
1896 				goto nfsmout;
1897 			}
1898 			if (compare) {
1899 			    if (!(*retcmpp)) {
1900 				if (nfsv4_strtogid(nd, cp, j, &gid) ||
1901 				    nap->na_gid != gid)
1902 				    *retcmpp = NFSERR_NOTSAME;
1903 			    }
1904 			} else if (nap != NULL) {
1905 				if (nfsv4_strtogid(nd, cp, j, &gid))
1906 					nap->na_gid = nfsrv_defaultgid;
1907 				else
1908 					nap->na_gid = gid;
1909 			}
1910 			if (j > NFSV4_SMALLSTR)
1911 				free(cp, M_NFSSTRING);
1912 			break;
1913 		case NFSATTRBIT_QUOTAHARD:
1914 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1915 			if (sbp != NULL) {
1916 			    if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA))
1917 				freenum = sbp->f_bfree;
1918 			    else
1919 				freenum = sbp->f_bavail;
1920 #ifdef QUOTA
1921 			    /*
1922 			     * ufs_quotactl() insists that the uid argument
1923 			     * equal p_ruid for non-root quota access, so
1924 			     * we'll just make sure that's the case.
1925 			     */
1926 			    savuid = p->p_cred->p_ruid;
1927 			    p->p_cred->p_ruid = cred->cr_uid;
1928 			    if (!VFS_QUOTACTL(vnode_mount(vp),QCMD(Q_GETQUOTA,
1929 				USRQUOTA), cred->cr_uid, (caddr_t)&dqb))
1930 				freenum = min(dqb.dqb_bhardlimit, freenum);
1931 			    p->p_cred->p_ruid = savuid;
1932 #endif	/* QUOTA */
1933 			    uquad = (u_int64_t)freenum;
1934 			    NFSQUOTABLKTOBYTE(uquad, sbp->f_bsize);
1935 			}
1936 			if (compare && !(*retcmpp)) {
1937 				if (uquad != fxdr_hyper(tl))
1938 					*retcmpp = NFSERR_NOTSAME;
1939 			}
1940 			attrsum += NFSX_HYPER;
1941 			break;
1942 		case NFSATTRBIT_QUOTASOFT:
1943 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1944 			if (sbp != NULL) {
1945 			    if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA))
1946 				freenum = sbp->f_bfree;
1947 			    else
1948 				freenum = sbp->f_bavail;
1949 #ifdef QUOTA
1950 			    /*
1951 			     * ufs_quotactl() insists that the uid argument
1952 			     * equal p_ruid for non-root quota access, so
1953 			     * we'll just make sure that's the case.
1954 			     */
1955 			    savuid = p->p_cred->p_ruid;
1956 			    p->p_cred->p_ruid = cred->cr_uid;
1957 			    if (!VFS_QUOTACTL(vnode_mount(vp),QCMD(Q_GETQUOTA,
1958 				USRQUOTA), cred->cr_uid, (caddr_t)&dqb))
1959 				freenum = min(dqb.dqb_bsoftlimit, freenum);
1960 			    p->p_cred->p_ruid = savuid;
1961 #endif	/* QUOTA */
1962 			    uquad = (u_int64_t)freenum;
1963 			    NFSQUOTABLKTOBYTE(uquad, sbp->f_bsize);
1964 			}
1965 			if (compare && !(*retcmpp)) {
1966 				if (uquad != fxdr_hyper(tl))
1967 					*retcmpp = NFSERR_NOTSAME;
1968 			}
1969 			attrsum += NFSX_HYPER;
1970 			break;
1971 		case NFSATTRBIT_QUOTAUSED:
1972 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1973 			if (sbp != NULL) {
1974 			    freenum = 0;
1975 #ifdef QUOTA
1976 			    /*
1977 			     * ufs_quotactl() insists that the uid argument
1978 			     * equal p_ruid for non-root quota access, so
1979 			     * we'll just make sure that's the case.
1980 			     */
1981 			    savuid = p->p_cred->p_ruid;
1982 			    p->p_cred->p_ruid = cred->cr_uid;
1983 			    if (!VFS_QUOTACTL(vnode_mount(vp),QCMD(Q_GETQUOTA,
1984 				USRQUOTA), cred->cr_uid, (caddr_t)&dqb))
1985 				freenum = dqb.dqb_curblocks;
1986 			    p->p_cred->p_ruid = savuid;
1987 #endif	/* QUOTA */
1988 			    uquad = (u_int64_t)freenum;
1989 			    NFSQUOTABLKTOBYTE(uquad, sbp->f_bsize);
1990 			}
1991 			if (compare && !(*retcmpp)) {
1992 				if (uquad != fxdr_hyper(tl))
1993 					*retcmpp = NFSERR_NOTSAME;
1994 			}
1995 			attrsum += NFSX_HYPER;
1996 			break;
1997 		case NFSATTRBIT_RAWDEV:
1998 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4SPECDATA);
1999 			j = fxdr_unsigned(int, *tl++);
2000 			k = fxdr_unsigned(int, *tl);
2001 			if (compare) {
2002 			    if (!(*retcmpp)) {
2003 				if (nap->na_rdev != NFSMAKEDEV(j, k))
2004 					*retcmpp = NFSERR_NOTSAME;
2005 			    }
2006 			} else if (nap != NULL) {
2007 				nap->na_rdev = NFSMAKEDEV(j, k);
2008 			}
2009 			attrsum += NFSX_V4SPECDATA;
2010 			break;
2011 		case NFSATTRBIT_SPACEAVAIL:
2012 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
2013 			if (compare) {
2014 				if (!(*retcmpp) &&
2015 				    sfp->sf_abytes != fxdr_hyper(tl))
2016 					*retcmpp = NFSERR_NOTSAME;
2017 			} else if (sfp != NULL) {
2018 				sfp->sf_abytes = fxdr_hyper(tl);
2019 			}
2020 			attrsum += NFSX_HYPER;
2021 			break;
2022 		case NFSATTRBIT_SPACEFREE:
2023 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
2024 			if (compare) {
2025 				if (!(*retcmpp) &&
2026 				    sfp->sf_fbytes != fxdr_hyper(tl))
2027 					*retcmpp = NFSERR_NOTSAME;
2028 			} else if (sfp != NULL) {
2029 				sfp->sf_fbytes = fxdr_hyper(tl);
2030 			}
2031 			attrsum += NFSX_HYPER;
2032 			break;
2033 		case NFSATTRBIT_SPACETOTAL:
2034 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
2035 			if (compare) {
2036 				if (!(*retcmpp) &&
2037 				    sfp->sf_tbytes != fxdr_hyper(tl))
2038 					*retcmpp = NFSERR_NOTSAME;
2039 			} else if (sfp != NULL) {
2040 				sfp->sf_tbytes = fxdr_hyper(tl);
2041 			}
2042 			attrsum += NFSX_HYPER;
2043 			break;
2044 		case NFSATTRBIT_SPACEUSED:
2045 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
2046 			thyp = fxdr_hyper(tl);
2047 			if (compare) {
2048 			    if (!(*retcmpp)) {
2049 				if ((u_int64_t)nap->na_bytes != thyp)
2050 					*retcmpp = NFSERR_NOTSAME;
2051 			    }
2052 			} else if (nap != NULL) {
2053 				nap->na_bytes = thyp;
2054 			}
2055 			attrsum += NFSX_HYPER;
2056 			break;
2057 		case NFSATTRBIT_SYSTEM:
2058 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2059 			if (compare && !(*retcmpp))
2060 				*retcmpp = NFSERR_ATTRNOTSUPP;
2061 			attrsum += NFSX_UNSIGNED;
2062 			break;
2063 		case NFSATTRBIT_TIMEACCESS:
2064 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2065 			fxdr_nfsv4time(tl, &temptime);
2066 			if (compare) {
2067 			    if (!(*retcmpp)) {
2068 				if (!NFS_CMPTIME(temptime, nap->na_atime))
2069 					*retcmpp = NFSERR_NOTSAME;
2070 			    }
2071 			} else if (nap != NULL) {
2072 				nap->na_atime = temptime;
2073 			}
2074 			attrsum += NFSX_V4TIME;
2075 			break;
2076 		case NFSATTRBIT_TIMEACCESSSET:
2077 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2078 			attrsum += NFSX_UNSIGNED;
2079 			i = fxdr_unsigned(int, *tl);
2080 			if (i == NFSV4SATTRTIME_TOCLIENT) {
2081 				NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2082 				attrsum += NFSX_V4TIME;
2083 			}
2084 			if (compare && !(*retcmpp))
2085 				*retcmpp = NFSERR_INVAL;
2086 			break;
2087 		case NFSATTRBIT_TIMEBACKUP:
2088 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2089 			if (compare && !(*retcmpp))
2090 				*retcmpp = NFSERR_ATTRNOTSUPP;
2091 			attrsum += NFSX_V4TIME;
2092 			break;
2093 		case NFSATTRBIT_TIMECREATE:
2094 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2095 			if (compare && !(*retcmpp))
2096 				*retcmpp = NFSERR_ATTRNOTSUPP;
2097 			attrsum += NFSX_V4TIME;
2098 			break;
2099 		case NFSATTRBIT_TIMEDELTA:
2100 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2101 			if (fsp != NULL) {
2102 			    if (compare) {
2103 				if (!(*retcmpp)) {
2104 				    if ((u_int32_t)fsp->fs_timedelta.tv_sec !=
2105 					fxdr_unsigned(u_int32_t, *(tl + 1)) ||
2106 				        (u_int32_t)fsp->fs_timedelta.tv_nsec !=
2107 					(fxdr_unsigned(u_int32_t, *(tl + 2)) %
2108 					 1000000000) ||
2109 					*tl != 0)
2110 					    *retcmpp = NFSERR_NOTSAME;
2111 				}
2112 			    } else {
2113 				fxdr_nfsv4time(tl, &fsp->fs_timedelta);
2114 			    }
2115 			}
2116 			attrsum += NFSX_V4TIME;
2117 			break;
2118 		case NFSATTRBIT_TIMEMETADATA:
2119 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2120 			fxdr_nfsv4time(tl, &temptime);
2121 			if (compare) {
2122 			    if (!(*retcmpp)) {
2123 				if (!NFS_CMPTIME(temptime, nap->na_ctime))
2124 					*retcmpp = NFSERR_NOTSAME;
2125 			    }
2126 			} else if (nap != NULL) {
2127 				nap->na_ctime = temptime;
2128 			}
2129 			attrsum += NFSX_V4TIME;
2130 			break;
2131 		case NFSATTRBIT_TIMEMODIFY:
2132 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2133 			fxdr_nfsv4time(tl, &temptime);
2134 			if (compare) {
2135 			    if (!(*retcmpp)) {
2136 				if (!NFS_CMPTIME(temptime, nap->na_mtime))
2137 					*retcmpp = NFSERR_NOTSAME;
2138 			    }
2139 			} else if (nap != NULL) {
2140 				nap->na_mtime = temptime;
2141 			}
2142 			attrsum += NFSX_V4TIME;
2143 			break;
2144 		case NFSATTRBIT_TIMEMODIFYSET:
2145 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2146 			attrsum += NFSX_UNSIGNED;
2147 			i = fxdr_unsigned(int, *tl);
2148 			if (i == NFSV4SATTRTIME_TOCLIENT) {
2149 				NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2150 				attrsum += NFSX_V4TIME;
2151 			}
2152 			if (compare && !(*retcmpp))
2153 				*retcmpp = NFSERR_INVAL;
2154 			break;
2155 		case NFSATTRBIT_MOUNTEDONFILEID:
2156 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
2157 			thyp = fxdr_hyper(tl);
2158 			if (compare) {
2159 				if (!(*retcmpp)) {
2160 					if (!vp || !nfsrv_atroot(vp, &thyp2))
2161 						thyp2 = nap->na_fileid;
2162 					if (thyp2 != thyp)
2163 						*retcmpp = NFSERR_NOTSAME;
2164 				}
2165 			} else if (nap != NULL)
2166 				nap->na_mntonfileno = thyp;
2167 			attrsum += NFSX_HYPER;
2168 			break;
2169 		case NFSATTRBIT_SUPPATTREXCLCREAT:
2170 			retnotsup = 0;
2171 			error = nfsrv_getattrbits(nd, &retattrbits,
2172 			    &cnt, &retnotsup);
2173 			if (error)
2174 			    goto nfsmout;
2175 			if (compare && !(*retcmpp)) {
2176 			   NFSSETSUPP_ATTRBIT(&checkattrbits, nd);
2177 			   NFSCLRNOTSETABLE_ATTRBIT(&checkattrbits, nd);
2178 			   NFSCLRBIT_ATTRBIT(&checkattrbits,
2179 				NFSATTRBIT_TIMEACCESSSET);
2180 			   if (!NFSEQUAL_ATTRBIT(&retattrbits, &checkattrbits)
2181 			       || retnotsup)
2182 				*retcmpp = NFSERR_NOTSAME;
2183 			}
2184 			attrsum += cnt;
2185 			break;
2186 		case NFSATTRBIT_FSLAYOUTTYPE:
2187 		case NFSATTRBIT_LAYOUTTYPE:
2188 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2189 			attrsum += NFSX_UNSIGNED;
2190 			i = fxdr_unsigned(int, *tl);
2191 			if (i > 0) {
2192 				NFSM_DISSECT(tl, u_int32_t *, i *
2193 				    NFSX_UNSIGNED);
2194 				attrsum += i * NFSX_UNSIGNED;
2195 				j = fxdr_unsigned(int, *tl);
2196 				if (i == 1 && compare && !(*retcmpp) &&
2197 				    (((nfsrv_doflexfile != 0 ||
2198 				       nfsrv_maxpnfsmirror > 1) &&
2199 				      j != NFSLAYOUT_FLEXFILE) ||
2200 				    (nfsrv_doflexfile == 0 &&
2201 				     j != NFSLAYOUT_NFSV4_1_FILES)))
2202 					*retcmpp = NFSERR_NOTSAME;
2203 			}
2204 			if (nfsrv_devidcnt == 0) {
2205 				if (compare && !(*retcmpp) && i > 0)
2206 					*retcmpp = NFSERR_NOTSAME;
2207 			} else {
2208 				if (compare && !(*retcmpp) && i != 1)
2209 					*retcmpp = NFSERR_NOTSAME;
2210 			}
2211 			break;
2212 		case NFSATTRBIT_LAYOUTALIGNMENT:
2213 		case NFSATTRBIT_LAYOUTBLKSIZE:
2214 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2215 			attrsum += NFSX_UNSIGNED;
2216 			i = fxdr_unsigned(int, *tl);
2217 			if (compare && !(*retcmpp) && i != NFS_SRVMAXIO)
2218 				*retcmpp = NFSERR_NOTSAME;
2219 			break;
2220 		default:
2221 			printf("EEK! nfsv4_loadattr unknown attr=%d\n",
2222 				bitpos);
2223 			if (compare && !(*retcmpp))
2224 				*retcmpp = NFSERR_ATTRNOTSUPP;
2225 			/*
2226 			 * and get out of the loop, since we can't parse
2227 			 * the unknown attrbute data.
2228 			 */
2229 			bitpos = NFSATTRBIT_MAX;
2230 			break;
2231 		}
2232 	}
2233 
2234 	/*
2235 	 * some clients pad the attrlist, so we need to skip over the
2236 	 * padding.
2237 	 */
2238 	if (attrsum > attrsize) {
2239 		error = NFSERR_BADXDR;
2240 	} else {
2241 		attrsize = NFSM_RNDUP(attrsize);
2242 		if (attrsum < attrsize)
2243 			error = nfsm_advance(nd, attrsize - attrsum, -1);
2244 	}
2245 nfsmout:
2246 	NFSEXITCODE2(error, nd);
2247 	return (error);
2248 }
2249 
2250 /*
2251  * Implement sleep locks for newnfs. The nfslock_usecnt allows for a
2252  * shared lock and the NFSXXX_LOCK flag permits an exclusive lock.
2253  * The first argument is a pointer to an nfsv4lock structure.
2254  * The second argument is 1 iff a blocking lock is wanted.
2255  * If this argument is 0, the call waits until no thread either wants nor
2256  * holds an exclusive lock.
2257  * It returns 1 if the lock was acquired, 0 otherwise.
2258  * If several processes call this function concurrently wanting the exclusive
2259  * lock, one will get the lock and the rest will return without getting the
2260  * lock. (If the caller must have the lock, it simply calls this function in a
2261  *  loop until the function returns 1 to indicate the lock was acquired.)
2262  * Any usecnt must be decremented by calling nfsv4_relref() before
2263  * calling nfsv4_lock(). It was done this way, so nfsv4_lock() could
2264  * be called in a loop.
2265  * The isleptp argument is set to indicate if the call slept, iff not NULL
2266  * and the mp argument indicates to check for a forced dismount, iff not
2267  * NULL.
2268  */
2269 APPLESTATIC int
2270 nfsv4_lock(struct nfsv4lock *lp, int iwantlock, int *isleptp,
2271     void *mutex, struct mount *mp)
2272 {
2273 
2274 	if (isleptp)
2275 		*isleptp = 0;
2276 	/*
2277 	 * If a lock is wanted, loop around until the lock is acquired by
2278 	 * someone and then released. If I want the lock, try to acquire it.
2279 	 * For a lock to be issued, no lock must be in force and the usecnt
2280 	 * must be zero.
2281 	 */
2282 	if (iwantlock) {
2283 	    if (!(lp->nfslock_lock & NFSV4LOCK_LOCK) &&
2284 		lp->nfslock_usecnt == 0) {
2285 		lp->nfslock_lock &= ~NFSV4LOCK_LOCKWANTED;
2286 		lp->nfslock_lock |= NFSV4LOCK_LOCK;
2287 		return (1);
2288 	    }
2289 	    lp->nfslock_lock |= NFSV4LOCK_LOCKWANTED;
2290 	}
2291 	while (lp->nfslock_lock & (NFSV4LOCK_LOCK | NFSV4LOCK_LOCKWANTED)) {
2292 		if (mp != NULL && NFSCL_FORCEDISM(mp)) {
2293 			lp->nfslock_lock &= ~NFSV4LOCK_LOCKWANTED;
2294 			return (0);
2295 		}
2296 		lp->nfslock_lock |= NFSV4LOCK_WANTED;
2297 		if (isleptp)
2298 			*isleptp = 1;
2299 		(void) nfsmsleep(&lp->nfslock_lock, mutex,
2300 		    PZERO - 1, "nfsv4lck", NULL);
2301 		if (iwantlock && !(lp->nfslock_lock & NFSV4LOCK_LOCK) &&
2302 		    lp->nfslock_usecnt == 0) {
2303 			lp->nfslock_lock &= ~NFSV4LOCK_LOCKWANTED;
2304 			lp->nfslock_lock |= NFSV4LOCK_LOCK;
2305 			return (1);
2306 		}
2307 	}
2308 	return (0);
2309 }
2310 
2311 /*
2312  * Release the lock acquired by nfsv4_lock().
2313  * The second argument is set to 1 to indicate the nfslock_usecnt should be
2314  * incremented, as well.
2315  */
2316 APPLESTATIC void
2317 nfsv4_unlock(struct nfsv4lock *lp, int incref)
2318 {
2319 
2320 	lp->nfslock_lock &= ~NFSV4LOCK_LOCK;
2321 	if (incref)
2322 		lp->nfslock_usecnt++;
2323 	nfsv4_wanted(lp);
2324 }
2325 
2326 /*
2327  * Release a reference cnt.
2328  */
2329 APPLESTATIC void
2330 nfsv4_relref(struct nfsv4lock *lp)
2331 {
2332 
2333 	if (lp->nfslock_usecnt <= 0)
2334 		panic("nfsv4root ref cnt");
2335 	lp->nfslock_usecnt--;
2336 	if (lp->nfslock_usecnt == 0)
2337 		nfsv4_wanted(lp);
2338 }
2339 
2340 /*
2341  * Get a reference cnt.
2342  * This function will wait for any exclusive lock to be released, but will
2343  * not wait for threads that want the exclusive lock. If priority needs
2344  * to be given to threads that need the exclusive lock, a call to nfsv4_lock()
2345  * with the 2nd argument == 0 should be done before calling nfsv4_getref().
2346  * If the mp argument is not NULL, check for NFSCL_FORCEDISM() being set and
2347  * return without getting a refcnt for that case.
2348  */
2349 APPLESTATIC void
2350 nfsv4_getref(struct nfsv4lock *lp, int *isleptp, void *mutex,
2351     struct mount *mp)
2352 {
2353 
2354 	if (isleptp)
2355 		*isleptp = 0;
2356 
2357 	/*
2358 	 * Wait for a lock held.
2359 	 */
2360 	while (lp->nfslock_lock & NFSV4LOCK_LOCK) {
2361 		if (mp != NULL && NFSCL_FORCEDISM(mp))
2362 			return;
2363 		lp->nfslock_lock |= NFSV4LOCK_WANTED;
2364 		if (isleptp)
2365 			*isleptp = 1;
2366 		(void) nfsmsleep(&lp->nfslock_lock, mutex,
2367 		    PZERO - 1, "nfsv4gr", NULL);
2368 	}
2369 	if (mp != NULL && NFSCL_FORCEDISM(mp))
2370 		return;
2371 
2372 	lp->nfslock_usecnt++;
2373 }
2374 
2375 /*
2376  * Get a reference as above, but return failure instead of sleeping if
2377  * an exclusive lock is held.
2378  */
2379 APPLESTATIC int
2380 nfsv4_getref_nonblock(struct nfsv4lock *lp)
2381 {
2382 
2383 	if ((lp->nfslock_lock & NFSV4LOCK_LOCK) != 0)
2384 		return (0);
2385 
2386 	lp->nfslock_usecnt++;
2387 	return (1);
2388 }
2389 
2390 /*
2391  * Test for a lock. Return 1 if locked, 0 otherwise.
2392  */
2393 APPLESTATIC int
2394 nfsv4_testlock(struct nfsv4lock *lp)
2395 {
2396 
2397 	if ((lp->nfslock_lock & NFSV4LOCK_LOCK) == 0 &&
2398 	    lp->nfslock_usecnt == 0)
2399 		return (0);
2400 	return (1);
2401 }
2402 
2403 /*
2404  * Wake up anyone sleeping, waiting for this lock.
2405  */
2406 static void
2407 nfsv4_wanted(struct nfsv4lock *lp)
2408 {
2409 
2410 	if (lp->nfslock_lock & NFSV4LOCK_WANTED) {
2411 		lp->nfslock_lock &= ~NFSV4LOCK_WANTED;
2412 		wakeup((caddr_t)&lp->nfslock_lock);
2413 	}
2414 }
2415 
2416 /*
2417  * Copy a string from an mbuf list into a character array.
2418  * Return EBADRPC if there is an mbuf error,
2419  * 0 otherwise.
2420  */
2421 APPLESTATIC int
2422 nfsrv_mtostr(struct nfsrv_descript *nd, char *str, int siz)
2423 {
2424 	char *cp;
2425 	int xfer, len;
2426 	mbuf_t mp;
2427 	int rem, error = 0;
2428 
2429 	mp = nd->nd_md;
2430 	cp = nd->nd_dpos;
2431 	len = NFSMTOD(mp, caddr_t) + mbuf_len(mp) - cp;
2432 	rem = NFSM_RNDUP(siz) - siz;
2433 	while (siz > 0) {
2434 		if (len > siz)
2435 			xfer = siz;
2436 		else
2437 			xfer = len;
2438 		NFSBCOPY(cp, str, xfer);
2439 		str += xfer;
2440 		siz -= xfer;
2441 		if (siz > 0) {
2442 			mp = mbuf_next(mp);
2443 			if (mp == NULL) {
2444 				error = EBADRPC;
2445 				goto out;
2446 			}
2447 			cp = NFSMTOD(mp, caddr_t);
2448 			len = mbuf_len(mp);
2449 		} else {
2450 			cp += xfer;
2451 			len -= xfer;
2452 		}
2453 	}
2454 	*str = '\0';
2455 	nd->nd_dpos = cp;
2456 	nd->nd_md = mp;
2457 	if (rem > 0) {
2458 		if (len < rem)
2459 			error = nfsm_advance(nd, rem, len);
2460 		else
2461 			nd->nd_dpos += rem;
2462 	}
2463 
2464 out:
2465 	NFSEXITCODE2(error, nd);
2466 	return (error);
2467 }
2468 
2469 /*
2470  * Fill in the attributes as marked by the bitmap (V4).
2471  */
2472 APPLESTATIC int
2473 nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
2474     NFSACL_T *saclp, struct vattr *vap, fhandle_t *fhp, int rderror,
2475     nfsattrbit_t *attrbitp, struct ucred *cred, NFSPROC_T *p, int isdgram,
2476     int reterr, int supports_nfsv4acls, int at_root, uint64_t mounted_on_fileno,
2477     struct statfs *pnfssf)
2478 {
2479 	int bitpos, retnum = 0;
2480 	u_int32_t *tl;
2481 	int siz, prefixnum, error;
2482 	u_char *cp, namestr[NFSV4_SMALLSTR];
2483 	nfsattrbit_t attrbits, retbits;
2484 	nfsattrbit_t *retbitp = &retbits;
2485 	u_int32_t freenum, *retnump;
2486 	u_int64_t uquad;
2487 	struct statfs *fs;
2488 	struct nfsfsinfo fsinf;
2489 	struct timespec temptime;
2490 	NFSACL_T *aclp, *naclp = NULL;
2491 	size_t atsiz;
2492 	bool xattrsupp;
2493 #ifdef QUOTA
2494 	struct dqblk dqb;
2495 	uid_t savuid;
2496 #endif
2497 
2498 	/*
2499 	 * First, set the bits that can be filled and get fsinfo.
2500 	 */
2501 	NFSSET_ATTRBIT(retbitp, attrbitp);
2502 	/*
2503 	 * If both p and cred are NULL, it is a client side setattr call.
2504 	 * If both p and cred are not NULL, it is a server side reply call.
2505 	 * If p is not NULL and cred is NULL, it is a client side callback
2506 	 * reply call.
2507 	 */
2508 	if (p == NULL && cred == NULL) {
2509 		NFSCLRNOTSETABLE_ATTRBIT(retbitp, nd);
2510 		aclp = saclp;
2511 	} else {
2512 		NFSCLRNOTFILLABLE_ATTRBIT(retbitp, nd);
2513 		naclp = acl_alloc(M_WAITOK);
2514 		aclp = naclp;
2515 	}
2516 	nfsvno_getfs(&fsinf, isdgram);
2517 #ifndef APPLE
2518 	/*
2519 	 * Get the VFS_STATFS(), since some attributes need them.
2520 	 */
2521 	fs = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
2522 	if (NFSISSETSTATFS_ATTRBIT(retbitp)) {
2523 		error = VFS_STATFS(mp, fs);
2524 		if (error != 0) {
2525 			if (reterr) {
2526 				nd->nd_repstat = NFSERR_ACCES;
2527 				free(fs, M_STATFS);
2528 				return (0);
2529 			}
2530 			NFSCLRSTATFS_ATTRBIT(retbitp);
2531 		}
2532 	}
2533 #endif
2534 
2535 	/*
2536 	 * And the NFSv4 ACL...
2537 	 */
2538 	if (NFSISSET_ATTRBIT(retbitp, NFSATTRBIT_ACLSUPPORT) &&
2539 	    (nfsrv_useacl == 0 || ((cred != NULL || p != NULL) &&
2540 		supports_nfsv4acls == 0))) {
2541 		NFSCLRBIT_ATTRBIT(retbitp, NFSATTRBIT_ACLSUPPORT);
2542 	}
2543 	if (NFSISSET_ATTRBIT(retbitp, NFSATTRBIT_ACL)) {
2544 		if (nfsrv_useacl == 0 || ((cred != NULL || p != NULL) &&
2545 		    supports_nfsv4acls == 0)) {
2546 			NFSCLRBIT_ATTRBIT(retbitp, NFSATTRBIT_ACL);
2547 		} else if (naclp != NULL) {
2548 			if (NFSVOPLOCK(vp, LK_SHARED) == 0) {
2549 				error = VOP_ACCESSX(vp, VREAD_ACL, cred, p);
2550 				if (error == 0)
2551 					error = VOP_GETACL(vp, ACL_TYPE_NFS4,
2552 					    naclp, cred, p);
2553 				NFSVOPUNLOCK(vp);
2554 			} else
2555 				error = NFSERR_PERM;
2556 			if (error != 0) {
2557 				if (reterr) {
2558 					nd->nd_repstat = NFSERR_ACCES;
2559 					free(fs, M_STATFS);
2560 					return (0);
2561 				}
2562 				NFSCLRBIT_ATTRBIT(retbitp, NFSATTRBIT_ACL);
2563 			}
2564 		}
2565 	}
2566 
2567 	/* Check to see if Extended Attributes are supported. */
2568 	xattrsupp = false;
2569 	if (NFSISSET_ATTRBIT(retbitp, NFSATTRBIT_XATTRSUPPORT)) {
2570 		if (NFSVOPLOCK(vp, LK_SHARED) == 0) {
2571 			error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER,
2572 			    "xxx", NULL, &atsiz, cred, p);
2573 			NFSVOPUNLOCK(vp);
2574 			if (error != EOPNOTSUPP)
2575 				xattrsupp = true;
2576 		}
2577 	}
2578 
2579 	/*
2580 	 * Put out the attribute bitmap for the ones being filled in
2581 	 * and get the field for the number of attributes returned.
2582 	 */
2583 	prefixnum = nfsrv_putattrbit(nd, retbitp);
2584 	NFSM_BUILD(retnump, u_int32_t *, NFSX_UNSIGNED);
2585 	prefixnum += NFSX_UNSIGNED;
2586 
2587 	/*
2588 	 * Now, loop around filling in the attributes for each bit set.
2589 	 */
2590 	for (bitpos = 0; bitpos < NFSATTRBIT_MAX; bitpos++) {
2591 	    if (NFSISSET_ATTRBIT(retbitp, bitpos)) {
2592 		switch (bitpos) {
2593 		case NFSATTRBIT_SUPPORTEDATTRS:
2594 			NFSSETSUPP_ATTRBIT(&attrbits, nd);
2595 			if (nfsrv_useacl == 0 || ((cred != NULL || p != NULL)
2596 			    && supports_nfsv4acls == 0)) {
2597 			    NFSCLRBIT_ATTRBIT(&attrbits,NFSATTRBIT_ACLSUPPORT);
2598 			    NFSCLRBIT_ATTRBIT(&attrbits,NFSATTRBIT_ACL);
2599 			}
2600 			retnum += nfsrv_putattrbit(nd, &attrbits);
2601 			break;
2602 		case NFSATTRBIT_TYPE:
2603 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2604 			*tl = vtonfsv34_type(vap->va_type);
2605 			retnum += NFSX_UNSIGNED;
2606 			break;
2607 		case NFSATTRBIT_FHEXPIRETYPE:
2608 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2609 			*tl = txdr_unsigned(NFSV4FHTYPE_PERSISTENT);
2610 			retnum += NFSX_UNSIGNED;
2611 			break;
2612 		case NFSATTRBIT_CHANGE:
2613 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2614 			txdr_hyper(vap->va_filerev, tl);
2615 			retnum += NFSX_HYPER;
2616 			break;
2617 		case NFSATTRBIT_SIZE:
2618 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2619 			txdr_hyper(vap->va_size, tl);
2620 			retnum += NFSX_HYPER;
2621 			break;
2622 		case NFSATTRBIT_LINKSUPPORT:
2623 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2624 			if (fsinf.fs_properties & NFSV3FSINFO_LINK)
2625 				*tl = newnfs_true;
2626 			else
2627 				*tl = newnfs_false;
2628 			retnum += NFSX_UNSIGNED;
2629 			break;
2630 		case NFSATTRBIT_SYMLINKSUPPORT:
2631 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2632 			if (fsinf.fs_properties & NFSV3FSINFO_SYMLINK)
2633 				*tl = newnfs_true;
2634 			else
2635 				*tl = newnfs_false;
2636 			retnum += NFSX_UNSIGNED;
2637 			break;
2638 		case NFSATTRBIT_NAMEDATTR:
2639 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2640 			*tl = newnfs_false;
2641 			retnum += NFSX_UNSIGNED;
2642 			break;
2643 		case NFSATTRBIT_FSID:
2644 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4FSID);
2645 			*tl++ = 0;
2646 			*tl++ = txdr_unsigned(mp->mnt_stat.f_fsid.val[0]);
2647 			*tl++ = 0;
2648 			*tl = txdr_unsigned(mp->mnt_stat.f_fsid.val[1]);
2649 			retnum += NFSX_V4FSID;
2650 			break;
2651 		case NFSATTRBIT_UNIQUEHANDLES:
2652 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2653 			*tl = newnfs_true;
2654 			retnum += NFSX_UNSIGNED;
2655 			break;
2656 		case NFSATTRBIT_LEASETIME:
2657 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2658 			*tl = txdr_unsigned(nfsrv_lease);
2659 			retnum += NFSX_UNSIGNED;
2660 			break;
2661 		case NFSATTRBIT_RDATTRERROR:
2662 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2663 			*tl = txdr_unsigned(rderror);
2664 			retnum += NFSX_UNSIGNED;
2665 			break;
2666 		/*
2667 		 * Recommended Attributes. (Only the supported ones.)
2668 		 */
2669 		case NFSATTRBIT_ACL:
2670 			retnum += nfsrv_buildacl(nd, aclp, vnode_vtype(vp), p);
2671 			break;
2672 		case NFSATTRBIT_ACLSUPPORT:
2673 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2674 			*tl = txdr_unsigned(NFSV4ACE_SUPTYPES);
2675 			retnum += NFSX_UNSIGNED;
2676 			break;
2677 		case NFSATTRBIT_CANSETTIME:
2678 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2679 			if (fsinf.fs_properties & NFSV3FSINFO_CANSETTIME)
2680 				*tl = newnfs_true;
2681 			else
2682 				*tl = newnfs_false;
2683 			retnum += NFSX_UNSIGNED;
2684 			break;
2685 		case NFSATTRBIT_CASEINSENSITIVE:
2686 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2687 			*tl = newnfs_false;
2688 			retnum += NFSX_UNSIGNED;
2689 			break;
2690 		case NFSATTRBIT_CASEPRESERVING:
2691 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2692 			*tl = newnfs_true;
2693 			retnum += NFSX_UNSIGNED;
2694 			break;
2695 		case NFSATTRBIT_CHOWNRESTRICTED:
2696 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2697 			*tl = newnfs_true;
2698 			retnum += NFSX_UNSIGNED;
2699 			break;
2700 		case NFSATTRBIT_FILEHANDLE:
2701 			retnum += nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
2702 			break;
2703 		case NFSATTRBIT_FILEID:
2704 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2705 			uquad = vap->va_fileid;
2706 			txdr_hyper(uquad, tl);
2707 			retnum += NFSX_HYPER;
2708 			break;
2709 		case NFSATTRBIT_FILESAVAIL:
2710 			/*
2711 			 * Check quota and use min(quota, f_ffree).
2712 			 */
2713 			freenum = fs->f_ffree;
2714 #ifdef QUOTA
2715 			/*
2716 			 * ufs_quotactl() insists that the uid argument
2717 			 * equal p_ruid for non-root quota access, so
2718 			 * we'll just make sure that's the case.
2719 			 */
2720 			savuid = p->p_cred->p_ruid;
2721 			p->p_cred->p_ruid = cred->cr_uid;
2722 			if (!VFS_QUOTACTL(mp, QCMD(Q_GETQUOTA,USRQUOTA),
2723 			    cred->cr_uid, (caddr_t)&dqb))
2724 			    freenum = min(dqb.dqb_isoftlimit-dqb.dqb_curinodes,
2725 				freenum);
2726 			p->p_cred->p_ruid = savuid;
2727 #endif	/* QUOTA */
2728 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2729 			*tl++ = 0;
2730 			*tl = txdr_unsigned(freenum);
2731 			retnum += NFSX_HYPER;
2732 			break;
2733 		case NFSATTRBIT_FILESFREE:
2734 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2735 			*tl++ = 0;
2736 			*tl = txdr_unsigned(fs->f_ffree);
2737 			retnum += NFSX_HYPER;
2738 			break;
2739 		case NFSATTRBIT_FILESTOTAL:
2740 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2741 			*tl++ = 0;
2742 			*tl = txdr_unsigned(fs->f_files);
2743 			retnum += NFSX_HYPER;
2744 			break;
2745 		case NFSATTRBIT_FSLOCATIONS:
2746 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2747 			*tl++ = 0;
2748 			*tl = 0;
2749 			retnum += 2 * NFSX_UNSIGNED;
2750 			break;
2751 		case NFSATTRBIT_HOMOGENEOUS:
2752 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2753 			if (fsinf.fs_properties & NFSV3FSINFO_HOMOGENEOUS)
2754 				*tl = newnfs_true;
2755 			else
2756 				*tl = newnfs_false;
2757 			retnum += NFSX_UNSIGNED;
2758 			break;
2759 		case NFSATTRBIT_MAXFILESIZE:
2760 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2761 			uquad = NFSRV_MAXFILESIZE;
2762 			txdr_hyper(uquad, tl);
2763 			retnum += NFSX_HYPER;
2764 			break;
2765 		case NFSATTRBIT_MAXLINK:
2766 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2767 			*tl = txdr_unsigned(NFS_LINK_MAX);
2768 			retnum += NFSX_UNSIGNED;
2769 			break;
2770 		case NFSATTRBIT_MAXNAME:
2771 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2772 			*tl = txdr_unsigned(NFS_MAXNAMLEN);
2773 			retnum += NFSX_UNSIGNED;
2774 			break;
2775 		case NFSATTRBIT_MAXREAD:
2776 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2777 			*tl++ = 0;
2778 			*tl = txdr_unsigned(fsinf.fs_rtmax);
2779 			retnum += NFSX_HYPER;
2780 			break;
2781 		case NFSATTRBIT_MAXWRITE:
2782 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2783 			*tl++ = 0;
2784 			*tl = txdr_unsigned(fsinf.fs_wtmax);
2785 			retnum += NFSX_HYPER;
2786 			break;
2787 		case NFSATTRBIT_MODE:
2788 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2789 			*tl = vtonfsv34_mode(vap->va_mode);
2790 			retnum += NFSX_UNSIGNED;
2791 			break;
2792 		case NFSATTRBIT_NOTRUNC:
2793 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2794 			*tl = newnfs_true;
2795 			retnum += NFSX_UNSIGNED;
2796 			break;
2797 		case NFSATTRBIT_NUMLINKS:
2798 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2799 			*tl = txdr_unsigned(vap->va_nlink);
2800 			retnum += NFSX_UNSIGNED;
2801 			break;
2802 		case NFSATTRBIT_OWNER:
2803 			cp = namestr;
2804 			nfsv4_uidtostr(vap->va_uid, &cp, &siz);
2805 			retnum += nfsm_strtom(nd, cp, siz);
2806 			if (cp != namestr)
2807 				free(cp, M_NFSSTRING);
2808 			break;
2809 		case NFSATTRBIT_OWNERGROUP:
2810 			cp = namestr;
2811 			nfsv4_gidtostr(vap->va_gid, &cp, &siz);
2812 			retnum += nfsm_strtom(nd, cp, siz);
2813 			if (cp != namestr)
2814 				free(cp, M_NFSSTRING);
2815 			break;
2816 		case NFSATTRBIT_QUOTAHARD:
2817 			if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA))
2818 				freenum = fs->f_bfree;
2819 			else
2820 				freenum = fs->f_bavail;
2821 #ifdef QUOTA
2822 			/*
2823 			 * ufs_quotactl() insists that the uid argument
2824 			 * equal p_ruid for non-root quota access, so
2825 			 * we'll just make sure that's the case.
2826 			 */
2827 			savuid = p->p_cred->p_ruid;
2828 			p->p_cred->p_ruid = cred->cr_uid;
2829 			if (!VFS_QUOTACTL(mp, QCMD(Q_GETQUOTA,USRQUOTA),
2830 			    cred->cr_uid, (caddr_t)&dqb))
2831 			    freenum = min(dqb.dqb_bhardlimit, freenum);
2832 			p->p_cred->p_ruid = savuid;
2833 #endif	/* QUOTA */
2834 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2835 			uquad = (u_int64_t)freenum;
2836 			NFSQUOTABLKTOBYTE(uquad, fs->f_bsize);
2837 			txdr_hyper(uquad, tl);
2838 			retnum += NFSX_HYPER;
2839 			break;
2840 		case NFSATTRBIT_QUOTASOFT:
2841 			if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA))
2842 				freenum = fs->f_bfree;
2843 			else
2844 				freenum = fs->f_bavail;
2845 #ifdef QUOTA
2846 			/*
2847 			 * ufs_quotactl() insists that the uid argument
2848 			 * equal p_ruid for non-root quota access, so
2849 			 * we'll just make sure that's the case.
2850 			 */
2851 			savuid = p->p_cred->p_ruid;
2852 			p->p_cred->p_ruid = cred->cr_uid;
2853 			if (!VFS_QUOTACTL(mp, QCMD(Q_GETQUOTA,USRQUOTA),
2854 			    cred->cr_uid, (caddr_t)&dqb))
2855 			    freenum = min(dqb.dqb_bsoftlimit, freenum);
2856 			p->p_cred->p_ruid = savuid;
2857 #endif	/* QUOTA */
2858 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2859 			uquad = (u_int64_t)freenum;
2860 			NFSQUOTABLKTOBYTE(uquad, fs->f_bsize);
2861 			txdr_hyper(uquad, tl);
2862 			retnum += NFSX_HYPER;
2863 			break;
2864 		case NFSATTRBIT_QUOTAUSED:
2865 			freenum = 0;
2866 #ifdef QUOTA
2867 			/*
2868 			 * ufs_quotactl() insists that the uid argument
2869 			 * equal p_ruid for non-root quota access, so
2870 			 * we'll just make sure that's the case.
2871 			 */
2872 			savuid = p->p_cred->p_ruid;
2873 			p->p_cred->p_ruid = cred->cr_uid;
2874 			if (!VFS_QUOTACTL(mp, QCMD(Q_GETQUOTA,USRQUOTA),
2875 			    cred->cr_uid, (caddr_t)&dqb))
2876 			    freenum = dqb.dqb_curblocks;
2877 			p->p_cred->p_ruid = savuid;
2878 #endif	/* QUOTA */
2879 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2880 			uquad = (u_int64_t)freenum;
2881 			NFSQUOTABLKTOBYTE(uquad, fs->f_bsize);
2882 			txdr_hyper(uquad, tl);
2883 			retnum += NFSX_HYPER;
2884 			break;
2885 		case NFSATTRBIT_RAWDEV:
2886 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4SPECDATA);
2887 			*tl++ = txdr_unsigned(NFSMAJOR(vap->va_rdev));
2888 			*tl = txdr_unsigned(NFSMINOR(vap->va_rdev));
2889 			retnum += NFSX_V4SPECDATA;
2890 			break;
2891 		case NFSATTRBIT_SPACEAVAIL:
2892 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2893 			if (priv_check_cred(cred, PRIV_VFS_BLOCKRESERVE)) {
2894 				if (pnfssf != NULL)
2895 					uquad = (u_int64_t)pnfssf->f_bfree;
2896 				else
2897 					uquad = (u_int64_t)fs->f_bfree;
2898 			} else {
2899 				if (pnfssf != NULL)
2900 					uquad = (u_int64_t)pnfssf->f_bavail;
2901 				else
2902 					uquad = (u_int64_t)fs->f_bavail;
2903 			}
2904 			if (pnfssf != NULL)
2905 				uquad *= pnfssf->f_bsize;
2906 			else
2907 				uquad *= fs->f_bsize;
2908 			txdr_hyper(uquad, tl);
2909 			retnum += NFSX_HYPER;
2910 			break;
2911 		case NFSATTRBIT_SPACEFREE:
2912 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2913 			if (pnfssf != NULL) {
2914 				uquad = (u_int64_t)pnfssf->f_bfree;
2915 				uquad *= pnfssf->f_bsize;
2916 			} else {
2917 				uquad = (u_int64_t)fs->f_bfree;
2918 				uquad *= fs->f_bsize;
2919 			}
2920 			txdr_hyper(uquad, tl);
2921 			retnum += NFSX_HYPER;
2922 			break;
2923 		case NFSATTRBIT_SPACETOTAL:
2924 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2925 			if (pnfssf != NULL) {
2926 				uquad = (u_int64_t)pnfssf->f_blocks;
2927 				uquad *= pnfssf->f_bsize;
2928 			} else {
2929 				uquad = (u_int64_t)fs->f_blocks;
2930 				uquad *= fs->f_bsize;
2931 			}
2932 			txdr_hyper(uquad, tl);
2933 			retnum += NFSX_HYPER;
2934 			break;
2935 		case NFSATTRBIT_SPACEUSED:
2936 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2937 			txdr_hyper(vap->va_bytes, tl);
2938 			retnum += NFSX_HYPER;
2939 			break;
2940 		case NFSATTRBIT_TIMEACCESS:
2941 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4TIME);
2942 			txdr_nfsv4time(&vap->va_atime, tl);
2943 			retnum += NFSX_V4TIME;
2944 			break;
2945 		case NFSATTRBIT_TIMEACCESSSET:
2946 			if ((vap->va_vaflags & VA_UTIMES_NULL) == 0) {
2947 				NFSM_BUILD(tl, u_int32_t *, NFSX_V4SETTIME);
2948 				*tl++ = txdr_unsigned(NFSV4SATTRTIME_TOCLIENT);
2949 				txdr_nfsv4time(&vap->va_atime, tl);
2950 				retnum += NFSX_V4SETTIME;
2951 			} else {
2952 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2953 				*tl = txdr_unsigned(NFSV4SATTRTIME_TOSERVER);
2954 				retnum += NFSX_UNSIGNED;
2955 			}
2956 			break;
2957 		case NFSATTRBIT_TIMEDELTA:
2958 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4TIME);
2959 			temptime.tv_sec = 0;
2960 			temptime.tv_nsec = 1000000000 / hz;
2961 			txdr_nfsv4time(&temptime, tl);
2962 			retnum += NFSX_V4TIME;
2963 			break;
2964 		case NFSATTRBIT_TIMEMETADATA:
2965 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4TIME);
2966 			txdr_nfsv4time(&vap->va_ctime, tl);
2967 			retnum += NFSX_V4TIME;
2968 			break;
2969 		case NFSATTRBIT_TIMEMODIFY:
2970 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4TIME);
2971 			txdr_nfsv4time(&vap->va_mtime, tl);
2972 			retnum += NFSX_V4TIME;
2973 			break;
2974 		case NFSATTRBIT_TIMEMODIFYSET:
2975 			if ((vap->va_vaflags & VA_UTIMES_NULL) == 0) {
2976 				NFSM_BUILD(tl, u_int32_t *, NFSX_V4SETTIME);
2977 				*tl++ = txdr_unsigned(NFSV4SATTRTIME_TOCLIENT);
2978 				txdr_nfsv4time(&vap->va_mtime, tl);
2979 				retnum += NFSX_V4SETTIME;
2980 			} else {
2981 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2982 				*tl = txdr_unsigned(NFSV4SATTRTIME_TOSERVER);
2983 				retnum += NFSX_UNSIGNED;
2984 			}
2985 			break;
2986 		case NFSATTRBIT_MOUNTEDONFILEID:
2987 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2988 			if (at_root != 0)
2989 				uquad = mounted_on_fileno;
2990 			else
2991 				uquad = vap->va_fileid;
2992 			txdr_hyper(uquad, tl);
2993 			retnum += NFSX_HYPER;
2994 			break;
2995 		case NFSATTRBIT_SUPPATTREXCLCREAT:
2996 			NFSSETSUPP_ATTRBIT(&attrbits, nd);
2997 			NFSCLRNOTSETABLE_ATTRBIT(&attrbits, nd);
2998 			NFSCLRBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET);
2999 			retnum += nfsrv_putattrbit(nd, &attrbits);
3000 			break;
3001 		case NFSATTRBIT_FSLAYOUTTYPE:
3002 		case NFSATTRBIT_LAYOUTTYPE:
3003 			if (nfsrv_devidcnt == 0)
3004 				siz = 1;
3005 			else
3006 				siz = 2;
3007 			if (siz == 2) {
3008 				NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3009 				*tl++ = txdr_unsigned(1);	/* One entry. */
3010 				if (nfsrv_doflexfile != 0 ||
3011 				    nfsrv_maxpnfsmirror > 1)
3012 					*tl = txdr_unsigned(NFSLAYOUT_FLEXFILE);
3013 				else
3014 					*tl = txdr_unsigned(
3015 					    NFSLAYOUT_NFSV4_1_FILES);
3016 			} else {
3017 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3018 				*tl = 0;
3019 			}
3020 			retnum += siz * NFSX_UNSIGNED;
3021 			break;
3022 		case NFSATTRBIT_LAYOUTALIGNMENT:
3023 		case NFSATTRBIT_LAYOUTBLKSIZE:
3024 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3025 			*tl = txdr_unsigned(NFS_SRVMAXIO);
3026 			retnum += NFSX_UNSIGNED;
3027 			break;
3028 		case NFSATTRBIT_XATTRSUPPORT:
3029 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3030 			if (xattrsupp)
3031 				*tl = newnfs_true;
3032 			else
3033 				*tl = newnfs_false;
3034 			retnum += NFSX_UNSIGNED;
3035 			break;
3036 		default:
3037 			printf("EEK! Bad V4 attribute bitpos=%d\n", bitpos);
3038 		}
3039 	    }
3040 	}
3041 	if (naclp != NULL)
3042 		acl_free(naclp);
3043 	free(fs, M_STATFS);
3044 	*retnump = txdr_unsigned(retnum);
3045 	return (retnum + prefixnum);
3046 }
3047 
3048 /*
3049  * Put the attribute bits onto an mbuf list.
3050  * Return the number of bytes of output generated.
3051  */
3052 APPLESTATIC int
3053 nfsrv_putattrbit(struct nfsrv_descript *nd, nfsattrbit_t *attrbitp)
3054 {
3055 	u_int32_t *tl;
3056 	int cnt, i, bytesize;
3057 
3058 	for (cnt = NFSATTRBIT_MAXWORDS; cnt > 0; cnt--)
3059 		if (attrbitp->bits[cnt - 1])
3060 			break;
3061 	bytesize = (cnt + 1) * NFSX_UNSIGNED;
3062 	NFSM_BUILD(tl, u_int32_t *, bytesize);
3063 	*tl++ = txdr_unsigned(cnt);
3064 	for (i = 0; i < cnt; i++)
3065 		*tl++ = txdr_unsigned(attrbitp->bits[i]);
3066 	return (bytesize);
3067 }
3068 
3069 /*
3070  * Convert a uid to a string.
3071  * If the lookup fails, just output the digits.
3072  * uid - the user id
3073  * cpp - points to a buffer of size NFSV4_SMALLSTR
3074  *       (malloc a larger one, as required)
3075  * retlenp - pointer to length to be returned
3076  */
3077 APPLESTATIC void
3078 nfsv4_uidtostr(uid_t uid, u_char **cpp, int *retlenp)
3079 {
3080 	int i;
3081 	struct nfsusrgrp *usrp;
3082 	u_char *cp = *cpp;
3083 	uid_t tmp;
3084 	int cnt, hasampersand, len = NFSV4_SMALLSTR, ret;
3085 	struct nfsrv_lughash *hp;
3086 
3087 	cnt = 0;
3088 tryagain:
3089 	if (nfsrv_dnsnamelen > 0 && !nfs_enable_uidtostring) {
3090 		/*
3091 		 * Always map nfsrv_defaultuid to "nobody".
3092 		 */
3093 		if (uid == nfsrv_defaultuid) {
3094 			i = nfsrv_dnsnamelen + 7;
3095 			if (i > len) {
3096 				if (len > NFSV4_SMALLSTR)
3097 					free(cp, M_NFSSTRING);
3098 				cp = malloc(i, M_NFSSTRING, M_WAITOK);
3099 				*cpp = cp;
3100 				len = i;
3101 				goto tryagain;
3102 			}
3103 			*retlenp = i;
3104 			NFSBCOPY("nobody@", cp, 7);
3105 			cp += 7;
3106 			NFSBCOPY(nfsrv_dnsname, cp, nfsrv_dnsnamelen);
3107 			return;
3108 		}
3109 		hasampersand = 0;
3110 		hp = NFSUSERHASH(uid);
3111 		mtx_lock(&hp->mtx);
3112 		TAILQ_FOREACH(usrp, &hp->lughead, lug_numhash) {
3113 			if (usrp->lug_uid == uid) {
3114 				if (usrp->lug_expiry < NFSD_MONOSEC)
3115 					break;
3116 				/*
3117 				 * If the name doesn't already have an '@'
3118 				 * in it, append @domainname to it.
3119 				 */
3120 				for (i = 0; i < usrp->lug_namelen; i++) {
3121 					if (usrp->lug_name[i] == '@') {
3122 						hasampersand = 1;
3123 						break;
3124 					}
3125 				}
3126 				if (hasampersand)
3127 					i = usrp->lug_namelen;
3128 				else
3129 					i = usrp->lug_namelen +
3130 					    nfsrv_dnsnamelen + 1;
3131 				if (i > len) {
3132 					mtx_unlock(&hp->mtx);
3133 					if (len > NFSV4_SMALLSTR)
3134 						free(cp, M_NFSSTRING);
3135 					cp = malloc(i, M_NFSSTRING, M_WAITOK);
3136 					*cpp = cp;
3137 					len = i;
3138 					goto tryagain;
3139 				}
3140 				*retlenp = i;
3141 				NFSBCOPY(usrp->lug_name, cp, usrp->lug_namelen);
3142 				if (!hasampersand) {
3143 					cp += usrp->lug_namelen;
3144 					*cp++ = '@';
3145 					NFSBCOPY(nfsrv_dnsname, cp, nfsrv_dnsnamelen);
3146 				}
3147 				TAILQ_REMOVE(&hp->lughead, usrp, lug_numhash);
3148 				TAILQ_INSERT_TAIL(&hp->lughead, usrp,
3149 				    lug_numhash);
3150 				mtx_unlock(&hp->mtx);
3151 				return;
3152 			}
3153 		}
3154 		mtx_unlock(&hp->mtx);
3155 		cnt++;
3156 		ret = nfsrv_getuser(RPCNFSUSERD_GETUID, uid, (gid_t)0, NULL);
3157 		if (ret == 0 && cnt < 2)
3158 			goto tryagain;
3159 	}
3160 
3161 	/*
3162 	 * No match, just return a string of digits.
3163 	 */
3164 	tmp = uid;
3165 	i = 0;
3166 	while (tmp || i == 0) {
3167 		tmp /= 10;
3168 		i++;
3169 	}
3170 	len = (i > len) ? len : i;
3171 	*retlenp = len;
3172 	cp += (len - 1);
3173 	tmp = uid;
3174 	for (i = 0; i < len; i++) {
3175 		*cp-- = '0' + (tmp % 10);
3176 		tmp /= 10;
3177 	}
3178 	return;
3179 }
3180 
3181 /*
3182  * Get a credential for the uid with the server's group list.
3183  * If none is found, just return the credential passed in after
3184  * logging a warning message.
3185  */
3186 struct ucred *
3187 nfsrv_getgrpscred(struct ucred *oldcred)
3188 {
3189 	struct nfsusrgrp *usrp;
3190 	struct ucred *newcred;
3191 	int cnt, ret;
3192 	uid_t uid;
3193 	struct nfsrv_lughash *hp;
3194 
3195 	cnt = 0;
3196 	uid = oldcred->cr_uid;
3197 tryagain:
3198 	if (nfsrv_dnsnamelen > 0) {
3199 		hp = NFSUSERHASH(uid);
3200 		mtx_lock(&hp->mtx);
3201 		TAILQ_FOREACH(usrp, &hp->lughead, lug_numhash) {
3202 			if (usrp->lug_uid == uid) {
3203 				if (usrp->lug_expiry < NFSD_MONOSEC)
3204 					break;
3205 				if (usrp->lug_cred != NULL) {
3206 					newcred = crhold(usrp->lug_cred);
3207 					crfree(oldcred);
3208 				} else
3209 					newcred = oldcred;
3210 				TAILQ_REMOVE(&hp->lughead, usrp, lug_numhash);
3211 				TAILQ_INSERT_TAIL(&hp->lughead, usrp,
3212 				    lug_numhash);
3213 				mtx_unlock(&hp->mtx);
3214 				return (newcred);
3215 			}
3216 		}
3217 		mtx_unlock(&hp->mtx);
3218 		cnt++;
3219 		ret = nfsrv_getuser(RPCNFSUSERD_GETUID, uid, (gid_t)0, NULL);
3220 		if (ret == 0 && cnt < 2)
3221 			goto tryagain;
3222 	}
3223 	return (oldcred);
3224 }
3225 
3226 /*
3227  * Convert a string to a uid.
3228  * If no conversion is possible return NFSERR_BADOWNER, otherwise
3229  * return 0.
3230  * If this is called from a client side mount using AUTH_SYS and the
3231  * string is made up entirely of digits, just convert the string to
3232  * a number.
3233  */
3234 APPLESTATIC int
3235 nfsv4_strtouid(struct nfsrv_descript *nd, u_char *str, int len, uid_t *uidp)
3236 {
3237 	int i;
3238 	char *cp, *endstr, *str0;
3239 	struct nfsusrgrp *usrp;
3240 	int cnt, ret;
3241 	int error = 0;
3242 	uid_t tuid;
3243 	struct nfsrv_lughash *hp, *hp2;
3244 
3245 	if (len == 0) {
3246 		error = NFSERR_BADOWNER;
3247 		goto out;
3248 	}
3249 	/* If a string of digits and an AUTH_SYS mount, just convert it. */
3250 	str0 = str;
3251 	tuid = (uid_t)strtoul(str0, &endstr, 10);
3252 	if ((endstr - str0) == len) {
3253 		/* A numeric string. */
3254 		if ((nd->nd_flag & ND_KERBV) == 0 &&
3255 		    ((nd->nd_flag & ND_NFSCL) != 0 ||
3256 		      nfsd_enable_stringtouid != 0))
3257 			*uidp = tuid;
3258 		else
3259 			error = NFSERR_BADOWNER;
3260 		goto out;
3261 	}
3262 	/*
3263 	 * Look for an '@'.
3264 	 */
3265 	cp = strchr(str0, '@');
3266 	if (cp != NULL)
3267 		i = (int)(cp++ - str0);
3268 	else
3269 		i = len;
3270 
3271 	cnt = 0;
3272 tryagain:
3273 	if (nfsrv_dnsnamelen > 0) {
3274 		/*
3275 		 * If an '@' is found and the domain name matches, search for
3276 		 * the name with dns stripped off.
3277 		 * Mixed case alpahbetics will match for the domain name, but
3278 		 * all upper case will not.
3279 		 */
3280 		if (cnt == 0 && i < len && i > 0 &&
3281 		    (len - 1 - i) == nfsrv_dnsnamelen &&
3282 		    !nfsrv_cmpmixedcase(cp, nfsrv_dnsname, nfsrv_dnsnamelen)) {
3283 			len -= (nfsrv_dnsnamelen + 1);
3284 			*(cp - 1) = '\0';
3285 		}
3286 
3287 		/*
3288 		 * Check for the special case of "nobody".
3289 		 */
3290 		if (len == 6 && !NFSBCMP(str, "nobody", 6)) {
3291 			*uidp = nfsrv_defaultuid;
3292 			error = 0;
3293 			goto out;
3294 		}
3295 
3296 		hp = NFSUSERNAMEHASH(str, len);
3297 		mtx_lock(&hp->mtx);
3298 		TAILQ_FOREACH(usrp, &hp->lughead, lug_namehash) {
3299 			if (usrp->lug_namelen == len &&
3300 			    !NFSBCMP(usrp->lug_name, str, len)) {
3301 				if (usrp->lug_expiry < NFSD_MONOSEC)
3302 					break;
3303 				hp2 = NFSUSERHASH(usrp->lug_uid);
3304 				mtx_lock(&hp2->mtx);
3305 				TAILQ_REMOVE(&hp2->lughead, usrp, lug_numhash);
3306 				TAILQ_INSERT_TAIL(&hp2->lughead, usrp,
3307 				    lug_numhash);
3308 				*uidp = usrp->lug_uid;
3309 				mtx_unlock(&hp2->mtx);
3310 				mtx_unlock(&hp->mtx);
3311 				error = 0;
3312 				goto out;
3313 			}
3314 		}
3315 		mtx_unlock(&hp->mtx);
3316 		cnt++;
3317 		ret = nfsrv_getuser(RPCNFSUSERD_GETUSER, (uid_t)0, (gid_t)0,
3318 		    str);
3319 		if (ret == 0 && cnt < 2)
3320 			goto tryagain;
3321 	}
3322 	error = NFSERR_BADOWNER;
3323 
3324 out:
3325 	NFSEXITCODE(error);
3326 	return (error);
3327 }
3328 
3329 /*
3330  * Convert a gid to a string.
3331  * gid - the group id
3332  * cpp - points to a buffer of size NFSV4_SMALLSTR
3333  *       (malloc a larger one, as required)
3334  * retlenp - pointer to length to be returned
3335  */
3336 APPLESTATIC void
3337 nfsv4_gidtostr(gid_t gid, u_char **cpp, int *retlenp)
3338 {
3339 	int i;
3340 	struct nfsusrgrp *usrp;
3341 	u_char *cp = *cpp;
3342 	gid_t tmp;
3343 	int cnt, hasampersand, len = NFSV4_SMALLSTR, ret;
3344 	struct nfsrv_lughash *hp;
3345 
3346 	cnt = 0;
3347 tryagain:
3348 	if (nfsrv_dnsnamelen > 0 && !nfs_enable_uidtostring) {
3349 		/*
3350 		 * Always map nfsrv_defaultgid to "nogroup".
3351 		 */
3352 		if (gid == nfsrv_defaultgid) {
3353 			i = nfsrv_dnsnamelen + 8;
3354 			if (i > len) {
3355 				if (len > NFSV4_SMALLSTR)
3356 					free(cp, M_NFSSTRING);
3357 				cp = malloc(i, M_NFSSTRING, M_WAITOK);
3358 				*cpp = cp;
3359 				len = i;
3360 				goto tryagain;
3361 			}
3362 			*retlenp = i;
3363 			NFSBCOPY("nogroup@", cp, 8);
3364 			cp += 8;
3365 			NFSBCOPY(nfsrv_dnsname, cp, nfsrv_dnsnamelen);
3366 			return;
3367 		}
3368 		hasampersand = 0;
3369 		hp = NFSGROUPHASH(gid);
3370 		mtx_lock(&hp->mtx);
3371 		TAILQ_FOREACH(usrp, &hp->lughead, lug_numhash) {
3372 			if (usrp->lug_gid == gid) {
3373 				if (usrp->lug_expiry < NFSD_MONOSEC)
3374 					break;
3375 				/*
3376 				 * If the name doesn't already have an '@'
3377 				 * in it, append @domainname to it.
3378 				 */
3379 				for (i = 0; i < usrp->lug_namelen; i++) {
3380 					if (usrp->lug_name[i] == '@') {
3381 						hasampersand = 1;
3382 						break;
3383 					}
3384 				}
3385 				if (hasampersand)
3386 					i = usrp->lug_namelen;
3387 				else
3388 					i = usrp->lug_namelen +
3389 					    nfsrv_dnsnamelen + 1;
3390 				if (i > len) {
3391 					mtx_unlock(&hp->mtx);
3392 					if (len > NFSV4_SMALLSTR)
3393 						free(cp, M_NFSSTRING);
3394 					cp = malloc(i, M_NFSSTRING, M_WAITOK);
3395 					*cpp = cp;
3396 					len = i;
3397 					goto tryagain;
3398 				}
3399 				*retlenp = i;
3400 				NFSBCOPY(usrp->lug_name, cp, usrp->lug_namelen);
3401 				if (!hasampersand) {
3402 					cp += usrp->lug_namelen;
3403 					*cp++ = '@';
3404 					NFSBCOPY(nfsrv_dnsname, cp, nfsrv_dnsnamelen);
3405 				}
3406 				TAILQ_REMOVE(&hp->lughead, usrp, lug_numhash);
3407 				TAILQ_INSERT_TAIL(&hp->lughead, usrp,
3408 				    lug_numhash);
3409 				mtx_unlock(&hp->mtx);
3410 				return;
3411 			}
3412 		}
3413 		mtx_unlock(&hp->mtx);
3414 		cnt++;
3415 		ret = nfsrv_getuser(RPCNFSUSERD_GETGID, (uid_t)0, gid, NULL);
3416 		if (ret == 0 && cnt < 2)
3417 			goto tryagain;
3418 	}
3419 
3420 	/*
3421 	 * No match, just return a string of digits.
3422 	 */
3423 	tmp = gid;
3424 	i = 0;
3425 	while (tmp || i == 0) {
3426 		tmp /= 10;
3427 		i++;
3428 	}
3429 	len = (i > len) ? len : i;
3430 	*retlenp = len;
3431 	cp += (len - 1);
3432 	tmp = gid;
3433 	for (i = 0; i < len; i++) {
3434 		*cp-- = '0' + (tmp % 10);
3435 		tmp /= 10;
3436 	}
3437 	return;
3438 }
3439 
3440 /*
3441  * Convert a string to a gid.
3442  * If no conversion is possible return NFSERR_BADOWNER, otherwise
3443  * return 0.
3444  * If this is called from a client side mount using AUTH_SYS and the
3445  * string is made up entirely of digits, just convert the string to
3446  * a number.
3447  */
3448 APPLESTATIC int
3449 nfsv4_strtogid(struct nfsrv_descript *nd, u_char *str, int len, gid_t *gidp)
3450 {
3451 	int i;
3452 	char *cp, *endstr, *str0;
3453 	struct nfsusrgrp *usrp;
3454 	int cnt, ret;
3455 	int error = 0;
3456 	gid_t tgid;
3457 	struct nfsrv_lughash *hp, *hp2;
3458 
3459 	if (len == 0) {
3460 		error =  NFSERR_BADOWNER;
3461 		goto out;
3462 	}
3463 	/* If a string of digits and an AUTH_SYS mount, just convert it. */
3464 	str0 = str;
3465 	tgid = (gid_t)strtoul(str0, &endstr, 10);
3466 	if ((endstr - str0) == len) {
3467 		/* A numeric string. */
3468 		if ((nd->nd_flag & ND_KERBV) == 0 &&
3469 		    ((nd->nd_flag & ND_NFSCL) != 0 ||
3470 		      nfsd_enable_stringtouid != 0))
3471 			*gidp = tgid;
3472 		else
3473 			error = NFSERR_BADOWNER;
3474 		goto out;
3475 	}
3476 	/*
3477 	 * Look for an '@'.
3478 	 */
3479 	cp = strchr(str0, '@');
3480 	if (cp != NULL)
3481 		i = (int)(cp++ - str0);
3482 	else
3483 		i = len;
3484 
3485 	cnt = 0;
3486 tryagain:
3487 	if (nfsrv_dnsnamelen > 0) {
3488 		/*
3489 		 * If an '@' is found and the dns name matches, search for the
3490 		 * name with the dns stripped off.
3491 		 */
3492 		if (cnt == 0 && i < len && i > 0 &&
3493 		    (len - 1 - i) == nfsrv_dnsnamelen &&
3494 		    !nfsrv_cmpmixedcase(cp, nfsrv_dnsname, nfsrv_dnsnamelen)) {
3495 			len -= (nfsrv_dnsnamelen + 1);
3496 			*(cp - 1) = '\0';
3497 		}
3498 
3499 		/*
3500 		 * Check for the special case of "nogroup".
3501 		 */
3502 		if (len == 7 && !NFSBCMP(str, "nogroup", 7)) {
3503 			*gidp = nfsrv_defaultgid;
3504 			error = 0;
3505 			goto out;
3506 		}
3507 
3508 		hp = NFSGROUPNAMEHASH(str, len);
3509 		mtx_lock(&hp->mtx);
3510 		TAILQ_FOREACH(usrp, &hp->lughead, lug_namehash) {
3511 			if (usrp->lug_namelen == len &&
3512 			    !NFSBCMP(usrp->lug_name, str, len)) {
3513 				if (usrp->lug_expiry < NFSD_MONOSEC)
3514 					break;
3515 				hp2 = NFSGROUPHASH(usrp->lug_gid);
3516 				mtx_lock(&hp2->mtx);
3517 				TAILQ_REMOVE(&hp2->lughead, usrp, lug_numhash);
3518 				TAILQ_INSERT_TAIL(&hp2->lughead, usrp,
3519 				    lug_numhash);
3520 				*gidp = usrp->lug_gid;
3521 				mtx_unlock(&hp2->mtx);
3522 				mtx_unlock(&hp->mtx);
3523 				error = 0;
3524 				goto out;
3525 			}
3526 		}
3527 		mtx_unlock(&hp->mtx);
3528 		cnt++;
3529 		ret = nfsrv_getuser(RPCNFSUSERD_GETGROUP, (uid_t)0, (gid_t)0,
3530 		    str);
3531 		if (ret == 0 && cnt < 2)
3532 			goto tryagain;
3533 	}
3534 	error = NFSERR_BADOWNER;
3535 
3536 out:
3537 	NFSEXITCODE(error);
3538 	return (error);
3539 }
3540 
3541 /*
3542  * Cmp len chars, allowing mixed case in the first argument to match lower
3543  * case in the second, but not if the first argument is all upper case.
3544  * Return 0 for a match, 1 otherwise.
3545  */
3546 static int
3547 nfsrv_cmpmixedcase(u_char *cp, u_char *cp2, int len)
3548 {
3549 	int i;
3550 	u_char tmp;
3551 	int fndlower = 0;
3552 
3553 	for (i = 0; i < len; i++) {
3554 		if (*cp >= 'A' && *cp <= 'Z') {
3555 			tmp = *cp++ + ('a' - 'A');
3556 		} else {
3557 			tmp = *cp++;
3558 			if (tmp >= 'a' && tmp <= 'z')
3559 				fndlower = 1;
3560 		}
3561 		if (tmp != *cp2++)
3562 			return (1);
3563 	}
3564 	if (fndlower)
3565 		return (0);
3566 	else
3567 		return (1);
3568 }
3569 
3570 /*
3571  * Set the port for the nfsuserd.
3572  */
3573 APPLESTATIC int
3574 nfsrv_nfsuserdport(struct nfsuserd_args *nargs, NFSPROC_T *p)
3575 {
3576 	struct nfssockreq *rp;
3577 #ifdef INET
3578 	struct sockaddr_in *ad;
3579 #endif
3580 #ifdef INET6
3581 	struct sockaddr_in6 *ad6;
3582 	const struct in6_addr in6loopback = IN6ADDR_LOOPBACK_INIT;
3583 #endif
3584 	int error;
3585 
3586 	NFSLOCKNAMEID();
3587 	if (nfsrv_nfsuserd != NOTRUNNING) {
3588 		NFSUNLOCKNAMEID();
3589 		error = EPERM;
3590 		goto out;
3591 	}
3592 	nfsrv_nfsuserd = STARTSTOP;
3593 	/*
3594 	 * Set up the socket record and connect.
3595 	 * Set nr_client NULL before unlocking, just to ensure that no other
3596 	 * process/thread/core will use a bogus old value.  This could only
3597 	 * occur if the use of the nameid lock to protect nfsrv_nfsuserd is
3598 	 * broken.
3599 	 */
3600 	rp = &nfsrv_nfsuserdsock;
3601 	rp->nr_client = NULL;
3602 	NFSUNLOCKNAMEID();
3603 	rp->nr_sotype = SOCK_DGRAM;
3604 	rp->nr_soproto = IPPROTO_UDP;
3605 	rp->nr_lock = (NFSR_RESERVEDPORT | NFSR_LOCALHOST);
3606 	rp->nr_cred = NULL;
3607 	rp->nr_prog = RPCPROG_NFSUSERD;
3608 	error = 0;
3609 	switch (nargs->nuserd_family) {
3610 #ifdef INET
3611 	case AF_INET:
3612 		rp->nr_nam = malloc(sizeof(struct sockaddr_in), M_SONAME,
3613 		    M_WAITOK | M_ZERO);
3614  		ad = (struct sockaddr_in *)rp->nr_nam;
3615 		ad->sin_len = sizeof(struct sockaddr_in);
3616  		ad->sin_family = AF_INET;
3617 		ad->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
3618 		ad->sin_port = nargs->nuserd_port;
3619 		break;
3620 #endif
3621 #ifdef INET6
3622 	case AF_INET6:
3623 		rp->nr_nam = malloc(sizeof(struct sockaddr_in6), M_SONAME,
3624 		    M_WAITOK | M_ZERO);
3625 		ad6 = (struct sockaddr_in6 *)rp->nr_nam;
3626 		ad6->sin6_len = sizeof(struct sockaddr_in6);
3627 		ad6->sin6_family = AF_INET6;
3628 		ad6->sin6_addr = in6loopback;
3629 		ad6->sin6_port = nargs->nuserd_port;
3630 		break;
3631 #endif
3632 	default:
3633 		error = ENXIO;
3634  	}
3635 	rp->nr_vers = RPCNFSUSERD_VERS;
3636 	if (error == 0)
3637 		error = newnfs_connect(NULL, rp, NFSPROCCRED(p), p, 0);
3638 	if (error == 0) {
3639 		NFSLOCKNAMEID();
3640 		nfsrv_nfsuserd = RUNNING;
3641 		NFSUNLOCKNAMEID();
3642 	} else {
3643 		free(rp->nr_nam, M_SONAME);
3644 		NFSLOCKNAMEID();
3645 		nfsrv_nfsuserd = NOTRUNNING;
3646 		NFSUNLOCKNAMEID();
3647 	}
3648 out:
3649 	NFSEXITCODE(error);
3650 	return (error);
3651 }
3652 
3653 /*
3654  * Delete the nfsuserd port.
3655  */
3656 APPLESTATIC void
3657 nfsrv_nfsuserddelport(void)
3658 {
3659 
3660 	NFSLOCKNAMEID();
3661 	if (nfsrv_nfsuserd != RUNNING) {
3662 		NFSUNLOCKNAMEID();
3663 		return;
3664 	}
3665 	nfsrv_nfsuserd = STARTSTOP;
3666 	/* Wait for all upcalls to complete. */
3667 	while (nfsrv_userdupcalls > 0)
3668 		msleep(&nfsrv_userdupcalls, NFSNAMEIDMUTEXPTR, PVFS,
3669 		    "nfsupcalls", 0);
3670 	NFSUNLOCKNAMEID();
3671 	newnfs_disconnect(&nfsrv_nfsuserdsock);
3672 	free(nfsrv_nfsuserdsock.nr_nam, M_SONAME);
3673 	NFSLOCKNAMEID();
3674 	nfsrv_nfsuserd = NOTRUNNING;
3675 	NFSUNLOCKNAMEID();
3676 }
3677 
3678 /*
3679  * Do upcalls to the nfsuserd, for cache misses of the owner/ownergroup
3680  * name<-->id cache.
3681  * Returns 0 upon success, non-zero otherwise.
3682  */
3683 static int
3684 nfsrv_getuser(int procnum, uid_t uid, gid_t gid, char *name)
3685 {
3686 	u_int32_t *tl;
3687 	struct nfsrv_descript *nd;
3688 	int len;
3689 	struct nfsrv_descript nfsd;
3690 	struct ucred *cred;
3691 	int error;
3692 
3693 	NFSLOCKNAMEID();
3694 	if (nfsrv_nfsuserd != RUNNING) {
3695 		NFSUNLOCKNAMEID();
3696 		error = EPERM;
3697 		goto out;
3698 	}
3699 	/*
3700 	 * Maintain a count of upcalls in progress, so that nfsrv_X()
3701 	 * can wait until no upcalls are in progress.
3702 	 */
3703 	nfsrv_userdupcalls++;
3704 	NFSUNLOCKNAMEID();
3705 	KASSERT(nfsrv_userdupcalls > 0,
3706 	    ("nfsrv_getuser: non-positive upcalls"));
3707 	nd = &nfsd;
3708 	cred = newnfs_getcred();
3709 	nd->nd_flag = ND_GSSINITREPLY;
3710 	nfsrvd_rephead(nd);
3711 
3712 	nd->nd_procnum = procnum;
3713 	if (procnum == RPCNFSUSERD_GETUID || procnum == RPCNFSUSERD_GETGID) {
3714 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3715 		if (procnum == RPCNFSUSERD_GETUID)
3716 			*tl = txdr_unsigned(uid);
3717 		else
3718 			*tl = txdr_unsigned(gid);
3719 	} else {
3720 		len = strlen(name);
3721 		(void) nfsm_strtom(nd, name, len);
3722 	}
3723 	error = newnfs_request(nd, NULL, NULL, &nfsrv_nfsuserdsock, NULL, NULL,
3724 		cred, RPCPROG_NFSUSERD, RPCNFSUSERD_VERS, NULL, 0, NULL, NULL);
3725 	NFSLOCKNAMEID();
3726 	if (--nfsrv_userdupcalls == 0 && nfsrv_nfsuserd == STARTSTOP)
3727 		wakeup(&nfsrv_userdupcalls);
3728 	NFSUNLOCKNAMEID();
3729 	NFSFREECRED(cred);
3730 	if (!error) {
3731 		mbuf_freem(nd->nd_mrep);
3732 		error = nd->nd_repstat;
3733 	}
3734 out:
3735 	NFSEXITCODE(error);
3736 	return (error);
3737 }
3738 
3739 /*
3740  * This function is called from the nfssvc(2) system call, to update the
3741  * kernel user/group name list(s) for the V4 owner and ownergroup attributes.
3742  */
3743 APPLESTATIC int
3744 nfssvc_idname(struct nfsd_idargs *nidp)
3745 {
3746 	struct nfsusrgrp *nusrp, *usrp, *newusrp;
3747 	struct nfsrv_lughash *hp_name, *hp_idnum, *thp;
3748 	int i, group_locked, groupname_locked, user_locked, username_locked;
3749 	int error = 0;
3750 	u_char *cp;
3751 	gid_t *grps;
3752 	struct ucred *cr;
3753 	static int onethread = 0;
3754 	static time_t lasttime = 0;
3755 
3756 	if (nidp->nid_namelen <= 0 || nidp->nid_namelen > MAXHOSTNAMELEN) {
3757 		error = EINVAL;
3758 		goto out;
3759 	}
3760 	if (nidp->nid_flag & NFSID_INITIALIZE) {
3761 		cp = malloc(nidp->nid_namelen + 1, M_NFSSTRING, M_WAITOK);
3762 		error = copyin(CAST_USER_ADDR_T(nidp->nid_name), cp,
3763 		    nidp->nid_namelen);
3764 		if (error != 0) {
3765 			free(cp, M_NFSSTRING);
3766 			goto out;
3767 		}
3768 		if (atomic_cmpset_acq_int(&nfsrv_dnsnamelen, 0, 0) == 0) {
3769 			/*
3770 			 * Free up all the old stuff and reinitialize hash
3771 			 * lists.  All mutexes for both lists must be locked,
3772 			 * with the user/group name ones before the uid/gid
3773 			 * ones, to avoid a LOR.
3774 			 */
3775 			for (i = 0; i < nfsrv_lughashsize; i++)
3776 				mtx_lock(&nfsusernamehash[i].mtx);
3777 			for (i = 0; i < nfsrv_lughashsize; i++)
3778 				mtx_lock(&nfsuserhash[i].mtx);
3779 			for (i = 0; i < nfsrv_lughashsize; i++)
3780 				TAILQ_FOREACH_SAFE(usrp,
3781 				    &nfsuserhash[i].lughead, lug_numhash, nusrp)
3782 					nfsrv_removeuser(usrp, 1);
3783 			for (i = 0; i < nfsrv_lughashsize; i++)
3784 				mtx_unlock(&nfsuserhash[i].mtx);
3785 			for (i = 0; i < nfsrv_lughashsize; i++)
3786 				mtx_unlock(&nfsusernamehash[i].mtx);
3787 			for (i = 0; i < nfsrv_lughashsize; i++)
3788 				mtx_lock(&nfsgroupnamehash[i].mtx);
3789 			for (i = 0; i < nfsrv_lughashsize; i++)
3790 				mtx_lock(&nfsgrouphash[i].mtx);
3791 			for (i = 0; i < nfsrv_lughashsize; i++)
3792 				TAILQ_FOREACH_SAFE(usrp,
3793 				    &nfsgrouphash[i].lughead, lug_numhash,
3794 				    nusrp)
3795 					nfsrv_removeuser(usrp, 0);
3796 			for (i = 0; i < nfsrv_lughashsize; i++)
3797 				mtx_unlock(&nfsgrouphash[i].mtx);
3798 			for (i = 0; i < nfsrv_lughashsize; i++)
3799 				mtx_unlock(&nfsgroupnamehash[i].mtx);
3800 			free(nfsrv_dnsname, M_NFSSTRING);
3801 			nfsrv_dnsname = NULL;
3802 		}
3803 		if (nfsuserhash == NULL) {
3804 			/* Allocate the hash tables. */
3805 			nfsuserhash = malloc(sizeof(struct nfsrv_lughash) *
3806 			    nfsrv_lughashsize, M_NFSUSERGROUP, M_WAITOK |
3807 			    M_ZERO);
3808 			for (i = 0; i < nfsrv_lughashsize; i++)
3809 				mtx_init(&nfsuserhash[i].mtx, "nfsuidhash",
3810 				    NULL, MTX_DEF | MTX_DUPOK);
3811 			nfsusernamehash = malloc(sizeof(struct nfsrv_lughash) *
3812 			    nfsrv_lughashsize, M_NFSUSERGROUP, M_WAITOK |
3813 			    M_ZERO);
3814 			for (i = 0; i < nfsrv_lughashsize; i++)
3815 				mtx_init(&nfsusernamehash[i].mtx,
3816 				    "nfsusrhash", NULL, MTX_DEF |
3817 				    MTX_DUPOK);
3818 			nfsgrouphash = malloc(sizeof(struct nfsrv_lughash) *
3819 			    nfsrv_lughashsize, M_NFSUSERGROUP, M_WAITOK |
3820 			    M_ZERO);
3821 			for (i = 0; i < nfsrv_lughashsize; i++)
3822 				mtx_init(&nfsgrouphash[i].mtx, "nfsgidhash",
3823 				    NULL, MTX_DEF | MTX_DUPOK);
3824 			nfsgroupnamehash = malloc(sizeof(struct nfsrv_lughash) *
3825 			    nfsrv_lughashsize, M_NFSUSERGROUP, M_WAITOK |
3826 			    M_ZERO);
3827 			for (i = 0; i < nfsrv_lughashsize; i++)
3828 			    mtx_init(&nfsgroupnamehash[i].mtx,
3829 			    "nfsgrphash", NULL, MTX_DEF | MTX_DUPOK);
3830 		}
3831 		/* (Re)initialize the list heads. */
3832 		for (i = 0; i < nfsrv_lughashsize; i++)
3833 			TAILQ_INIT(&nfsuserhash[i].lughead);
3834 		for (i = 0; i < nfsrv_lughashsize; i++)
3835 			TAILQ_INIT(&nfsusernamehash[i].lughead);
3836 		for (i = 0; i < nfsrv_lughashsize; i++)
3837 			TAILQ_INIT(&nfsgrouphash[i].lughead);
3838 		for (i = 0; i < nfsrv_lughashsize; i++)
3839 			TAILQ_INIT(&nfsgroupnamehash[i].lughead);
3840 
3841 		/*
3842 		 * Put name in "DNS" string.
3843 		 */
3844 		nfsrv_dnsname = cp;
3845 		nfsrv_defaultuid = nidp->nid_uid;
3846 		nfsrv_defaultgid = nidp->nid_gid;
3847 		nfsrv_usercnt = 0;
3848 		nfsrv_usermax = nidp->nid_usermax;
3849 		atomic_store_rel_int(&nfsrv_dnsnamelen, nidp->nid_namelen);
3850 		goto out;
3851 	}
3852 
3853 	/*
3854 	 * malloc the new one now, so any potential sleep occurs before
3855 	 * manipulation of the lists.
3856 	 */
3857 	newusrp = malloc(sizeof(struct nfsusrgrp) + nidp->nid_namelen,
3858 	    M_NFSUSERGROUP, M_WAITOK | M_ZERO);
3859 	error = copyin(CAST_USER_ADDR_T(nidp->nid_name), newusrp->lug_name,
3860 	    nidp->nid_namelen);
3861 	if (error == 0 && nidp->nid_ngroup > 0 &&
3862 	    (nidp->nid_flag & NFSID_ADDUID) != 0) {
3863 		grps = malloc(sizeof(gid_t) * nidp->nid_ngroup, M_TEMP,
3864 		    M_WAITOK);
3865 		error = copyin(CAST_USER_ADDR_T(nidp->nid_grps), grps,
3866 		    sizeof(gid_t) * nidp->nid_ngroup);
3867 		if (error == 0) {
3868 			/*
3869 			 * Create a credential just like svc_getcred(),
3870 			 * but using the group list provided.
3871 			 */
3872 			cr = crget();
3873 			cr->cr_uid = cr->cr_ruid = cr->cr_svuid = nidp->nid_uid;
3874 			crsetgroups(cr, nidp->nid_ngroup, grps);
3875 			cr->cr_rgid = cr->cr_svgid = cr->cr_groups[0];
3876 			cr->cr_prison = &prison0;
3877 			prison_hold(cr->cr_prison);
3878 #ifdef MAC
3879 			mac_cred_associate_nfsd(cr);
3880 #endif
3881 			newusrp->lug_cred = cr;
3882 		}
3883 		free(grps, M_TEMP);
3884 	}
3885 	if (error) {
3886 		free(newusrp, M_NFSUSERGROUP);
3887 		goto out;
3888 	}
3889 	newusrp->lug_namelen = nidp->nid_namelen;
3890 
3891 	/*
3892 	 * The lock order is username[0]->[nfsrv_lughashsize - 1] followed
3893 	 * by uid[0]->[nfsrv_lughashsize - 1], with the same for group.
3894 	 * The flags user_locked, username_locked, group_locked and
3895 	 * groupname_locked are set to indicate all of those hash lists are
3896 	 * locked. hp_name != NULL  and hp_idnum != NULL indicates that
3897 	 * the respective one mutex is locked.
3898 	 */
3899 	user_locked = username_locked = group_locked = groupname_locked = 0;
3900 	hp_name = hp_idnum = NULL;
3901 
3902 	/*
3903 	 * Delete old entries, as required.
3904 	 */
3905 	if (nidp->nid_flag & (NFSID_DELUID | NFSID_ADDUID)) {
3906 		/* Must lock all username hash lists first, to avoid a LOR. */
3907 		for (i = 0; i < nfsrv_lughashsize; i++)
3908 			mtx_lock(&nfsusernamehash[i].mtx);
3909 		username_locked = 1;
3910 		hp_idnum = NFSUSERHASH(nidp->nid_uid);
3911 		mtx_lock(&hp_idnum->mtx);
3912 		TAILQ_FOREACH_SAFE(usrp, &hp_idnum->lughead, lug_numhash,
3913 		    nusrp) {
3914 			if (usrp->lug_uid == nidp->nid_uid)
3915 				nfsrv_removeuser(usrp, 1);
3916 		}
3917 	} else if (nidp->nid_flag & (NFSID_DELUSERNAME | NFSID_ADDUSERNAME)) {
3918 		hp_name = NFSUSERNAMEHASH(newusrp->lug_name,
3919 		    newusrp->lug_namelen);
3920 		mtx_lock(&hp_name->mtx);
3921 		TAILQ_FOREACH_SAFE(usrp, &hp_name->lughead, lug_namehash,
3922 		    nusrp) {
3923 			if (usrp->lug_namelen == newusrp->lug_namelen &&
3924 			    !NFSBCMP(usrp->lug_name, newusrp->lug_name,
3925 			    usrp->lug_namelen)) {
3926 				thp = NFSUSERHASH(usrp->lug_uid);
3927 				mtx_lock(&thp->mtx);
3928 				nfsrv_removeuser(usrp, 1);
3929 				mtx_unlock(&thp->mtx);
3930 			}
3931 		}
3932 		hp_idnum = NFSUSERHASH(nidp->nid_uid);
3933 		mtx_lock(&hp_idnum->mtx);
3934 	} else if (nidp->nid_flag & (NFSID_DELGID | NFSID_ADDGID)) {
3935 		/* Must lock all groupname hash lists first, to avoid a LOR. */
3936 		for (i = 0; i < nfsrv_lughashsize; i++)
3937 			mtx_lock(&nfsgroupnamehash[i].mtx);
3938 		groupname_locked = 1;
3939 		hp_idnum = NFSGROUPHASH(nidp->nid_gid);
3940 		mtx_lock(&hp_idnum->mtx);
3941 		TAILQ_FOREACH_SAFE(usrp, &hp_idnum->lughead, lug_numhash,
3942 		    nusrp) {
3943 			if (usrp->lug_gid == nidp->nid_gid)
3944 				nfsrv_removeuser(usrp, 0);
3945 		}
3946 	} else if (nidp->nid_flag & (NFSID_DELGROUPNAME | NFSID_ADDGROUPNAME)) {
3947 		hp_name = NFSGROUPNAMEHASH(newusrp->lug_name,
3948 		    newusrp->lug_namelen);
3949 		mtx_lock(&hp_name->mtx);
3950 		TAILQ_FOREACH_SAFE(usrp, &hp_name->lughead, lug_namehash,
3951 		    nusrp) {
3952 			if (usrp->lug_namelen == newusrp->lug_namelen &&
3953 			    !NFSBCMP(usrp->lug_name, newusrp->lug_name,
3954 			    usrp->lug_namelen)) {
3955 				thp = NFSGROUPHASH(usrp->lug_gid);
3956 				mtx_lock(&thp->mtx);
3957 				nfsrv_removeuser(usrp, 0);
3958 				mtx_unlock(&thp->mtx);
3959 			}
3960 		}
3961 		hp_idnum = NFSGROUPHASH(nidp->nid_gid);
3962 		mtx_lock(&hp_idnum->mtx);
3963 	}
3964 
3965 	/*
3966 	 * Now, we can add the new one.
3967 	 */
3968 	if (nidp->nid_usertimeout)
3969 		newusrp->lug_expiry = NFSD_MONOSEC + nidp->nid_usertimeout;
3970 	else
3971 		newusrp->lug_expiry = NFSD_MONOSEC + 5;
3972 	if (nidp->nid_flag & (NFSID_ADDUID | NFSID_ADDUSERNAME)) {
3973 		newusrp->lug_uid = nidp->nid_uid;
3974 		thp = NFSUSERHASH(newusrp->lug_uid);
3975 		mtx_assert(&thp->mtx, MA_OWNED);
3976 		TAILQ_INSERT_TAIL(&thp->lughead, newusrp, lug_numhash);
3977 		thp = NFSUSERNAMEHASH(newusrp->lug_name, newusrp->lug_namelen);
3978 		mtx_assert(&thp->mtx, MA_OWNED);
3979 		TAILQ_INSERT_TAIL(&thp->lughead, newusrp, lug_namehash);
3980 		atomic_add_int(&nfsrv_usercnt, 1);
3981 	} else if (nidp->nid_flag & (NFSID_ADDGID | NFSID_ADDGROUPNAME)) {
3982 		newusrp->lug_gid = nidp->nid_gid;
3983 		thp = NFSGROUPHASH(newusrp->lug_gid);
3984 		mtx_assert(&thp->mtx, MA_OWNED);
3985 		TAILQ_INSERT_TAIL(&thp->lughead, newusrp, lug_numhash);
3986 		thp = NFSGROUPNAMEHASH(newusrp->lug_name, newusrp->lug_namelen);
3987 		mtx_assert(&thp->mtx, MA_OWNED);
3988 		TAILQ_INSERT_TAIL(&thp->lughead, newusrp, lug_namehash);
3989 		atomic_add_int(&nfsrv_usercnt, 1);
3990 	} else {
3991 		if (newusrp->lug_cred != NULL)
3992 			crfree(newusrp->lug_cred);
3993 		free(newusrp, M_NFSUSERGROUP);
3994 	}
3995 
3996 	/*
3997 	 * Once per second, allow one thread to trim the cache.
3998 	 */
3999 	if (lasttime < NFSD_MONOSEC &&
4000 	    atomic_cmpset_acq_int(&onethread, 0, 1) != 0) {
4001 		/*
4002 		 * First, unlock the single mutexes, so that all entries
4003 		 * can be locked and any LOR is avoided.
4004 		 */
4005 		if (hp_name != NULL) {
4006 			mtx_unlock(&hp_name->mtx);
4007 			hp_name = NULL;
4008 		}
4009 		if (hp_idnum != NULL) {
4010 			mtx_unlock(&hp_idnum->mtx);
4011 			hp_idnum = NULL;
4012 		}
4013 
4014 		if ((nidp->nid_flag & (NFSID_DELUID | NFSID_ADDUID |
4015 		    NFSID_DELUSERNAME | NFSID_ADDUSERNAME)) != 0) {
4016 			if (username_locked == 0) {
4017 				for (i = 0; i < nfsrv_lughashsize; i++)
4018 					mtx_lock(&nfsusernamehash[i].mtx);
4019 				username_locked = 1;
4020 			}
4021 			KASSERT(user_locked == 0,
4022 			    ("nfssvc_idname: user_locked"));
4023 			for (i = 0; i < nfsrv_lughashsize; i++)
4024 				mtx_lock(&nfsuserhash[i].mtx);
4025 			user_locked = 1;
4026 			for (i = 0; i < nfsrv_lughashsize; i++) {
4027 				TAILQ_FOREACH_SAFE(usrp,
4028 				    &nfsuserhash[i].lughead, lug_numhash,
4029 				    nusrp)
4030 					if (usrp->lug_expiry < NFSD_MONOSEC)
4031 						nfsrv_removeuser(usrp, 1);
4032 			}
4033 			for (i = 0; i < nfsrv_lughashsize; i++) {
4034 				/*
4035 				 * Trim the cache using an approximate LRU
4036 				 * algorithm.  This code deletes the least
4037 				 * recently used entry on each hash list.
4038 				 */
4039 				if (nfsrv_usercnt <= nfsrv_usermax)
4040 					break;
4041 				usrp = TAILQ_FIRST(&nfsuserhash[i].lughead);
4042 				if (usrp != NULL)
4043 					nfsrv_removeuser(usrp, 1);
4044 			}
4045 		} else {
4046 			if (groupname_locked == 0) {
4047 				for (i = 0; i < nfsrv_lughashsize; i++)
4048 					mtx_lock(&nfsgroupnamehash[i].mtx);
4049 				groupname_locked = 1;
4050 			}
4051 			KASSERT(group_locked == 0,
4052 			    ("nfssvc_idname: group_locked"));
4053 			for (i = 0; i < nfsrv_lughashsize; i++)
4054 				mtx_lock(&nfsgrouphash[i].mtx);
4055 			group_locked = 1;
4056 			for (i = 0; i < nfsrv_lughashsize; i++) {
4057 				TAILQ_FOREACH_SAFE(usrp,
4058 				    &nfsgrouphash[i].lughead, lug_numhash,
4059 				    nusrp)
4060 					if (usrp->lug_expiry < NFSD_MONOSEC)
4061 						nfsrv_removeuser(usrp, 0);
4062 			}
4063 			for (i = 0; i < nfsrv_lughashsize; i++) {
4064 				/*
4065 				 * Trim the cache using an approximate LRU
4066 				 * algorithm.  This code deletes the least
4067 				 * recently user entry on each hash list.
4068 				 */
4069 				if (nfsrv_usercnt <= nfsrv_usermax)
4070 					break;
4071 				usrp = TAILQ_FIRST(&nfsgrouphash[i].lughead);
4072 				if (usrp != NULL)
4073 					nfsrv_removeuser(usrp, 0);
4074 			}
4075 		}
4076 		lasttime = NFSD_MONOSEC;
4077 		atomic_store_rel_int(&onethread, 0);
4078 	}
4079 
4080 	/* Now, unlock all locked mutexes. */
4081 	if (hp_idnum != NULL)
4082 		mtx_unlock(&hp_idnum->mtx);
4083 	if (hp_name != NULL)
4084 		mtx_unlock(&hp_name->mtx);
4085 	if (user_locked != 0)
4086 		for (i = 0; i < nfsrv_lughashsize; i++)
4087 			mtx_unlock(&nfsuserhash[i].mtx);
4088 	if (username_locked != 0)
4089 		for (i = 0; i < nfsrv_lughashsize; i++)
4090 			mtx_unlock(&nfsusernamehash[i].mtx);
4091 	if (group_locked != 0)
4092 		for (i = 0; i < nfsrv_lughashsize; i++)
4093 			mtx_unlock(&nfsgrouphash[i].mtx);
4094 	if (groupname_locked != 0)
4095 		for (i = 0; i < nfsrv_lughashsize; i++)
4096 			mtx_unlock(&nfsgroupnamehash[i].mtx);
4097 out:
4098 	NFSEXITCODE(error);
4099 	return (error);
4100 }
4101 
4102 /*
4103  * Remove a user/group name element.
4104  */
4105 static void
4106 nfsrv_removeuser(struct nfsusrgrp *usrp, int isuser)
4107 {
4108 	struct nfsrv_lughash *hp;
4109 
4110 	if (isuser != 0) {
4111 		hp = NFSUSERHASH(usrp->lug_uid);
4112 		mtx_assert(&hp->mtx, MA_OWNED);
4113 		TAILQ_REMOVE(&hp->lughead, usrp, lug_numhash);
4114 		hp = NFSUSERNAMEHASH(usrp->lug_name, usrp->lug_namelen);
4115 		mtx_assert(&hp->mtx, MA_OWNED);
4116 		TAILQ_REMOVE(&hp->lughead, usrp, lug_namehash);
4117 	} else {
4118 		hp = NFSGROUPHASH(usrp->lug_gid);
4119 		mtx_assert(&hp->mtx, MA_OWNED);
4120 		TAILQ_REMOVE(&hp->lughead, usrp, lug_numhash);
4121 		hp = NFSGROUPNAMEHASH(usrp->lug_name, usrp->lug_namelen);
4122 		mtx_assert(&hp->mtx, MA_OWNED);
4123 		TAILQ_REMOVE(&hp->lughead, usrp, lug_namehash);
4124 	}
4125 	atomic_add_int(&nfsrv_usercnt, -1);
4126 	if (usrp->lug_cred != NULL)
4127 		crfree(usrp->lug_cred);
4128 	free(usrp, M_NFSUSERGROUP);
4129 }
4130 
4131 /*
4132  * Free up all the allocations related to the name<-->id cache.
4133  * This function should only be called when the nfsuserd daemon isn't
4134  * running, since it doesn't do any locking.
4135  * This function is meant to be used when the nfscommon module is unloaded.
4136  */
4137 APPLESTATIC void
4138 nfsrv_cleanusergroup(void)
4139 {
4140 	struct nfsrv_lughash *hp, *hp2;
4141 	struct nfsusrgrp *nusrp, *usrp;
4142 	int i;
4143 
4144 	if (nfsuserhash == NULL)
4145 		return;
4146 
4147 	for (i = 0; i < nfsrv_lughashsize; i++) {
4148 		hp = &nfsuserhash[i];
4149 		TAILQ_FOREACH_SAFE(usrp, &hp->lughead, lug_numhash, nusrp) {
4150 			TAILQ_REMOVE(&hp->lughead, usrp, lug_numhash);
4151 			hp2 = NFSUSERNAMEHASH(usrp->lug_name,
4152 			    usrp->lug_namelen);
4153 			TAILQ_REMOVE(&hp2->lughead, usrp, lug_namehash);
4154 			if (usrp->lug_cred != NULL)
4155 				crfree(usrp->lug_cred);
4156 			free(usrp, M_NFSUSERGROUP);
4157 		}
4158 		hp = &nfsgrouphash[i];
4159 		TAILQ_FOREACH_SAFE(usrp, &hp->lughead, lug_numhash, nusrp) {
4160 			TAILQ_REMOVE(&hp->lughead, usrp, lug_numhash);
4161 			hp2 = NFSGROUPNAMEHASH(usrp->lug_name,
4162 			    usrp->lug_namelen);
4163 			TAILQ_REMOVE(&hp2->lughead, usrp, lug_namehash);
4164 			if (usrp->lug_cred != NULL)
4165 				crfree(usrp->lug_cred);
4166 			free(usrp, M_NFSUSERGROUP);
4167 		}
4168 		mtx_destroy(&nfsuserhash[i].mtx);
4169 		mtx_destroy(&nfsusernamehash[i].mtx);
4170 		mtx_destroy(&nfsgroupnamehash[i].mtx);
4171 		mtx_destroy(&nfsgrouphash[i].mtx);
4172 	}
4173 	free(nfsuserhash, M_NFSUSERGROUP);
4174 	free(nfsusernamehash, M_NFSUSERGROUP);
4175 	free(nfsgrouphash, M_NFSUSERGROUP);
4176 	free(nfsgroupnamehash, M_NFSUSERGROUP);
4177 	free(nfsrv_dnsname, M_NFSSTRING);
4178 }
4179 
4180 /*
4181  * This function scans a byte string and checks for UTF-8 compliance.
4182  * It returns 0 if it conforms and NFSERR_INVAL if not.
4183  */
4184 APPLESTATIC int
4185 nfsrv_checkutf8(u_int8_t *cp, int len)
4186 {
4187 	u_int32_t val = 0x0;
4188 	int cnt = 0, gotd = 0, shift = 0;
4189 	u_int8_t byte;
4190 	static int utf8_shift[5] = { 7, 11, 16, 21, 26 };
4191 	int error = 0;
4192 
4193 	/*
4194 	 * Here are what the variables are used for:
4195 	 * val - the calculated value of a multibyte char, used to check
4196 	 *       that it was coded with the correct range
4197 	 * cnt - the number of 10xxxxxx bytes to follow
4198 	 * gotd - set for a char of Dxxx, so D800<->DFFF can be checked for
4199 	 * shift - lower order bits of range (ie. "val >> shift" should
4200 	 *       not be 0, in other words, dividing by the lower bound
4201 	 *       of the range should get a non-zero value)
4202 	 * byte - used to calculate cnt
4203 	 */
4204 	while (len > 0) {
4205 		if (cnt > 0) {
4206 			/* This handles the 10xxxxxx bytes */
4207 			if ((*cp & 0xc0) != 0x80 ||
4208 			    (gotd && (*cp & 0x20))) {
4209 				error = NFSERR_INVAL;
4210 				goto out;
4211 			}
4212 			gotd = 0;
4213 			val <<= 6;
4214 			val |= (*cp & 0x3f);
4215 			cnt--;
4216 			if (cnt == 0 && (val >> shift) == 0x0) {
4217 				error = NFSERR_INVAL;
4218 				goto out;
4219 			}
4220 		} else if (*cp & 0x80) {
4221 			/* first byte of multi byte char */
4222 			byte = *cp;
4223 			while ((byte & 0x40) && cnt < 6) {
4224 				cnt++;
4225 				byte <<= 1;
4226 			}
4227 			if (cnt == 0 || cnt == 6) {
4228 				error = NFSERR_INVAL;
4229 				goto out;
4230 			}
4231 			val = (*cp & (0x3f >> cnt));
4232 			shift = utf8_shift[cnt - 1];
4233 			if (cnt == 2 && val == 0xd)
4234 				/* Check for the 0xd800-0xdfff case */
4235 				gotd = 1;
4236 		}
4237 		cp++;
4238 		len--;
4239 	}
4240 	if (cnt > 0)
4241 		error = NFSERR_INVAL;
4242 
4243 out:
4244 	NFSEXITCODE(error);
4245 	return (error);
4246 }
4247 
4248 /*
4249  * Parse the xdr for an NFSv4 FsLocations attribute. Return two malloc'd
4250  * strings, one with the root path in it and the other with the list of
4251  * locations. The list is in the same format as is found in nfr_refs.
4252  * It is a "," separated list of entries, where each of them is of the
4253  * form <server>:<rootpath>. For example
4254  * "nfsv4-test:/sub2,nfsv4-test2:/user/mnt,nfsv4-test2:/user/mnt2"
4255  * The nilp argument is set to 1 for the special case of a null fs_root
4256  * and an empty server list.
4257  * It returns NFSERR_BADXDR, if the xdr can't be parsed and returns the
4258  * number of xdr bytes parsed in sump.
4259  */
4260 static int
4261 nfsrv_getrefstr(struct nfsrv_descript *nd, u_char **fsrootp, u_char **srvp,
4262     int *sump, int *nilp)
4263 {
4264 	u_int32_t *tl;
4265 	u_char *cp = NULL, *cp2 = NULL, *cp3, *str;
4266 	int i, j, len, stringlen, cnt, slen, siz, xdrsum, error = 0, nsrv;
4267 	struct list {
4268 		SLIST_ENTRY(list) next;
4269 		int len;
4270 		u_char host[1];
4271 	} *lsp, *nlsp;
4272 	SLIST_HEAD(, list) head;
4273 
4274 	*fsrootp = NULL;
4275 	*srvp = NULL;
4276 	*nilp = 0;
4277 
4278 	/*
4279 	 * Get the fs_root path and check for the special case of null path
4280 	 * and 0 length server list.
4281 	 */
4282 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4283 	len = fxdr_unsigned(int, *tl);
4284 	if (len < 0 || len > 10240) {
4285 		error = NFSERR_BADXDR;
4286 		goto nfsmout;
4287 	}
4288 	if (len == 0) {
4289 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4290 		if (*tl != 0) {
4291 			error = NFSERR_BADXDR;
4292 			goto nfsmout;
4293 		}
4294 		*nilp = 1;
4295 		*sump = 2 * NFSX_UNSIGNED;
4296 		error = 0;
4297 		goto nfsmout;
4298 	}
4299 	cp = malloc(len + 1, M_NFSSTRING, M_WAITOK);
4300 	error = nfsrv_mtostr(nd, cp, len);
4301 	if (!error) {
4302 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4303 		cnt = fxdr_unsigned(int, *tl);
4304 		if (cnt <= 0)
4305 			error = NFSERR_BADXDR;
4306 	}
4307 	if (error)
4308 		goto nfsmout;
4309 
4310 	/*
4311 	 * Now, loop through the location list and make up the srvlist.
4312 	 */
4313 	xdrsum = (2 * NFSX_UNSIGNED) + NFSM_RNDUP(len);
4314 	cp2 = cp3 = malloc(1024, M_NFSSTRING, M_WAITOK);
4315 	slen = 1024;
4316 	siz = 0;
4317 	for (i = 0; i < cnt; i++) {
4318 		SLIST_INIT(&head);
4319 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4320 		nsrv = fxdr_unsigned(int, *tl);
4321 		if (nsrv <= 0) {
4322 			error = NFSERR_BADXDR;
4323 			goto nfsmout;
4324 		}
4325 
4326 		/*
4327 		 * Handle the first server by putting it in the srvstr.
4328 		 */
4329 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4330 		len = fxdr_unsigned(int, *tl);
4331 		if (len <= 0 || len > 1024) {
4332 			error = NFSERR_BADXDR;
4333 			goto nfsmout;
4334 		}
4335 		nfsrv_refstrbigenough(siz + len + 3, &cp2, &cp3, &slen);
4336 		if (cp3 != cp2) {
4337 			*cp3++ = ',';
4338 			siz++;
4339 		}
4340 		error = nfsrv_mtostr(nd, cp3, len);
4341 		if (error)
4342 			goto nfsmout;
4343 		cp3 += len;
4344 		*cp3++ = ':';
4345 		siz += (len + 1);
4346 		xdrsum += (2 * NFSX_UNSIGNED) + NFSM_RNDUP(len);
4347 		for (j = 1; j < nsrv; j++) {
4348 			/*
4349 			 * Yuck, put them in an slist and process them later.
4350 			 */
4351 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4352 			len = fxdr_unsigned(int, *tl);
4353 			if (len <= 0 || len > 1024) {
4354 				error = NFSERR_BADXDR;
4355 				goto nfsmout;
4356 			}
4357 			lsp = (struct list *)malloc(sizeof (struct list)
4358 			    + len, M_TEMP, M_WAITOK);
4359 			error = nfsrv_mtostr(nd, lsp->host, len);
4360 			if (error)
4361 				goto nfsmout;
4362 			xdrsum += NFSX_UNSIGNED + NFSM_RNDUP(len);
4363 			lsp->len = len;
4364 			SLIST_INSERT_HEAD(&head, lsp, next);
4365 		}
4366 
4367 		/*
4368 		 * Finally, we can get the path.
4369 		 */
4370 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4371 		len = fxdr_unsigned(int, *tl);
4372 		if (len <= 0 || len > 1024) {
4373 			error = NFSERR_BADXDR;
4374 			goto nfsmout;
4375 		}
4376 		nfsrv_refstrbigenough(siz + len + 1, &cp2, &cp3, &slen);
4377 		error = nfsrv_mtostr(nd, cp3, len);
4378 		if (error)
4379 			goto nfsmout;
4380 		xdrsum += NFSX_UNSIGNED + NFSM_RNDUP(len);
4381 		str = cp3;
4382 		stringlen = len;
4383 		cp3 += len;
4384 		siz += len;
4385 		SLIST_FOREACH_SAFE(lsp, &head, next, nlsp) {
4386 			nfsrv_refstrbigenough(siz + lsp->len + stringlen + 3,
4387 			    &cp2, &cp3, &slen);
4388 			*cp3++ = ',';
4389 			NFSBCOPY(lsp->host, cp3, lsp->len);
4390 			cp3 += lsp->len;
4391 			*cp3++ = ':';
4392 			NFSBCOPY(str, cp3, stringlen);
4393 			cp3 += stringlen;
4394 			*cp3 = '\0';
4395 			siz += (lsp->len + stringlen + 2);
4396 			free(lsp, M_TEMP);
4397 		}
4398 	}
4399 	*fsrootp = cp;
4400 	*srvp = cp2;
4401 	*sump = xdrsum;
4402 	NFSEXITCODE2(0, nd);
4403 	return (0);
4404 nfsmout:
4405 	if (cp != NULL)
4406 		free(cp, M_NFSSTRING);
4407 	if (cp2 != NULL)
4408 		free(cp2, M_NFSSTRING);
4409 	NFSEXITCODE2(error, nd);
4410 	return (error);
4411 }
4412 
4413 /*
4414  * Make the malloc'd space large enough. This is a pain, but the xdr
4415  * doesn't set an upper bound on the side, so...
4416  */
4417 static void
4418 nfsrv_refstrbigenough(int siz, u_char **cpp, u_char **cpp2, int *slenp)
4419 {
4420 	u_char *cp;
4421 	int i;
4422 
4423 	if (siz <= *slenp)
4424 		return;
4425 	cp = malloc(siz + 1024, M_NFSSTRING, M_WAITOK);
4426 	NFSBCOPY(*cpp, cp, *slenp);
4427 	free(*cpp, M_NFSSTRING);
4428 	i = *cpp2 - *cpp;
4429 	*cpp = cp;
4430 	*cpp2 = cp + i;
4431 	*slenp = siz + 1024;
4432 }
4433 
4434 /*
4435  * Initialize the reply header data structures.
4436  */
4437 APPLESTATIC void
4438 nfsrvd_rephead(struct nfsrv_descript *nd)
4439 {
4440 	mbuf_t mreq;
4441 
4442 	/*
4443 	 * If this is a big reply, use a cluster.
4444 	 */
4445 	if ((nd->nd_flag & ND_GSSINITREPLY) == 0 &&
4446 	    nfs_bigreply[nd->nd_procnum]) {
4447 		NFSMCLGET(mreq, M_WAITOK);
4448 		nd->nd_mreq = mreq;
4449 		nd->nd_mb = mreq;
4450 	} else {
4451 		NFSMGET(mreq);
4452 		nd->nd_mreq = mreq;
4453 		nd->nd_mb = mreq;
4454 	}
4455 	nd->nd_bpos = NFSMTOD(mreq, caddr_t);
4456 	mbuf_setlen(mreq, 0);
4457 
4458 	if ((nd->nd_flag & ND_GSSINITREPLY) == 0)
4459 		NFSM_BUILD(nd->nd_errp, int *, NFSX_UNSIGNED);
4460 }
4461 
4462 /*
4463  * Lock a socket against others.
4464  * Currently used to serialize connect/disconnect attempts.
4465  */
4466 int
4467 newnfs_sndlock(int *flagp)
4468 {
4469 	struct timespec ts;
4470 
4471 	NFSLOCKSOCK();
4472 	while (*flagp & NFSR_SNDLOCK) {
4473 		*flagp |= NFSR_WANTSND;
4474 		ts.tv_sec = 0;
4475 		ts.tv_nsec = 0;
4476 		(void) nfsmsleep((caddr_t)flagp, NFSSOCKMUTEXPTR,
4477 		    PZERO - 1, "nfsndlck", &ts);
4478 	}
4479 	*flagp |= NFSR_SNDLOCK;
4480 	NFSUNLOCKSOCK();
4481 	return (0);
4482 }
4483 
4484 /*
4485  * Unlock the stream socket for others.
4486  */
4487 void
4488 newnfs_sndunlock(int *flagp)
4489 {
4490 
4491 	NFSLOCKSOCK();
4492 	if ((*flagp & NFSR_SNDLOCK) == 0)
4493 		panic("nfs sndunlock");
4494 	*flagp &= ~NFSR_SNDLOCK;
4495 	if (*flagp & NFSR_WANTSND) {
4496 		*flagp &= ~NFSR_WANTSND;
4497 		wakeup((caddr_t)flagp);
4498 	}
4499 	NFSUNLOCKSOCK();
4500 }
4501 
4502 APPLESTATIC int
4503 nfsv4_getipaddr(struct nfsrv_descript *nd, struct sockaddr_in *sin,
4504     struct sockaddr_in6 *sin6, sa_family_t *saf, int *isudp)
4505 {
4506 	struct in_addr saddr;
4507 	uint32_t portnum, *tl;
4508 	int i, j, k;
4509 	sa_family_t af = AF_UNSPEC;
4510 	char addr[64], protocol[5], *cp;
4511 	int cantparse = 0, error = 0;
4512 	uint16_t portv;
4513 
4514 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4515 	i = fxdr_unsigned(int, *tl);
4516 	if (i >= 3 && i <= 4) {
4517 		error = nfsrv_mtostr(nd, protocol, i);
4518 		if (error)
4519 			goto nfsmout;
4520 		if (strcmp(protocol, "tcp") == 0) {
4521 			af = AF_INET;
4522 			*isudp = 0;
4523 		} else if (strcmp(protocol, "udp") == 0) {
4524 			af = AF_INET;
4525 			*isudp = 1;
4526 		} else if (strcmp(protocol, "tcp6") == 0) {
4527 			af = AF_INET6;
4528 			*isudp = 0;
4529 		} else if (strcmp(protocol, "udp6") == 0) {
4530 			af = AF_INET6;
4531 			*isudp = 1;
4532 		} else
4533 			cantparse = 1;
4534 	} else {
4535 		cantparse = 1;
4536 		if (i > 0) {
4537 			error = nfsm_advance(nd, NFSM_RNDUP(i), -1);
4538 			if (error)
4539 				goto nfsmout;
4540 		}
4541 	}
4542 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4543 	i = fxdr_unsigned(int, *tl);
4544 	if (i < 0) {
4545 		error = NFSERR_BADXDR;
4546 		goto nfsmout;
4547 	} else if (cantparse == 0 && i >= 11 && i < 64) {
4548 		/*
4549 		 * The shortest address is 11chars and the longest is < 64.
4550 		 */
4551 		error = nfsrv_mtostr(nd, addr, i);
4552 		if (error)
4553 			goto nfsmout;
4554 
4555 		/* Find the port# at the end and extract that. */
4556 		i = strlen(addr);
4557 		k = 0;
4558 		cp = &addr[i - 1];
4559 		/* Count back two '.'s from end to get port# field. */
4560 		for (j = 0; j < i; j++) {
4561 			if (*cp == '.') {
4562 				k++;
4563 				if (k == 2)
4564 					break;
4565 			}
4566 			cp--;
4567 		}
4568 		if (k == 2) {
4569 			/*
4570 			 * The NFSv4 port# is appended as .N.N, where N is
4571 			 * a decimal # in the range 0-255, just like an inet4
4572 			 * address. Cheat and use inet_aton(), which will
4573 			 * return a Class A address and then shift the high
4574 			 * order 8bits over to convert it to the port#.
4575 			 */
4576 			*cp++ = '\0';
4577 			if (inet_aton(cp, &saddr) == 1) {
4578 				portnum = ntohl(saddr.s_addr);
4579 				portv = (uint16_t)((portnum >> 16) |
4580 				    (portnum & 0xff));
4581 			} else
4582 				cantparse = 1;
4583 		} else
4584 			cantparse = 1;
4585 		if (cantparse == 0) {
4586 			if (af == AF_INET) {
4587 				if (inet_pton(af, addr, &sin->sin_addr) == 1) {
4588 					sin->sin_len = sizeof(*sin);
4589 					sin->sin_family = AF_INET;
4590 					sin->sin_port = htons(portv);
4591 					*saf = af;
4592 					return (0);
4593 				}
4594 			} else {
4595 				if (inet_pton(af, addr, &sin6->sin6_addr)
4596 				    == 1) {
4597 					sin6->sin6_len = sizeof(*sin6);
4598 					sin6->sin6_family = AF_INET6;
4599 					sin6->sin6_port = htons(portv);
4600 					*saf = af;
4601 					return (0);
4602 				}
4603 			}
4604 		}
4605 	} else {
4606 		if (i > 0) {
4607 			error = nfsm_advance(nd, NFSM_RNDUP(i), -1);
4608 			if (error)
4609 				goto nfsmout;
4610 		}
4611 	}
4612 	error = EPERM;
4613 nfsmout:
4614 	return (error);
4615 }
4616 
4617 /*
4618  * Handle an NFSv4.1 Sequence request for the session.
4619  * If reply != NULL, use it to return the cached reply, as required.
4620  * The client gets a cached reply via this call for callbacks, however the
4621  * server gets a cached reply via the nfsv4_seqsess_cachereply() call.
4622  */
4623 int
4624 nfsv4_seqsession(uint32_t seqid, uint32_t slotid, uint32_t highslot,
4625     struct nfsslot *slots, struct mbuf **reply, uint16_t maxslot)
4626 {
4627 	int error;
4628 
4629 	error = 0;
4630 	if (reply != NULL)
4631 		*reply = NULL;
4632 	if (slotid > maxslot)
4633 		return (NFSERR_BADSLOT);
4634 	if (seqid == slots[slotid].nfssl_seq) {
4635 		/* A retry. */
4636 		if (slots[slotid].nfssl_inprog != 0)
4637 			error = NFSERR_DELAY;
4638 		else if (slots[slotid].nfssl_reply != NULL) {
4639 			if (reply != NULL) {
4640 				*reply = slots[slotid].nfssl_reply;
4641 				slots[slotid].nfssl_reply = NULL;
4642 			}
4643 			slots[slotid].nfssl_inprog = 1;
4644 			error = NFSERR_REPLYFROMCACHE;
4645 		} else
4646 			/* No reply cached, so just do it. */
4647 			slots[slotid].nfssl_inprog = 1;
4648 	} else if ((slots[slotid].nfssl_seq + 1) == seqid) {
4649 		if (slots[slotid].nfssl_reply != NULL)
4650 			m_freem(slots[slotid].nfssl_reply);
4651 		slots[slotid].nfssl_reply = NULL;
4652 		slots[slotid].nfssl_inprog = 1;
4653 		slots[slotid].nfssl_seq++;
4654 	} else
4655 		error = NFSERR_SEQMISORDERED;
4656 	return (error);
4657 }
4658 
4659 /*
4660  * Cache this reply for the slot.
4661  * Use the "rep" argument to return the cached reply if repstat is set to
4662  * NFSERR_REPLYFROMCACHE. The client never sets repstat to this value.
4663  */
4664 void
4665 nfsv4_seqsess_cacherep(uint32_t slotid, struct nfsslot *slots, int repstat,
4666    struct mbuf **rep)
4667 {
4668 
4669 	if (repstat == NFSERR_REPLYFROMCACHE) {
4670 		*rep = slots[slotid].nfssl_reply;
4671 		slots[slotid].nfssl_reply = NULL;
4672 	} else {
4673 		if (slots[slotid].nfssl_reply != NULL)
4674 			m_freem(slots[slotid].nfssl_reply);
4675 		slots[slotid].nfssl_reply = *rep;
4676 	}
4677 	slots[slotid].nfssl_inprog = 0;
4678 }
4679 
4680 /*
4681  * Generate the xdr for an NFSv4.1 Sequence Operation.
4682  */
4683 APPLESTATIC void
4684 nfsv4_setsequence(struct nfsmount *nmp, struct nfsrv_descript *nd,
4685     struct nfsclsession *sep, int dont_replycache)
4686 {
4687 	uint32_t *tl, slotseq = 0;
4688 	int error, maxslot, slotpos;
4689 	uint8_t sessionid[NFSX_V4SESSIONID];
4690 
4691 	error = nfsv4_sequencelookup(nmp, sep, &slotpos, &maxslot, &slotseq,
4692 	    sessionid);
4693 	nd->nd_maxreq = sep->nfsess_maxreq;
4694 	nd->nd_maxresp = sep->nfsess_maxresp;
4695 
4696 	/* Build the Sequence arguments. */
4697 	NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID + 4 * NFSX_UNSIGNED);
4698 	nd->nd_sequence = tl;
4699 	bcopy(sessionid, tl, NFSX_V4SESSIONID);
4700 	tl += NFSX_V4SESSIONID / NFSX_UNSIGNED;
4701 	nd->nd_slotseq = tl;
4702 	if (error == 0) {
4703 		nd->nd_flag |= ND_HASSLOTID;
4704 		nd->nd_slotid = slotpos;
4705 		*tl++ = txdr_unsigned(slotseq);
4706 		*tl++ = txdr_unsigned(slotpos);
4707 		*tl++ = txdr_unsigned(maxslot);
4708 		if (dont_replycache == 0)
4709 			*tl = newnfs_true;
4710 		else
4711 			*tl = newnfs_false;
4712 	} else {
4713 		/*
4714 		 * There are two errors and the rest of the session can
4715 		 * just be zeros.
4716 		 * NFSERR_BADSESSION: This bad session should just generate
4717 		 *    the same error again when the RPC is retried.
4718 		 * ESTALE: A forced dismount is in progress and will cause the
4719 		 *    RPC to fail later.
4720 		 */
4721 		*tl++ = 0;
4722 		*tl++ = 0;
4723 		*tl++ = 0;
4724 		*tl = 0;
4725 	}
4726 	nd->nd_flag |= ND_HASSEQUENCE;
4727 }
4728 
4729 int
4730 nfsv4_sequencelookup(struct nfsmount *nmp, struct nfsclsession *sep,
4731     int *slotposp, int *maxslotp, uint32_t *slotseqp, uint8_t *sessionid)
4732 {
4733 	int i, maxslot, slotpos;
4734 	uint64_t bitval;
4735 
4736 	/* Find an unused slot. */
4737 	slotpos = -1;
4738 	maxslot = -1;
4739 	mtx_lock(&sep->nfsess_mtx);
4740 	do {
4741 		if (nmp != NULL && sep->nfsess_defunct != 0) {
4742 			/* Just return the bad session. */
4743 			bcopy(sep->nfsess_sessionid, sessionid,
4744 			    NFSX_V4SESSIONID);
4745 			mtx_unlock(&sep->nfsess_mtx);
4746 			return (NFSERR_BADSESSION);
4747 		}
4748 		bitval = 1;
4749 		for (i = 0; i < sep->nfsess_foreslots; i++) {
4750 			if ((bitval & sep->nfsess_slots) == 0) {
4751 				slotpos = i;
4752 				sep->nfsess_slots |= bitval;
4753 				sep->nfsess_slotseq[i]++;
4754 				*slotseqp = sep->nfsess_slotseq[i];
4755 				break;
4756 			}
4757 			bitval <<= 1;
4758 		}
4759 		if (slotpos == -1) {
4760 			/*
4761 			 * If a forced dismount is in progress, just return.
4762 			 * This RPC attempt will fail when it calls
4763 			 * newnfs_request().
4764 			 */
4765 			if (nmp != NULL && NFSCL_FORCEDISM(nmp->nm_mountp)) {
4766 				mtx_unlock(&sep->nfsess_mtx);
4767 				return (ESTALE);
4768 			}
4769 			/* Wake up once/sec, to check for a forced dismount. */
4770 			(void)mtx_sleep(&sep->nfsess_slots, &sep->nfsess_mtx,
4771 			    PZERO, "nfsclseq", hz);
4772 		}
4773 	} while (slotpos == -1);
4774 	/* Now, find the highest slot in use. (nfsc_slots is 64bits) */
4775 	bitval = 1;
4776 	for (i = 0; i < 64; i++) {
4777 		if ((bitval & sep->nfsess_slots) != 0)
4778 			maxslot = i;
4779 		bitval <<= 1;
4780 	}
4781 	bcopy(sep->nfsess_sessionid, sessionid, NFSX_V4SESSIONID);
4782 	mtx_unlock(&sep->nfsess_mtx);
4783 	*slotposp = slotpos;
4784 	*maxslotp = maxslot;
4785 	return (0);
4786 }
4787 
4788 /*
4789  * Free a session slot.
4790  */
4791 APPLESTATIC void
4792 nfsv4_freeslot(struct nfsclsession *sep, int slot)
4793 {
4794 	uint64_t bitval;
4795 
4796 	bitval = 1;
4797 	if (slot > 0)
4798 		bitval <<= slot;
4799 	mtx_lock(&sep->nfsess_mtx);
4800 	if ((bitval & sep->nfsess_slots) == 0)
4801 		printf("freeing free slot!!\n");
4802 	sep->nfsess_slots &= ~bitval;
4803 	wakeup(&sep->nfsess_slots);
4804 	mtx_unlock(&sep->nfsess_mtx);
4805 }
4806 
4807 /*
4808  * Search for a matching pnfsd DS, based on the nmp arg.
4809  * Return one if found, NULL otherwise.
4810  */
4811 struct nfsdevice *
4812 nfsv4_findmirror(struct nfsmount *nmp)
4813 {
4814 	struct nfsdevice *ds;
4815 
4816 	mtx_assert(NFSDDSMUTEXPTR, MA_OWNED);
4817 	/*
4818 	 * Search the DS server list for a match with nmp.
4819 	 */
4820 	if (nfsrv_devidcnt == 0)
4821 		return (NULL);
4822 	TAILQ_FOREACH(ds, &nfsrv_devidhead, nfsdev_list) {
4823 		if (ds->nfsdev_nmp == nmp) {
4824 			NFSCL_DEBUG(4, "nfsv4_findmirror: fnd main ds\n");
4825 			break;
4826 		}
4827 	}
4828 	return (ds);
4829 }
4830 
4831