xref: /freebsd/sys/fs/nfs/nfs_commonsubs.c (revision f4b37ed0f8b307b1f3f0f630ca725d68f1dff30d)
1 /*-
2  * Copyright (c) 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Rick Macklem at The University of Guelph.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 4. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 /*
38  * These functions support the macros and help fiddle mbuf chains for
39  * the nfs op functions. They do things like create the rpc header and
40  * copy data between mbuf chains and uio lists.
41  */
42 #ifndef APPLEKEXT
43 #include "opt_inet6.h"
44 
45 #include <fs/nfs/nfsport.h>
46 
47 /*
48  * Data items converted to xdr at startup, since they are constant
49  * This is kinda hokey, but may save a little time doing byte swaps
50  */
51 u_int32_t newnfs_true, newnfs_false, newnfs_xdrneg1;
52 
53 /* And other global data */
54 nfstype nfsv34_type[9] = { NFNON, NFREG, NFDIR, NFBLK, NFCHR, NFLNK, NFSOCK,
55 		      NFFIFO, NFNON };
56 enum vtype newnv2tov_type[8] = { VNON, VREG, VDIR, VBLK, VCHR, VLNK, VNON, VNON };
57 enum vtype nv34tov_type[8]={ VNON, VREG, VDIR, VBLK, VCHR, VLNK, VSOCK, VFIFO };
58 struct timeval nfsboottime;	/* Copy boottime once, so it never changes */
59 int nfscl_ticks;
60 int nfsrv_useacl = 1;
61 struct nfssockreq nfsrv_nfsuserdsock;
62 int nfsrv_nfsuserd = 0;
63 struct nfsreqhead nfsd_reqq;
64 uid_t nfsrv_defaultuid;
65 gid_t nfsrv_defaultgid;
66 int nfsrv_lease = NFSRV_LEASE;
67 int ncl_mbuf_mlen = MLEN;
68 int nfsd_enable_stringtouid = 0;
69 NFSNAMEIDMUTEX;
70 NFSSOCKMUTEX;
71 
72 /*
73  * This array of structures indicates, for V4:
74  * retfh - which of 3 types of calling args are used
75  *	0 - doesn't change cfh or use a sfh
76  *	1 - replaces cfh with a new one (unless it returns an error status)
77  *	2 - uses cfh and sfh
78  * needscfh - if the op wants a cfh and premtime
79  *	0 - doesn't use a cfh
80  *	1 - uses a cfh, but doesn't want pre-op attributes
81  *	2 - uses a cfh and wants pre-op attributes
82  * savereply - indicates a non-idempotent Op
83  *	0 - not non-idempotent
84  *	1 - non-idempotent
85  * Ops that are ordered via seqid# are handled separately from these
86  * non-idempotent Ops.
87  * Define it here, since it is used by both the client and server.
88  */
89 struct nfsv4_opflag nfsv4_opflag[NFSV41_NOPS] = {
90 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* undef */
91 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* undef */
92 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* undef */
93 	{ 0, 1, 0, 0, LK_SHARED, 1 },			/* Access */
94 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* Close */
95 	{ 0, 2, 0, 1, LK_EXCLUSIVE, 1 },		/* Commit */
96 	{ 1, 2, 1, 1, LK_EXCLUSIVE, 1 },		/* Create */
97 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Delegpurge */
98 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* Delegreturn */
99 	{ 0, 1, 0, 0, LK_SHARED, 1 },			/* Getattr */
100 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* GetFH */
101 	{ 2, 1, 1, 1, LK_EXCLUSIVE, 1 },		/* Link */
102 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* Lock */
103 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* LockT */
104 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* LockU */
105 	{ 1, 2, 0, 0, LK_EXCLUSIVE, 1 },		/* Lookup */
106 	{ 1, 2, 0, 0, LK_EXCLUSIVE, 1 },		/* Lookupp */
107 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* NVerify */
108 	{ 1, 1, 0, 1, LK_EXCLUSIVE, 1 },		/* Open */
109 	{ 1, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* OpenAttr */
110 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* OpenConfirm */
111 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* OpenDowngrade */
112 	{ 1, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* PutFH */
113 	{ 1, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* PutPubFH */
114 	{ 1, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* PutRootFH */
115 	{ 0, 1, 0, 0, LK_SHARED, 1 },			/* Read */
116 	{ 0, 1, 0, 0, LK_SHARED, 1 },			/* Readdir */
117 	{ 0, 1, 0, 0, LK_SHARED, 1 },			/* ReadLink */
118 	{ 0, 2, 1, 1, LK_EXCLUSIVE, 1 },		/* Remove */
119 	{ 2, 1, 1, 1, LK_EXCLUSIVE, 1 },		/* Rename */
120 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Renew */
121 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* RestoreFH */
122 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* SaveFH */
123 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* SecInfo */
124 	{ 0, 2, 1, 1, LK_EXCLUSIVE, 1 },		/* Setattr */
125 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* SetClientID */
126 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* SetClientIDConfirm */
127 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* Verify */
128 	{ 0, 2, 1, 1, LK_EXCLUSIVE, 1 },		/* Write */
129 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* ReleaseLockOwner */
130 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Backchannel Ctrl */
131 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Bind Conn to Sess */
132 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 0 },		/* Exchange ID */
133 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 0 },		/* Create Session */
134 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 0 },		/* Destroy Session */
135 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Free StateID */
136 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Get Dir Deleg */
137 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Get Device Info */
138 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Get Device List */
139 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* Layout Commit */
140 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* Layout Get */
141 	{ 0, 1, 0, 0, LK_EXCLUSIVE, 1 },		/* Layout Return */
142 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Secinfo No name */
143 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Sequence */
144 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Set SSV */
145 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Test StateID */
146 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Want Delegation */
147 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 0 },		/* Destroy ClientID */
148 	{ 0, 0, 0, 0, LK_EXCLUSIVE, 1 },		/* Reclaim Complete */
149 };
150 #endif	/* !APPLEKEXT */
151 
152 static int ncl_mbuf_mhlen = MHLEN;
153 static int nfsrv_usercnt = 0;
154 static int nfsrv_dnsnamelen;
155 static u_char *nfsrv_dnsname = NULL;
156 static int nfsrv_usermax = 999999999;
157 static struct nfsuserhashhead nfsuserhash[NFSUSERHASHSIZE];
158 static struct nfsuserhashhead nfsusernamehash[NFSUSERHASHSIZE];
159 static struct nfsuserhashhead nfsgrouphash[NFSGROUPHASHSIZE];
160 static struct nfsuserhashhead nfsgroupnamehash[NFSGROUPHASHSIZE];
161 static struct nfsuserlruhead nfsuserlruhead;
162 
163 /*
164  * This static array indicates whether or not the RPC generates a large
165  * reply. This is used by nfs_reply() to decide whether or not an mbuf
166  * cluster should be allocated. (If a cluster is required by an RPC
167  * marked 0 in this array, the code will still work, just not quite as
168  * efficiently.)
169  */
170 int nfs_bigreply[NFSV41_NPROCS] = { 0, 0, 0, 1, 0, 1, 1, 0, 0, 0, 0,
171     0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
172     0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0 };
173 
174 /* local functions */
175 static int nfsrv_skipace(struct nfsrv_descript *nd, int *acesizep);
176 static void nfsv4_wanted(struct nfsv4lock *lp);
177 static int nfsrv_cmpmixedcase(u_char *cp, u_char *cp2, int len);
178 static int nfsrv_getuser(int procnum, uid_t uid, gid_t gid, char *name,
179     NFSPROC_T *p);
180 static void nfsrv_removeuser(struct nfsusrgrp *usrp);
181 static int nfsrv_getrefstr(struct nfsrv_descript *, u_char **, u_char **,
182     int *, int *);
183 static void nfsrv_refstrbigenough(int, u_char **, u_char **, int *);
184 
185 
186 #ifndef APPLE
187 /*
188  * copies mbuf chain to the uio scatter/gather list
189  */
190 int
191 nfsm_mbufuio(struct nfsrv_descript *nd, struct uio *uiop, int siz)
192 {
193 	char *mbufcp, *uiocp;
194 	int xfer, left, len;
195 	mbuf_t mp;
196 	long uiosiz, rem;
197 	int error = 0;
198 
199 	mp = nd->nd_md;
200 	mbufcp = nd->nd_dpos;
201 	len = NFSMTOD(mp, caddr_t) + mbuf_len(mp) - mbufcp;
202 	rem = NFSM_RNDUP(siz) - siz;
203 	while (siz > 0) {
204 		if (uiop->uio_iovcnt <= 0 || uiop->uio_iov == NULL) {
205 			error = EBADRPC;
206 			goto out;
207 		}
208 		left = uiop->uio_iov->iov_len;
209 		uiocp = uiop->uio_iov->iov_base;
210 		if (left > siz)
211 			left = siz;
212 		uiosiz = left;
213 		while (left > 0) {
214 			while (len == 0) {
215 				mp = mbuf_next(mp);
216 				if (mp == NULL) {
217 					error = EBADRPC;
218 					goto out;
219 				}
220 				mbufcp = NFSMTOD(mp, caddr_t);
221 				len = mbuf_len(mp);
222 				KASSERT(len >= 0,
223 				    ("len %d, corrupted mbuf?", len));
224 			}
225 			xfer = (left > len) ? len : left;
226 #ifdef notdef
227 			/* Not Yet.. */
228 			if (uiop->uio_iov->iov_op != NULL)
229 				(*(uiop->uio_iov->iov_op))
230 				(mbufcp, uiocp, xfer);
231 			else
232 #endif
233 			if (uiop->uio_segflg == UIO_SYSSPACE)
234 				NFSBCOPY(mbufcp, uiocp, xfer);
235 			else
236 				copyout(mbufcp, CAST_USER_ADDR_T(uiocp), xfer);
237 			left -= xfer;
238 			len -= xfer;
239 			mbufcp += xfer;
240 			uiocp += xfer;
241 			uiop->uio_offset += xfer;
242 			uiop->uio_resid -= xfer;
243 		}
244 		if (uiop->uio_iov->iov_len <= siz) {
245 			uiop->uio_iovcnt--;
246 			uiop->uio_iov++;
247 		} else {
248 			uiop->uio_iov->iov_base = (void *)
249 				((char *)uiop->uio_iov->iov_base + uiosiz);
250 			uiop->uio_iov->iov_len -= uiosiz;
251 		}
252 		siz -= uiosiz;
253 	}
254 	nd->nd_dpos = mbufcp;
255 	nd->nd_md = mp;
256 	if (rem > 0) {
257 		if (len < rem)
258 			error = nfsm_advance(nd, rem, len);
259 		else
260 			nd->nd_dpos += rem;
261 	}
262 
263 out:
264 	NFSEXITCODE2(error, nd);
265 	return (error);
266 }
267 #endif	/* !APPLE */
268 
269 /*
270  * Help break down an mbuf chain by setting the first siz bytes contiguous
271  * pointed to by returned val.
272  * This is used by the macro NFSM_DISSECT for tough
273  * cases.
274  */
275 APPLESTATIC void *
276 nfsm_dissct(struct nfsrv_descript *nd, int siz, int how)
277 {
278 	mbuf_t mp2;
279 	int siz2, xfer;
280 	caddr_t p;
281 	int left;
282 	caddr_t retp;
283 
284 	retp = NULL;
285 	left = NFSMTOD(nd->nd_md, caddr_t) + mbuf_len(nd->nd_md) - nd->nd_dpos;
286 	while (left == 0) {
287 		nd->nd_md = mbuf_next(nd->nd_md);
288 		if (nd->nd_md == NULL)
289 			return (retp);
290 		left = mbuf_len(nd->nd_md);
291 		nd->nd_dpos = NFSMTOD(nd->nd_md, caddr_t);
292 	}
293 	if (left >= siz) {
294 		retp = nd->nd_dpos;
295 		nd->nd_dpos += siz;
296 	} else if (mbuf_next(nd->nd_md) == NULL) {
297 		return (retp);
298 	} else if (siz > ncl_mbuf_mhlen) {
299 		panic("nfs S too big");
300 	} else {
301 		MGET(mp2, MT_DATA, how);
302 		if (mp2 == NULL)
303 			return (NULL);
304 		mbuf_setnext(mp2, mbuf_next(nd->nd_md));
305 		mbuf_setnext(nd->nd_md, mp2);
306 		mbuf_setlen(nd->nd_md, mbuf_len(nd->nd_md) - left);
307 		nd->nd_md = mp2;
308 		retp = p = NFSMTOD(mp2, caddr_t);
309 		NFSBCOPY(nd->nd_dpos, p, left);	/* Copy what was left */
310 		siz2 = siz - left;
311 		p += left;
312 		mp2 = mbuf_next(mp2);
313 		/* Loop around copying up the siz2 bytes */
314 		while (siz2 > 0) {
315 			if (mp2 == NULL)
316 				return (NULL);
317 			xfer = (siz2 > mbuf_len(mp2)) ? mbuf_len(mp2) : siz2;
318 			if (xfer > 0) {
319 				NFSBCOPY(NFSMTOD(mp2, caddr_t), p, xfer);
320 				NFSM_DATAP(mp2, xfer);
321 				mbuf_setlen(mp2, mbuf_len(mp2) - xfer);
322 				p += xfer;
323 				siz2 -= xfer;
324 			}
325 			if (siz2 > 0)
326 				mp2 = mbuf_next(mp2);
327 		}
328 		mbuf_setlen(nd->nd_md, siz);
329 		nd->nd_md = mp2;
330 		nd->nd_dpos = NFSMTOD(mp2, caddr_t);
331 	}
332 	return (retp);
333 }
334 
335 /*
336  * Advance the position in the mbuf chain.
337  * If offs == 0, this is a no-op, but it is simpler to just return from
338  * here than check for offs > 0 for all calls to nfsm_advance.
339  * If left == -1, it should be calculated here.
340  */
341 APPLESTATIC int
342 nfsm_advance(struct nfsrv_descript *nd, int offs, int left)
343 {
344 	int error = 0;
345 
346 	if (offs == 0)
347 		goto out;
348 	/*
349 	 * A negative offs should be considered a serious problem.
350 	 */
351 	if (offs < 0)
352 		panic("nfsrv_advance");
353 
354 	/*
355 	 * If left == -1, calculate it here.
356 	 */
357 	if (left == -1)
358 		left = NFSMTOD(nd->nd_md, caddr_t) + mbuf_len(nd->nd_md) -
359 		    nd->nd_dpos;
360 
361 	/*
362 	 * Loop around, advancing over the mbuf data.
363 	 */
364 	while (offs > left) {
365 		offs -= left;
366 		nd->nd_md = mbuf_next(nd->nd_md);
367 		if (nd->nd_md == NULL) {
368 			error = EBADRPC;
369 			goto out;
370 		}
371 		left = mbuf_len(nd->nd_md);
372 		nd->nd_dpos = NFSMTOD(nd->nd_md, caddr_t);
373 	}
374 	nd->nd_dpos += offs;
375 
376 out:
377 	NFSEXITCODE(error);
378 	return (error);
379 }
380 
381 /*
382  * Copy a string into mbuf(s).
383  * Return the number of bytes output, including XDR overheads.
384  */
385 APPLESTATIC int
386 nfsm_strtom(struct nfsrv_descript *nd, const char *cp, int siz)
387 {
388 	mbuf_t m2;
389 	int xfer, left;
390 	mbuf_t m1;
391 	int rem, bytesize;
392 	u_int32_t *tl;
393 	char *cp2;
394 
395 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
396 	*tl = txdr_unsigned(siz);
397 	rem = NFSM_RNDUP(siz) - siz;
398 	bytesize = NFSX_UNSIGNED + siz + rem;
399 	m2 = nd->nd_mb;
400 	cp2 = nd->nd_bpos;
401 	left = M_TRAILINGSPACE(m2);
402 
403 	/*
404 	 * Loop around copying the string to mbuf(s).
405 	 */
406 	while (siz > 0) {
407 		if (left == 0) {
408 			if (siz > ncl_mbuf_mlen)
409 				NFSMCLGET(m1, M_WAITOK);
410 			else
411 				NFSMGET(m1);
412 			mbuf_setlen(m1, 0);
413 			mbuf_setnext(m2, m1);
414 			m2 = m1;
415 			cp2 = NFSMTOD(m2, caddr_t);
416 			left = M_TRAILINGSPACE(m2);
417 		}
418 		if (left >= siz)
419 			xfer = siz;
420 		else
421 			xfer = left;
422 		NFSBCOPY(cp, cp2, xfer);
423 		cp += xfer;
424 		mbuf_setlen(m2, mbuf_len(m2) + xfer);
425 		siz -= xfer;
426 		left -= xfer;
427 		if (siz == 0 && rem) {
428 			if (left < rem)
429 				panic("nfsm_strtom");
430 			NFSBZERO(cp2 + xfer, rem);
431 			mbuf_setlen(m2, mbuf_len(m2) + rem);
432 		}
433 	}
434 	nd->nd_mb = m2;
435 	nd->nd_bpos = NFSMTOD(m2, caddr_t) + mbuf_len(m2);
436 	return (bytesize);
437 }
438 
439 /*
440  * Called once to initialize data structures...
441  */
442 APPLESTATIC void
443 newnfs_init(void)
444 {
445 	static int nfs_inited = 0;
446 
447 	if (nfs_inited)
448 		return;
449 	nfs_inited = 1;
450 
451 	newnfs_true = txdr_unsigned(TRUE);
452 	newnfs_false = txdr_unsigned(FALSE);
453 	newnfs_xdrneg1 = txdr_unsigned(-1);
454 	nfscl_ticks = (hz * NFS_TICKINTVL + 500) / 1000;
455 	if (nfscl_ticks < 1)
456 		nfscl_ticks = 1;
457 	NFSSETBOOTTIME(nfsboottime);
458 
459 	/*
460 	 * Initialize reply list and start timer
461 	 */
462 	TAILQ_INIT(&nfsd_reqq);
463 	NFS_TIMERINIT;
464 }
465 
466 /*
467  * Put a file handle in an mbuf list.
468  * If the size argument == 0, just use the default size.
469  * set_true == 1 if there should be an newnfs_true prepended on the file handle.
470  * Return the number of bytes output, including XDR overhead.
471  */
472 APPLESTATIC int
473 nfsm_fhtom(struct nfsrv_descript *nd, u_int8_t *fhp, int size, int set_true)
474 {
475 	u_int32_t *tl;
476 	u_int8_t *cp;
477 	int fullsiz, rem, bytesize = 0;
478 
479 	if (size == 0)
480 		size = NFSX_MYFH;
481 	switch (nd->nd_flag & (ND_NFSV2 | ND_NFSV3 | ND_NFSV4)) {
482 	case ND_NFSV2:
483 		if (size > NFSX_V2FH)
484 			panic("fh size > NFSX_V2FH for NFSv2");
485 		NFSM_BUILD(cp, u_int8_t *, NFSX_V2FH);
486 		NFSBCOPY(fhp, cp, size);
487 		if (size < NFSX_V2FH)
488 			NFSBZERO(cp + size, NFSX_V2FH - size);
489 		bytesize = NFSX_V2FH;
490 		break;
491 	case ND_NFSV3:
492 	case ND_NFSV4:
493 		fullsiz = NFSM_RNDUP(size);
494 		rem = fullsiz - size;
495 		if (set_true) {
496 		    bytesize = 2 * NFSX_UNSIGNED + fullsiz;
497 		    NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
498 		    *tl = newnfs_true;
499 		} else {
500 		    bytesize = NFSX_UNSIGNED + fullsiz;
501 		}
502 		(void) nfsm_strtom(nd, fhp, size);
503 		break;
504 	};
505 	return (bytesize);
506 }
507 
508 /*
509  * This function compares two net addresses by family and returns TRUE
510  * if they are the same host.
511  * If there is any doubt, return FALSE.
512  * The AF_INET family is handled as a special case so that address mbufs
513  * don't need to be saved to store "struct in_addr", which is only 4 bytes.
514  */
515 APPLESTATIC int
516 nfsaddr_match(int family, union nethostaddr *haddr, NFSSOCKADDR_T nam)
517 {
518 	struct sockaddr_in *inetaddr;
519 
520 	switch (family) {
521 	case AF_INET:
522 		inetaddr = NFSSOCKADDR(nam, struct sockaddr_in *);
523 		if (inetaddr->sin_family == AF_INET &&
524 		    inetaddr->sin_addr.s_addr == haddr->had_inet.s_addr)
525 			return (1);
526 		break;
527 #ifdef INET6
528 	case AF_INET6:
529 		{
530 		struct sockaddr_in6 *inetaddr6;
531 
532 		inetaddr6 = NFSSOCKADDR(nam, struct sockaddr_in6 *);
533 		/* XXX - should test sin6_scope_id ? */
534 		if (inetaddr6->sin6_family == AF_INET6 &&
535 		    IN6_ARE_ADDR_EQUAL(&inetaddr6->sin6_addr,
536 			  &haddr->had_inet6))
537 			return (1);
538 		}
539 		break;
540 #endif
541 	};
542 	return (0);
543 }
544 
545 /*
546  * Similar to the above, but takes to NFSSOCKADDR_T args.
547  */
548 APPLESTATIC int
549 nfsaddr2_match(NFSSOCKADDR_T nam1, NFSSOCKADDR_T nam2)
550 {
551 	struct sockaddr_in *addr1, *addr2;
552 	struct sockaddr *inaddr;
553 
554 	inaddr = NFSSOCKADDR(nam1, struct sockaddr *);
555 	switch (inaddr->sa_family) {
556 	case AF_INET:
557 		addr1 = NFSSOCKADDR(nam1, struct sockaddr_in *);
558 		addr2 = NFSSOCKADDR(nam2, struct sockaddr_in *);
559 		if (addr2->sin_family == AF_INET &&
560 		    addr1->sin_addr.s_addr == addr2->sin_addr.s_addr)
561 			return (1);
562 		break;
563 #ifdef INET6
564 	case AF_INET6:
565 		{
566 		struct sockaddr_in6 *inet6addr1, *inet6addr2;
567 
568 		inet6addr1 = NFSSOCKADDR(nam1, struct sockaddr_in6 *);
569 		inet6addr2 = NFSSOCKADDR(nam2, struct sockaddr_in6 *);
570 		/* XXX - should test sin6_scope_id ? */
571 		if (inet6addr2->sin6_family == AF_INET6 &&
572 		    IN6_ARE_ADDR_EQUAL(&inet6addr1->sin6_addr,
573 			  &inet6addr2->sin6_addr))
574 			return (1);
575 		}
576 		break;
577 #endif
578 	};
579 	return (0);
580 }
581 
582 
583 /*
584  * Trim the stuff already dissected off the mbuf list.
585  */
586 APPLESTATIC void
587 newnfs_trimleading(nd)
588 	struct nfsrv_descript *nd;
589 {
590 	mbuf_t m, n;
591 	int offs;
592 
593 	/*
594 	 * First, free up leading mbufs.
595 	 */
596 	if (nd->nd_mrep != nd->nd_md) {
597 		m = nd->nd_mrep;
598 		while (mbuf_next(m) != nd->nd_md) {
599 			if (mbuf_next(m) == NULL)
600 				panic("nfsm trim leading");
601 			m = mbuf_next(m);
602 		}
603 		mbuf_setnext(m, NULL);
604 		mbuf_freem(nd->nd_mrep);
605 	}
606 	m = nd->nd_md;
607 
608 	/*
609 	 * Now, adjust this mbuf, based on nd_dpos.
610 	 */
611 	offs = nd->nd_dpos - NFSMTOD(m, caddr_t);
612 	if (offs == mbuf_len(m)) {
613 		n = m;
614 		m = mbuf_next(m);
615 		if (m == NULL)
616 			panic("nfsm trim leading2");
617 		mbuf_setnext(n, NULL);
618 		mbuf_freem(n);
619 	} else if (offs > 0) {
620 		mbuf_setlen(m, mbuf_len(m) - offs);
621 		NFSM_DATAP(m, offs);
622 	} else if (offs < 0)
623 		panic("nfsm trimleading offs");
624 	nd->nd_mrep = m;
625 	nd->nd_md = m;
626 	nd->nd_dpos = NFSMTOD(m, caddr_t);
627 }
628 
629 /*
630  * Trim trailing data off the mbuf list being built.
631  */
632 APPLESTATIC void
633 newnfs_trimtrailing(nd, mb, bpos)
634 	struct nfsrv_descript *nd;
635 	mbuf_t mb;
636 	caddr_t bpos;
637 {
638 
639 	if (mbuf_next(mb)) {
640 		mbuf_freem(mbuf_next(mb));
641 		mbuf_setnext(mb, NULL);
642 	}
643 	mbuf_setlen(mb, bpos - NFSMTOD(mb, caddr_t));
644 	nd->nd_mb = mb;
645 	nd->nd_bpos = bpos;
646 }
647 
648 /*
649  * Dissect a file handle on the client.
650  */
651 APPLESTATIC int
652 nfsm_getfh(struct nfsrv_descript *nd, struct nfsfh **nfhpp)
653 {
654 	u_int32_t *tl;
655 	struct nfsfh *nfhp;
656 	int error, len;
657 
658 	*nfhpp = NULL;
659 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
660 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
661 		if ((len = fxdr_unsigned(int, *tl)) <= 0 ||
662 			len > NFSX_FHMAX) {
663 			error = EBADRPC;
664 			goto nfsmout;
665 		}
666 	} else
667 		len = NFSX_V2FH;
668 	MALLOC(nfhp, struct nfsfh *, sizeof (struct nfsfh) + len,
669 	    M_NFSFH, M_WAITOK);
670 	error = nfsrv_mtostr(nd, nfhp->nfh_fh, len);
671 	if (error) {
672 		FREE((caddr_t)nfhp, M_NFSFH);
673 		goto nfsmout;
674 	}
675 	nfhp->nfh_len = len;
676 	*nfhpp = nfhp;
677 nfsmout:
678 	NFSEXITCODE2(error, nd);
679 	return (error);
680 }
681 
682 /*
683  * Break down the nfsv4 acl.
684  * If the aclp == NULL or won't fit in an acl, just discard the acl info.
685  */
686 APPLESTATIC int
687 nfsrv_dissectacl(struct nfsrv_descript *nd, NFSACL_T *aclp, int *aclerrp,
688     int *aclsizep, __unused NFSPROC_T *p)
689 {
690 	u_int32_t *tl;
691 	int i, aclsize;
692 	int acecnt, error = 0, aceerr = 0, acesize;
693 
694 	*aclerrp = 0;
695 	if (aclp)
696 		aclp->acl_cnt = 0;
697 	/*
698 	 * Parse out the ace entries and expect them to conform to
699 	 * what can be supported by R/W/X bits.
700 	 */
701 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
702 	aclsize = NFSX_UNSIGNED;
703 	acecnt = fxdr_unsigned(int, *tl);
704 	if (acecnt > ACL_MAX_ENTRIES)
705 		aceerr = NFSERR_ATTRNOTSUPP;
706 	if (nfsrv_useacl == 0)
707 		aceerr = NFSERR_ATTRNOTSUPP;
708 	for (i = 0; i < acecnt; i++) {
709 		if (aclp && !aceerr)
710 			error = nfsrv_dissectace(nd, &aclp->acl_entry[i],
711 			    &aceerr, &acesize, p);
712 		else
713 			error = nfsrv_skipace(nd, &acesize);
714 		if (error)
715 			goto nfsmout;
716 		aclsize += acesize;
717 	}
718 	if (aclp && !aceerr)
719 		aclp->acl_cnt = acecnt;
720 	if (aceerr)
721 		*aclerrp = aceerr;
722 	if (aclsizep)
723 		*aclsizep = aclsize;
724 nfsmout:
725 	NFSEXITCODE2(error, nd);
726 	return (error);
727 }
728 
729 /*
730  * Skip over an NFSv4 ace entry. Just dissect the xdr and discard it.
731  */
732 static int
733 nfsrv_skipace(struct nfsrv_descript *nd, int *acesizep)
734 {
735 	u_int32_t *tl;
736 	int error, len = 0;
737 
738 	NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
739 	len = fxdr_unsigned(int, *(tl + 3));
740 	error = nfsm_advance(nd, NFSM_RNDUP(len), -1);
741 nfsmout:
742 	*acesizep = NFSM_RNDUP(len) + (4 * NFSX_UNSIGNED);
743 	NFSEXITCODE2(error, nd);
744 	return (error);
745 }
746 
747 /*
748  * Get attribute bits from an mbuf list.
749  * Returns EBADRPC for a parsing error, 0 otherwise.
750  * If the clearinvalid flag is set, clear the bits not supported.
751  */
752 APPLESTATIC int
753 nfsrv_getattrbits(struct nfsrv_descript *nd, nfsattrbit_t *attrbitp, int *cntp,
754     int *retnotsupp)
755 {
756 	u_int32_t *tl;
757 	int cnt, i, outcnt;
758 	int error = 0;
759 
760 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
761 	cnt = fxdr_unsigned(int, *tl);
762 	if (cnt < 0) {
763 		error = NFSERR_BADXDR;
764 		goto nfsmout;
765 	}
766 	if (cnt > NFSATTRBIT_MAXWORDS)
767 		outcnt = NFSATTRBIT_MAXWORDS;
768 	else
769 		outcnt = cnt;
770 	NFSZERO_ATTRBIT(attrbitp);
771 	if (outcnt > 0) {
772 		NFSM_DISSECT(tl, u_int32_t *, outcnt * NFSX_UNSIGNED);
773 		for (i = 0; i < outcnt; i++)
774 			attrbitp->bits[i] = fxdr_unsigned(u_int32_t, *tl++);
775 	}
776 	for (i = 0; i < (cnt - outcnt); i++) {
777 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
778 		if (retnotsupp != NULL && *tl != 0)
779 			*retnotsupp = NFSERR_ATTRNOTSUPP;
780 	}
781 	if (cntp)
782 		*cntp = NFSX_UNSIGNED + (cnt * NFSX_UNSIGNED);
783 nfsmout:
784 	NFSEXITCODE2(error, nd);
785 	return (error);
786 }
787 
788 /*
789  * Get the attributes for V4.
790  * If the compare flag is true, test for any attribute changes,
791  * otherwise return the attribute values.
792  * These attributes cover fields in "struct vattr", "struct statfs",
793  * "struct nfsfsinfo", the file handle and the lease duration.
794  * The value of retcmpp is set to 1 if all attributes are the same,
795  * and 0 otherwise.
796  * Returns EBADRPC if it can't be parsed, 0 otherwise.
797  */
798 APPLESTATIC int
799 nfsv4_loadattr(struct nfsrv_descript *nd, vnode_t vp,
800     struct nfsvattr *nap, struct nfsfh **nfhpp, fhandle_t *fhp, int fhsize,
801     struct nfsv3_pathconf *pc, struct statfs *sbp, struct nfsstatfs *sfp,
802     struct nfsfsinfo *fsp, NFSACL_T *aclp, int compare, int *retcmpp,
803     u_int32_t *leasep, u_int32_t *rderrp, NFSPROC_T *p, struct ucred *cred)
804 {
805 	u_int32_t *tl;
806 	int i = 0, j, k, l = 0, m, bitpos, attrsum = 0;
807 	int error, tfhsize, aceerr, attrsize, cnt, retnotsup;
808 	u_char *cp, *cp2, namestr[NFSV4_SMALLSTR + 1];
809 	nfsattrbit_t attrbits, retattrbits, checkattrbits;
810 	struct nfsfh *tnfhp;
811 	struct nfsreferral *refp;
812 	u_quad_t tquad;
813 	nfsquad_t tnfsquad;
814 	struct timespec temptime;
815 	uid_t uid;
816 	gid_t gid;
817 	long fid;
818 	u_int32_t freenum = 0, tuint;
819 	u_int64_t uquad = 0, thyp, thyp2;
820 #ifdef QUOTA
821 	struct dqblk dqb;
822 	uid_t savuid;
823 #endif
824 	if (compare) {
825 		retnotsup = 0;
826 		error = nfsrv_getattrbits(nd, &attrbits, NULL, &retnotsup);
827 	} else {
828 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
829 	}
830 	if (error)
831 		goto nfsmout;
832 
833 	if (compare) {
834 		*retcmpp = retnotsup;
835 	} else {
836 		/*
837 		 * Just set default values to some of the important ones.
838 		 */
839 		if (nap != NULL) {
840 			nap->na_type = VREG;
841 			nap->na_mode = 0;
842 			nap->na_rdev = (NFSDEV_T)0;
843 			nap->na_mtime.tv_sec = 0;
844 			nap->na_mtime.tv_nsec = 0;
845 			nap->na_gen = 0;
846 			nap->na_flags = 0;
847 			nap->na_blocksize = NFS_FABLKSIZE;
848 		}
849 		if (sbp != NULL) {
850 			sbp->f_bsize = NFS_FABLKSIZE;
851 			sbp->f_blocks = 0;
852 			sbp->f_bfree = 0;
853 			sbp->f_bavail = 0;
854 			sbp->f_files = 0;
855 			sbp->f_ffree = 0;
856 		}
857 		if (fsp != NULL) {
858 			fsp->fs_rtmax = 8192;
859 			fsp->fs_rtpref = 8192;
860 			fsp->fs_maxname = NFS_MAXNAMLEN;
861 			fsp->fs_wtmax = 8192;
862 			fsp->fs_wtpref = 8192;
863 			fsp->fs_wtmult = NFS_FABLKSIZE;
864 			fsp->fs_dtpref = 8192;
865 			fsp->fs_maxfilesize = 0xffffffffffffffffull;
866 			fsp->fs_timedelta.tv_sec = 0;
867 			fsp->fs_timedelta.tv_nsec = 1;
868 			fsp->fs_properties = (NFSV3_FSFLINK | NFSV3_FSFSYMLINK |
869 				NFSV3_FSFHOMOGENEOUS | NFSV3_FSFCANSETTIME);
870 		}
871 		if (pc != NULL) {
872 			pc->pc_linkmax = LINK_MAX;
873 			pc->pc_namemax = NAME_MAX;
874 			pc->pc_notrunc = 0;
875 			pc->pc_chownrestricted = 0;
876 			pc->pc_caseinsensitive = 0;
877 			pc->pc_casepreserving = 1;
878 		}
879 	}
880 
881 	/*
882 	 * Loop around getting the attributes.
883 	 */
884 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
885 	attrsize = fxdr_unsigned(int, *tl);
886 	for (bitpos = 0; bitpos < NFSATTRBIT_MAX; bitpos++) {
887 	    if (attrsum > attrsize) {
888 		error = NFSERR_BADXDR;
889 		goto nfsmout;
890 	    }
891 	    if (NFSISSET_ATTRBIT(&attrbits, bitpos))
892 		switch (bitpos) {
893 		case NFSATTRBIT_SUPPORTEDATTRS:
894 			retnotsup = 0;
895 			if (compare || nap == NULL)
896 			    error = nfsrv_getattrbits(nd, &retattrbits,
897 				&cnt, &retnotsup);
898 			else
899 			    error = nfsrv_getattrbits(nd, &nap->na_suppattr,
900 				&cnt, &retnotsup);
901 			if (error)
902 			    goto nfsmout;
903 			if (compare && !(*retcmpp)) {
904 			   NFSSETSUPP_ATTRBIT(&checkattrbits);
905 
906 			   /* Some filesystem do not support NFSv4ACL   */
907 			   if (nfsrv_useacl == 0 || nfs_supportsnfsv4acls(vp) == 0) {
908 				NFSCLRBIT_ATTRBIT(&checkattrbits, NFSATTRBIT_ACL);
909 				NFSCLRBIT_ATTRBIT(&checkattrbits, NFSATTRBIT_ACLSUPPORT);
910 		   	   }
911 			   if (!NFSEQUAL_ATTRBIT(&retattrbits, &checkattrbits)
912 			       || retnotsup)
913 				*retcmpp = NFSERR_NOTSAME;
914 			}
915 			attrsum += cnt;
916 			break;
917 		case NFSATTRBIT_TYPE:
918 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
919 			if (compare) {
920 				if (!(*retcmpp)) {
921 				    if (nap->na_type != nfsv34tov_type(*tl))
922 					*retcmpp = NFSERR_NOTSAME;
923 				}
924 			} else if (nap != NULL) {
925 				nap->na_type = nfsv34tov_type(*tl);
926 			}
927 			attrsum += NFSX_UNSIGNED;
928 			break;
929 		case NFSATTRBIT_FHEXPIRETYPE:
930 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
931 			if (compare && !(*retcmpp)) {
932 				if (fxdr_unsigned(int, *tl) !=
933 					NFSV4FHTYPE_PERSISTENT)
934 					*retcmpp = NFSERR_NOTSAME;
935 			}
936 			attrsum += NFSX_UNSIGNED;
937 			break;
938 		case NFSATTRBIT_CHANGE:
939 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
940 			if (compare) {
941 				if (!(*retcmpp)) {
942 				    if (nap->na_filerev != fxdr_hyper(tl))
943 					*retcmpp = NFSERR_NOTSAME;
944 				}
945 			} else if (nap != NULL) {
946 				nap->na_filerev = fxdr_hyper(tl);
947 			}
948 			attrsum += NFSX_HYPER;
949 			break;
950 		case NFSATTRBIT_SIZE:
951 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
952 			if (compare) {
953 				if (!(*retcmpp)) {
954 				    if (nap->na_size != fxdr_hyper(tl))
955 					*retcmpp = NFSERR_NOTSAME;
956 				}
957 			} else if (nap != NULL) {
958 				nap->na_size = fxdr_hyper(tl);
959 			}
960 			attrsum += NFSX_HYPER;
961 			break;
962 		case NFSATTRBIT_LINKSUPPORT:
963 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
964 			if (compare) {
965 				if (!(*retcmpp)) {
966 				    if (fsp->fs_properties & NFSV3_FSFLINK) {
967 					if (*tl == newnfs_false)
968 						*retcmpp = NFSERR_NOTSAME;
969 				    } else {
970 					if (*tl == newnfs_true)
971 						*retcmpp = NFSERR_NOTSAME;
972 				    }
973 				}
974 			} else if (fsp != NULL) {
975 				if (*tl == newnfs_true)
976 					fsp->fs_properties |= NFSV3_FSFLINK;
977 				else
978 					fsp->fs_properties &= ~NFSV3_FSFLINK;
979 			}
980 			attrsum += NFSX_UNSIGNED;
981 			break;
982 		case NFSATTRBIT_SYMLINKSUPPORT:
983 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
984 			if (compare) {
985 				if (!(*retcmpp)) {
986 				    if (fsp->fs_properties & NFSV3_FSFSYMLINK) {
987 					if (*tl == newnfs_false)
988 						*retcmpp = NFSERR_NOTSAME;
989 				    } else {
990 					if (*tl == newnfs_true)
991 						*retcmpp = NFSERR_NOTSAME;
992 				    }
993 				}
994 			} else if (fsp != NULL) {
995 				if (*tl == newnfs_true)
996 					fsp->fs_properties |= NFSV3_FSFSYMLINK;
997 				else
998 					fsp->fs_properties &= ~NFSV3_FSFSYMLINK;
999 			}
1000 			attrsum += NFSX_UNSIGNED;
1001 			break;
1002 		case NFSATTRBIT_NAMEDATTR:
1003 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1004 			if (compare && !(*retcmpp)) {
1005 				if (*tl != newnfs_false)
1006 					*retcmpp = NFSERR_NOTSAME;
1007 			}
1008 			attrsum += NFSX_UNSIGNED;
1009 			break;
1010 		case NFSATTRBIT_FSID:
1011 			NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1012 			thyp = fxdr_hyper(tl);
1013 			tl += 2;
1014 			thyp2 = fxdr_hyper(tl);
1015 			if (compare) {
1016 			    if (*retcmpp == 0) {
1017 				if (thyp != (u_int64_t)
1018 				    vfs_statfs(vnode_mount(vp))->f_fsid.val[0] ||
1019 				    thyp2 != (u_int64_t)
1020 				    vfs_statfs(vnode_mount(vp))->f_fsid.val[1])
1021 					*retcmpp = NFSERR_NOTSAME;
1022 			    }
1023 			} else if (nap != NULL) {
1024 				nap->na_filesid[0] = thyp;
1025 				nap->na_filesid[1] = thyp2;
1026 			}
1027 			attrsum += (4 * NFSX_UNSIGNED);
1028 			break;
1029 		case NFSATTRBIT_UNIQUEHANDLES:
1030 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1031 			if (compare && !(*retcmpp)) {
1032 				if (*tl != newnfs_true)
1033 					*retcmpp = NFSERR_NOTSAME;
1034 			}
1035 			attrsum += NFSX_UNSIGNED;
1036 			break;
1037 		case NFSATTRBIT_LEASETIME:
1038 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1039 			if (compare) {
1040 				if (fxdr_unsigned(int, *tl) != nfsrv_lease &&
1041 				    !(*retcmpp))
1042 					*retcmpp = NFSERR_NOTSAME;
1043 			} else if (leasep != NULL) {
1044 				*leasep = fxdr_unsigned(u_int32_t, *tl);
1045 			}
1046 			attrsum += NFSX_UNSIGNED;
1047 			break;
1048 		case NFSATTRBIT_RDATTRERROR:
1049 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1050 			if (compare) {
1051 				 if (!(*retcmpp))
1052 					*retcmpp = NFSERR_INVAL;
1053 			} else if (rderrp != NULL) {
1054 				*rderrp = fxdr_unsigned(u_int32_t, *tl);
1055 			}
1056 			attrsum += NFSX_UNSIGNED;
1057 			break;
1058 		case NFSATTRBIT_ACL:
1059 			if (compare) {
1060 			  if (!(*retcmpp)) {
1061 			    if (nfsrv_useacl && nfs_supportsnfsv4acls(vp)) {
1062 				NFSACL_T *naclp;
1063 
1064 				naclp = acl_alloc(M_WAITOK);
1065 				error = nfsrv_dissectacl(nd, naclp, &aceerr,
1066 				    &cnt, p);
1067 				if (error) {
1068 				    acl_free(naclp);
1069 				    goto nfsmout;
1070 				}
1071 				if (aceerr || aclp == NULL ||
1072 				    nfsrv_compareacl(aclp, naclp))
1073 				    *retcmpp = NFSERR_NOTSAME;
1074 				acl_free(naclp);
1075 			    } else {
1076 				error = nfsrv_dissectacl(nd, NULL, &aceerr,
1077 				    &cnt, p);
1078 				*retcmpp = NFSERR_ATTRNOTSUPP;
1079 			    }
1080 			  }
1081 			} else {
1082 				if (vp != NULL && aclp != NULL)
1083 				    error = nfsrv_dissectacl(nd, aclp, &aceerr,
1084 					&cnt, p);
1085 				else
1086 				    error = nfsrv_dissectacl(nd, NULL, &aceerr,
1087 					&cnt, p);
1088 				if (error)
1089 				    goto nfsmout;
1090 			}
1091 
1092 			attrsum += cnt;
1093 			break;
1094 		case NFSATTRBIT_ACLSUPPORT:
1095 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1096 			if (compare && !(*retcmpp)) {
1097 				if (nfsrv_useacl && nfs_supportsnfsv4acls(vp)) {
1098 					if (fxdr_unsigned(u_int32_t, *tl) !=
1099 					    NFSV4ACE_SUPTYPES)
1100 						*retcmpp = NFSERR_NOTSAME;
1101 				} else {
1102 					*retcmpp = NFSERR_ATTRNOTSUPP;
1103 				}
1104 			}
1105 			attrsum += NFSX_UNSIGNED;
1106 			break;
1107 		case NFSATTRBIT_ARCHIVE:
1108 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1109 			if (compare && !(*retcmpp))
1110 				*retcmpp = NFSERR_ATTRNOTSUPP;
1111 			attrsum += NFSX_UNSIGNED;
1112 			break;
1113 		case NFSATTRBIT_CANSETTIME:
1114 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1115 			if (compare) {
1116 				if (!(*retcmpp)) {
1117 				    if (fsp->fs_properties & NFSV3_FSFCANSETTIME) {
1118 					if (*tl == newnfs_false)
1119 						*retcmpp = NFSERR_NOTSAME;
1120 				    } else {
1121 					if (*tl == newnfs_true)
1122 						*retcmpp = NFSERR_NOTSAME;
1123 				    }
1124 				}
1125 			} else if (fsp != NULL) {
1126 				if (*tl == newnfs_true)
1127 					fsp->fs_properties |= NFSV3_FSFCANSETTIME;
1128 				else
1129 					fsp->fs_properties &= ~NFSV3_FSFCANSETTIME;
1130 			}
1131 			attrsum += NFSX_UNSIGNED;
1132 			break;
1133 		case NFSATTRBIT_CASEINSENSITIVE:
1134 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1135 			if (compare) {
1136 				if (!(*retcmpp)) {
1137 				    if (*tl != newnfs_false)
1138 					*retcmpp = NFSERR_NOTSAME;
1139 				}
1140 			} else if (pc != NULL) {
1141 				pc->pc_caseinsensitive =
1142 				    fxdr_unsigned(u_int32_t, *tl);
1143 			}
1144 			attrsum += NFSX_UNSIGNED;
1145 			break;
1146 		case NFSATTRBIT_CASEPRESERVING:
1147 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1148 			if (compare) {
1149 				if (!(*retcmpp)) {
1150 				    if (*tl != newnfs_true)
1151 					*retcmpp = NFSERR_NOTSAME;
1152 				}
1153 			} else if (pc != NULL) {
1154 				pc->pc_casepreserving =
1155 				    fxdr_unsigned(u_int32_t, *tl);
1156 			}
1157 			attrsum += NFSX_UNSIGNED;
1158 			break;
1159 		case NFSATTRBIT_CHOWNRESTRICTED:
1160 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1161 			if (compare) {
1162 				if (!(*retcmpp)) {
1163 				    if (*tl != newnfs_true)
1164 					*retcmpp = NFSERR_NOTSAME;
1165 				}
1166 			} else if (pc != NULL) {
1167 				pc->pc_chownrestricted =
1168 				    fxdr_unsigned(u_int32_t, *tl);
1169 			}
1170 			attrsum += NFSX_UNSIGNED;
1171 			break;
1172 		case NFSATTRBIT_FILEHANDLE:
1173 			error = nfsm_getfh(nd, &tnfhp);
1174 			if (error)
1175 				goto nfsmout;
1176 			tfhsize = tnfhp->nfh_len;
1177 			if (compare) {
1178 				if (!(*retcmpp) &&
1179 				    !NFSRV_CMPFH(tnfhp->nfh_fh, tfhsize,
1180 				     fhp, fhsize))
1181 					*retcmpp = NFSERR_NOTSAME;
1182 				FREE((caddr_t)tnfhp, M_NFSFH);
1183 			} else if (nfhpp != NULL) {
1184 				*nfhpp = tnfhp;
1185 			} else {
1186 				FREE((caddr_t)tnfhp, M_NFSFH);
1187 			}
1188 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(tfhsize));
1189 			break;
1190 		case NFSATTRBIT_FILEID:
1191 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1192 			thyp = fxdr_hyper(tl);
1193 			if (compare) {
1194 				if (!(*retcmpp)) {
1195 				    if ((u_int64_t)nap->na_fileid != thyp)
1196 					*retcmpp = NFSERR_NOTSAME;
1197 				}
1198 			} else if (nap != NULL) {
1199 				if (*tl++)
1200 					printf("NFSv4 fileid > 32bits\n");
1201 				nap->na_fileid = thyp;
1202 			}
1203 			attrsum += NFSX_HYPER;
1204 			break;
1205 		case NFSATTRBIT_FILESAVAIL:
1206 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1207 			if (compare) {
1208 				if (!(*retcmpp) &&
1209 				    sfp->sf_afiles != fxdr_hyper(tl))
1210 					*retcmpp = NFSERR_NOTSAME;
1211 			} else if (sfp != NULL) {
1212 				sfp->sf_afiles = fxdr_hyper(tl);
1213 			}
1214 			attrsum += NFSX_HYPER;
1215 			break;
1216 		case NFSATTRBIT_FILESFREE:
1217 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1218 			if (compare) {
1219 				if (!(*retcmpp) &&
1220 				    sfp->sf_ffiles != fxdr_hyper(tl))
1221 					*retcmpp = NFSERR_NOTSAME;
1222 			} else if (sfp != NULL) {
1223 				sfp->sf_ffiles = fxdr_hyper(tl);
1224 			}
1225 			attrsum += NFSX_HYPER;
1226 			break;
1227 		case NFSATTRBIT_FILESTOTAL:
1228 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1229 			if (compare) {
1230 				if (!(*retcmpp) &&
1231 				    sfp->sf_tfiles != fxdr_hyper(tl))
1232 					*retcmpp = NFSERR_NOTSAME;
1233 			} else if (sfp != NULL) {
1234 				sfp->sf_tfiles = fxdr_hyper(tl);
1235 			}
1236 			attrsum += NFSX_HYPER;
1237 			break;
1238 		case NFSATTRBIT_FSLOCATIONS:
1239 			error = nfsrv_getrefstr(nd, &cp, &cp2, &l, &m);
1240 			if (error)
1241 				goto nfsmout;
1242 			attrsum += l;
1243 			if (compare && !(*retcmpp)) {
1244 				refp = nfsv4root_getreferral(vp, NULL, 0);
1245 				if (refp != NULL) {
1246 					if (cp == NULL || cp2 == NULL ||
1247 					    strcmp(cp, "/") ||
1248 					    strcmp(cp2, refp->nfr_srvlist))
1249 						*retcmpp = NFSERR_NOTSAME;
1250 				} else if (m == 0) {
1251 					*retcmpp = NFSERR_NOTSAME;
1252 				}
1253 			}
1254 			if (cp != NULL)
1255 				free(cp, M_NFSSTRING);
1256 			if (cp2 != NULL)
1257 				free(cp2, M_NFSSTRING);
1258 			break;
1259 		case NFSATTRBIT_HIDDEN:
1260 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1261 			if (compare && !(*retcmpp))
1262 				*retcmpp = NFSERR_ATTRNOTSUPP;
1263 			attrsum += NFSX_UNSIGNED;
1264 			break;
1265 		case NFSATTRBIT_HOMOGENEOUS:
1266 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1267 			if (compare) {
1268 				if (!(*retcmpp)) {
1269 				    if (fsp->fs_properties &
1270 					NFSV3_FSFHOMOGENEOUS) {
1271 					if (*tl == newnfs_false)
1272 						*retcmpp = NFSERR_NOTSAME;
1273 				    } else {
1274 					if (*tl == newnfs_true)
1275 						*retcmpp = NFSERR_NOTSAME;
1276 				    }
1277 				}
1278 			} else if (fsp != NULL) {
1279 				if (*tl == newnfs_true)
1280 				    fsp->fs_properties |= NFSV3_FSFHOMOGENEOUS;
1281 				else
1282 				    fsp->fs_properties &= ~NFSV3_FSFHOMOGENEOUS;
1283 			}
1284 			attrsum += NFSX_UNSIGNED;
1285 			break;
1286 		case NFSATTRBIT_MAXFILESIZE:
1287 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1288 			tnfsquad.qval = fxdr_hyper(tl);
1289 			if (compare) {
1290 				if (!(*retcmpp)) {
1291 					tquad = NFSRV_MAXFILESIZE;
1292 					if (tquad != tnfsquad.qval)
1293 						*retcmpp = NFSERR_NOTSAME;
1294 				}
1295 			} else if (fsp != NULL) {
1296 				fsp->fs_maxfilesize = tnfsquad.qval;
1297 			}
1298 			attrsum += NFSX_HYPER;
1299 			break;
1300 		case NFSATTRBIT_MAXLINK:
1301 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1302 			if (compare) {
1303 				if (!(*retcmpp)) {
1304 				    if (fxdr_unsigned(int, *tl) != LINK_MAX)
1305 					*retcmpp = NFSERR_NOTSAME;
1306 				}
1307 			} else if (pc != NULL) {
1308 				pc->pc_linkmax = fxdr_unsigned(u_int32_t, *tl);
1309 			}
1310 			attrsum += NFSX_UNSIGNED;
1311 			break;
1312 		case NFSATTRBIT_MAXNAME:
1313 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1314 			if (compare) {
1315 				if (!(*retcmpp)) {
1316 				    if (fsp->fs_maxname !=
1317 					fxdr_unsigned(u_int32_t, *tl))
1318 						*retcmpp = NFSERR_NOTSAME;
1319 				}
1320 			} else {
1321 				tuint = fxdr_unsigned(u_int32_t, *tl);
1322 				/*
1323 				 * Some Linux NFSv4 servers report this
1324 				 * as 0 or 4billion, so I'll set it to
1325 				 * NFS_MAXNAMLEN. If a server actually creates
1326 				 * a name longer than NFS_MAXNAMLEN, it will
1327 				 * get an error back.
1328 				 */
1329 				if (tuint == 0 || tuint > NFS_MAXNAMLEN)
1330 					tuint = NFS_MAXNAMLEN;
1331 				if (fsp != NULL)
1332 					fsp->fs_maxname = tuint;
1333 				if (pc != NULL)
1334 					pc->pc_namemax = tuint;
1335 			}
1336 			attrsum += NFSX_UNSIGNED;
1337 			break;
1338 		case NFSATTRBIT_MAXREAD:
1339 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1340 			if (compare) {
1341 				if (!(*retcmpp)) {
1342 				    if (fsp->fs_rtmax != fxdr_unsigned(u_int32_t,
1343 					*(tl + 1)) || *tl != 0)
1344 					*retcmpp = NFSERR_NOTSAME;
1345 				}
1346 			} else if (fsp != NULL) {
1347 				fsp->fs_rtmax = fxdr_unsigned(u_int32_t, *++tl);
1348 				fsp->fs_rtpref = fsp->fs_rtmax;
1349 				fsp->fs_dtpref = fsp->fs_rtpref;
1350 			}
1351 			attrsum += NFSX_HYPER;
1352 			break;
1353 		case NFSATTRBIT_MAXWRITE:
1354 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1355 			if (compare) {
1356 				if (!(*retcmpp)) {
1357 				    if (fsp->fs_wtmax != fxdr_unsigned(u_int32_t,
1358 					*(tl + 1)) || *tl != 0)
1359 					*retcmpp = NFSERR_NOTSAME;
1360 				}
1361 			} else if (fsp != NULL) {
1362 				fsp->fs_wtmax = fxdr_unsigned(int, *++tl);
1363 				fsp->fs_wtpref = fsp->fs_wtmax;
1364 			}
1365 			attrsum += NFSX_HYPER;
1366 			break;
1367 		case NFSATTRBIT_MIMETYPE:
1368 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1369 			i = fxdr_unsigned(int, *tl);
1370 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(i));
1371 			error = nfsm_advance(nd, NFSM_RNDUP(i), -1);
1372 			if (error)
1373 				goto nfsmout;
1374 			if (compare && !(*retcmpp))
1375 				*retcmpp = NFSERR_ATTRNOTSUPP;
1376 			break;
1377 		case NFSATTRBIT_MODE:
1378 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1379 			if (compare) {
1380 				if (!(*retcmpp)) {
1381 				    if (nap->na_mode != nfstov_mode(*tl))
1382 					*retcmpp = NFSERR_NOTSAME;
1383 				}
1384 			} else if (nap != NULL) {
1385 				nap->na_mode = nfstov_mode(*tl);
1386 			}
1387 			attrsum += NFSX_UNSIGNED;
1388 			break;
1389 		case NFSATTRBIT_NOTRUNC:
1390 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1391 			if (compare) {
1392 				if (!(*retcmpp)) {
1393 				    if (*tl != newnfs_true)
1394 					*retcmpp = NFSERR_NOTSAME;
1395 				}
1396 			} else if (pc != NULL) {
1397 				pc->pc_notrunc = fxdr_unsigned(u_int32_t, *tl);
1398 			}
1399 			attrsum += NFSX_UNSIGNED;
1400 			break;
1401 		case NFSATTRBIT_NUMLINKS:
1402 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1403 			tuint = fxdr_unsigned(u_int32_t, *tl);
1404 			if (compare) {
1405 			    if (!(*retcmpp)) {
1406 				if ((u_int32_t)nap->na_nlink != tuint)
1407 					*retcmpp = NFSERR_NOTSAME;
1408 			    }
1409 			} else if (nap != NULL) {
1410 				nap->na_nlink = tuint;
1411 			}
1412 			attrsum += NFSX_UNSIGNED;
1413 			break;
1414 		case NFSATTRBIT_OWNER:
1415 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1416 			j = fxdr_unsigned(int, *tl);
1417 			if (j < 0) {
1418 				error = NFSERR_BADXDR;
1419 				goto nfsmout;
1420 			}
1421 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(j));
1422 			if (j > NFSV4_SMALLSTR)
1423 				cp = malloc(j + 1, M_NFSSTRING, M_WAITOK);
1424 			else
1425 				cp = namestr;
1426 			error = nfsrv_mtostr(nd, cp, j);
1427 			if (error) {
1428 				if (j > NFSV4_SMALLSTR)
1429 					free(cp, M_NFSSTRING);
1430 				goto nfsmout;
1431 			}
1432 			if (compare) {
1433 			    if (!(*retcmpp)) {
1434 				if (nfsv4_strtouid(nd, cp, j, &uid, p) ||
1435 				    nap->na_uid != uid)
1436 				    *retcmpp = NFSERR_NOTSAME;
1437 			    }
1438 			} else if (nap != NULL) {
1439 				if (nfsv4_strtouid(nd, cp, j, &uid, p))
1440 					nap->na_uid = nfsrv_defaultuid;
1441 				else
1442 					nap->na_uid = uid;
1443 			}
1444 			if (j > NFSV4_SMALLSTR)
1445 				free(cp, M_NFSSTRING);
1446 			break;
1447 		case NFSATTRBIT_OWNERGROUP:
1448 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1449 			j = fxdr_unsigned(int, *tl);
1450 			if (j < 0) {
1451 				error =  NFSERR_BADXDR;
1452 				goto nfsmout;
1453 			}
1454 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(j));
1455 			if (j > NFSV4_SMALLSTR)
1456 				cp = malloc(j + 1, M_NFSSTRING, M_WAITOK);
1457 			else
1458 				cp = namestr;
1459 			error = nfsrv_mtostr(nd, cp, j);
1460 			if (error) {
1461 				if (j > NFSV4_SMALLSTR)
1462 					free(cp, M_NFSSTRING);
1463 				goto nfsmout;
1464 			}
1465 			if (compare) {
1466 			    if (!(*retcmpp)) {
1467 				if (nfsv4_strtogid(nd, cp, j, &gid, p) ||
1468 				    nap->na_gid != gid)
1469 				    *retcmpp = NFSERR_NOTSAME;
1470 			    }
1471 			} else if (nap != NULL) {
1472 				if (nfsv4_strtogid(nd, cp, j, &gid, p))
1473 					nap->na_gid = nfsrv_defaultgid;
1474 				else
1475 					nap->na_gid = gid;
1476 			}
1477 			if (j > NFSV4_SMALLSTR)
1478 				free(cp, M_NFSSTRING);
1479 			break;
1480 		case NFSATTRBIT_QUOTAHARD:
1481 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1482 			if (sbp != NULL) {
1483 			    if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA, 0))
1484 				freenum = sbp->f_bfree;
1485 			    else
1486 				freenum = sbp->f_bavail;
1487 #ifdef QUOTA
1488 			    /*
1489 			     * ufs_quotactl() insists that the uid argument
1490 			     * equal p_ruid for non-root quota access, so
1491 			     * we'll just make sure that's the case.
1492 			     */
1493 			    savuid = p->p_cred->p_ruid;
1494 			    p->p_cred->p_ruid = cred->cr_uid;
1495 			    if (!VFS_QUOTACTL(vnode_mount(vp),QCMD(Q_GETQUOTA,
1496 				USRQUOTA), cred->cr_uid, (caddr_t)&dqb))
1497 				freenum = min(dqb.dqb_bhardlimit, freenum);
1498 			    p->p_cred->p_ruid = savuid;
1499 #endif	/* QUOTA */
1500 			    uquad = (u_int64_t)freenum;
1501 			    NFSQUOTABLKTOBYTE(uquad, sbp->f_bsize);
1502 			}
1503 			if (compare && !(*retcmpp)) {
1504 				if (uquad != fxdr_hyper(tl))
1505 					*retcmpp = NFSERR_NOTSAME;
1506 			}
1507 			attrsum += NFSX_HYPER;
1508 			break;
1509 		case NFSATTRBIT_QUOTASOFT:
1510 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1511 			if (sbp != NULL) {
1512 			    if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA, 0))
1513 				freenum = sbp->f_bfree;
1514 			    else
1515 				freenum = sbp->f_bavail;
1516 #ifdef QUOTA
1517 			    /*
1518 			     * ufs_quotactl() insists that the uid argument
1519 			     * equal p_ruid for non-root quota access, so
1520 			     * we'll just make sure that's the case.
1521 			     */
1522 			    savuid = p->p_cred->p_ruid;
1523 			    p->p_cred->p_ruid = cred->cr_uid;
1524 			    if (!VFS_QUOTACTL(vnode_mount(vp),QCMD(Q_GETQUOTA,
1525 				USRQUOTA), cred->cr_uid, (caddr_t)&dqb))
1526 				freenum = min(dqb.dqb_bsoftlimit, freenum);
1527 			    p->p_cred->p_ruid = savuid;
1528 #endif	/* QUOTA */
1529 			    uquad = (u_int64_t)freenum;
1530 			    NFSQUOTABLKTOBYTE(uquad, sbp->f_bsize);
1531 			}
1532 			if (compare && !(*retcmpp)) {
1533 				if (uquad != fxdr_hyper(tl))
1534 					*retcmpp = NFSERR_NOTSAME;
1535 			}
1536 			attrsum += NFSX_HYPER;
1537 			break;
1538 		case NFSATTRBIT_QUOTAUSED:
1539 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1540 			if (sbp != NULL) {
1541 			    freenum = 0;
1542 #ifdef QUOTA
1543 			    /*
1544 			     * ufs_quotactl() insists that the uid argument
1545 			     * equal p_ruid for non-root quota access, so
1546 			     * we'll just make sure that's the case.
1547 			     */
1548 			    savuid = p->p_cred->p_ruid;
1549 			    p->p_cred->p_ruid = cred->cr_uid;
1550 			    if (!VFS_QUOTACTL(vnode_mount(vp),QCMD(Q_GETQUOTA,
1551 				USRQUOTA), cred->cr_uid, (caddr_t)&dqb))
1552 				freenum = dqb.dqb_curblocks;
1553 			    p->p_cred->p_ruid = savuid;
1554 #endif	/* QUOTA */
1555 			    uquad = (u_int64_t)freenum;
1556 			    NFSQUOTABLKTOBYTE(uquad, sbp->f_bsize);
1557 			}
1558 			if (compare && !(*retcmpp)) {
1559 				if (uquad != fxdr_hyper(tl))
1560 					*retcmpp = NFSERR_NOTSAME;
1561 			}
1562 			attrsum += NFSX_HYPER;
1563 			break;
1564 		case NFSATTRBIT_RAWDEV:
1565 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4SPECDATA);
1566 			j = fxdr_unsigned(int, *tl++);
1567 			k = fxdr_unsigned(int, *tl);
1568 			if (compare) {
1569 			    if (!(*retcmpp)) {
1570 				if (nap->na_rdev != NFSMAKEDEV(j, k))
1571 					*retcmpp = NFSERR_NOTSAME;
1572 			    }
1573 			} else if (nap != NULL) {
1574 				nap->na_rdev = NFSMAKEDEV(j, k);
1575 			}
1576 			attrsum += NFSX_V4SPECDATA;
1577 			break;
1578 		case NFSATTRBIT_SPACEAVAIL:
1579 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1580 			if (compare) {
1581 				if (!(*retcmpp) &&
1582 				    sfp->sf_abytes != fxdr_hyper(tl))
1583 					*retcmpp = NFSERR_NOTSAME;
1584 			} else if (sfp != NULL) {
1585 				sfp->sf_abytes = fxdr_hyper(tl);
1586 			}
1587 			attrsum += NFSX_HYPER;
1588 			break;
1589 		case NFSATTRBIT_SPACEFREE:
1590 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1591 			if (compare) {
1592 				if (!(*retcmpp) &&
1593 				    sfp->sf_fbytes != fxdr_hyper(tl))
1594 					*retcmpp = NFSERR_NOTSAME;
1595 			} else if (sfp != NULL) {
1596 				sfp->sf_fbytes = fxdr_hyper(tl);
1597 			}
1598 			attrsum += NFSX_HYPER;
1599 			break;
1600 		case NFSATTRBIT_SPACETOTAL:
1601 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1602 			if (compare) {
1603 				if (!(*retcmpp) &&
1604 				    sfp->sf_tbytes != fxdr_hyper(tl))
1605 					*retcmpp = NFSERR_NOTSAME;
1606 			} else if (sfp != NULL) {
1607 				sfp->sf_tbytes = fxdr_hyper(tl);
1608 			}
1609 			attrsum += NFSX_HYPER;
1610 			break;
1611 		case NFSATTRBIT_SPACEUSED:
1612 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1613 			thyp = fxdr_hyper(tl);
1614 			if (compare) {
1615 			    if (!(*retcmpp)) {
1616 				if ((u_int64_t)nap->na_bytes != thyp)
1617 					*retcmpp = NFSERR_NOTSAME;
1618 			    }
1619 			} else if (nap != NULL) {
1620 				nap->na_bytes = thyp;
1621 			}
1622 			attrsum += NFSX_HYPER;
1623 			break;
1624 		case NFSATTRBIT_SYSTEM:
1625 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1626 			if (compare && !(*retcmpp))
1627 				*retcmpp = NFSERR_ATTRNOTSUPP;
1628 			attrsum += NFSX_UNSIGNED;
1629 			break;
1630 		case NFSATTRBIT_TIMEACCESS:
1631 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
1632 			fxdr_nfsv4time(tl, &temptime);
1633 			if (compare) {
1634 			    if (!(*retcmpp)) {
1635 				if (!NFS_CMPTIME(temptime, nap->na_atime))
1636 					*retcmpp = NFSERR_NOTSAME;
1637 			    }
1638 			} else if (nap != NULL) {
1639 				nap->na_atime = temptime;
1640 			}
1641 			attrsum += NFSX_V4TIME;
1642 			break;
1643 		case NFSATTRBIT_TIMEACCESSSET:
1644 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1645 			attrsum += NFSX_UNSIGNED;
1646 			i = fxdr_unsigned(int, *tl);
1647 			if (i == NFSV4SATTRTIME_TOCLIENT) {
1648 				NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
1649 				attrsum += NFSX_V4TIME;
1650 			}
1651 			if (compare && !(*retcmpp))
1652 				*retcmpp = NFSERR_INVAL;
1653 			break;
1654 		case NFSATTRBIT_TIMEBACKUP:
1655 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
1656 			if (compare && !(*retcmpp))
1657 				*retcmpp = NFSERR_ATTRNOTSUPP;
1658 			attrsum += NFSX_V4TIME;
1659 			break;
1660 		case NFSATTRBIT_TIMECREATE:
1661 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
1662 			if (compare && !(*retcmpp))
1663 				*retcmpp = NFSERR_ATTRNOTSUPP;
1664 			attrsum += NFSX_V4TIME;
1665 			break;
1666 		case NFSATTRBIT_TIMEDELTA:
1667 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
1668 			if (fsp != NULL) {
1669 			    if (compare) {
1670 				if (!(*retcmpp)) {
1671 				    if ((u_int32_t)fsp->fs_timedelta.tv_sec !=
1672 					fxdr_unsigned(u_int32_t, *(tl + 1)) ||
1673 				        (u_int32_t)fsp->fs_timedelta.tv_nsec !=
1674 					(fxdr_unsigned(u_int32_t, *(tl + 2)) %
1675 					 1000000000) ||
1676 					*tl != 0)
1677 					    *retcmpp = NFSERR_NOTSAME;
1678 				}
1679 			    } else {
1680 				fxdr_nfsv4time(tl, &fsp->fs_timedelta);
1681 			    }
1682 			}
1683 			attrsum += NFSX_V4TIME;
1684 			break;
1685 		case NFSATTRBIT_TIMEMETADATA:
1686 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
1687 			fxdr_nfsv4time(tl, &temptime);
1688 			if (compare) {
1689 			    if (!(*retcmpp)) {
1690 				if (!NFS_CMPTIME(temptime, nap->na_ctime))
1691 					*retcmpp = NFSERR_NOTSAME;
1692 			    }
1693 			} else if (nap != NULL) {
1694 				nap->na_ctime = temptime;
1695 			}
1696 			attrsum += NFSX_V4TIME;
1697 			break;
1698 		case NFSATTRBIT_TIMEMODIFY:
1699 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
1700 			fxdr_nfsv4time(tl, &temptime);
1701 			if (compare) {
1702 			    if (!(*retcmpp)) {
1703 				if (!NFS_CMPTIME(temptime, nap->na_mtime))
1704 					*retcmpp = NFSERR_NOTSAME;
1705 			    }
1706 			} else if (nap != NULL) {
1707 				nap->na_mtime = temptime;
1708 			}
1709 			attrsum += NFSX_V4TIME;
1710 			break;
1711 		case NFSATTRBIT_TIMEMODIFYSET:
1712 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1713 			attrsum += NFSX_UNSIGNED;
1714 			i = fxdr_unsigned(int, *tl);
1715 			if (i == NFSV4SATTRTIME_TOCLIENT) {
1716 				NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
1717 				attrsum += NFSX_V4TIME;
1718 			}
1719 			if (compare && !(*retcmpp))
1720 				*retcmpp = NFSERR_INVAL;
1721 			break;
1722 		case NFSATTRBIT_MOUNTEDONFILEID:
1723 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
1724 			thyp = fxdr_hyper(tl);
1725 			if (compare) {
1726 			    if (!(*retcmpp)) {
1727 				if (*tl++) {
1728 					*retcmpp = NFSERR_NOTSAME;
1729 				} else {
1730 					if (!vp || !nfsrv_atroot(vp, &fid))
1731 						fid = nap->na_fileid;
1732 					if ((u_int64_t)fid != thyp)
1733 						*retcmpp = NFSERR_NOTSAME;
1734 				}
1735 			    }
1736 			} else if (nap != NULL) {
1737 			    if (*tl++)
1738 				printf("NFSv4 mounted on fileid > 32bits\n");
1739 			    nap->na_mntonfileno = thyp;
1740 			}
1741 			attrsum += NFSX_HYPER;
1742 			break;
1743 		case NFSATTRBIT_SUPPATTREXCLCREAT:
1744 			retnotsup = 0;
1745 			error = nfsrv_getattrbits(nd, &retattrbits,
1746 			    &cnt, &retnotsup);
1747 			if (error)
1748 			    goto nfsmout;
1749 			if (compare && !(*retcmpp)) {
1750 			   NFSSETSUPP_ATTRBIT(&checkattrbits);
1751 			   NFSCLRNOTSETABLE_ATTRBIT(&checkattrbits);
1752 			   NFSCLRBIT_ATTRBIT(&checkattrbits,
1753 				NFSATTRBIT_TIMEACCESSSET);
1754 			   if (!NFSEQUAL_ATTRBIT(&retattrbits, &checkattrbits)
1755 			       || retnotsup)
1756 				*retcmpp = NFSERR_NOTSAME;
1757 			}
1758 			attrsum += cnt;
1759 			break;
1760 		default:
1761 			printf("EEK! nfsv4_loadattr unknown attr=%d\n",
1762 				bitpos);
1763 			if (compare && !(*retcmpp))
1764 				*retcmpp = NFSERR_ATTRNOTSUPP;
1765 			/*
1766 			 * and get out of the loop, since we can't parse
1767 			 * the unknown attrbute data.
1768 			 */
1769 			bitpos = NFSATTRBIT_MAX;
1770 			break;
1771 		};
1772 	}
1773 
1774 	/*
1775 	 * some clients pad the attrlist, so we need to skip over the
1776 	 * padding.
1777 	 */
1778 	if (attrsum > attrsize) {
1779 		error = NFSERR_BADXDR;
1780 	} else {
1781 		attrsize = NFSM_RNDUP(attrsize);
1782 		if (attrsum < attrsize)
1783 			error = nfsm_advance(nd, attrsize - attrsum, -1);
1784 	}
1785 nfsmout:
1786 	NFSEXITCODE2(error, nd);
1787 	return (error);
1788 }
1789 
1790 /*
1791  * Implement sleep locks for newnfs. The nfslock_usecnt allows for a
1792  * shared lock and the NFSXXX_LOCK flag permits an exclusive lock.
1793  * The first argument is a pointer to an nfsv4lock structure.
1794  * The second argument is 1 iff a blocking lock is wanted.
1795  * If this argument is 0, the call waits until no thread either wants nor
1796  * holds an exclusive lock.
1797  * It returns 1 if the lock was acquired, 0 otherwise.
1798  * If several processes call this function concurrently wanting the exclusive
1799  * lock, one will get the lock and the rest will return without getting the
1800  * lock. (If the caller must have the lock, it simply calls this function in a
1801  *  loop until the function returns 1 to indicate the lock was acquired.)
1802  * Any usecnt must be decremented by calling nfsv4_relref() before
1803  * calling nfsv4_lock(). It was done this way, so nfsv4_lock() could
1804  * be called in a loop.
1805  * The isleptp argument is set to indicate if the call slept, iff not NULL
1806  * and the mp argument indicates to check for a forced dismount, iff not
1807  * NULL.
1808  */
1809 APPLESTATIC int
1810 nfsv4_lock(struct nfsv4lock *lp, int iwantlock, int *isleptp,
1811     void *mutex, struct mount *mp)
1812 {
1813 
1814 	if (isleptp)
1815 		*isleptp = 0;
1816 	/*
1817 	 * If a lock is wanted, loop around until the lock is acquired by
1818 	 * someone and then released. If I want the lock, try to acquire it.
1819 	 * For a lock to be issued, no lock must be in force and the usecnt
1820 	 * must be zero.
1821 	 */
1822 	if (iwantlock) {
1823 	    if (!(lp->nfslock_lock & NFSV4LOCK_LOCK) &&
1824 		lp->nfslock_usecnt == 0) {
1825 		lp->nfslock_lock &= ~NFSV4LOCK_LOCKWANTED;
1826 		lp->nfslock_lock |= NFSV4LOCK_LOCK;
1827 		return (1);
1828 	    }
1829 	    lp->nfslock_lock |= NFSV4LOCK_LOCKWANTED;
1830 	}
1831 	while (lp->nfslock_lock & (NFSV4LOCK_LOCK | NFSV4LOCK_LOCKWANTED)) {
1832 		if (mp != NULL && (mp->mnt_kern_flag & MNTK_UNMOUNTF) != 0) {
1833 			lp->nfslock_lock &= ~NFSV4LOCK_LOCKWANTED;
1834 			return (0);
1835 		}
1836 		lp->nfslock_lock |= NFSV4LOCK_WANTED;
1837 		if (isleptp)
1838 			*isleptp = 1;
1839 		(void) nfsmsleep(&lp->nfslock_lock, mutex,
1840 		    PZERO - 1, "nfsv4lck", NULL);
1841 		if (iwantlock && !(lp->nfslock_lock & NFSV4LOCK_LOCK) &&
1842 		    lp->nfslock_usecnt == 0) {
1843 			lp->nfslock_lock &= ~NFSV4LOCK_LOCKWANTED;
1844 			lp->nfslock_lock |= NFSV4LOCK_LOCK;
1845 			return (1);
1846 		}
1847 	}
1848 	return (0);
1849 }
1850 
1851 /*
1852  * Release the lock acquired by nfsv4_lock().
1853  * The second argument is set to 1 to indicate the nfslock_usecnt should be
1854  * incremented, as well.
1855  */
1856 APPLESTATIC void
1857 nfsv4_unlock(struct nfsv4lock *lp, int incref)
1858 {
1859 
1860 	lp->nfslock_lock &= ~NFSV4LOCK_LOCK;
1861 	if (incref)
1862 		lp->nfslock_usecnt++;
1863 	nfsv4_wanted(lp);
1864 }
1865 
1866 /*
1867  * Release a reference cnt.
1868  */
1869 APPLESTATIC void
1870 nfsv4_relref(struct nfsv4lock *lp)
1871 {
1872 
1873 	if (lp->nfslock_usecnt <= 0)
1874 		panic("nfsv4root ref cnt");
1875 	lp->nfslock_usecnt--;
1876 	if (lp->nfslock_usecnt == 0)
1877 		nfsv4_wanted(lp);
1878 }
1879 
1880 /*
1881  * Get a reference cnt.
1882  * This function will wait for any exclusive lock to be released, but will
1883  * not wait for threads that want the exclusive lock. If priority needs
1884  * to be given to threads that need the exclusive lock, a call to nfsv4_lock()
1885  * with the 2nd argument == 0 should be done before calling nfsv4_getref().
1886  * If the mp argument is not NULL, check for MNTK_UNMOUNTF being set and
1887  * return without getting a refcnt for that case.
1888  */
1889 APPLESTATIC void
1890 nfsv4_getref(struct nfsv4lock *lp, int *isleptp, void *mutex,
1891     struct mount *mp)
1892 {
1893 
1894 	if (isleptp)
1895 		*isleptp = 0;
1896 
1897 	/*
1898 	 * Wait for a lock held.
1899 	 */
1900 	while (lp->nfslock_lock & NFSV4LOCK_LOCK) {
1901 		if (mp != NULL && (mp->mnt_kern_flag & MNTK_UNMOUNTF) != 0)
1902 			return;
1903 		lp->nfslock_lock |= NFSV4LOCK_WANTED;
1904 		if (isleptp)
1905 			*isleptp = 1;
1906 		(void) nfsmsleep(&lp->nfslock_lock, mutex,
1907 		    PZERO - 1, "nfsv4gr", NULL);
1908 	}
1909 	if (mp != NULL && (mp->mnt_kern_flag & MNTK_UNMOUNTF) != 0)
1910 		return;
1911 
1912 	lp->nfslock_usecnt++;
1913 }
1914 
1915 /*
1916  * Get a reference as above, but return failure instead of sleeping if
1917  * an exclusive lock is held.
1918  */
1919 APPLESTATIC int
1920 nfsv4_getref_nonblock(struct nfsv4lock *lp)
1921 {
1922 
1923 	if ((lp->nfslock_lock & NFSV4LOCK_LOCK) != 0)
1924 		return (0);
1925 
1926 	lp->nfslock_usecnt++;
1927 	return (1);
1928 }
1929 
1930 /*
1931  * Test for a lock. Return 1 if locked, 0 otherwise.
1932  */
1933 APPLESTATIC int
1934 nfsv4_testlock(struct nfsv4lock *lp)
1935 {
1936 
1937 	if ((lp->nfslock_lock & NFSV4LOCK_LOCK) == 0 &&
1938 	    lp->nfslock_usecnt == 0)
1939 		return (0);
1940 	return (1);
1941 }
1942 
1943 /*
1944  * Wake up anyone sleeping, waiting for this lock.
1945  */
1946 static void
1947 nfsv4_wanted(struct nfsv4lock *lp)
1948 {
1949 
1950 	if (lp->nfslock_lock & NFSV4LOCK_WANTED) {
1951 		lp->nfslock_lock &= ~NFSV4LOCK_WANTED;
1952 		wakeup((caddr_t)&lp->nfslock_lock);
1953 	}
1954 }
1955 
1956 /*
1957  * Copy a string from an mbuf list into a character array.
1958  * Return EBADRPC if there is an mbuf error,
1959  * 0 otherwise.
1960  */
1961 APPLESTATIC int
1962 nfsrv_mtostr(struct nfsrv_descript *nd, char *str, int siz)
1963 {
1964 	char *cp;
1965 	int xfer, len;
1966 	mbuf_t mp;
1967 	int rem, error = 0;
1968 
1969 	mp = nd->nd_md;
1970 	cp = nd->nd_dpos;
1971 	len = NFSMTOD(mp, caddr_t) + mbuf_len(mp) - cp;
1972 	rem = NFSM_RNDUP(siz) - siz;
1973 	while (siz > 0) {
1974 		if (len > siz)
1975 			xfer = siz;
1976 		else
1977 			xfer = len;
1978 		NFSBCOPY(cp, str, xfer);
1979 		str += xfer;
1980 		siz -= xfer;
1981 		if (siz > 0) {
1982 			mp = mbuf_next(mp);
1983 			if (mp == NULL) {
1984 				error = EBADRPC;
1985 				goto out;
1986 			}
1987 			cp = NFSMTOD(mp, caddr_t);
1988 			len = mbuf_len(mp);
1989 		} else {
1990 			cp += xfer;
1991 			len -= xfer;
1992 		}
1993 	}
1994 	*str = '\0';
1995 	nd->nd_dpos = cp;
1996 	nd->nd_md = mp;
1997 	if (rem > 0) {
1998 		if (len < rem)
1999 			error = nfsm_advance(nd, rem, len);
2000 		else
2001 			nd->nd_dpos += rem;
2002 	}
2003 
2004 out:
2005 	NFSEXITCODE2(error, nd);
2006 	return (error);
2007 }
2008 
2009 /*
2010  * Fill in the attributes as marked by the bitmap (V4).
2011  */
2012 APPLESTATIC int
2013 nfsv4_fillattr(struct nfsrv_descript *nd, struct mount *mp, vnode_t vp,
2014     NFSACL_T *saclp, struct vattr *vap, fhandle_t *fhp, int rderror,
2015     nfsattrbit_t *attrbitp, struct ucred *cred, NFSPROC_T *p, int isdgram,
2016     int reterr, int supports_nfsv4acls, int at_root, uint64_t mounted_on_fileno)
2017 {
2018 	int bitpos, retnum = 0;
2019 	u_int32_t *tl;
2020 	int siz, prefixnum, error;
2021 	u_char *cp, namestr[NFSV4_SMALLSTR];
2022 	nfsattrbit_t attrbits, retbits;
2023 	nfsattrbit_t *retbitp = &retbits;
2024 	u_int32_t freenum, *retnump;
2025 	u_int64_t uquad;
2026 	struct statfs fs;
2027 	struct nfsfsinfo fsinf;
2028 	struct timespec temptime;
2029 	NFSACL_T *aclp, *naclp = NULL;
2030 #ifdef QUOTA
2031 	struct dqblk dqb;
2032 	uid_t savuid;
2033 #endif
2034 
2035 	/*
2036 	 * First, set the bits that can be filled and get fsinfo.
2037 	 */
2038 	NFSSET_ATTRBIT(retbitp, attrbitp);
2039 	/*
2040 	 * If both p and cred are NULL, it is a client side setattr call.
2041 	 * If both p and cred are not NULL, it is a server side reply call.
2042 	 * If p is not NULL and cred is NULL, it is a client side callback
2043 	 * reply call.
2044 	 */
2045 	if (p == NULL && cred == NULL) {
2046 		NFSCLRNOTSETABLE_ATTRBIT(retbitp);
2047 		aclp = saclp;
2048 	} else {
2049 		NFSCLRNOTFILLABLE_ATTRBIT(retbitp);
2050 		naclp = acl_alloc(M_WAITOK);
2051 		aclp = naclp;
2052 	}
2053 	nfsvno_getfs(&fsinf, isdgram);
2054 #ifndef APPLE
2055 	/*
2056 	 * Get the VFS_STATFS(), since some attributes need them.
2057 	 */
2058 	if (NFSISSETSTATFS_ATTRBIT(retbitp)) {
2059 		error = VFS_STATFS(mp, &fs);
2060 		if (error != 0) {
2061 			if (reterr) {
2062 				nd->nd_repstat = NFSERR_ACCES;
2063 				return (0);
2064 			}
2065 			NFSCLRSTATFS_ATTRBIT(retbitp);
2066 		}
2067 	}
2068 #endif
2069 
2070 	/*
2071 	 * And the NFSv4 ACL...
2072 	 */
2073 	if (NFSISSET_ATTRBIT(retbitp, NFSATTRBIT_ACLSUPPORT) &&
2074 	    (nfsrv_useacl == 0 || ((cred != NULL || p != NULL) &&
2075 		supports_nfsv4acls == 0))) {
2076 		NFSCLRBIT_ATTRBIT(retbitp, NFSATTRBIT_ACLSUPPORT);
2077 	}
2078 	if (NFSISSET_ATTRBIT(retbitp, NFSATTRBIT_ACL)) {
2079 		if (nfsrv_useacl == 0 || ((cred != NULL || p != NULL) &&
2080 		    supports_nfsv4acls == 0)) {
2081 			NFSCLRBIT_ATTRBIT(retbitp, NFSATTRBIT_ACL);
2082 		} else if (naclp != NULL) {
2083 			if (NFSVOPLOCK(vp, LK_SHARED) == 0) {
2084 				error = VOP_ACCESSX(vp, VREAD_ACL, cred, p);
2085 				if (error == 0)
2086 					error = VOP_GETACL(vp, ACL_TYPE_NFS4,
2087 					    naclp, cred, p);
2088 				NFSVOPUNLOCK(vp, 0);
2089 			} else
2090 				error = NFSERR_PERM;
2091 			if (error != 0) {
2092 				if (reterr) {
2093 					nd->nd_repstat = NFSERR_ACCES;
2094 					return (0);
2095 				}
2096 				NFSCLRBIT_ATTRBIT(retbitp, NFSATTRBIT_ACL);
2097 			}
2098 		}
2099 	}
2100 
2101 	/*
2102 	 * Put out the attribute bitmap for the ones being filled in
2103 	 * and get the field for the number of attributes returned.
2104 	 */
2105 	prefixnum = nfsrv_putattrbit(nd, retbitp);
2106 	NFSM_BUILD(retnump, u_int32_t *, NFSX_UNSIGNED);
2107 	prefixnum += NFSX_UNSIGNED;
2108 
2109 	/*
2110 	 * Now, loop around filling in the attributes for each bit set.
2111 	 */
2112 	for (bitpos = 0; bitpos < NFSATTRBIT_MAX; bitpos++) {
2113 	    if (NFSISSET_ATTRBIT(retbitp, bitpos)) {
2114 		switch (bitpos) {
2115 		case NFSATTRBIT_SUPPORTEDATTRS:
2116 			NFSSETSUPP_ATTRBIT(&attrbits);
2117 			if (nfsrv_useacl == 0 || ((cred != NULL || p != NULL)
2118 			    && supports_nfsv4acls == 0)) {
2119 			    NFSCLRBIT_ATTRBIT(&attrbits,NFSATTRBIT_ACLSUPPORT);
2120 			    NFSCLRBIT_ATTRBIT(&attrbits,NFSATTRBIT_ACL);
2121 			}
2122 			retnum += nfsrv_putattrbit(nd, &attrbits);
2123 			break;
2124 		case NFSATTRBIT_TYPE:
2125 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2126 			*tl = vtonfsv34_type(vap->va_type);
2127 			retnum += NFSX_UNSIGNED;
2128 			break;
2129 		case NFSATTRBIT_FHEXPIRETYPE:
2130 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2131 			*tl = txdr_unsigned(NFSV4FHTYPE_PERSISTENT);
2132 			retnum += NFSX_UNSIGNED;
2133 			break;
2134 		case NFSATTRBIT_CHANGE:
2135 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2136 			txdr_hyper(vap->va_filerev, tl);
2137 			retnum += NFSX_HYPER;
2138 			break;
2139 		case NFSATTRBIT_SIZE:
2140 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2141 			txdr_hyper(vap->va_size, tl);
2142 			retnum += NFSX_HYPER;
2143 			break;
2144 		case NFSATTRBIT_LINKSUPPORT:
2145 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2146 			if (fsinf.fs_properties & NFSV3FSINFO_LINK)
2147 				*tl = newnfs_true;
2148 			else
2149 				*tl = newnfs_false;
2150 			retnum += NFSX_UNSIGNED;
2151 			break;
2152 		case NFSATTRBIT_SYMLINKSUPPORT:
2153 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2154 			if (fsinf.fs_properties & NFSV3FSINFO_SYMLINK)
2155 				*tl = newnfs_true;
2156 			else
2157 				*tl = newnfs_false;
2158 			retnum += NFSX_UNSIGNED;
2159 			break;
2160 		case NFSATTRBIT_NAMEDATTR:
2161 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2162 			*tl = newnfs_false;
2163 			retnum += NFSX_UNSIGNED;
2164 			break;
2165 		case NFSATTRBIT_FSID:
2166 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4FSID);
2167 			*tl++ = 0;
2168 			*tl++ = txdr_unsigned(mp->mnt_stat.f_fsid.val[0]);
2169 			*tl++ = 0;
2170 			*tl = txdr_unsigned(mp->mnt_stat.f_fsid.val[1]);
2171 			retnum += NFSX_V4FSID;
2172 			break;
2173 		case NFSATTRBIT_UNIQUEHANDLES:
2174 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2175 			*tl = newnfs_true;
2176 			retnum += NFSX_UNSIGNED;
2177 			break;
2178 		case NFSATTRBIT_LEASETIME:
2179 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2180 			*tl = txdr_unsigned(nfsrv_lease);
2181 			retnum += NFSX_UNSIGNED;
2182 			break;
2183 		case NFSATTRBIT_RDATTRERROR:
2184 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2185 			*tl = txdr_unsigned(rderror);
2186 			retnum += NFSX_UNSIGNED;
2187 			break;
2188 		/*
2189 		 * Recommended Attributes. (Only the supported ones.)
2190 		 */
2191 		case NFSATTRBIT_ACL:
2192 			retnum += nfsrv_buildacl(nd, aclp, vnode_vtype(vp), p);
2193 			break;
2194 		case NFSATTRBIT_ACLSUPPORT:
2195 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2196 			*tl = txdr_unsigned(NFSV4ACE_SUPTYPES);
2197 			retnum += NFSX_UNSIGNED;
2198 			break;
2199 		case NFSATTRBIT_CANSETTIME:
2200 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2201 			if (fsinf.fs_properties & NFSV3FSINFO_CANSETTIME)
2202 				*tl = newnfs_true;
2203 			else
2204 				*tl = newnfs_false;
2205 			retnum += NFSX_UNSIGNED;
2206 			break;
2207 		case NFSATTRBIT_CASEINSENSITIVE:
2208 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2209 			*tl = newnfs_false;
2210 			retnum += NFSX_UNSIGNED;
2211 			break;
2212 		case NFSATTRBIT_CASEPRESERVING:
2213 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2214 			*tl = newnfs_true;
2215 			retnum += NFSX_UNSIGNED;
2216 			break;
2217 		case NFSATTRBIT_CHOWNRESTRICTED:
2218 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2219 			*tl = newnfs_true;
2220 			retnum += NFSX_UNSIGNED;
2221 			break;
2222 		case NFSATTRBIT_FILEHANDLE:
2223 			retnum += nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
2224 			break;
2225 		case NFSATTRBIT_FILEID:
2226 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2227 			*tl++ = 0;
2228 			*tl = txdr_unsigned(vap->va_fileid);
2229 			retnum += NFSX_HYPER;
2230 			break;
2231 		case NFSATTRBIT_FILESAVAIL:
2232 			/*
2233 			 * Check quota and use min(quota, f_ffree).
2234 			 */
2235 			freenum = fs.f_ffree;
2236 #ifdef QUOTA
2237 			/*
2238 			 * ufs_quotactl() insists that the uid argument
2239 			 * equal p_ruid for non-root quota access, so
2240 			 * we'll just make sure that's the case.
2241 			 */
2242 			savuid = p->p_cred->p_ruid;
2243 			p->p_cred->p_ruid = cred->cr_uid;
2244 			if (!VFS_QUOTACTL(mp, QCMD(Q_GETQUOTA,USRQUOTA),
2245 			    cred->cr_uid, (caddr_t)&dqb))
2246 			    freenum = min(dqb.dqb_isoftlimit-dqb.dqb_curinodes,
2247 				freenum);
2248 			p->p_cred->p_ruid = savuid;
2249 #endif	/* QUOTA */
2250 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2251 			*tl++ = 0;
2252 			*tl = txdr_unsigned(freenum);
2253 			retnum += NFSX_HYPER;
2254 			break;
2255 		case NFSATTRBIT_FILESFREE:
2256 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2257 			*tl++ = 0;
2258 			*tl = txdr_unsigned(fs.f_ffree);
2259 			retnum += NFSX_HYPER;
2260 			break;
2261 		case NFSATTRBIT_FILESTOTAL:
2262 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2263 			*tl++ = 0;
2264 			*tl = txdr_unsigned(fs.f_files);
2265 			retnum += NFSX_HYPER;
2266 			break;
2267 		case NFSATTRBIT_FSLOCATIONS:
2268 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2269 			*tl++ = 0;
2270 			*tl = 0;
2271 			retnum += 2 * NFSX_UNSIGNED;
2272 			break;
2273 		case NFSATTRBIT_HOMOGENEOUS:
2274 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2275 			if (fsinf.fs_properties & NFSV3FSINFO_HOMOGENEOUS)
2276 				*tl = newnfs_true;
2277 			else
2278 				*tl = newnfs_false;
2279 			retnum += NFSX_UNSIGNED;
2280 			break;
2281 		case NFSATTRBIT_MAXFILESIZE:
2282 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2283 			uquad = NFSRV_MAXFILESIZE;
2284 			txdr_hyper(uquad, tl);
2285 			retnum += NFSX_HYPER;
2286 			break;
2287 		case NFSATTRBIT_MAXLINK:
2288 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2289 			*tl = txdr_unsigned(LINK_MAX);
2290 			retnum += NFSX_UNSIGNED;
2291 			break;
2292 		case NFSATTRBIT_MAXNAME:
2293 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2294 			*tl = txdr_unsigned(NFS_MAXNAMLEN);
2295 			retnum += NFSX_UNSIGNED;
2296 			break;
2297 		case NFSATTRBIT_MAXREAD:
2298 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2299 			*tl++ = 0;
2300 			*tl = txdr_unsigned(fsinf.fs_rtmax);
2301 			retnum += NFSX_HYPER;
2302 			break;
2303 		case NFSATTRBIT_MAXWRITE:
2304 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2305 			*tl++ = 0;
2306 			*tl = txdr_unsigned(fsinf.fs_wtmax);
2307 			retnum += NFSX_HYPER;
2308 			break;
2309 		case NFSATTRBIT_MODE:
2310 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2311 			*tl = vtonfsv34_mode(vap->va_mode);
2312 			retnum += NFSX_UNSIGNED;
2313 			break;
2314 		case NFSATTRBIT_NOTRUNC:
2315 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2316 			*tl = newnfs_true;
2317 			retnum += NFSX_UNSIGNED;
2318 			break;
2319 		case NFSATTRBIT_NUMLINKS:
2320 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2321 			*tl = txdr_unsigned(vap->va_nlink);
2322 			retnum += NFSX_UNSIGNED;
2323 			break;
2324 		case NFSATTRBIT_OWNER:
2325 			cp = namestr;
2326 			nfsv4_uidtostr(vap->va_uid, &cp, &siz, p);
2327 			retnum += nfsm_strtom(nd, cp, siz);
2328 			if (cp != namestr)
2329 				free(cp, M_NFSSTRING);
2330 			break;
2331 		case NFSATTRBIT_OWNERGROUP:
2332 			cp = namestr;
2333 			nfsv4_gidtostr(vap->va_gid, &cp, &siz, p);
2334 			retnum += nfsm_strtom(nd, cp, siz);
2335 			if (cp != namestr)
2336 				free(cp, M_NFSSTRING);
2337 			break;
2338 		case NFSATTRBIT_QUOTAHARD:
2339 			if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA, 0))
2340 				freenum = fs.f_bfree;
2341 			else
2342 				freenum = fs.f_bavail;
2343 #ifdef QUOTA
2344 			/*
2345 			 * ufs_quotactl() insists that the uid argument
2346 			 * equal p_ruid for non-root quota access, so
2347 			 * we'll just make sure that's the case.
2348 			 */
2349 			savuid = p->p_cred->p_ruid;
2350 			p->p_cred->p_ruid = cred->cr_uid;
2351 			if (!VFS_QUOTACTL(mp, QCMD(Q_GETQUOTA,USRQUOTA),
2352 			    cred->cr_uid, (caddr_t)&dqb))
2353 			    freenum = min(dqb.dqb_bhardlimit, freenum);
2354 			p->p_cred->p_ruid = savuid;
2355 #endif	/* QUOTA */
2356 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2357 			uquad = (u_int64_t)freenum;
2358 			NFSQUOTABLKTOBYTE(uquad, fs.f_bsize);
2359 			txdr_hyper(uquad, tl);
2360 			retnum += NFSX_HYPER;
2361 			break;
2362 		case NFSATTRBIT_QUOTASOFT:
2363 			if (priv_check_cred(cred, PRIV_VFS_EXCEEDQUOTA, 0))
2364 				freenum = fs.f_bfree;
2365 			else
2366 				freenum = fs.f_bavail;
2367 #ifdef QUOTA
2368 			/*
2369 			 * ufs_quotactl() insists that the uid argument
2370 			 * equal p_ruid for non-root quota access, so
2371 			 * we'll just make sure that's the case.
2372 			 */
2373 			savuid = p->p_cred->p_ruid;
2374 			p->p_cred->p_ruid = cred->cr_uid;
2375 			if (!VFS_QUOTACTL(mp, QCMD(Q_GETQUOTA,USRQUOTA),
2376 			    cred->cr_uid, (caddr_t)&dqb))
2377 			    freenum = min(dqb.dqb_bsoftlimit, freenum);
2378 			p->p_cred->p_ruid = savuid;
2379 #endif	/* QUOTA */
2380 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2381 			uquad = (u_int64_t)freenum;
2382 			NFSQUOTABLKTOBYTE(uquad, fs.f_bsize);
2383 			txdr_hyper(uquad, tl);
2384 			retnum += NFSX_HYPER;
2385 			break;
2386 		case NFSATTRBIT_QUOTAUSED:
2387 			freenum = 0;
2388 #ifdef QUOTA
2389 			/*
2390 			 * ufs_quotactl() insists that the uid argument
2391 			 * equal p_ruid for non-root quota access, so
2392 			 * we'll just make sure that's the case.
2393 			 */
2394 			savuid = p->p_cred->p_ruid;
2395 			p->p_cred->p_ruid = cred->cr_uid;
2396 			if (!VFS_QUOTACTL(mp, QCMD(Q_GETQUOTA,USRQUOTA),
2397 			    cred->cr_uid, (caddr_t)&dqb))
2398 			    freenum = dqb.dqb_curblocks;
2399 			p->p_cred->p_ruid = savuid;
2400 #endif	/* QUOTA */
2401 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2402 			uquad = (u_int64_t)freenum;
2403 			NFSQUOTABLKTOBYTE(uquad, fs.f_bsize);
2404 			txdr_hyper(uquad, tl);
2405 			retnum += NFSX_HYPER;
2406 			break;
2407 		case NFSATTRBIT_RAWDEV:
2408 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4SPECDATA);
2409 			*tl++ = txdr_unsigned(NFSMAJOR(vap->va_rdev));
2410 			*tl = txdr_unsigned(NFSMINOR(vap->va_rdev));
2411 			retnum += NFSX_V4SPECDATA;
2412 			break;
2413 		case NFSATTRBIT_SPACEAVAIL:
2414 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2415 			if (priv_check_cred(cred, PRIV_VFS_BLOCKRESERVE, 0))
2416 				uquad = (u_int64_t)fs.f_bfree;
2417 			else
2418 				uquad = (u_int64_t)fs.f_bavail;
2419 			uquad *= fs.f_bsize;
2420 			txdr_hyper(uquad, tl);
2421 			retnum += NFSX_HYPER;
2422 			break;
2423 		case NFSATTRBIT_SPACEFREE:
2424 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2425 			uquad = (u_int64_t)fs.f_bfree;
2426 			uquad *= fs.f_bsize;
2427 			txdr_hyper(uquad, tl);
2428 			retnum += NFSX_HYPER;
2429 			break;
2430 		case NFSATTRBIT_SPACETOTAL:
2431 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2432 			uquad = (u_int64_t)fs.f_blocks;
2433 			uquad *= fs.f_bsize;
2434 			txdr_hyper(uquad, tl);
2435 			retnum += NFSX_HYPER;
2436 			break;
2437 		case NFSATTRBIT_SPACEUSED:
2438 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2439 			txdr_hyper(vap->va_bytes, tl);
2440 			retnum += NFSX_HYPER;
2441 			break;
2442 		case NFSATTRBIT_TIMEACCESS:
2443 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4TIME);
2444 			txdr_nfsv4time(&vap->va_atime, tl);
2445 			retnum += NFSX_V4TIME;
2446 			break;
2447 		case NFSATTRBIT_TIMEACCESSSET:
2448 			if ((vap->va_vaflags & VA_UTIMES_NULL) == 0) {
2449 				NFSM_BUILD(tl, u_int32_t *, NFSX_V4SETTIME);
2450 				*tl++ = txdr_unsigned(NFSV4SATTRTIME_TOCLIENT);
2451 				txdr_nfsv4time(&vap->va_atime, tl);
2452 				retnum += NFSX_V4SETTIME;
2453 			} else {
2454 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2455 				*tl = txdr_unsigned(NFSV4SATTRTIME_TOSERVER);
2456 				retnum += NFSX_UNSIGNED;
2457 			}
2458 			break;
2459 		case NFSATTRBIT_TIMEDELTA:
2460 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4TIME);
2461 			temptime.tv_sec = 0;
2462 			temptime.tv_nsec = 1000000000 / hz;
2463 			txdr_nfsv4time(&temptime, tl);
2464 			retnum += NFSX_V4TIME;
2465 			break;
2466 		case NFSATTRBIT_TIMEMETADATA:
2467 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4TIME);
2468 			txdr_nfsv4time(&vap->va_ctime, tl);
2469 			retnum += NFSX_V4TIME;
2470 			break;
2471 		case NFSATTRBIT_TIMEMODIFY:
2472 			NFSM_BUILD(tl, u_int32_t *, NFSX_V4TIME);
2473 			txdr_nfsv4time(&vap->va_mtime, tl);
2474 			retnum += NFSX_V4TIME;
2475 			break;
2476 		case NFSATTRBIT_TIMEMODIFYSET:
2477 			if ((vap->va_vaflags & VA_UTIMES_NULL) == 0) {
2478 				NFSM_BUILD(tl, u_int32_t *, NFSX_V4SETTIME);
2479 				*tl++ = txdr_unsigned(NFSV4SATTRTIME_TOCLIENT);
2480 				txdr_nfsv4time(&vap->va_mtime, tl);
2481 				retnum += NFSX_V4SETTIME;
2482 			} else {
2483 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
2484 				*tl = txdr_unsigned(NFSV4SATTRTIME_TOSERVER);
2485 				retnum += NFSX_UNSIGNED;
2486 			}
2487 			break;
2488 		case NFSATTRBIT_MOUNTEDONFILEID:
2489 			NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER);
2490 			if (at_root != 0)
2491 				uquad = mounted_on_fileno;
2492 			else
2493 				uquad = (u_int64_t)vap->va_fileid;
2494 			txdr_hyper(uquad, tl);
2495 			retnum += NFSX_HYPER;
2496 			break;
2497 		case NFSATTRBIT_SUPPATTREXCLCREAT:
2498 			NFSSETSUPP_ATTRBIT(&attrbits);
2499 			NFSCLRNOTSETABLE_ATTRBIT(&attrbits);
2500 			NFSCLRBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET);
2501 			retnum += nfsrv_putattrbit(nd, &attrbits);
2502 			break;
2503 		default:
2504 			printf("EEK! Bad V4 attribute bitpos=%d\n", bitpos);
2505 		};
2506 	    }
2507 	}
2508 	if (naclp != NULL)
2509 		acl_free(naclp);
2510 	*retnump = txdr_unsigned(retnum);
2511 	return (retnum + prefixnum);
2512 }
2513 
2514 /*
2515  * Put the attribute bits onto an mbuf list.
2516  * Return the number of bytes of output generated.
2517  */
2518 APPLESTATIC int
2519 nfsrv_putattrbit(struct nfsrv_descript *nd, nfsattrbit_t *attrbitp)
2520 {
2521 	u_int32_t *tl;
2522 	int cnt, i, bytesize;
2523 
2524 	for (cnt = NFSATTRBIT_MAXWORDS; cnt > 0; cnt--)
2525 		if (attrbitp->bits[cnt - 1])
2526 			break;
2527 	bytesize = (cnt + 1) * NFSX_UNSIGNED;
2528 	NFSM_BUILD(tl, u_int32_t *, bytesize);
2529 	*tl++ = txdr_unsigned(cnt);
2530 	for (i = 0; i < cnt; i++)
2531 		*tl++ = txdr_unsigned(attrbitp->bits[i]);
2532 	return (bytesize);
2533 }
2534 
2535 /*
2536  * Convert a uid to a string.
2537  * If the lookup fails, just output the digits.
2538  * uid - the user id
2539  * cpp - points to a buffer of size NFSV4_SMALLSTR
2540  *       (malloc a larger one, as required)
2541  * retlenp - pointer to length to be returned
2542  */
2543 APPLESTATIC void
2544 nfsv4_uidtostr(uid_t uid, u_char **cpp, int *retlenp, NFSPROC_T *p)
2545 {
2546 	int i;
2547 	struct nfsusrgrp *usrp;
2548 	u_char *cp = *cpp;
2549 	uid_t tmp;
2550 	int cnt, hasampersand, len = NFSV4_SMALLSTR, ret;
2551 
2552 	cnt = 0;
2553 tryagain:
2554 	NFSLOCKNAMEID();
2555 	if (nfsrv_dnsname) {
2556 		/*
2557 		 * Always map nfsrv_defaultuid to "nobody".
2558 		 */
2559 		if (uid == nfsrv_defaultuid) {
2560 			i = nfsrv_dnsnamelen + 7;
2561 			if (i > len) {
2562 				NFSUNLOCKNAMEID();
2563 				if (len > NFSV4_SMALLSTR)
2564 					free(cp, M_NFSSTRING);
2565 				cp = malloc(i, M_NFSSTRING, M_WAITOK);
2566 				*cpp = cp;
2567 				len = i;
2568 				goto tryagain;
2569 			}
2570 			*retlenp = i;
2571 			NFSBCOPY("nobody@", cp, 7);
2572 			cp += 7;
2573 			NFSBCOPY(nfsrv_dnsname, cp, nfsrv_dnsnamelen);
2574 			NFSUNLOCKNAMEID();
2575 			return;
2576 		}
2577 		hasampersand = 0;
2578 		LIST_FOREACH(usrp, NFSUSERHASH(uid), lug_numhash) {
2579 			if (usrp->lug_uid == uid) {
2580 				if (usrp->lug_expiry < NFSD_MONOSEC)
2581 					break;
2582 				/*
2583 				 * If the name doesn't already have an '@'
2584 				 * in it, append @domainname to it.
2585 				 */
2586 				for (i = 0; i < usrp->lug_namelen; i++) {
2587 					if (usrp->lug_name[i] == '@') {
2588 						hasampersand = 1;
2589 						break;
2590 					}
2591 				}
2592 				if (hasampersand)
2593 					i = usrp->lug_namelen;
2594 				else
2595 					i = usrp->lug_namelen +
2596 					    nfsrv_dnsnamelen + 1;
2597 				if (i > len) {
2598 					NFSUNLOCKNAMEID();
2599 					if (len > NFSV4_SMALLSTR)
2600 						free(cp, M_NFSSTRING);
2601 					cp = malloc(i, M_NFSSTRING, M_WAITOK);
2602 					*cpp = cp;
2603 					len = i;
2604 					goto tryagain;
2605 				}
2606 				*retlenp = i;
2607 				NFSBCOPY(usrp->lug_name, cp, usrp->lug_namelen);
2608 				if (!hasampersand) {
2609 					cp += usrp->lug_namelen;
2610 					*cp++ = '@';
2611 					NFSBCOPY(nfsrv_dnsname, cp, nfsrv_dnsnamelen);
2612 				}
2613 				TAILQ_REMOVE(&nfsuserlruhead, usrp, lug_lru);
2614 				TAILQ_INSERT_TAIL(&nfsuserlruhead, usrp, lug_lru);
2615 				NFSUNLOCKNAMEID();
2616 				return;
2617 			}
2618 		}
2619 		NFSUNLOCKNAMEID();
2620 		cnt++;
2621 		ret = nfsrv_getuser(RPCNFSUSERD_GETUID, uid, (gid_t)0,
2622 		    NULL, p);
2623 		if (ret == 0 && cnt < 2)
2624 			goto tryagain;
2625 	} else {
2626 		NFSUNLOCKNAMEID();
2627 	}
2628 
2629 	/*
2630 	 * No match, just return a string of digits.
2631 	 */
2632 	tmp = uid;
2633 	i = 0;
2634 	while (tmp || i == 0) {
2635 		tmp /= 10;
2636 		i++;
2637 	}
2638 	len = (i > len) ? len : i;
2639 	*retlenp = len;
2640 	cp += (len - 1);
2641 	tmp = uid;
2642 	for (i = 0; i < len; i++) {
2643 		*cp-- = '0' + (tmp % 10);
2644 		tmp /= 10;
2645 	}
2646 	return;
2647 }
2648 
2649 /*
2650  * Convert a string to a uid.
2651  * If no conversion is possible return NFSERR_BADOWNER, otherwise
2652  * return 0.
2653  * If this is called from a client side mount using AUTH_SYS and the
2654  * string is made up entirely of digits, just convert the string to
2655  * a number.
2656  */
2657 APPLESTATIC int
2658 nfsv4_strtouid(struct nfsrv_descript *nd, u_char *str, int len, uid_t *uidp,
2659     NFSPROC_T *p)
2660 {
2661 	int i;
2662 	char *cp, *endstr, *str0;
2663 	struct nfsusrgrp *usrp;
2664 	int cnt, ret;
2665 	int error = 0;
2666 	uid_t tuid;
2667 
2668 	if (len == 0) {
2669 		error = NFSERR_BADOWNER;
2670 		goto out;
2671 	}
2672 	/* If a string of digits and an AUTH_SYS mount, just convert it. */
2673 	str0 = str;
2674 	tuid = (uid_t)strtoul(str0, &endstr, 10);
2675 	if ((endstr - str0) == len) {
2676 		/* A numeric string. */
2677 		if ((nd->nd_flag & ND_KERBV) == 0 &&
2678 		    ((nd->nd_flag & ND_NFSCL) != 0 ||
2679 		      nfsd_enable_stringtouid != 0))
2680 			*uidp = tuid;
2681 		else
2682 			error = NFSERR_BADOWNER;
2683 		goto out;
2684 	}
2685 	/*
2686 	 * Look for an '@'.
2687 	 */
2688 	cp = strchr(str0, '@');
2689 	if (cp != NULL)
2690 		i = (int)(cp++ - str0);
2691 	else
2692 		i = len;
2693 
2694 	cnt = 0;
2695 tryagain:
2696 	NFSLOCKNAMEID();
2697 	/*
2698 	 * If an '@' is found and the domain name matches, search for the name
2699 	 * with dns stripped off.
2700 	 * Mixed case alpahbetics will match for the domain name, but all
2701 	 * upper case will not.
2702 	 */
2703 	if (cnt == 0 && i < len && i > 0 && nfsrv_dnsname &&
2704 	    (len - 1 - i) == nfsrv_dnsnamelen &&
2705 	    !nfsrv_cmpmixedcase(cp, nfsrv_dnsname, nfsrv_dnsnamelen)) {
2706 		len -= (nfsrv_dnsnamelen + 1);
2707 		*(cp - 1) = '\0';
2708 	}
2709 
2710 	/*
2711 	 * Check for the special case of "nobody".
2712 	 */
2713 	if (len == 6 && !NFSBCMP(str, "nobody", 6)) {
2714 		*uidp = nfsrv_defaultuid;
2715 		NFSUNLOCKNAMEID();
2716 		error = 0;
2717 		goto out;
2718 	}
2719 
2720 	LIST_FOREACH(usrp, NFSUSERNAMEHASH(str, len), lug_namehash) {
2721 		if (usrp->lug_namelen == len &&
2722 		    !NFSBCMP(usrp->lug_name, str, len)) {
2723 			if (usrp->lug_expiry < NFSD_MONOSEC)
2724 				break;
2725 			*uidp = usrp->lug_uid;
2726 			TAILQ_REMOVE(&nfsuserlruhead, usrp, lug_lru);
2727 			TAILQ_INSERT_TAIL(&nfsuserlruhead, usrp, lug_lru);
2728 			NFSUNLOCKNAMEID();
2729 			error = 0;
2730 			goto out;
2731 		}
2732 	}
2733 	NFSUNLOCKNAMEID();
2734 	cnt++;
2735 	ret = nfsrv_getuser(RPCNFSUSERD_GETUSER, (uid_t)0, (gid_t)0,
2736 	    str, p);
2737 	if (ret == 0 && cnt < 2)
2738 		goto tryagain;
2739 	error = NFSERR_BADOWNER;
2740 
2741 out:
2742 	NFSEXITCODE(error);
2743 	return (error);
2744 }
2745 
2746 /*
2747  * Convert a gid to a string.
2748  * gid - the group id
2749  * cpp - points to a buffer of size NFSV4_SMALLSTR
2750  *       (malloc a larger one, as required)
2751  * retlenp - pointer to length to be returned
2752  */
2753 APPLESTATIC void
2754 nfsv4_gidtostr(gid_t gid, u_char **cpp, int *retlenp, NFSPROC_T *p)
2755 {
2756 	int i;
2757 	struct nfsusrgrp *usrp;
2758 	u_char *cp = *cpp;
2759 	gid_t tmp;
2760 	int cnt, hasampersand, len = NFSV4_SMALLSTR, ret;
2761 
2762 	cnt = 0;
2763 tryagain:
2764 	NFSLOCKNAMEID();
2765 	if (nfsrv_dnsname) {
2766 		/*
2767 		 * Always map nfsrv_defaultgid to "nogroup".
2768 		 */
2769 		if (gid == nfsrv_defaultgid) {
2770 			i = nfsrv_dnsnamelen + 8;
2771 			if (i > len) {
2772 				NFSUNLOCKNAMEID();
2773 				if (len > NFSV4_SMALLSTR)
2774 					free(cp, M_NFSSTRING);
2775 				cp = malloc(i, M_NFSSTRING, M_WAITOK);
2776 				*cpp = cp;
2777 				len = i;
2778 				goto tryagain;
2779 			}
2780 			*retlenp = i;
2781 			NFSBCOPY("nogroup@", cp, 8);
2782 			cp += 8;
2783 			NFSBCOPY(nfsrv_dnsname, cp, nfsrv_dnsnamelen);
2784 			NFSUNLOCKNAMEID();
2785 			return;
2786 		}
2787 		hasampersand = 0;
2788 		LIST_FOREACH(usrp, NFSGROUPHASH(gid), lug_numhash) {
2789 			if (usrp->lug_gid == gid) {
2790 				if (usrp->lug_expiry < NFSD_MONOSEC)
2791 					break;
2792 				/*
2793 				 * If the name doesn't already have an '@'
2794 				 * in it, append @domainname to it.
2795 				 */
2796 				for (i = 0; i < usrp->lug_namelen; i++) {
2797 					if (usrp->lug_name[i] == '@') {
2798 						hasampersand = 1;
2799 						break;
2800 					}
2801 				}
2802 				if (hasampersand)
2803 					i = usrp->lug_namelen;
2804 				else
2805 					i = usrp->lug_namelen +
2806 					    nfsrv_dnsnamelen + 1;
2807 				if (i > len) {
2808 					NFSUNLOCKNAMEID();
2809 					if (len > NFSV4_SMALLSTR)
2810 						free(cp, M_NFSSTRING);
2811 					cp = malloc(i, M_NFSSTRING, M_WAITOK);
2812 					*cpp = cp;
2813 					len = i;
2814 					goto tryagain;
2815 				}
2816 				*retlenp = i;
2817 				NFSBCOPY(usrp->lug_name, cp, usrp->lug_namelen);
2818 				if (!hasampersand) {
2819 					cp += usrp->lug_namelen;
2820 					*cp++ = '@';
2821 					NFSBCOPY(nfsrv_dnsname, cp, nfsrv_dnsnamelen);
2822 				}
2823 				TAILQ_REMOVE(&nfsuserlruhead, usrp, lug_lru);
2824 				TAILQ_INSERT_TAIL(&nfsuserlruhead, usrp, lug_lru);
2825 				NFSUNLOCKNAMEID();
2826 				return;
2827 			}
2828 		}
2829 		NFSUNLOCKNAMEID();
2830 		cnt++;
2831 		ret = nfsrv_getuser(RPCNFSUSERD_GETGID, (uid_t)0, gid,
2832 		    NULL, p);
2833 		if (ret == 0 && cnt < 2)
2834 			goto tryagain;
2835 	} else {
2836 		NFSUNLOCKNAMEID();
2837 	}
2838 
2839 	/*
2840 	 * No match, just return a string of digits.
2841 	 */
2842 	tmp = gid;
2843 	i = 0;
2844 	while (tmp || i == 0) {
2845 		tmp /= 10;
2846 		i++;
2847 	}
2848 	len = (i > len) ? len : i;
2849 	*retlenp = len;
2850 	cp += (len - 1);
2851 	tmp = gid;
2852 	for (i = 0; i < len; i++) {
2853 		*cp-- = '0' + (tmp % 10);
2854 		tmp /= 10;
2855 	}
2856 	return;
2857 }
2858 
2859 /*
2860  * Convert a string to a gid.
2861  * If no conversion is possible return NFSERR_BADOWNER, otherwise
2862  * return 0.
2863  * If this is called from a client side mount using AUTH_SYS and the
2864  * string is made up entirely of digits, just convert the string to
2865  * a number.
2866  */
2867 APPLESTATIC int
2868 nfsv4_strtogid(struct nfsrv_descript *nd, u_char *str, int len, gid_t *gidp,
2869     NFSPROC_T *p)
2870 {
2871 	int i;
2872 	char *cp, *endstr, *str0;
2873 	struct nfsusrgrp *usrp;
2874 	int cnt, ret;
2875 	int error = 0;
2876 	gid_t tgid;
2877 
2878 	if (len == 0) {
2879 		error =  NFSERR_BADOWNER;
2880 		goto out;
2881 	}
2882 	/* If a string of digits and an AUTH_SYS mount, just convert it. */
2883 	str0 = str;
2884 	tgid = (gid_t)strtoul(str0, &endstr, 10);
2885 	if ((endstr - str0) == len) {
2886 		/* A numeric string. */
2887 		if ((nd->nd_flag & ND_KERBV) == 0 &&
2888 		    ((nd->nd_flag & ND_NFSCL) != 0 ||
2889 		      nfsd_enable_stringtouid != 0))
2890 			*gidp = tgid;
2891 		else
2892 			error = NFSERR_BADOWNER;
2893 		goto out;
2894 	}
2895 	/*
2896 	 * Look for an '@'.
2897 	 */
2898 	cp = strchr(str0, '@');
2899 	if (cp != NULL)
2900 		i = (int)(cp++ - str0);
2901 	else
2902 		i = len;
2903 
2904 	cnt = 0;
2905 tryagain:
2906 	NFSLOCKNAMEID();
2907 	/*
2908 	 * If an '@' is found and the dns name matches, search for the name
2909 	 * with the dns stripped off.
2910 	 */
2911 	if (cnt == 0 && i < len && i > 0 && nfsrv_dnsname &&
2912 	    (len - 1 - i) == nfsrv_dnsnamelen &&
2913 	    !nfsrv_cmpmixedcase(cp, nfsrv_dnsname, nfsrv_dnsnamelen)) {
2914 		len -= (nfsrv_dnsnamelen + 1);
2915 		*(cp - 1) = '\0';
2916 	}
2917 
2918 	/*
2919 	 * Check for the special case of "nogroup".
2920 	 */
2921 	if (len == 7 && !NFSBCMP(str, "nogroup", 7)) {
2922 		*gidp = nfsrv_defaultgid;
2923 		NFSUNLOCKNAMEID();
2924 		error = 0;
2925 		goto out;
2926 	}
2927 
2928 	LIST_FOREACH(usrp, NFSGROUPNAMEHASH(str, len), lug_namehash) {
2929 		if (usrp->lug_namelen == len &&
2930 		    !NFSBCMP(usrp->lug_name, str, len)) {
2931 			if (usrp->lug_expiry < NFSD_MONOSEC)
2932 				break;
2933 			*gidp = usrp->lug_gid;
2934 			TAILQ_REMOVE(&nfsuserlruhead, usrp, lug_lru);
2935 			TAILQ_INSERT_TAIL(&nfsuserlruhead, usrp, lug_lru);
2936 			NFSUNLOCKNAMEID();
2937 			error = 0;
2938 			goto out;
2939 		}
2940 	}
2941 	NFSUNLOCKNAMEID();
2942 	cnt++;
2943 	ret = nfsrv_getuser(RPCNFSUSERD_GETGROUP, (uid_t)0, (gid_t)0,
2944 	    str, p);
2945 	if (ret == 0 && cnt < 2)
2946 		goto tryagain;
2947 	error = NFSERR_BADOWNER;
2948 
2949 out:
2950 	NFSEXITCODE(error);
2951 	return (error);
2952 }
2953 
2954 /*
2955  * Cmp len chars, allowing mixed case in the first argument to match lower
2956  * case in the second, but not if the first argument is all upper case.
2957  * Return 0 for a match, 1 otherwise.
2958  */
2959 static int
2960 nfsrv_cmpmixedcase(u_char *cp, u_char *cp2, int len)
2961 {
2962 	int i;
2963 	u_char tmp;
2964 	int fndlower = 0;
2965 
2966 	for (i = 0; i < len; i++) {
2967 		if (*cp >= 'A' && *cp <= 'Z') {
2968 			tmp = *cp++ + ('a' - 'A');
2969 		} else {
2970 			tmp = *cp++;
2971 			if (tmp >= 'a' && tmp <= 'z')
2972 				fndlower = 1;
2973 		}
2974 		if (tmp != *cp2++)
2975 			return (1);
2976 	}
2977 	if (fndlower)
2978 		return (0);
2979 	else
2980 		return (1);
2981 }
2982 
2983 /*
2984  * Set the port for the nfsuserd.
2985  */
2986 APPLESTATIC int
2987 nfsrv_nfsuserdport(u_short port, NFSPROC_T *p)
2988 {
2989 	struct nfssockreq *rp;
2990 	struct sockaddr_in *ad;
2991 	int error;
2992 
2993 	NFSLOCKNAMEID();
2994 	if (nfsrv_nfsuserd) {
2995 		NFSUNLOCKNAMEID();
2996 		error = EPERM;
2997 		goto out;
2998 	}
2999 	nfsrv_nfsuserd = 1;
3000 	NFSUNLOCKNAMEID();
3001 	/*
3002 	 * Set up the socket record and connect.
3003 	 */
3004 	rp = &nfsrv_nfsuserdsock;
3005 	rp->nr_client = NULL;
3006 	rp->nr_sotype = SOCK_DGRAM;
3007 	rp->nr_soproto = IPPROTO_UDP;
3008 	rp->nr_lock = (NFSR_RESERVEDPORT | NFSR_LOCALHOST);
3009 	rp->nr_cred = NULL;
3010 	NFSSOCKADDRALLOC(rp->nr_nam);
3011 	NFSSOCKADDRSIZE(rp->nr_nam, sizeof (struct sockaddr_in));
3012 	ad = NFSSOCKADDR(rp->nr_nam, struct sockaddr_in *);
3013 	ad->sin_family = AF_INET;
3014 	ad->sin_addr.s_addr = htonl((u_int32_t)0x7f000001);	/* 127.0.0.1 */
3015 	ad->sin_port = port;
3016 	rp->nr_prog = RPCPROG_NFSUSERD;
3017 	rp->nr_vers = RPCNFSUSERD_VERS;
3018 	error = newnfs_connect(NULL, rp, NFSPROCCRED(p), p, 0);
3019 	if (error) {
3020 		NFSSOCKADDRFREE(rp->nr_nam);
3021 		nfsrv_nfsuserd = 0;
3022 	}
3023 out:
3024 	NFSEXITCODE(error);
3025 	return (error);
3026 }
3027 
3028 /*
3029  * Delete the nfsuserd port.
3030  */
3031 APPLESTATIC void
3032 nfsrv_nfsuserddelport(void)
3033 {
3034 
3035 	NFSLOCKNAMEID();
3036 	if (nfsrv_nfsuserd == 0) {
3037 		NFSUNLOCKNAMEID();
3038 		return;
3039 	}
3040 	nfsrv_nfsuserd = 0;
3041 	NFSUNLOCKNAMEID();
3042 	newnfs_disconnect(&nfsrv_nfsuserdsock);
3043 	NFSSOCKADDRFREE(nfsrv_nfsuserdsock.nr_nam);
3044 }
3045 
3046 /*
3047  * Do upcalls to the nfsuserd, for cache misses of the owner/ownergroup
3048  * name<-->id cache.
3049  * Returns 0 upon success, non-zero otherwise.
3050  */
3051 static int
3052 nfsrv_getuser(int procnum, uid_t uid, gid_t gid, char *name, NFSPROC_T *p)
3053 {
3054 	u_int32_t *tl;
3055 	struct nfsrv_descript *nd;
3056 	int len;
3057 	struct nfsrv_descript nfsd;
3058 	struct ucred *cred;
3059 	int error;
3060 
3061 	NFSLOCKNAMEID();
3062 	if (nfsrv_nfsuserd == 0) {
3063 		NFSUNLOCKNAMEID();
3064 		error = EPERM;
3065 		goto out;
3066 	}
3067 	NFSUNLOCKNAMEID();
3068 	nd = &nfsd;
3069 	cred = newnfs_getcred();
3070 	nd->nd_flag = ND_GSSINITREPLY;
3071 	nfsrvd_rephead(nd);
3072 
3073 	nd->nd_procnum = procnum;
3074 	if (procnum == RPCNFSUSERD_GETUID || procnum == RPCNFSUSERD_GETGID) {
3075 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3076 		if (procnum == RPCNFSUSERD_GETUID)
3077 			*tl = txdr_unsigned(uid);
3078 		else
3079 			*tl = txdr_unsigned(gid);
3080 	} else {
3081 		len = strlen(name);
3082 		(void) nfsm_strtom(nd, name, len);
3083 	}
3084 	error = newnfs_request(nd, NULL, NULL, &nfsrv_nfsuserdsock, NULL, NULL,
3085 		cred, RPCPROG_NFSUSERD, RPCNFSUSERD_VERS, NULL, 0, NULL, NULL);
3086 	NFSFREECRED(cred);
3087 	if (!error) {
3088 		mbuf_freem(nd->nd_mrep);
3089 		error = nd->nd_repstat;
3090 	}
3091 out:
3092 	NFSEXITCODE(error);
3093 	return (error);
3094 }
3095 
3096 /*
3097  * This function is called from the nfssvc(2) system call, to update the
3098  * kernel user/group name list(s) for the V4 owner and ownergroup attributes.
3099  */
3100 APPLESTATIC int
3101 nfssvc_idname(struct nfsd_idargs *nidp)
3102 {
3103 	struct nfsusrgrp *nusrp, *usrp, *newusrp;
3104 	struct nfsuserhashhead *hp;
3105 	int i;
3106 	int error = 0;
3107 	u_char *cp;
3108 
3109 	if (nidp->nid_flag & NFSID_INITIALIZE) {
3110 	    cp = (u_char *)malloc(nidp->nid_namelen + 1,
3111 		M_NFSSTRING, M_WAITOK);
3112 	    error = copyin(CAST_USER_ADDR_T(nidp->nid_name), cp,
3113 		nidp->nid_namelen);
3114 	    NFSLOCKNAMEID();
3115 	    if (nfsrv_dnsname) {
3116 		/*
3117 		 * Free up all the old stuff and reinitialize hash lists.
3118 		 */
3119 		TAILQ_FOREACH_SAFE(usrp, &nfsuserlruhead, lug_lru, nusrp) {
3120 			nfsrv_removeuser(usrp);
3121 		}
3122 		free(nfsrv_dnsname, M_NFSSTRING);
3123 		nfsrv_dnsname = NULL;
3124 	    }
3125 	    TAILQ_INIT(&nfsuserlruhead);
3126 	    for (i = 0; i < NFSUSERHASHSIZE; i++)
3127 		LIST_INIT(&nfsuserhash[i]);
3128 	    for (i = 0; i < NFSGROUPHASHSIZE; i++)
3129 		LIST_INIT(&nfsgrouphash[i]);
3130 	    for (i = 0; i < NFSUSERHASHSIZE; i++)
3131 		LIST_INIT(&nfsusernamehash[i]);
3132 	    for (i = 0; i < NFSGROUPHASHSIZE; i++)
3133 		LIST_INIT(&nfsgroupnamehash[i]);
3134 
3135 	    /*
3136 	     * Put name in "DNS" string.
3137 	     */
3138 	    if (!error) {
3139 		nfsrv_dnsname = cp;
3140 		nfsrv_dnsnamelen = nidp->nid_namelen;
3141 		nfsrv_defaultuid = nidp->nid_uid;
3142 		nfsrv_defaultgid = nidp->nid_gid;
3143 		nfsrv_usercnt = 0;
3144 		nfsrv_usermax = nidp->nid_usermax;
3145 	    }
3146 	    NFSUNLOCKNAMEID();
3147 	    if (error)
3148 		free(cp, M_NFSSTRING);
3149 	    goto out;
3150 	}
3151 
3152 	/*
3153 	 * malloc the new one now, so any potential sleep occurs before
3154 	 * manipulation of the lists.
3155 	 */
3156 	MALLOC(newusrp, struct nfsusrgrp *, sizeof (struct nfsusrgrp) +
3157 	    nidp->nid_namelen, M_NFSUSERGROUP, M_WAITOK);
3158 	error = copyin(CAST_USER_ADDR_T(nidp->nid_name), newusrp->lug_name,
3159 	    nidp->nid_namelen);
3160 	if (error) {
3161 		free((caddr_t)newusrp, M_NFSUSERGROUP);
3162 		goto out;
3163 	}
3164 	newusrp->lug_namelen = nidp->nid_namelen;
3165 
3166 	NFSLOCKNAMEID();
3167 	/*
3168 	 * Delete old entries, as required.
3169 	 */
3170 	if (nidp->nid_flag & (NFSID_DELUID | NFSID_ADDUID)) {
3171 		hp = NFSUSERHASH(nidp->nid_uid);
3172 		LIST_FOREACH_SAFE(usrp, hp, lug_numhash, nusrp) {
3173 			if (usrp->lug_uid == nidp->nid_uid)
3174 				nfsrv_removeuser(usrp);
3175 		}
3176 	}
3177 	if (nidp->nid_flag & (NFSID_DELUSERNAME | NFSID_ADDUSERNAME)) {
3178 		hp = NFSUSERNAMEHASH(newusrp->lug_name, newusrp->lug_namelen);
3179 		LIST_FOREACH_SAFE(usrp, hp, lug_namehash, nusrp) {
3180 			if (usrp->lug_namelen == newusrp->lug_namelen &&
3181 			    !NFSBCMP(usrp->lug_name, newusrp->lug_name,
3182 			    usrp->lug_namelen))
3183 				nfsrv_removeuser(usrp);
3184 		}
3185 	}
3186 	if (nidp->nid_flag & (NFSID_DELGID | NFSID_ADDGID)) {
3187 		hp = NFSGROUPHASH(nidp->nid_gid);
3188 		LIST_FOREACH_SAFE(usrp, hp, lug_numhash, nusrp) {
3189 			if (usrp->lug_gid == nidp->nid_gid)
3190 				nfsrv_removeuser(usrp);
3191 		}
3192 	}
3193 	if (nidp->nid_flag & (NFSID_DELGROUPNAME | NFSID_ADDGROUPNAME)) {
3194 		hp = NFSGROUPNAMEHASH(newusrp->lug_name, newusrp->lug_namelen);
3195 		LIST_FOREACH_SAFE(usrp, hp, lug_namehash, nusrp) {
3196 			if (usrp->lug_namelen == newusrp->lug_namelen &&
3197 			    !NFSBCMP(usrp->lug_name, newusrp->lug_name,
3198 			    usrp->lug_namelen))
3199 				nfsrv_removeuser(usrp);
3200 		}
3201 	}
3202 	TAILQ_FOREACH_SAFE(usrp, &nfsuserlruhead, lug_lru, nusrp) {
3203 		if (usrp->lug_expiry < NFSD_MONOSEC)
3204 			nfsrv_removeuser(usrp);
3205 	}
3206 	while (nfsrv_usercnt >= nfsrv_usermax) {
3207 		usrp = TAILQ_FIRST(&nfsuserlruhead);
3208 		nfsrv_removeuser(usrp);
3209 	}
3210 
3211 	/*
3212 	 * Now, we can add the new one.
3213 	 */
3214 	if (nidp->nid_usertimeout)
3215 		newusrp->lug_expiry = NFSD_MONOSEC + nidp->nid_usertimeout;
3216 	else
3217 		newusrp->lug_expiry = NFSD_MONOSEC + 5;
3218 	if (nidp->nid_flag & (NFSID_ADDUID | NFSID_ADDUSERNAME)) {
3219 		newusrp->lug_uid = nidp->nid_uid;
3220 		LIST_INSERT_HEAD(NFSUSERHASH(newusrp->lug_uid), newusrp,
3221 		    lug_numhash);
3222 		LIST_INSERT_HEAD(NFSUSERNAMEHASH(newusrp->lug_name,
3223 		    newusrp->lug_namelen), newusrp, lug_namehash);
3224 		TAILQ_INSERT_TAIL(&nfsuserlruhead, newusrp, lug_lru);
3225 		nfsrv_usercnt++;
3226 	} else if (nidp->nid_flag & (NFSID_ADDGID | NFSID_ADDGROUPNAME)) {
3227 		newusrp->lug_gid = nidp->nid_gid;
3228 		LIST_INSERT_HEAD(NFSGROUPHASH(newusrp->lug_gid), newusrp,
3229 		    lug_numhash);
3230 		LIST_INSERT_HEAD(NFSGROUPNAMEHASH(newusrp->lug_name,
3231 		    newusrp->lug_namelen), newusrp, lug_namehash);
3232 		TAILQ_INSERT_TAIL(&nfsuserlruhead, newusrp, lug_lru);
3233 		nfsrv_usercnt++;
3234 	} else
3235 		FREE((caddr_t)newusrp, M_NFSUSERGROUP);
3236 	NFSUNLOCKNAMEID();
3237 out:
3238 	NFSEXITCODE(error);
3239 	return (error);
3240 }
3241 
3242 /*
3243  * Remove a user/group name element.
3244  */
3245 static void
3246 nfsrv_removeuser(struct nfsusrgrp *usrp)
3247 {
3248 
3249 	NFSNAMEIDREQUIRED();
3250 	LIST_REMOVE(usrp, lug_numhash);
3251 	LIST_REMOVE(usrp, lug_namehash);
3252 	TAILQ_REMOVE(&nfsuserlruhead, usrp, lug_lru);
3253 	nfsrv_usercnt--;
3254 	FREE((caddr_t)usrp, M_NFSUSERGROUP);
3255 }
3256 
3257 /*
3258  * This function scans a byte string and checks for UTF-8 compliance.
3259  * It returns 0 if it conforms and NFSERR_INVAL if not.
3260  */
3261 APPLESTATIC int
3262 nfsrv_checkutf8(u_int8_t *cp, int len)
3263 {
3264 	u_int32_t val = 0x0;
3265 	int cnt = 0, gotd = 0, shift = 0;
3266 	u_int8_t byte;
3267 	static int utf8_shift[5] = { 7, 11, 16, 21, 26 };
3268 	int error = 0;
3269 
3270 	/*
3271 	 * Here are what the variables are used for:
3272 	 * val - the calculated value of a multibyte char, used to check
3273 	 *       that it was coded with the correct range
3274 	 * cnt - the number of 10xxxxxx bytes to follow
3275 	 * gotd - set for a char of Dxxx, so D800<->DFFF can be checked for
3276 	 * shift - lower order bits of range (ie. "val >> shift" should
3277 	 *       not be 0, in other words, dividing by the lower bound
3278 	 *       of the range should get a non-zero value)
3279 	 * byte - used to calculate cnt
3280 	 */
3281 	while (len > 0) {
3282 		if (cnt > 0) {
3283 			/* This handles the 10xxxxxx bytes */
3284 			if ((*cp & 0xc0) != 0x80 ||
3285 			    (gotd && (*cp & 0x20))) {
3286 				error = NFSERR_INVAL;
3287 				goto out;
3288 			}
3289 			gotd = 0;
3290 			val <<= 6;
3291 			val |= (*cp & 0x3f);
3292 			cnt--;
3293 			if (cnt == 0 && (val >> shift) == 0x0) {
3294 				error = NFSERR_INVAL;
3295 				goto out;
3296 			}
3297 		} else if (*cp & 0x80) {
3298 			/* first byte of multi byte char */
3299 			byte = *cp;
3300 			while ((byte & 0x40) && cnt < 6) {
3301 				cnt++;
3302 				byte <<= 1;
3303 			}
3304 			if (cnt == 0 || cnt == 6) {
3305 				error = NFSERR_INVAL;
3306 				goto out;
3307 			}
3308 			val = (*cp & (0x3f >> cnt));
3309 			shift = utf8_shift[cnt - 1];
3310 			if (cnt == 2 && val == 0xd)
3311 				/* Check for the 0xd800-0xdfff case */
3312 				gotd = 1;
3313 		}
3314 		cp++;
3315 		len--;
3316 	}
3317 	if (cnt > 0)
3318 		error = NFSERR_INVAL;
3319 
3320 out:
3321 	NFSEXITCODE(error);
3322 	return (error);
3323 }
3324 
3325 /*
3326  * Parse the xdr for an NFSv4 FsLocations attribute. Return two malloc'd
3327  * strings, one with the root path in it and the other with the list of
3328  * locations. The list is in the same format as is found in nfr_refs.
3329  * It is a "," separated list of entries, where each of them is of the
3330  * form <server>:<rootpath>. For example
3331  * "nfsv4-test:/sub2,nfsv4-test2:/user/mnt,nfsv4-test2:/user/mnt2"
3332  * The nilp argument is set to 1 for the special case of a null fs_root
3333  * and an empty server list.
3334  * It returns NFSERR_BADXDR, if the xdr can't be parsed and returns the
3335  * number of xdr bytes parsed in sump.
3336  */
3337 static int
3338 nfsrv_getrefstr(struct nfsrv_descript *nd, u_char **fsrootp, u_char **srvp,
3339     int *sump, int *nilp)
3340 {
3341 	u_int32_t *tl;
3342 	u_char *cp = NULL, *cp2 = NULL, *cp3, *str;
3343 	int i, j, len, stringlen, cnt, slen, siz, xdrsum, error = 0, nsrv;
3344 	struct list {
3345 		SLIST_ENTRY(list) next;
3346 		int len;
3347 		u_char host[1];
3348 	} *lsp, *nlsp;
3349 	SLIST_HEAD(, list) head;
3350 
3351 	*fsrootp = NULL;
3352 	*srvp = NULL;
3353 	*nilp = 0;
3354 
3355 	/*
3356 	 * Get the fs_root path and check for the special case of null path
3357 	 * and 0 length server list.
3358 	 */
3359 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3360 	len = fxdr_unsigned(int, *tl);
3361 	if (len < 0 || len > 10240) {
3362 		error = NFSERR_BADXDR;
3363 		goto nfsmout;
3364 	}
3365 	if (len == 0) {
3366 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3367 		if (*tl != 0) {
3368 			error = NFSERR_BADXDR;
3369 			goto nfsmout;
3370 		}
3371 		*nilp = 1;
3372 		*sump = 2 * NFSX_UNSIGNED;
3373 		error = 0;
3374 		goto nfsmout;
3375 	}
3376 	cp = malloc(len + 1, M_NFSSTRING, M_WAITOK);
3377 	error = nfsrv_mtostr(nd, cp, len);
3378 	if (!error) {
3379 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3380 		cnt = fxdr_unsigned(int, *tl);
3381 		if (cnt <= 0)
3382 			error = NFSERR_BADXDR;
3383 	}
3384 	if (error)
3385 		goto nfsmout;
3386 
3387 	/*
3388 	 * Now, loop through the location list and make up the srvlist.
3389 	 */
3390 	xdrsum = (2 * NFSX_UNSIGNED) + NFSM_RNDUP(len);
3391 	cp2 = cp3 = malloc(1024, M_NFSSTRING, M_WAITOK);
3392 	slen = 1024;
3393 	siz = 0;
3394 	for (i = 0; i < cnt; i++) {
3395 		SLIST_INIT(&head);
3396 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3397 		nsrv = fxdr_unsigned(int, *tl);
3398 		if (nsrv <= 0) {
3399 			error = NFSERR_BADXDR;
3400 			goto nfsmout;
3401 		}
3402 
3403 		/*
3404 		 * Handle the first server by putting it in the srvstr.
3405 		 */
3406 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3407 		len = fxdr_unsigned(int, *tl);
3408 		if (len <= 0 || len > 1024) {
3409 			error = NFSERR_BADXDR;
3410 			goto nfsmout;
3411 		}
3412 		nfsrv_refstrbigenough(siz + len + 3, &cp2, &cp3, &slen);
3413 		if (cp3 != cp2) {
3414 			*cp3++ = ',';
3415 			siz++;
3416 		}
3417 		error = nfsrv_mtostr(nd, cp3, len);
3418 		if (error)
3419 			goto nfsmout;
3420 		cp3 += len;
3421 		*cp3++ = ':';
3422 		siz += (len + 1);
3423 		xdrsum += (2 * NFSX_UNSIGNED) + NFSM_RNDUP(len);
3424 		for (j = 1; j < nsrv; j++) {
3425 			/*
3426 			 * Yuck, put them in an slist and process them later.
3427 			 */
3428 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3429 			len = fxdr_unsigned(int, *tl);
3430 			if (len <= 0 || len > 1024) {
3431 				error = NFSERR_BADXDR;
3432 				goto nfsmout;
3433 			}
3434 			lsp = (struct list *)malloc(sizeof (struct list)
3435 			    + len, M_TEMP, M_WAITOK);
3436 			error = nfsrv_mtostr(nd, lsp->host, len);
3437 			if (error)
3438 				goto nfsmout;
3439 			xdrsum += NFSX_UNSIGNED + NFSM_RNDUP(len);
3440 			lsp->len = len;
3441 			SLIST_INSERT_HEAD(&head, lsp, next);
3442 		}
3443 
3444 		/*
3445 		 * Finally, we can get the path.
3446 		 */
3447 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3448 		len = fxdr_unsigned(int, *tl);
3449 		if (len <= 0 || len > 1024) {
3450 			error = NFSERR_BADXDR;
3451 			goto nfsmout;
3452 		}
3453 		nfsrv_refstrbigenough(siz + len + 1, &cp2, &cp3, &slen);
3454 		error = nfsrv_mtostr(nd, cp3, len);
3455 		if (error)
3456 			goto nfsmout;
3457 		xdrsum += NFSX_UNSIGNED + NFSM_RNDUP(len);
3458 		str = cp3;
3459 		stringlen = len;
3460 		cp3 += len;
3461 		siz += len;
3462 		SLIST_FOREACH_SAFE(lsp, &head, next, nlsp) {
3463 			nfsrv_refstrbigenough(siz + lsp->len + stringlen + 3,
3464 			    &cp2, &cp3, &slen);
3465 			*cp3++ = ',';
3466 			NFSBCOPY(lsp->host, cp3, lsp->len);
3467 			cp3 += lsp->len;
3468 			*cp3++ = ':';
3469 			NFSBCOPY(str, cp3, stringlen);
3470 			cp3 += stringlen;
3471 			*cp3 = '\0';
3472 			siz += (lsp->len + stringlen + 2);
3473 			free((caddr_t)lsp, M_TEMP);
3474 		}
3475 	}
3476 	*fsrootp = cp;
3477 	*srvp = cp2;
3478 	*sump = xdrsum;
3479 	NFSEXITCODE2(0, nd);
3480 	return (0);
3481 nfsmout:
3482 	if (cp != NULL)
3483 		free(cp, M_NFSSTRING);
3484 	if (cp2 != NULL)
3485 		free(cp2, M_NFSSTRING);
3486 	NFSEXITCODE2(error, nd);
3487 	return (error);
3488 }
3489 
3490 /*
3491  * Make the malloc'd space large enough. This is a pain, but the xdr
3492  * doesn't set an upper bound on the side, so...
3493  */
3494 static void
3495 nfsrv_refstrbigenough(int siz, u_char **cpp, u_char **cpp2, int *slenp)
3496 {
3497 	u_char *cp;
3498 	int i;
3499 
3500 	if (siz <= *slenp)
3501 		return;
3502 	cp = malloc(siz + 1024, M_NFSSTRING, M_WAITOK);
3503 	NFSBCOPY(*cpp, cp, *slenp);
3504 	free(*cpp, M_NFSSTRING);
3505 	i = *cpp2 - *cpp;
3506 	*cpp = cp;
3507 	*cpp2 = cp + i;
3508 	*slenp = siz + 1024;
3509 }
3510 
3511 /*
3512  * Initialize the reply header data structures.
3513  */
3514 APPLESTATIC void
3515 nfsrvd_rephead(struct nfsrv_descript *nd)
3516 {
3517 	mbuf_t mreq;
3518 
3519 	/*
3520 	 * If this is a big reply, use a cluster.
3521 	 */
3522 	if ((nd->nd_flag & ND_GSSINITREPLY) == 0 &&
3523 	    nfs_bigreply[nd->nd_procnum]) {
3524 		NFSMCLGET(mreq, M_WAITOK);
3525 		nd->nd_mreq = mreq;
3526 		nd->nd_mb = mreq;
3527 	} else {
3528 		NFSMGET(mreq);
3529 		nd->nd_mreq = mreq;
3530 		nd->nd_mb = mreq;
3531 	}
3532 	nd->nd_bpos = NFSMTOD(mreq, caddr_t);
3533 	mbuf_setlen(mreq, 0);
3534 
3535 	if ((nd->nd_flag & ND_GSSINITREPLY) == 0)
3536 		NFSM_BUILD(nd->nd_errp, int *, NFSX_UNSIGNED);
3537 }
3538 
3539 /*
3540  * Lock a socket against others.
3541  * Currently used to serialize connect/disconnect attempts.
3542  */
3543 int
3544 newnfs_sndlock(int *flagp)
3545 {
3546 	struct timespec ts;
3547 
3548 	NFSLOCKSOCK();
3549 	while (*flagp & NFSR_SNDLOCK) {
3550 		*flagp |= NFSR_WANTSND;
3551 		ts.tv_sec = 0;
3552 		ts.tv_nsec = 0;
3553 		(void) nfsmsleep((caddr_t)flagp, NFSSOCKMUTEXPTR,
3554 		    PZERO - 1, "nfsndlck", &ts);
3555 	}
3556 	*flagp |= NFSR_SNDLOCK;
3557 	NFSUNLOCKSOCK();
3558 	return (0);
3559 }
3560 
3561 /*
3562  * Unlock the stream socket for others.
3563  */
3564 void
3565 newnfs_sndunlock(int *flagp)
3566 {
3567 
3568 	NFSLOCKSOCK();
3569 	if ((*flagp & NFSR_SNDLOCK) == 0)
3570 		panic("nfs sndunlock");
3571 	*flagp &= ~NFSR_SNDLOCK;
3572 	if (*flagp & NFSR_WANTSND) {
3573 		*flagp &= ~NFSR_WANTSND;
3574 		wakeup((caddr_t)flagp);
3575 	}
3576 	NFSUNLOCKSOCK();
3577 }
3578 
3579 APPLESTATIC int
3580 nfsv4_getipaddr(struct nfsrv_descript *nd, struct sockaddr_storage *sa,
3581     int *isudp)
3582 {
3583 	struct sockaddr_in *sad;
3584 	struct sockaddr_in6 *sad6;
3585 	struct in_addr saddr;
3586 	uint32_t portnum, *tl;
3587 	int af = 0, i, j, k;
3588 	char addr[64], protocol[5], *cp;
3589 	int cantparse = 0, error = 0;
3590 	uint16_t portv;
3591 
3592 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3593 	i = fxdr_unsigned(int, *tl);
3594 	if (i >= 3 && i <= 4) {
3595 		error = nfsrv_mtostr(nd, protocol, i);
3596 		if (error)
3597 			goto nfsmout;
3598 		if (strcmp(protocol, "tcp") == 0) {
3599 			af = AF_INET;
3600 			*isudp = 0;
3601 		} else if (strcmp(protocol, "udp") == 0) {
3602 			af = AF_INET;
3603 			*isudp = 1;
3604 		} else if (strcmp(protocol, "tcp6") == 0) {
3605 			af = AF_INET6;
3606 			*isudp = 0;
3607 		} else if (strcmp(protocol, "udp6") == 0) {
3608 			af = AF_INET6;
3609 			*isudp = 1;
3610 		} else
3611 			cantparse = 1;
3612 	} else {
3613 		cantparse = 1;
3614 		if (i > 0) {
3615 			error = nfsm_advance(nd, NFSM_RNDUP(i), -1);
3616 			if (error)
3617 				goto nfsmout;
3618 		}
3619 	}
3620 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3621 	i = fxdr_unsigned(int, *tl);
3622 	if (i < 0) {
3623 		error = NFSERR_BADXDR;
3624 		goto nfsmout;
3625 	} else if (cantparse == 0 && i >= 11 && i < 64) {
3626 		/*
3627 		 * The shortest address is 11chars and the longest is < 64.
3628 		 */
3629 		error = nfsrv_mtostr(nd, addr, i);
3630 		if (error)
3631 			goto nfsmout;
3632 
3633 		/* Find the port# at the end and extract that. */
3634 		i = strlen(addr);
3635 		k = 0;
3636 		cp = &addr[i - 1];
3637 		/* Count back two '.'s from end to get port# field. */
3638 		for (j = 0; j < i; j++) {
3639 			if (*cp == '.') {
3640 				k++;
3641 				if (k == 2)
3642 					break;
3643 			}
3644 			cp--;
3645 		}
3646 		if (k == 2) {
3647 			/*
3648 			 * The NFSv4 port# is appended as .N.N, where N is
3649 			 * a decimal # in the range 0-255, just like an inet4
3650 			 * address. Cheat and use inet_aton(), which will
3651 			 * return a Class A address and then shift the high
3652 			 * order 8bits over to convert it to the port#.
3653 			 */
3654 			*cp++ = '\0';
3655 			if (inet_aton(cp, &saddr) == 1) {
3656 				portnum = ntohl(saddr.s_addr);
3657 				portv = (uint16_t)((portnum >> 16) |
3658 				    (portnum & 0xff));
3659 			} else
3660 				cantparse = 1;
3661 		} else
3662 			cantparse = 1;
3663 		if (cantparse == 0) {
3664 			if (af == AF_INET) {
3665 				sad = (struct sockaddr_in *)sa;
3666 				if (inet_pton(af, addr, &sad->sin_addr) == 1) {
3667 					sad->sin_len = sizeof(*sad);
3668 					sad->sin_family = AF_INET;
3669 					sad->sin_port = htons(portv);
3670 					return (0);
3671 				}
3672 			} else {
3673 				sad6 = (struct sockaddr_in6 *)sa;
3674 				if (inet_pton(af, addr, &sad6->sin6_addr)
3675 				    == 1) {
3676 					sad6->sin6_len = sizeof(*sad6);
3677 					sad6->sin6_family = AF_INET6;
3678 					sad6->sin6_port = htons(portv);
3679 					return (0);
3680 				}
3681 			}
3682 		}
3683 	} else {
3684 		if (i > 0) {
3685 			error = nfsm_advance(nd, NFSM_RNDUP(i), -1);
3686 			if (error)
3687 				goto nfsmout;
3688 		}
3689 	}
3690 	error = EPERM;
3691 nfsmout:
3692 	return (error);
3693 }
3694 
3695 /*
3696  * Handle an NFSv4.1 Sequence request for the session.
3697  * If reply != NULL, use it to return the cached reply, as required.
3698  * The client gets a cached reply via this call for callbacks, however the
3699  * server gets a cached reply via the nfsv4_seqsess_cachereply() call.
3700  */
3701 int
3702 nfsv4_seqsession(uint32_t seqid, uint32_t slotid, uint32_t highslot,
3703     struct nfsslot *slots, struct mbuf **reply, uint16_t maxslot)
3704 {
3705 	int error;
3706 
3707 	error = 0;
3708 	if (reply != NULL)
3709 		*reply = NULL;
3710 	if (slotid > maxslot)
3711 		return (NFSERR_BADSLOT);
3712 	if (seqid == slots[slotid].nfssl_seq) {
3713 		/* A retry. */
3714 		if (slots[slotid].nfssl_inprog != 0)
3715 			error = NFSERR_DELAY;
3716 		else if (slots[slotid].nfssl_reply != NULL) {
3717 			if (reply != NULL) {
3718 				*reply = slots[slotid].nfssl_reply;
3719 				slots[slotid].nfssl_reply = NULL;
3720 			}
3721 			slots[slotid].nfssl_inprog = 1;
3722 			error = NFSERR_REPLYFROMCACHE;
3723 		} else
3724 			/* No reply cached, so just do it. */
3725 			slots[slotid].nfssl_inprog = 1;
3726 	} else if ((slots[slotid].nfssl_seq + 1) == seqid) {
3727 		if (slots[slotid].nfssl_reply != NULL)
3728 			m_freem(slots[slotid].nfssl_reply);
3729 		slots[slotid].nfssl_reply = NULL;
3730 		slots[slotid].nfssl_inprog = 1;
3731 		slots[slotid].nfssl_seq++;
3732 	} else
3733 		error = NFSERR_SEQMISORDERED;
3734 	return (error);
3735 }
3736 
3737 /*
3738  * Cache this reply for the slot.
3739  * Use the "rep" argument to return the cached reply if repstat is set to
3740  * NFSERR_REPLYFROMCACHE. The client never sets repstat to this value.
3741  */
3742 void
3743 nfsv4_seqsess_cacherep(uint32_t slotid, struct nfsslot *slots, int repstat,
3744    struct mbuf **rep)
3745 {
3746 
3747 	if (repstat == NFSERR_REPLYFROMCACHE) {
3748 		*rep = slots[slotid].nfssl_reply;
3749 		slots[slotid].nfssl_reply = NULL;
3750 	} else {
3751 		if (slots[slotid].nfssl_reply != NULL)
3752 			m_freem(slots[slotid].nfssl_reply);
3753 		slots[slotid].nfssl_reply = *rep;
3754 	}
3755 	slots[slotid].nfssl_inprog = 0;
3756 }
3757 
3758 /*
3759  * Generate the xdr for an NFSv4.1 Sequence Operation.
3760  */
3761 APPLESTATIC void
3762 nfsv4_setsequence(struct nfsmount *nmp, struct nfsrv_descript *nd,
3763     struct nfsclsession *sep, int dont_replycache)
3764 {
3765 	uint32_t *tl, slotseq = 0;
3766 	int error, maxslot, slotpos;
3767 	uint8_t sessionid[NFSX_V4SESSIONID];
3768 
3769 	error = nfsv4_sequencelookup(nmp, sep, &slotpos, &maxslot, &slotseq,
3770 	    sessionid);
3771 	if (error != 0)
3772 		return;
3773 	KASSERT(maxslot >= 0, ("nfscl_setsequence neg maxslot"));
3774 
3775 	/* Build the Sequence arguments. */
3776 	NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID + 4 * NFSX_UNSIGNED);
3777 	bcopy(sessionid, tl, NFSX_V4SESSIONID);
3778 	tl += NFSX_V4SESSIONID / NFSX_UNSIGNED;
3779 	nd->nd_slotseq = tl;
3780 	*tl++ = txdr_unsigned(slotseq);
3781 	*tl++ = txdr_unsigned(slotpos);
3782 	*tl++ = txdr_unsigned(maxslot);
3783 	if (dont_replycache == 0)
3784 		*tl = newnfs_true;
3785 	else
3786 		*tl = newnfs_false;
3787 	nd->nd_flag |= ND_HASSEQUENCE;
3788 }
3789 
3790 int
3791 nfsv4_sequencelookup(struct nfsmount *nmp, struct nfsclsession *sep,
3792     int *slotposp, int *maxslotp, uint32_t *slotseqp, uint8_t *sessionid)
3793 {
3794 	int i, maxslot, slotpos;
3795 	uint64_t bitval;
3796 
3797 	/* Find an unused slot. */
3798 	slotpos = -1;
3799 	maxslot = -1;
3800 	mtx_lock(&sep->nfsess_mtx);
3801 	do {
3802 		bitval = 1;
3803 		for (i = 0; i < sep->nfsess_foreslots; i++) {
3804 			if ((bitval & sep->nfsess_slots) == 0) {
3805 				slotpos = i;
3806 				sep->nfsess_slots |= bitval;
3807 				sep->nfsess_slotseq[i]++;
3808 				*slotseqp = sep->nfsess_slotseq[i];
3809 				break;
3810 			}
3811 			bitval <<= 1;
3812 		}
3813 		if (slotpos == -1) {
3814 			/*
3815 			 * If a forced dismount is in progress, just return.
3816 			 * This RPC attempt will fail when it calls
3817 			 * newnfs_request().
3818 			 */
3819 			if (nmp != NULL &&
3820 			    (nmp->nm_mountp->mnt_kern_flag & MNTK_UNMOUNTF)
3821 			    != 0) {
3822 				mtx_unlock(&sep->nfsess_mtx);
3823 				return (ESTALE);
3824 			}
3825 			/* Wake up once/sec, to check for a forced dismount. */
3826 			(void)mtx_sleep(&sep->nfsess_slots, &sep->nfsess_mtx,
3827 			    PZERO, "nfsclseq", hz);
3828 		}
3829 	} while (slotpos == -1);
3830 	/* Now, find the highest slot in use. (nfsc_slots is 64bits) */
3831 	bitval = 1;
3832 	for (i = 0; i < 64; i++) {
3833 		if ((bitval & sep->nfsess_slots) != 0)
3834 			maxslot = i;
3835 		bitval <<= 1;
3836 	}
3837 	bcopy(sep->nfsess_sessionid, sessionid, NFSX_V4SESSIONID);
3838 	mtx_unlock(&sep->nfsess_mtx);
3839 	*slotposp = slotpos;
3840 	*maxslotp = maxslot;
3841 	return (0);
3842 }
3843 
3844 /*
3845  * Free a session slot.
3846  */
3847 APPLESTATIC void
3848 nfsv4_freeslot(struct nfsclsession *sep, int slot)
3849 {
3850 	uint64_t bitval;
3851 
3852 	bitval = 1;
3853 	if (slot > 0)
3854 		bitval <<= slot;
3855 	mtx_lock(&sep->nfsess_mtx);
3856 	if ((bitval & sep->nfsess_slots) == 0)
3857 		printf("freeing free slot!!\n");
3858 	sep->nfsess_slots &= ~bitval;
3859 	wakeup(&sep->nfsess_slots);
3860 	mtx_unlock(&sep->nfsess_mtx);
3861 }
3862 
3863