OPENAFS-SA-2016-002 AFSStoreStatus information leak
[openafs.git] / src / WINNT / afsd / cm_dcache.c
index 73d455f..cd73158 100644 (file)
@@ -22,6 +22,7 @@
 #include <osi.h>
 
 #include "afsd.h"
+#include "smb.h"
 
 #ifdef DEBUG
 extern void afsi_log(char *pattern, ...);
@@ -33,27 +34,22 @@ extern osi_mutex_t cm_Freelance_Lock;
 
 #define USE_RX_IOVEC 1
 
-/* we can access connp->serverp without holding a lock because that
-   never changes since the connection is made. */
-#define SERVERHAS64BIT(connp) (!((connp)->serverp->flags & CM_SERVERFLAG_NO64BIT))
-#define SET_SERVERHASNO64BIT(connp) (cm_SetServerNo64Bit((connp)->serverp, TRUE))
-
 /* functions called back from the buffer package when reading or writing data,
  * or when holding or releasing a vnode pointer.
  */
 long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
                  cm_user_t *userp, cm_req_t *reqp)
 {
-    /* store the data back from this buffer; the buffer is locked and held,
-     * but the vnode involved isn't locked, yet.  It is held by its
-     * reference from the buffer, which won't change until the buffer is
-     * released by our caller.  Thus, we don't have to worry about holding
-     * bufp->scp.
+    /*
+     * store the data back from this buffer; the buffer is locked and held,
+     * but the vnode involved may or may not be locked depending on whether
+     * or not the CM_BUF_WRITE_SCP_LOCKED flag is set.
      */
-    long code, code1;
+    long code;
     cm_scache_t *scp = vscp;
     afs_int32 nbytes;
     afs_int32 save_nbytes;
+    cm_scache_t save_scache;
     long temp;
     AFSFetchStatus outStatus;
     AFSStoreStatus inStatus;
@@ -72,13 +68,15 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
     int require_64bit_ops = 0;
     int call_was_64bit = 0;
     int scp_locked = flags & CM_BUF_WRITE_SCP_LOCKED;
+    int storedata_excl = 0;
 
     osi_assertx(userp != NULL, "null cm_user_t");
     osi_assertx(scp != NULL, "null cm_scache_t");
 
     memset(&volSync, 0, sizeof(volSync));
 
-    /* now, the buffer may or may not be filled with good data (buf_GetNewLocked
+    /*
+     * now, the buffer may or may not be filled with good data (buf_GetNewLocked
      * drops lots of locks, and may indeed return a properly initialized
      * buffer, although more likely it will just return a new, empty, buffer.
      */
@@ -94,6 +92,7 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
 
     /* Serialize StoreData RPC's; for rationale see cm_scache.c */
     (void) cm_SyncOp(scp, NULL, userp, reqp, 0, CM_SCACHESYNC_STOREDATA_EXCL);
+    storedata_excl = 1;
 
     code = cm_SetupStoreBIOD(scp, offsetp, length, &biod, userp, reqp);
     if (code) {
@@ -107,10 +106,8 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
     if (biod.length == 0) {
         osi_Log0(afsd_logp, "cm_SetupStoreBIOD length 0");
         cm_ReleaseBIOD(&biod, 1, 0, 1);        /* should be a NOOP */
-        cm_SyncOpDone(scp, NULL, CM_SCACHESYNC_STOREDATA_EXCL);
-        if (!scp_locked)
-            lock_ReleaseWrite(&scp->rw);
-        return 0;
+        code = 0;
+        goto exit_storedata_excl;
     }
 
     /* prepare the output status for the store */
@@ -151,10 +148,14 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
         require_64bit_ops = 1;
     }
 
+    /* now we're ready to do the store operation */
+  retry_rpc:
+    InterlockedIncrement(&scp->activeRPCs);
     lock_ReleaseWrite(&scp->rw);
 
-    /* now we're ready to do the store operation */
     save_nbytes = nbytes;
+    save_scache = *scp;
+
     do {
         code = cm_ConnFromFID(&scp->fid, userp, reqp, &connp);
         if (code)
@@ -273,7 +274,7 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
                 temp = rx_Writev(rxcallp, tiov, tnio, vbytes);
                 if (temp != vbytes) {
                     osi_Log3(afsd_logp, "rx_Writev failed bp 0x%p, %d != %d", bufp, temp, vbytes);
-                    code = (rxcallp->error < 0) ? rxcallp->error : RX_PROTOCOL_ERROR;
+                    code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
                     break;
                 }
 
@@ -307,6 +308,36 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
                 }
                 nbytes -= wbytes;
 #endif /* USE_RX_IOVEC */
+
+                /*
+                 * Rx supports an out of band signalling mechanism that permits
+                 * RPC specific status information to be communicated in the
+                 * reverse direction of the channel.  For RXAFS_StoreData, the
+                 * 0-bit is set once all of the permission checks have completed
+                 * and the volume/vnode locks have been obtained by the file
+                 * server.  The signal is intended to notify the Unix afs client
+                 * that is performing store-on-close that it is safe to permit
+                 * the close operation to complete while the store continues
+                 * in the background.  All of the callbacks have been broken
+                 * and the locks will not be dropped until the RPC completes
+                 * which prevents any other operation from being initiated on
+                 * the vnode until the store is finished.
+                 *
+                 * The Windows client does not perform store-on-close.  Instead
+                 * it uses the CM_SCACHESYNC_STOREDATA_EXCL request flag and
+                 * CM_SCACHEFLAG_DATASTORING scache state to ensure that store
+                 * operations are serialized.  The 0-bit signal permits the
+                 * CM_SCACHEFLAG_DATASTORING state to the dropped which in
+                 * turn permits another thread to prep its own BIOD in parallel.
+                 * This is safe because it is impossible for that second store
+                 * RPC to complete before this one does.
+                 */
+                if ( storedata_excl && (rx_GetRemoteStatus(rxcallp) & 1)) {
+                    lock_ObtainWrite(&scp->rw);
+                    cm_SyncOpDone(scp, NULL, CM_SCACHESYNC_STOREDATA_EXCL);
+                    lock_ReleaseWrite(&scp->rw);
+                    storedata_excl = 0;
+                }
             }  /* while more bytes to write */
         }      /* if RPC started successfully */
 
@@ -326,19 +357,17 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
             }
         }
 
-        code1 = rx_EndCall(rxcallp, code);
+        /* Prefer rx_EndCall error over StoreData error. Note that this will
+        * never set 'code' to 0 if we passed in a non-zero code. */
+        code = rx_EndCall(rxcallp, code);
 
-        if ((code == RXGEN_OPCODE || code1 == RXGEN_OPCODE) && SERVERHAS64BIT(connp)) {
+        if (code == RXGEN_OPCODE && SERVERHAS64BIT(connp)) {
             SET_SERVERHASNO64BIT(connp);
             qdp = NULL;
             nbytes = save_nbytes;
             goto retry;
         }
-
-        /* Prefer StoreData error over rx_EndCall error */
-        if (code1 != 0)
-            code = code1;
-    } while (cm_Analyze(connp, userp, reqp, &scp->fid, &volSync, NULL, NULL, code));
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 1, &outStatus, &volSync, NULL, NULL, code));
 
     code = cm_MapRPCError(code, reqp);
 
@@ -350,8 +379,6 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
     /* now, clean up our state */
     lock_ObtainWrite(&scp->rw);
 
-    cm_ReleaseBIOD(&biod, 1, code, 1);
-
     if (code == 0) {
         osi_hyper_t t;
         /* now, here's something a little tricky: in AFS 3, a dirty
@@ -383,14 +410,29 @@ long cm_BufWrite(void *vscp, osi_hyper_t *offsetp, long length, long flags,
         if (LargeIntegerGreaterThanOrEqualTo(t, scp->length))
             _InterlockedAnd(&scp->mask, ~CM_SCACHEMASK_LENGTH);
 
-        cm_MergeStatus(NULL, scp, &outStatus, &volSync, userp, reqp, CM_MERGEFLAG_STOREDATA);
+        code = cm_MergeStatus(NULL, scp, &outStatus, &volSync, userp, reqp, CM_MERGEFLAG_STOREDATA);
     } else {
+        InterlockedDecrement(&scp->activeRPCs);
         if (code == CM_ERROR_SPACE)
             _InterlockedOr(&scp->flags, CM_SCACHEFLAG_OUTOFSPACE);
         else if (code == CM_ERROR_QUOTA)
             _InterlockedOr(&scp->flags, CM_SCACHEFLAG_OVERQUOTA);
     }
-    cm_SyncOpDone(scp, NULL, CM_SCACHESYNC_STOREDATA_EXCL);
+
+    if ( cm_verifyData )
+    {
+        if (!cm_VerifyStoreData(&biod, &save_scache)) {
+            /* file server content doesn't match what we sent. */
+            nbytes = save_nbytes;
+            goto retry_rpc;
+        }
+    }
+
+    cm_ReleaseBIOD(&biod, 1, code, 1);
+
+  exit_storedata_excl:
+    if (storedata_excl)
+        cm_SyncOpDone(scp, NULL, CM_SCACHESYNC_STOREDATA_EXCL);
 
     if (!scp_locked)
         lock_ReleaseWrite(&scp->rw);
@@ -409,7 +451,7 @@ long cm_StoreMini(cm_scache_t *scp, cm_user_t *userp, cm_req_t *reqp)
     AFSStoreStatus inStatus;
     AFSVolSync volSync;
     AFSFid tfid;
-    long code, code1;
+    long code;
     osi_hyper_t truncPos;
     cm_conn_t *connp;
     struct rx_call *rxcallp;
@@ -418,6 +460,7 @@ long cm_StoreMini(cm_scache_t *scp, cm_user_t *userp, cm_req_t *reqp)
     int call_was_64bit = 0;
 
     memset(&volSync, 0, sizeof(volSync));
+    memset(&inStatus, 0, sizeof(inStatus);
 
     osi_Log2(afsd_logp, "cm_StoreMini scp 0x%p userp 0x%p", scp, userp);
 
@@ -443,6 +486,7 @@ long cm_StoreMini(cm_scache_t *scp, cm_user_t *userp, cm_req_t *reqp)
         require_64bit_ops = 1;
     }
 
+    InterlockedIncrement(&scp->activeRPCs);
     lock_ReleaseWrite(&scp->rw);
 
     cm_AFSFidFromFid(&tfid, &scp->fid);
@@ -503,17 +547,13 @@ long cm_StoreMini(cm_scache_t *scp, cm_user_t *userp, cm_req_t *reqp)
                    osi_Log0(afsd_logp, "EndRXAFS_StoreData SUCCESS");
             }
         }
-        code1 = rx_EndCall(rxcallp, code);
+        code = rx_EndCall(rxcallp, code);
 
-        if ((code == RXGEN_OPCODE || code1 == RXGEN_OPCODE) && SERVERHAS64BIT(connp)) {
+        if (code == RXGEN_OPCODE && SERVERHAS64BIT(connp)) {
             SET_SERVERHASNO64BIT(connp);
             goto retry;
         }
-
-        /* prefer StoreData error over rx_EndCall error */
-        if (code == 0 && code1 != 0)
-            code = code1;
-    } while (cm_Analyze(connp, userp, reqp, &scp->fid, &volSync, NULL, NULL, code));
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 1, &outStatus, &volSync, NULL, NULL, code));
     code = cm_MapRPCError(code, reqp);
 
     /* now, clean up our state */
@@ -534,7 +574,9 @@ long cm_StoreMini(cm_scache_t *scp, cm_user_t *userp, cm_req_t *reqp)
 
         if (LargeIntegerGreaterThanOrEqualTo(t, scp->length))
             _InterlockedAnd(&scp->mask, ~CM_SCACHEMASK_LENGTH);
-        cm_MergeStatus(NULL, scp, &outStatus, &volSync, userp, reqp, CM_MERGEFLAG_STOREDATA);
+        code = cm_MergeStatus(NULL, scp, &outStatus, &volSync, userp, reqp, CM_MERGEFLAG_STOREDATA);
+    } else {
+        InterlockedDecrement(&scp->activeRPCs);
     }
     cm_SyncOpDone(scp, NULL, CM_SCACHESYNC_STOREDATA_EXCL);
 
@@ -687,10 +729,10 @@ cm_CheckFetchRange(cm_scache_t *scp, osi_hyper_t *startBasep, osi_hyper_t *lengt
             break;
         }
 
-        bp = buf_Find(scp, &tbase);
+        bp = buf_Find(&scp->fid, &tbase);
         /* We cheat slightly by not locking the bp mutex. */
         if (bp) {
-            if ((bp->cmFlags & (CM_BUF_CMFETCHING | CM_BUF_CMSTORING | CM_BUF_CMBKGFETCH)) == 0
+            if ((bp->cmFlags & (CM_BUF_CMFETCHING | CM_BUF_CMSTORING)) == 0
                  && (bp->dataVersion < scp->bufDataVersionLow || bp->dataVersion > scp->dataVersion))
                 stop = 1;
             buf_Release(bp);
@@ -725,31 +767,32 @@ cm_CheckFetchRange(cm_scache_t *scp, osi_hyper_t *startBasep, osi_hyper_t *lengt
 }
 
 afs_int32
-cm_BkgStore(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, afs_uint32 p4,
-           cm_user_t *userp)
+cm_BkgStore(cm_scache_t *scp, void *rockp, cm_user_t *userp, cm_req_t *reqp)
 {
     osi_hyper_t toffset;
-    long length;
-    cm_req_t req;
+    afs_uint32 length;
     long code = 0;
+    afs_uint32 req_flags = reqp->flags;
+
+    toffset = ((rock_BkgStore_t *)rockp)->offset;
+    length = ((rock_BkgStore_t *)rockp)->length;
 
     if (scp->flags & CM_SCACHEFLAG_DELETED) {
-       osi_Log4(afsd_logp, "Skipping BKG store - Deleted scp 0x%p, offset 0x%x:%08x, length 0x%x", scp, p2, p1, p3);
+       osi_Log4(afsd_logp, "Skipping BKG store - Deleted scp 0x%p, offset 0x%x:%08x, length 0x%x",
+                 scp, toffset.HighPart, toffset.LowPart, length);
     } else {
-       cm_InitReq(&req);
-
        /* Retries will be performed by the BkgDaemon thread if appropriate */
-       req.flags |= CM_REQ_NORETRY;
+       reqp->flags |= CM_REQ_NORETRY;
 
-       toffset.LowPart = p1;
-       toffset.HighPart = p2;
-       length = p3;
+       osi_Log4(afsd_logp, "Starting BKG store scp 0x%p, offset 0x%x:%08x, length 0x%x",
+                 scp, toffset.HighPart, toffset.LowPart, length);
 
-       osi_Log4(afsd_logp, "Starting BKG store scp 0x%p, offset 0x%x:%08x, length 0x%x", scp, p2, p1, p3);
+       code = cm_BufWrite(scp, &toffset, length, /* flags */ 0, userp, reqp);
 
-       code = cm_BufWrite(scp, &toffset, length, /* flags */ 0, userp, &req);
+       osi_Log5(afsd_logp, "Finished BKG store scp 0x%p, offset 0x%x:%08x, length 0x%x, code 0x%x",
+                 scp, toffset.HighPart, toffset.LowPart, length, code);
 
-       osi_Log4(afsd_logp, "Finished BKG store scp 0x%p, offset 0x%x:%08x, code 0x%x", scp, p2, p1, code);
+        reqp->flags = req_flags;
     }
 
     /*
@@ -771,6 +814,7 @@ cm_BkgStore(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, afs_u
         cm_SyncOpDone(scp, NULL, CM_SCACHESYNC_ASYNCSTORE);
         lock_ReleaseWrite(&scp->rw);
     }
+
     return code;
 }
 
@@ -792,8 +836,7 @@ void cm_ClearPrefetchFlag(long code, cm_scache_t *scp, osi_hyper_t *base, osi_hy
 /* do the prefetch.  if the prefetch fails, return 0 (success)
  * because there is no harm done.  */
 afs_int32
-cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, afs_uint32 p4,
-              cm_user_t *userp)
+cm_BkgPrefetch(cm_scache_t *scp, void *rockp, cm_user_t *userp, cm_req_t *reqp)
 {
     osi_hyper_t length;
     osi_hyper_t base;
@@ -804,25 +847,22 @@ cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, af
     afs_int32 code;
     int rxheld = 0;
     cm_buf_t *bp = NULL;
-    cm_req_t req;
-
-    cm_InitReq(&req);
+    afs_uint32 req_flags;
 
     /* Retries will be performed by the BkgDaemon thread if appropriate */
-    req.flags |= CM_REQ_NORETRY;
+    req_flags = reqp->flags;
+    reqp->flags |= CM_REQ_NORETRY;
 
     fetched.LowPart = 0;
     fetched.HighPart = 0;
     tblocksize = ConvertLongToLargeInteger(cm_data.buf_blockSize);
-    base.LowPart = p1;
-    base.HighPart = p2;
-    length.LowPart = p3;
-    length.HighPart = p4;
+    base = ((rock_BkgFetch_t *)rockp)->base;
+    length = ((rock_BkgFetch_t *)rockp)->length;
 
     end = LargeIntegerAdd(base, length);
 
     osi_Log5(afsd_logp, "Starting BKG prefetch scp 0x%p offset 0x%x:%x length 0x%x:%x",
-             scp, p2, p1, p4, p3);
+             scp, base.HighPart, base.LowPart, length.HighPart, length.LowPart);
 
     for ( code = 0, offset = base;
           code == 0 && LargeIntegerLessThan(offset, end);
@@ -833,7 +873,7 @@ cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, af
             rxheld = 0;
         }
 
-        code = buf_Get(scp, &offset, &req, &bp);
+        code = buf_Get(scp, &offset, reqp, 0, &bp);
         if (code)
             break;
 
@@ -843,7 +883,6 @@ cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, af
                 lock_ObtainWrite(&scp->rw);
                 rxheld = 1;
             }
-            _InterlockedAnd(&bp->cmFlags, ~CM_BUF_CMBKGFETCH);
             buf_Release(bp);
             bp = NULL;
             continue;
@@ -854,11 +893,10 @@ cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, af
             rxheld = 1;
         }
 
-        code = cm_GetBuffer(scp, bp, NULL, userp, &req);
+        code = cm_GetBuffer(scp, bp, NULL, userp, reqp);
         if (code == 0)
             fetched = LargeIntegerAdd(fetched, tblocksize);
         buf_Release(bp);
-        _InterlockedAnd(&bp->cmFlags, ~CM_BUF_CMBKGFETCH);
     }
 
     if (!rxheld) {
@@ -866,22 +904,11 @@ cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, af
         rxheld = 1;
     }
 
-    /* Clear flag from any remaining buffers */
-    for ( ;
-          LargeIntegerLessThan(offset, end);
-          offset = LargeIntegerAdd(offset, tblocksize) )
-    {
-        bp = buf_Find(scp, &offset);
-        if (bp) {
-            _InterlockedAnd(&bp->cmFlags, ~CM_BUF_CMBKGFETCH);
-            buf_Release(bp);
-        }
-    }
     cm_ClearPrefetchFlag(LargeIntegerGreaterThanZero(fetched) ? 0 : code,
                          scp, &base, &fetched);
 
     /* wakeup anyone who is waiting */
-    if (scp->flags & CM_SCACHEFLAG_WAITING) {
+    if (!osi_QIsEmpty(&scp->waitQueueH)) {
         osi_Log1(afsd_logp, "CM BkgPrefetch Waking scp 0x%p", scp);
         osi_Wakeup((LONG_PTR) &scp->flags);
     }
@@ -889,6 +916,8 @@ cm_BkgPrefetch(cm_scache_t *scp, afs_uint32 p1, afs_uint32 p2, afs_uint32 p3, af
 
     osi_Log4(afsd_logp, "Ending BKG prefetch scp 0x%p code 0x%x fetched 0x%x:%x",
              scp, code, fetched.HighPart, fetched.LowPart);
+
+    reqp->flags = req_flags;
     return code;
 }
 
@@ -904,9 +933,8 @@ void cm_ConsiderPrefetch(cm_scache_t *scp, osi_hyper_t *offsetp, afs_uint32 coun
     osi_hyper_t readBase;
     osi_hyper_t readLength;
     osi_hyper_t readEnd;
-    osi_hyper_t offset;
     osi_hyper_t tblocksize;            /* a long long temp variable */
-    cm_buf_t    *bp;
+    rock_BkgFetch_t *rockp;
 
     tblocksize = ConvertLongToLargeInteger(cm_data.buf_blockSize);
 
@@ -942,42 +970,22 @@ void cm_ConsiderPrefetch(cm_scache_t *scp, osi_hyper_t *offsetp, afs_uint32 coun
 
     readEnd = LargeIntegerAdd(realBase, readLength);
 
-    /*
-     * Mark each buffer in the range as queued for a
-     * background fetch
-     */
-    for ( offset = realBase;
-          LargeIntegerLessThan(offset, readEnd);
-          offset = LargeIntegerAdd(offset, tblocksize) )
-    {
-        if (rwheld) {
-            lock_ReleaseWrite(&scp->rw);
-            rwheld = 0;
-        }
-
-        bp = buf_Find(scp, &offset);
-        if (!bp)
-            continue;
-
-        if (!rwheld) {
-            lock_ObtainWrite(&scp->rw);
-            rwheld = 1;
-        }
-
-        _InterlockedOr(&bp->cmFlags, CM_BUF_CMBKGFETCH);
-        buf_Release(bp);
-    }
-
     if (rwheld)
         lock_ReleaseWrite(&scp->rw);
 
     osi_Log2(afsd_logp, "BKG Prefetch request scp 0x%p, base 0x%x",
              scp, realBase.LowPart);
 
-    cm_QueueBKGRequest(scp, cm_BkgPrefetch,
-                       realBase.LowPart, realBase.HighPart,
-                       readLength.LowPart, readLength.HighPart,
-                       userp);
+    rockp = malloc(sizeof(*rockp));
+    if (rockp == NULL) {
+        return;        /* can't proceed without a rock */
+    }
+
+    rockp->base = realBase;
+    rockp->length = readLength;
+
+    /* cm_BkgDaemon frees the rock */
+    cm_QueueBKGRequest(scp, cm_BkgPrefetch, rockp, userp, reqp);
 }
 
 /* scp must be locked; temporarily unlocked during processing.
@@ -1001,12 +1009,18 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
     osi_hyper_t scanStart;             /* where to start scan for dirty pages */
     osi_hyper_t scanEnd;               /* where to stop scan for dirty pages */
     osi_hyper_t firstModOffset;        /* offset of first modified page in range */
+    osi_hyper_t tblocksize;
     long temp;
     long code;
     long flags;                        /* flags to cm_SyncOp */
+    int blockSize = cm_data.blockSize; /* need a signed version */
+
+    tblocksize = ConvertLongToLargeInteger(cm_data.buf_blockSize);
 
     /* clear things out */
     biop->scp = scp;                   /* do not hold; held by caller */
+    biop->userp = userp;                /* do not hold; held by caller */
+    biop->reqp = reqp;
     biop->offset = *inOffsetp;
     biop->length = 0;
     biop->bufListp = NULL;
@@ -1015,15 +1029,16 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
 
     /* reserve a chunk's worth of buffers */
     lock_ReleaseWrite(&scp->rw);
-    buf_ReserveBuffers(cm_chunkSize / cm_data.buf_blockSize);
+    biop->reserved = (cm_chunkSize / blockSize);
+    buf_ReserveBuffers(biop->reserved);
     lock_ObtainWrite(&scp->rw);
 
     bufp = NULL;
-    for (temp = 0; temp < inSize; temp += cm_data.buf_blockSize) {
+    for (temp = 0; temp < inSize; temp += blockSize) {
         thyper = ConvertLongToLargeInteger(temp);
         tbase = LargeIntegerAdd(*inOffsetp, thyper);
 
-        bufp = buf_Find(scp, &tbase);
+        bufp = buf_Find(&scp->fid, &tbase);
         if (bufp) {
             /* get buffer mutex and scp mutex safely */
             lock_ReleaseWrite(&scp->rw);
@@ -1043,7 +1058,7 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
                 lock_ReleaseMutex(&bufp->mx);
                 buf_Release(bufp);
                 bufp = NULL;
-                buf_UnreserveBuffers(cm_chunkSize / cm_data.buf_blockSize);
+               buf_UnreserveBuffers(cm_chunkSize / blockSize);
                 return code;
             }
 
@@ -1051,7 +1066,7 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
             if (bufp->flags & CM_BUF_DIRTY) {
                 osi_assertx(!(bufp->flags & CM_BUF_WRITING),
                             "WRITING w/o CMSTORING in SetupStoreBIOD");
-                bufp->flags |= CM_BUF_WRITING;
+                _InterlockedOr(&bufp->flags, CM_BUF_WRITING);
                 break;
             }
 
@@ -1063,8 +1078,6 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
         }
     }
 
-    biop->reserved = 1;
-
     /* if we get here, if bufp is null, we didn't find any dirty buffers
      * that weren't already being stored back, so we just quit now.
      */
@@ -1078,33 +1091,47 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
     /* put this element in the list */
     qdp = osi_QDAlloc();
     osi_SetQData(qdp, bufp);
+
+    if ( cm_verifyData )
+        buf_ComputeCheckSum(bufp);
+
     /* don't have to hold bufp, since held by buf_Find above */
     osi_QAddH((osi_queue_t **) &biop->bufListp,
               (osi_queue_t **) &biop->bufListEndp,
               &qdp->q);
-    biop->length = cm_data.buf_blockSize;
+    biop->length = blockSize;
     firstModOffset = bufp->offset;
     biop->offset = firstModOffset;
     bufp = NULL;       /* this buffer and reference added to the queue */
 
-    /* compute the window surrounding *inOffsetp of size cm_chunkSize */
-    scanStart = *inOffsetp;
+    /* compute the window surrounding firstModOffset of size cm_chunkSize */
+    scanStart = firstModOffset;
     scanStart.LowPart &= (-cm_chunkSize);
     thyper = ConvertLongToLargeInteger(cm_chunkSize);
     scanEnd = LargeIntegerAdd(scanStart, thyper);
 
+    /* do not scan beyond the end of the file */
+    if (scanEnd.QuadPart > scp->length.QuadPart) {
+       scanEnd = scp->length;
+       scanEnd.LowPart &= (-blockSize);
+       if (scanEnd.LowPart < scp->length.LowPart)
+           scanEnd.LowPart += blockSize;
+    }
+
+    /* do not leave out a requested portion of the range */
+    if (scanEnd.QuadPart < inOffsetp->QuadPart + inSize) {
+       scanEnd.QuadPart = inOffsetp->QuadPart + inSize;
+    }
+
     flags = CM_SCACHESYNC_GETSTATUS
         | CM_SCACHESYNC_STOREDATA
-        | CM_SCACHESYNC_BUFLOCKED
-        | CM_SCACHESYNC_NOWAIT;
+        | CM_SCACHESYNC_BUFLOCKED;
 
     /* start by looking backwards until scanStart */
-    /* hyper version of cm_data.buf_blockSize */
-    thyper = ConvertLongToLargeInteger(cm_data.buf_blockSize);
-    tbase = LargeIntegerSubtract(firstModOffset, thyper);
+    tbase = LargeIntegerSubtract(firstModOffset, tblocksize);
     while(LargeIntegerGreaterThanOrEqualTo(tbase, scanStart)) {
         /* see if we can find the buffer */
-        bufp = buf_Find(scp, &tbase);
+        bufp = buf_Find(&scp->fid, &tbase);
         if (!bufp)
             break;
 
@@ -1144,6 +1171,10 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
          */
         qdp = osi_QDAlloc();
         osi_SetQData(qdp, bufp);
+
+        if ( cm_verifyData )
+            buf_ComputeCheckSum(bufp);
+
         /* no buf_hold necessary, since we have it held from buf_Find */
         osi_QAddT((osi_queue_t **) &biop->bufListp,
                   (osi_queue_t **) &biop->bufListEndp,
@@ -1151,20 +1182,18 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
        bufp = NULL;            /* added to the queue */
 
         /* update biod info describing the transfer */
-        biop->offset = LargeIntegerSubtract(biop->offset, thyper);
-        biop->length += cm_data.buf_blockSize;
+       biop->offset = LargeIntegerSubtract(biop->offset, tblocksize);
+       biop->length += blockSize;
 
         /* update loop pointer */
-        tbase = LargeIntegerSubtract(tbase, thyper);
+       tbase = LargeIntegerSubtract(tbase, tblocksize);
     }  /* while loop looking for pages preceding the one we found */
 
     /* now, find later dirty, contiguous pages, and add them to the list */
-    /* hyper version of cm_data.buf_blockSize */
-    thyper = ConvertLongToLargeInteger(cm_data.buf_blockSize);
-    tbase = LargeIntegerAdd(firstModOffset, thyper);
+    tbase = LargeIntegerAdd(firstModOffset, tblocksize);
     while(LargeIntegerLessThan(tbase, scanEnd)) {
         /* see if we can find the buffer */
-        bufp = buf_Find(scp, &tbase);
+        bufp = buf_Find(&scp->fid, &tbase);
         if (!bufp)
             break;
 
@@ -1204,6 +1233,10 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
          */
         qdp = osi_QDAlloc();
         osi_SetQData(qdp, bufp);
+
+        if ( cm_verifyData )
+            buf_ComputeCheckSum(bufp);
+
         /* no buf_hold necessary, since we have it held from buf_Find */
         osi_QAddH((osi_queue_t **) &biop->bufListp,
                   (osi_queue_t **) &biop->bufListEndp,
@@ -1211,10 +1244,10 @@ long cm_SetupStoreBIOD(cm_scache_t *scp, osi_hyper_t *inOffsetp, long inSize,
        bufp = NULL;
 
         /* update biod info describing the transfer */
-        biop->length += cm_data.buf_blockSize;
+       biop->length += blockSize;
 
         /* update loop pointer */
-        tbase = LargeIntegerAdd(tbase, thyper);
+       tbase = LargeIntegerAdd(tbase, tblocksize);
     }  /* while loop looking for pages following the first page we found */
 
     /* finally, we're done */
@@ -1241,11 +1274,13 @@ long cm_SetupFetchBIOD(cm_scache_t *scp, osi_hyper_t *offsetp,
     osi_hyper_t fileSize;              /* the # of bytes in the file */
     osi_queueData_t *heldBufListp;     /* we hold all buffers in this list */
     osi_queueData_t *heldBufListEndp;  /* first one */
-    int reserving;
+    afs_uint64 reserving;
 
     tblocksize = ConvertLongToLargeInteger(cm_data.buf_blockSize);
 
     biop->scp = scp;                   /* do not hold; held by caller */
+    biop->userp = userp;                /* do not hold; held by caller */
+    biop->reqp = reqp;
     biop->offset = *offsetp;
     /* null out the list of buffers */
     biop->bufListp = biop->bufListEndp = NULL;
@@ -1296,7 +1331,7 @@ long cm_SetupFetchBIOD(cm_scache_t *scp, osi_hyper_t *offsetp,
         if (LargeIntegerGreaterThanOrEqualTo(pageBase, fileSize))
             break;
 
-        code = buf_Get(scp, &pageBase, reqp, &tbp);
+        code = buf_Get(scp, &pageBase, reqp, 0, &tbp);
         if (code) {
             lock_ObtainWrite(&scp->rw);
             cm_SyncOpDone(scp, NULL, CM_SCACHESYNC_NEEDCALLBACK | CM_SCACHESYNC_GETSTATUS);
@@ -1326,7 +1361,7 @@ long cm_SetupFetchBIOD(cm_scache_t *scp, osi_hyper_t *offsetp,
         if (LargeIntegerGreaterThanOrEqualTo(pageBase, fileSize))
             break;
 
-        tbp = buf_Find(scp, &pageBase);
+        tbp = buf_Find(&scp->fid, &pageBase);
         if (!tbp)
             break;
 
@@ -1457,10 +1492,11 @@ void cm_ReleaseBIOD(cm_bulkIO_t *biop, int isStore, long code, int scp_locked)
     osi_queueData_t *qdp;
     osi_queueData_t *nqdp;
     int flags;
+    int reportErrorToRedir = 0;
 
     /* Give back reserved buffers */
     if (biop->reserved)
-        buf_UnreserveBuffers(cm_chunkSize / cm_data.buf_blockSize);
+        buf_UnreserveBuffers(biop->reserved);
 
     if (isStore)
         flags = CM_SCACHESYNC_STOREDATA;
@@ -1494,7 +1530,7 @@ void cm_ReleaseBIOD(cm_bulkIO_t *biop, int isStore, long code, int scp_locked)
                    osi_Wakeup((LONG_PTR) bufp);
                }
                if (code) {
-                   bufp->flags &= ~CM_BUF_WRITING;
+                   _InterlockedAnd(&bufp->flags, ~CM_BUF_WRITING);
                     switch (code) {
                     case CM_ERROR_NOSUCHFILE:
                     case CM_ERROR_BADFD:
@@ -1504,16 +1540,19 @@ void cm_ReleaseBIOD(cm_bulkIO_t *biop, int isStore, long code, int scp_locked)
                     case CM_ERROR_TOOBIG:
                     case CM_ERROR_READONLY:
                     case CM_ERROR_NOSUCHPATH:
+                    case EIO:
+                    case CM_ERROR_INVAL_NET_RESP:
+                    case CM_ERROR_UNKNOWN:
                         /*
                          * Apply the fatal error to this buffer.
                          */
-                        bufp->flags &= ~CM_BUF_DIRTY;
-                        bufp->flags |= CM_BUF_ERROR;
-                        bufp->dirty_offset = 0;
+                        _InterlockedAnd(&bufp->flags, ~CM_BUF_DIRTY);
+                        _InterlockedOr(&bufp->flags, CM_BUF_ERROR);
                         bufp->dirty_length = 0;
                         bufp->error = code;
                         bufp->dataVersion = CM_BUF_VERSION_BAD;
                         bufp->dirtyCounter++;
+                        reportErrorToRedir = 1;
                         break;
                     case CM_ERROR_TIMEDOUT:
                     case CM_ERROR_ALLDOWN:
@@ -1527,7 +1566,7 @@ void cm_ReleaseBIOD(cm_bulkIO_t *biop, int isStore, long code, int scp_locked)
                         break;
                     }
                } else {
-                   bufp->flags &= ~(CM_BUF_WRITING | CM_BUF_DIRTY);
+                   _InterlockedAnd(&bufp->flags, ~(CM_BUF_WRITING | CM_BUF_DIRTY));
                     bufp->dirty_offset = bufp->dirty_length = 0;
                 }
            }
@@ -1538,6 +1577,12 @@ void cm_ReleaseBIOD(cm_bulkIO_t *biop, int isStore, long code, int scp_locked)
            buf_Release(bufp);
            bufp = NULL;
        }
+
+        if (RDR_Initialized && reportErrorToRedir) {
+            DWORD status;
+            smb_MapNTError(cm_MapRPCError(code, biop->reqp), &status, TRUE);
+            RDR_SetFileStatus( &scp->fid, &biop->userp->authgroup, status);
+        }
     } else {
        if (!scp_locked)
             lock_ObtainWrite(&scp->rw);
@@ -1610,11 +1655,11 @@ cm_CloneStatus(cm_scache_t *scp, cm_user_t *userp, int scp_locked,
 long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp,
                   cm_req_t *reqp)
 {
-    long code=0, code1=0;
+    long code=0;
     afs_uint32 nbytes;                 /* bytes in transfer */
     afs_uint32 nbytes_hi = 0;            /* high-order 32 bits of bytes in transfer */
     afs_uint64 length_found = 0;
-    long rbytes;                       /* bytes in rx_Read call */
+    long rxbytes;                      /* bytes in rx_Read call */
     long temp;
     AFSFetchStatus afsStatus;
     AFSCallBack callback;
@@ -1636,6 +1681,8 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
     int first_read = 1;
     int scp_locked = 1;
 
+    memset(&afsStatus, 0, sizeof(afsStatus));
+    memset(&callback, 0, sizeof(callback));
     memset(&volSync, 0, sizeof(volSync));
 
     /* now, the buffer may or may not be filled with good data (buf_GetNewLocked
@@ -1664,7 +1711,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
     code = cm_SetupFetchBIOD(scp, &bufp->offset, &biod, userp, reqp);
     if (code) {
         /* couldn't even get the first page setup properly */
-        osi_Log1(afsd_logp, "GetBuffer: SetupFetchBIOD failure code %d", code);
+        osi_Log1(afsd_logp, "cm_GetBuffer: SetupFetchBIOD failure code %d", code);
         return code;
     }
 
@@ -1675,28 +1722,52 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
      * We can lose a race condition and end up with biod.length zero, in
      * which case we just retry.
      */
-    if (bufp->dataVersion <= scp->dataVersion && bufp->dataVersion >= scp->bufDataVersionLow || biod.length == 0) {
-        if ((bufp->dataVersion == CM_BUF_VERSION_BAD || bufp->dataVersion < scp->bufDataVersionLow) &&
-             LargeIntegerGreaterThanOrEqualTo(bufp->offset, scp->serverLength))
-        {
-            osi_Log4(afsd_logp, "Bad DVs 0x%x != (0x%x -> 0x%x) or length 0x%x",
-                     bufp->dataVersion, scp->bufDataVersionLow, scp->dataVersion, biod.length);
 
-            if (bufp->dataVersion == CM_BUF_VERSION_BAD)
-                memset(bufp->datap, 0, cm_data.buf_blockSize);
-            bufp->dataVersion = scp->dataVersion;
+    if (bufp->dataVersion <= scp->dataVersion && bufp->dataVersion >= scp->bufDataVersionLow) {
+        /* We obtained the buffer while we were waiting */
+        goto release_biod;
+    }
+
+    if (biod.length == 0) {
+        osi_Log2(afsd_logp, "cm_GetBuffer BIOD length 0 scp 0x%p bufp 0x%p",
+                 scp, bufp);
+        goto release_biod;
+    }
+
+    /* Check for buffers we can fill locally */
+    for (qdp = biod.bufListEndp;
+          qdp;
+          qdp = (osi_queueData_t *) osi_QPrev(&qdp->q)) {
+        tbufp = osi_GetQData(qdp);
+
+        if ( tbufp->dataVersion == CM_BUF_VERSION_BAD ||
+             tbufp->dataVersion < scp->bufDataVersionLow ||
+             tbufp->dataVersion > scp->dataVersion) {
+
+            osi_Log4(afsd_logp, "cm_GetBuffer bufp 0x%p DVs 0x%x != (0x%x -> 0x%x)",
+                     tbufp, tbufp->dataVersion, scp->bufDataVersionLow, scp->dataVersion);
+
+            if (LargeIntegerGreaterThanOrEqualTo(tbufp->offset, scp->length))
+            {
+                if (tbufp->dataVersion == CM_BUF_VERSION_BAD)
+                    memset(tbufp->datap, 0, cm_data.buf_blockSize);
+                tbufp->dataVersion = scp->dataVersion;
+            }
+
+            if ((scp->mask & CM_SCACHEMASK_TRUNCPOS) &&
+                 LargeIntegerGreaterThanOrEqualTo(tbufp->offset, scp->truncPos)) {
+                memset(tbufp->datap, 0, cm_data.buf_blockSize);
+                tbufp->dataVersion = scp->dataVersion;
+            }
         }
-        cm_ReleaseBIOD(&biod, 0, 0, 1);
-        return 0;
-    } else if ((bufp->dataVersion == CM_BUF_VERSION_BAD || bufp->dataVersion < scp->bufDataVersionLow)
-                && (scp->mask & CM_SCACHEMASK_TRUNCPOS) &&
-                LargeIntegerGreaterThanOrEqualTo(bufp->offset, scp->truncPos)) {
-        memset(bufp->datap, 0, cm_data.buf_blockSize);
-        bufp->dataVersion = scp->dataVersion;
-        cm_ReleaseBIOD(&biod, 0, 0, 1);
-        return 0;
     }
 
+    if (bufp->dataVersion <= scp->dataVersion && bufp->dataVersion >= scp->bufDataVersionLow) {
+        /* We locally populated the buffer we wanted */
+        goto release_biod;
+    }
+
+    InterlockedIncrement(&scp->activeRPCs);
     lock_ReleaseWrite(&scp->rw);
     scp_locked = 0;
 
@@ -1784,7 +1855,8 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
      * the network round trip by allocating zeroed buffers and
      * faking the status info.
      */
-    if (biod.offset.QuadPart >= scp->length.QuadPart) {
+    if (biod.offset.QuadPart >= scp->serverLength.QuadPart ||
+        ((scp->mask & CM_SCACHEMASK_TRUNCPOS) && biod.offset.QuadPart > scp->truncPos.QuadPart)) {
         osi_Log5(afsd_logp, "SKIP FetchData64 scp 0x%p, off 0x%x:%08x > length 0x%x:%08x",
                  scp, biod.offset.HighPart, biod.offset.LowPart,
                  scp->length.HighPart, scp->length.LowPart);
@@ -1812,6 +1884,8 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
 
     /* now make the call */
     do {
+       long code1;
+
         code = cm_ConnFromFID(&scp->fid, userp, reqp, &connp);
         if (code)
             continue;
@@ -1836,8 +1910,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                     nbytes_hi = ntohl(nbytes_hi);
                 } else {
                     nbytes_hi = 0;
-                   code = rxcallp->error;
-                    code1 = rx_EndCall(rxcallp, code);
+                    code = rx_EndCall(rxcallp, RX_PROTOCOL_ERROR);
                     rxcallp = NULL;
                 }
             }
@@ -1885,7 +1958,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                 }
             } else {
                 osi_Log1(afsd_logp, "cm_GetBuffer rx_Read32 returns %d != 4", temp);
-                code = (rxcallp->error < 0) ? rxcallp->error : RX_PROTOCOL_ERROR;
+                code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
             }
         }
         /* for the moment, nbytes_hi will always be 0 if code == 0
@@ -1923,27 +1996,29 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                      * length_found and continue as if the file server said
                      * it was sending us zero octets of data.
                      */
-                    if (fs_fetchdata_offset_bug && first_read)
+                    if (fs_fetchdata_offset_bug && first_read) {
                         length_found = 0;
-                    else
-                        code = (rxcallp->error < 0) ? rxcallp->error : RX_PROTOCOL_ERROR;
-                    break;
+                        break;
+                    } else if (temp <= 0) {
+                        code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
+                        break;
+                    }
                 }
 
                 iov = 0;
                 iov_offset = 0;
-                rbytes = temp;
+                rxbytes = temp;
 
-                while (rbytes > 0) {
+                while (rxbytes > 0) {
                     afs_int32 len;
 
                     osi_assertx(bufferp != NULL, "null cm_buf_t");
 
-                    len = MIN(tiov[iov].iov_len - iov_offset, cm_data.buf_blockSize - buffer_offset);
+                    len = min(tiov[iov].iov_len - iov_offset, cm_data.buf_blockSize - buffer_offset);
                     memcpy(bufferp + buffer_offset, tiov[iov].iov_base + iov_offset, len);
                     iov_offset += len;
                     buffer_offset += len;
-                    rbytes -= len;
+                    rxbytes -= len;
 
                     if (iov_offset == tiov[iov].iov_len) {
                         iov++;
@@ -1958,7 +2033,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                         */
                         _InterlockedOr(&tbufp->cmFlags, CM_BUF_CMFULLYFETCHED);
                         lock_ObtainWrite(&scp->rw);
-                        if (scp->flags & CM_SCACHEFLAG_WAITING) {
+                        if (!osi_QIsEmpty(&scp->waitQueueH)) {
                             osi_Log1(afsd_logp, "CM GetBuffer Waking scp 0x%p", scp);
                             osi_Wakeup((LONG_PTR) &scp->flags);
                         }
@@ -1989,10 +2064,10 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                  */
                 osi_assertx(bufferp != NULL, "null cm_buf_t");
 
-                /* read rbytes of data */
-                rbytes = (afs_uint32)(length_found > cm_data.buf_blockSize ? cm_data.buf_blockSize : length_found);
-                temp = rx_Read(rxcallp, bufferp, rbytes);
-                if (temp < rbytes) {
+                /* read rxbytes of data */
+                rxbytes = (afs_uint32)(length_found > cm_data.buf_blockSize ? cm_data.buf_blockSize : length_found);
+                temp = rx_Read(rxcallp, bufferp, rxbytes);
+                if (temp < rxbytes) {
                     /*
                      * If the file server returned (filesize - offset),
                      * then the first rx_Read will return zero octets of data.
@@ -2000,11 +2075,13 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                      * length_found and continue as if the file server said
                      * it was sending us zero octets of data.
                      */
-                    if (fs_fetchdata_offset_bug && first_read)
+                    if (fs_fetchdata_offset_bug && first_read) {
                         length_found = 0;
-                    else
-                        code = (rxcallp->error < 0) ? rxcallp->error : RX_PROTOCOL_ERROR;
-                    break;
+                        break;
+                    } else if (temp <= 0) {
+                        code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
+                        break;
+                    }
                 }
                 first_read = 0;
 
@@ -2015,7 +2092,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                  */
                 _InterlockedOr(&tbufp->cmFlags, CM_BUF_CMFULLYFETCHED);
                 lock_ObtainWrite(&scp->rw);
-                if (scp->flags & CM_SCACHEFLAG_WAITING) {
+                if (!osi_QIsEmpty(&scp->waitQueueH)) {
                     osi_Log1(afsd_logp, "CM GetBuffer Waking scp 0x%p", scp);
                     osi_Wakeup((LONG_PTR) &scp->flags);
                 }
@@ -2050,26 +2127,26 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
              * all of the rest of the pages.
              */
 #ifdef USE_RX_IOVEC
-            rbytes = cm_data.buf_blockSize - buffer_offset;
+            rxbytes = cm_data.buf_blockSize - buffer_offset;
             bufferp = tbufp->datap + buffer_offset;
 #else /* USE_RX_IOVEC */
             /* bytes fetched */
            osi_assertx((bufferp - tbufp->datap) < LONG_MAX, "data >= LONG_MAX");
-            rbytes = (long) (bufferp - tbufp->datap);
+            rxbytes = (long) (bufferp - tbufp->datap);
 
             /* bytes left to zero */
-            rbytes = cm_data.buf_blockSize - rbytes;
+            rxbytes = cm_data.buf_blockSize - rxbytes;
 #endif /* USE_RX_IOVEC */
             while(qdp) {
-                if (rbytes != 0)
-                    memset(bufferp, 0, rbytes);
+                if (rxbytes != 0)
+                    memset(bufferp, 0, rxbytes);
                 qdp = (osi_queueData_t *) osi_QPrev(&qdp->q);
                 if (qdp == NULL)
                     break;
                 tbufp = osi_GetQData(qdp);
                 bufferp = tbufp->datap;
                 /* bytes to clear in this page */
-                rbytes = cm_data.buf_blockSize;
+                rxbytes = cm_data.buf_blockSize;
             }
         }
 
@@ -2085,6 +2162,7 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                 osi_Log1(afsd_logp, "CALL EndRXAFS_FetchData skipped due to error %d", code);
         }
 
+        code1 = code;
         if (rxcallp)
             code1 = rx_EndCall(rxcallp, code);
 
@@ -2100,12 +2178,13 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
                 scp_locked = 0;
             }
             code = 0;
-        /* Prefer the error value from FetchData over rx_EndCall */
-        } else if (code == 0 && code1 != 0)
+        } else {
+           /* Prefer the error from rx_EndCall over any other error */
             code = code1;
+       }
         osi_Log0(afsd_logp, "CALL FetchData DONE");
 
-    } while (cm_Analyze(connp, userp, reqp, &scp->fid, &volSync, NULL, NULL, code));
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 0, &afsStatus, &volSync, NULL, NULL, code));
 
   fetchingcompleted:
     code = cm_MapRPCError(code, reqp);
@@ -2135,12 +2214,15 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
         }
     }
 
+    if (code == 0)
+        code = cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
+    else
+        InterlockedDecrement(&scp->activeRPCs);
+
+  release_biod:
     /* release scatter/gather I/O structure (buffers, locks) */
     cm_ReleaseBIOD(&biod, 0, code, 1);
 
-    if (code == 0)
-        cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
-
     return code;
 }
 
@@ -2150,15 +2232,15 @@ long cm_GetBuffer(cm_scache_t *scp, cm_buf_t *bufp, int *cpffp, cm_user_t *userp
  * a provided buffer.  Called with scp locked. The scp is locked on return.
  */
 long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_length,
-                cm_user_t *userp, cm_req_t *reqp)
+                int * bytes_readp, cm_user_t *userp, cm_req_t *reqp)
 {
-    long code=0, code1=0;
+    long code=0;
     afs_uint32 nbytes;                 /* bytes in transfer */
     afs_uint32 nbytes_hi = 0;           /* high-order 32 bits of bytes in transfer */
     afs_uint64 length_found = 0;
     char *bufferp = datap;
     afs_uint32 buffer_offset = 0;
-    long rbytes;                       /* bytes in rx_Read call */
+    long rxbytes;                      /* bytes in rx_Read call */
     long temp;
     AFSFetchStatus afsStatus;
     AFSCallBack callback;
@@ -2175,6 +2257,11 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
     int first_read = 1;
     int scp_locked = 1;
 
+    if (bytes_readp)
+        *bytes_readp = 0;
+
+    memset(&afsStatus, 0, sizeof(afsStatus));
+    memset(&callback, 0, sizeof(callback));
     memset(&volSync, 0, sizeof(volSync));
 
     /* now, the buffer may or may not be filled with good data (buf_GetNewLocked
@@ -2201,6 +2288,7 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
         require_64bit_ops = 1;
     }
 
+    InterlockedIncrement(&scp->activeRPCs);
     osi_Log2(afsd_logp, "cm_GetData: fetching data scp %p DV 0x%x", scp, scp->dataVersion);
 
 #ifdef AFS_FREELANCE_CLIENT
@@ -2265,6 +2353,8 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
 
     /* now make the call */
     do {
+       long code1;
+
         code = cm_ConnFromFID(&scp->fid, userp, reqp, &connp);
         if (code)
             continue;
@@ -2289,8 +2379,7 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                     nbytes_hi = ntohl(nbytes_hi);
                 } else {
                     nbytes_hi = 0;
-                   code = rxcallp->error;
-                    code1 = rx_EndCall(rxcallp, code);
+                    code = rx_EndCall(rxcallp, RX_PROTOCOL_ERROR);
                     rxcallp = NULL;
                 }
             }
@@ -2337,7 +2426,7 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                 }
             } else {
                 osi_Log1(afsd_logp, "cm_GetData rx_Read32 returns %d != 4", temp);
-                code = (rxcallp->error < 0) ? rxcallp->error : RX_PROTOCOL_ERROR;
+                code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
             }
         }
         /* for the moment, nbytes_hi will always be 0 if code == 0
@@ -2366,27 +2455,29 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                      * length_found and continue as if the file server said
                      * it was sending us zero octets of data.
                      */
-                    if (fs_fetchdata_offset_bug && first_read)
+                    if (fs_fetchdata_offset_bug && first_read) {
                         length_found = 0;
-                    else
-                        code = (rxcallp->error < 0) ? rxcallp->error : RX_PROTOCOL_ERROR;
-                    break;
+                        break;
+                    } else if (temp <= 0) {
+                        code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
+                        break;
+                    }
                 }
 
                 iov = 0;
                 iov_offset = 0;
-                rbytes = temp;
+                rxbytes = temp;
 
-                while (rbytes > 0) {
+                while (rxbytes > 0) {
                     afs_int32 len;
 
                     osi_assertx(bufferp != NULL, "null cm_buf_t");
 
-                    len = MIN(tiov[iov].iov_len - iov_offset, data_length - buffer_offset);
+                    len = min(tiov[iov].iov_len - iov_offset, data_length - buffer_offset);
                     memcpy(bufferp + buffer_offset, tiov[iov].iov_base + iov_offset, len);
                     iov_offset += len;
                     buffer_offset += len;
-                    rbytes -= len;
+                    rxbytes -= len;
 
                     if (iov_offset == tiov[iov].iov_len) {
                         iov++;
@@ -2402,10 +2493,10 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                  */
                 osi_assertx(bufferp != NULL, "null cm_buf_t");
 
-                /* read rbytes of data */
-                rbytes = (afs_uint32)(length_found > data_length ? data_length : length_found);
-                temp = rx_Read(rxcallp, bufferp, rbytes);
-                if (temp < rbytes) {
+                /* read rxbytes of data */
+                rxbytes = (afs_uint32)(length_found > data_length ? data_length : length_found);
+                temp = rx_Read(rxcallp, bufferp, rxbytes);
+                if (temp < rxbytes) {
                     /*
                      * If the file server returned (filesize - offset),
                      * then the first rx_Read will return zero octets of data.
@@ -2413,11 +2504,13 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                      * length_found and continue as if the file server said
                      * it was sending us zero octets of data.
                      */
-                    if (fs_fetchdata_offset_bug && first_read)
+                    if (fs_fetchdata_offset_bug && first_read) {
                         length_found = 0;
-                    else
-                        code = (rxcallp->error < 0) ? rxcallp->error : RX_PROTOCOL_ERROR;
-                    break;
+                        break;
+                    } else if (temp <= 0) {
+                        code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
+                        break;
+                    }
                 }
                 first_read = 0;
 
@@ -2433,18 +2526,18 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
              * all of the rest of the pages.
              */
 #ifdef USE_RX_IOVEC
-            rbytes = data_length - buffer_offset;
+            rxbytes = data_length - buffer_offset;
             bufferp = datap + buffer_offset;
 #else /* USE_RX_IOVEC */
             /* bytes fetched */
            osi_assertx((bufferp - datap) < LONG_MAX, "data >= LONG_MAX");
-            rbytes = (long) (bufferp - datap);
+            rxbytes = (long) (bufferp - datap);
 
             /* bytes left to zero */
-            rbytes = data_length - rbytes;
+            rxbytes = data_length - rxbytes;
 #endif /* USE_RX_IOVEC */
-            if (rbytes != 0)
-                memset(bufferp, 0, rbytes);
+            if (rxbytes != 0)
+                memset(bufferp, 0, rxbytes);
         }
 
         if (code == 0) {
@@ -2459,6 +2552,7 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                 osi_Log1(afsd_logp, "CALL EndRXAFS_FetchData skipped due to error %d", code);
         }
 
+       code1 = code;
         if (rxcallp)
             code1 = rx_EndCall(rxcallp, code);
 
@@ -2474,12 +2568,13 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
                 scp_locked = 0;
             }
             code = 0;
-        /* Prefer the error value from FetchData over rx_EndCall */
-        } else if (code == 0 && code1 != 0)
+        } else {
+           /* Prefer the error from rx_EndCall over any other error */
             code = code1;
+       }
         osi_Log0(afsd_logp, "CALL FetchData DONE");
 
-    } while (cm_Analyze(connp, userp, reqp, &scp->fid, &volSync, NULL, NULL, code));
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 0, &afsStatus, &volSync, NULL, NULL, code));
 
   fetchingcompleted:
     code = cm_MapRPCError(code, reqp);
@@ -2488,7 +2583,286 @@ long cm_GetData(cm_scache_t *scp, osi_hyper_t *offsetp, char *datap, int data_le
         lock_ObtainWrite(&scp->rw);
 
     if (code == 0)
-        cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
+        code = cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
+    else
+        InterlockedDecrement(&scp->activeRPCs);
+
+    *bytes_readp = (long) (bufferp - datap);
 
     return code;
 }
+
+/*
+ * cm_VerifyStoreData.   Function passed a rw locked cm_scache_t and a store data biod.
+ *
+ * Return 1 if the data verifies; 0 if not.
+ */
+
+long
+cm_VerifyStoreData(cm_bulkIO_t *biod, cm_scache_t *savedScp)
+{
+    long code=0;
+    afs_uint32 nbytes;                 /* bytes in transfer */
+    afs_uint32 nbytes_hi = 0;           /* high-order 32 bits of bytes in transfer */
+    afs_uint64 length_found = 0;
+    long rxbytes;                      /* bytes in rx_Read call */
+    long temp;
+    AFSFetchStatus afsStatus;
+    AFSCallBack callback;
+    AFSVolSync volSync;
+    AFSFid tfid;
+    struct rx_call *rxcallp;
+    struct rx_connection *rxconnp;
+    cm_conn_t *connp;
+    int require_64bit_ops = 0;
+    int call_was_64bit = 0;
+    int fs_fetchdata_offset_bug = 0;
+    int first_read = 1;
+    int scp_locked = 1;
+    char * bufferp = malloc(biod->length);
+    long verified = 0;
+    cm_scache_t *scp = biod->scp;
+    cm_user_t *userp = biod->userp;
+    cm_req_t *reqp = biod->reqp;
+    afs_uint64 dataVersion = scp->dataVersion;
+
+    memset(&afsStatus, 0, sizeof(afsStatus));
+    memset(&callback, 0, sizeof(callback));
+    memset(&volSync, 0, sizeof(volSync));
+    memset(bufferp, 0, biod->length);
+
+    cm_AFSFidFromFid(&tfid, &scp->fid);
+
+    if (LargeIntegerGreaterThan(LargeIntegerAdd(biod->offset,
+                                                ConvertLongToLargeInteger(biod->length)),
+                                ConvertLongToLargeInteger(LONG_MAX))) {
+        require_64bit_ops = 1;
+    }
+
+    InterlockedIncrement(&scp->activeRPCs);
+    osi_Log2(afsd_logp, "cm_VerifyStoreData: fetching data scp %p DV 0x%x", scp, scp->dataVersion);
+
+    if (scp_locked) {
+        lock_ReleaseWrite(&scp->rw);
+        scp_locked = 0;
+    }
+
+    /* now make the call */
+    do {
+       long code1;
+
+        code = cm_ConnFromFID(&scp->fid, userp, reqp, &connp);
+        if (code)
+            continue;
+
+        rxconnp = cm_GetRxConn(connp);
+        rxcallp = rx_NewCall(rxconnp);
+        rx_PutConnection(rxconnp);
+
+        nbytes = nbytes_hi = 0;
+
+        if (SERVERHAS64BIT(connp)) {
+            call_was_64bit = 1;
+
+            osi_Log4(afsd_logp, "CALL FetchData64 scp 0x%p, off 0x%x:%08x, size 0x%x",
+                     scp, biod->offset.HighPart, biod->offset.LowPart, biod->length);
+
+            code = StartRXAFS_FetchData64(rxcallp, &tfid, biod->offset.QuadPart, biod->length);
+
+            if (code == 0) {
+                temp = rx_Read32(rxcallp, &nbytes_hi);
+                if (temp == sizeof(afs_int32)) {
+                    nbytes_hi = ntohl(nbytes_hi);
+                } else {
+                    nbytes_hi = 0;
+                    code = rx_EndCall(rxcallp, RX_PROTOCOL_ERROR);
+                    rxcallp = NULL;
+                }
+            }
+        } else {
+            call_was_64bit = 0;
+        }
+
+        if (code == RXGEN_OPCODE || !SERVERHAS64BIT(connp)) {
+            if (require_64bit_ops) {
+                osi_Log0(afsd_logp, "Skipping FetchData.  Operation requires FetchData64");
+                code = CM_ERROR_TOOBIG;
+            } else {
+                if (!rxcallp) {
+                    rxconnp = cm_GetRxConn(connp);
+                    rxcallp = rx_NewCall(rxconnp);
+                    rx_PutConnection(rxconnp);
+                }
+
+                osi_Log3(afsd_logp, "CALL FetchData scp 0x%p, off 0x%x, size 0x%x",
+                         scp, biod->offset.LowPart, biod->length);
+
+                code = StartRXAFS_FetchData(rxcallp, &tfid, biod->offset.LowPart, biod->length);
+
+                SET_SERVERHASNO64BIT(connp);
+            }
+        }
+
+        if (code == 0) {
+            temp  = rx_Read32(rxcallp, &nbytes);
+            if (temp == sizeof(afs_int32)) {
+                nbytes = ntohl(nbytes);
+                FillInt64(length_found, nbytes_hi, nbytes);
+                if (length_found > biod->length) {
+                    /*
+                     * prior to 1.4.12 and 1.5.65 the file server would return
+                     * (filesize - offset) if the requested offset was greater than
+                     * the filesize.  The correct return value would have been zero.
+                     * Force a retry by returning an RX_PROTOCOL_ERROR.  If the cause
+                     * is a race between two RPCs issues by this cache manager, the
+                     * correct thing will happen the second time.
+                     */
+                    osi_Log0(afsd_logp, "cm_GetData length_found > biod.length");
+                    fs_fetchdata_offset_bug = 1;
+                }
+            } else {
+                osi_Log1(afsd_logp, "cm_GetData rx_Read32 returns %d != 4", temp);
+                code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
+            }
+        }
+        /* for the moment, nbytes_hi will always be 0 if code == 0
+           because data_length is a 32-bit quantity. */
+
+        if (code == 0) {
+            /* fill length_found of data from the pipe into the pages.
+             * When we stop, qdp will point at the last page we're
+             * dealing with, and bufferp will tell us where we
+             * stopped.  We'll need this info below when we clear
+             * the remainder of the last page out (and potentially
+             * clear later pages out, if we fetch past EOF).
+             */
+            while (length_found > 0) {
+                /* assert that there are still more buffers;
+                 * our check above for length_found being less than
+                 * data_length should ensure this.
+                 */
+                osi_assertx(bufferp != NULL, "null cm_buf_t");
+
+                /* read rxbytes of data */
+                rxbytes = (afs_uint32)(length_found > biod->length ? biod->length : length_found);
+                temp = rx_Read(rxcallp, bufferp, rxbytes);
+                if (temp < rxbytes) {
+                    /*
+                     * If the file server returned (filesize - offset),
+                     * then the first rx_Read will return zero octets of data.
+                     * If it does, do not treat it as an error.  Correct the
+                     * length_found and continue as if the file server said
+                     * it was sending us zero octets of data.
+                     */
+                    if (fs_fetchdata_offset_bug && first_read) {
+                        length_found = 0;
+                        break;
+                    } else if (temp <= 0) {
+                        code = (rx_Error(rxcallp) < 0) ? rx_Error(rxcallp) : RX_PROTOCOL_ERROR;
+                        break;
+                    }
+                }
+                first_read = 0;
+
+                /* and adjust counters */
+                length_found -= temp;
+            }
+        }
+
+        if (code == 0) {
+            if (call_was_64bit)
+                code = EndRXAFS_FetchData64(rxcallp, &afsStatus, &callback, &volSync);
+            else
+                code = EndRXAFS_FetchData(rxcallp, &afsStatus, &callback, &volSync);
+        } else {
+            if (call_was_64bit)
+                osi_Log1(afsd_logp, "CALL EndRXAFS_FetchData64 skipped due to error %d", code);
+            else
+                osi_Log1(afsd_logp, "CALL EndRXAFS_FetchData skipped due to error %d", code);
+        }
+
+       code1 = code;
+        if (rxcallp)
+            code1 = rx_EndCall(rxcallp, code);
+
+        if (code1 == RXKADUNKNOWNKEY)
+            osi_Log0(afsd_logp, "CALL EndCall returns RXKADUNKNOWNKEY");
+
+        /* If we are avoiding a file server bug, ignore the error state */
+        if (fs_fetchdata_offset_bug && first_read && length_found == 0 && code == -451) {
+            /* Clone the current status info and clear the error state */
+            scp_locked = cm_CloneStatus(scp, userp, scp_locked, &afsStatus, &volSync);
+            if (scp_locked) {
+                lock_ReleaseWrite(&scp->rw);
+                scp_locked = 0;
+            }
+            code = 0;
+        } else {
+           /* Prefer the error from rx_EndCall over any other error */
+            code = code1;
+       }
+        osi_Log0(afsd_logp, "CALL FetchData DONE");
+
+    } while (cm_Analyze(connp, userp, reqp, &scp->fid, NULL, 0, &afsStatus, &volSync, NULL, NULL, code));
+
+  fetchingcompleted:
+    code = cm_MapRPCError(code, reqp);
+
+    if (!scp_locked)
+        lock_ObtainWrite(&scp->rw);
+
+    if (code == 0)
+        code = cm_MergeStatus(NULL, scp, &afsStatus, &volSync, userp, reqp, CM_MERGEFLAG_FETCHDATA);
+    else
+        InterlockedDecrement(&scp->activeRPCs);
+
+    if (code == 0)
+    {
+        if (dataVersion == scp->dataVersion)
+        {
+            osi_queueData_t *qdp = NULL;
+            cm_buf_t *bufp;
+            afs_uint32 buf_offset;
+            afs_uint32 bytes_compared = 0;
+            afs_uint32 cmp_length;
+            int md5_match = 1;
+
+            verified = 1;
+
+            while ( bytes_compared < biod->length )
+            {
+                if (qdp == NULL) {
+                    qdp = biod->bufListEndp;
+                    buf_offset = biod->offset.LowPart % cm_data.buf_blockSize;
+                } else {
+                    qdp = (osi_queueData_t *) osi_QPrev(&qdp->q);
+                    buf_offset = 0;
+                }
+                cmp_length =  cm_data.buf_blockSize - buf_offset;
+                if (cmp_length > biod->length - bytes_compared)
+                    cmp_length = biod->length - bytes_compared;
+
+                osi_assertx(qdp != NULL, "null osi_queueData_t");
+                bufp = osi_GetQData(qdp);
+
+                if (memcmp(bufferp+bytes_compared, bufp->datap+buf_offset, cmp_length) != 0)
+                {
+                    verified = 0;
+                    md5_match = buf_ValidateCheckSum(bufp);
+
+                    osi_Log5(afsd_logp, "cm_VerifyDataStore verification failed scp 0x%p bufp 0x%p offset 0x%x:%08x md5 %s",
+                             scp, bufp, bufp->offset.HighPart, bufp->offset.LowPart, md5_match ? "match" : "no-match");
+                }
+                bytes_compared += cmp_length;
+            }
+        } else {
+            osi_Log4(afsd_logp, "cm_VerifyStoreData unable to verify due to data version change scp 0x%p, off 0x%x:%08x, size 0x%x",
+                     scp, biod->offset.HighPart, biod->offset.LowPart, biod->length);
+        }
+    }
+
+    if (bufferp)
+        free(bufferp);
+
+    return verified;
+}