The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/fs/nfsserver/nfs_nfsdport.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * SPDX-License-Identifier: BSD-3-Clause
    3  *
    4  * Copyright (c) 1989, 1993
    5  *      The Regents of the University of California.  All rights reserved.
    6  *
    7  * This code is derived from software contributed to Berkeley by
    8  * Rick Macklem at The University of Guelph.
    9  *
   10  * Redistribution and use in source and binary forms, with or without
   11  * modification, are permitted provided that the following conditions
   12  * are met:
   13  * 1. Redistributions of source code must retain the above copyright
   14  *    notice, this list of conditions and the following disclaimer.
   15  * 2. Redistributions in binary form must reproduce the above copyright
   16  *    notice, this list of conditions and the following disclaimer in the
   17  *    documentation and/or other materials provided with the distribution.
   18  * 3. Neither the name of the University nor the names of its contributors
   19  *    may be used to endorse or promote products derived from this software
   20  *    without specific prior written permission.
   21  *
   22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   32  * SUCH DAMAGE.
   33  *
   34  */
   35 
   36 #include <sys/cdefs.h>
   37 __FBSDID("$FreeBSD$");
   38 
   39 #include <sys/capsicum.h>
   40 #include <sys/extattr.h>
   41 
   42 /*
   43  * Functions that perform the vfs operations required by the routines in
   44  * nfsd_serv.c. It is hoped that this change will make the server more
   45  * portable.
   46  */
   47 
   48 #include <fs/nfs/nfsport.h>
   49 #include <security/mac/mac_framework.h>
   50 #include <sys/filio.h>
   51 #include <sys/hash.h>
   52 #include <sys/sysctl.h>
   53 #include <nlm/nlm_prot.h>
   54 #include <nlm/nlm.h>
   55 
   56 FEATURE(nfsd, "NFSv4 server");
   57 
   58 extern u_int32_t newnfs_true, newnfs_false, newnfs_xdrneg1;
   59 extern int nfsrv_useacl;
   60 extern int newnfs_numnfsd;
   61 extern struct mount nfsv4root_mnt;
   62 extern struct nfsrv_stablefirst nfsrv_stablefirst;
   63 extern void (*nfsd_call_servertimer)(void);
   64 extern SVCPOOL  *nfsrvd_pool;
   65 extern struct nfsv4lock nfsd_suspend_lock;
   66 extern struct nfsclienthashhead *nfsclienthash;
   67 extern struct nfslockhashhead *nfslockhash;
   68 extern struct nfssessionhash *nfssessionhash;
   69 extern int nfsrv_sessionhashsize;
   70 extern struct nfsstatsv1 nfsstatsv1;
   71 extern struct nfslayouthash *nfslayouthash;
   72 extern int nfsrv_layouthashsize;
   73 extern struct mtx nfsrv_dslock_mtx;
   74 extern int nfs_pnfsiothreads;
   75 extern struct nfsdontlisthead nfsrv_dontlisthead;
   76 extern volatile int nfsrv_dontlistlen;
   77 extern volatile int nfsrv_devidcnt;
   78 extern int nfsrv_maxpnfsmirror;
   79 struct vfsoptlist nfsv4root_opt, nfsv4root_newopt;
   80 NFSDLOCKMUTEX;
   81 NFSSTATESPINLOCK;
   82 struct nfsrchash_bucket nfsrchash_table[NFSRVCACHE_HASHSIZE];
   83 struct nfsrchash_bucket nfsrcahash_table[NFSRVCACHE_HASHSIZE];
   84 struct mtx nfsrc_udpmtx;
   85 struct mtx nfs_v4root_mutex;
   86 struct mtx nfsrv_dontlistlock_mtx;
   87 struct mtx nfsrv_recalllock_mtx;
   88 struct nfsrvfh nfs_rootfh, nfs_pubfh;
   89 int nfs_pubfhset = 0, nfs_rootfhset = 0;
   90 struct proc *nfsd_master_proc = NULL;
   91 int nfsd_debuglevel = 0;
   92 static pid_t nfsd_master_pid = (pid_t)-1;
   93 static char nfsd_master_comm[MAXCOMLEN + 1];
   94 static struct timeval nfsd_master_start;
   95 static uint32_t nfsv4_sysid = 0;
   96 static fhandle_t zerofh;
   97 
   98 static int nfssvc_srvcall(struct thread *, struct nfssvc_args *,
   99     struct ucred *);
  100 
  101 int nfsrv_enable_crossmntpt = 1;
  102 static int nfs_commit_blks;
  103 static int nfs_commit_miss;
  104 extern int nfsrv_issuedelegs;
  105 extern int nfsrv_dolocallocks;
  106 extern int nfsd_enable_stringtouid;
  107 extern struct nfsdevicehead nfsrv_devidhead;
  108 
  109 static int nfsrv_createiovec(int, struct mbuf **, struct mbuf **,
  110     struct iovec **);
  111 static int nfsrv_createiovec_extpgs(int, int, struct mbuf **,
  112     struct mbuf **, struct iovec **);
  113 static int nfsrv_createiovecw(int, struct mbuf *, char *, struct iovec **,
  114     int *);
  115 static void nfsrv_pnfscreate(struct vnode *, struct vattr *, struct ucred *,
  116     NFSPROC_T *);
  117 static void nfsrv_pnfsremovesetup(struct vnode *, NFSPROC_T *, struct vnode **,
  118     int *, char *, fhandle_t *);
  119 static void nfsrv_pnfsremove(struct vnode **, int, char *, fhandle_t *,
  120     NFSPROC_T *);
  121 static int nfsrv_proxyds(struct vnode *, off_t, int, struct ucred *,
  122     struct thread *, int, struct mbuf **, char *, struct mbuf **,
  123     struct nfsvattr *, struct acl *, off_t *, int, bool *);
  124 static int nfsrv_setextattr(struct vnode *, struct nfsvattr *, NFSPROC_T *);
  125 static int nfsrv_readdsrpc(fhandle_t *, off_t, int, struct ucred *,
  126     NFSPROC_T *, struct nfsmount *, struct mbuf **, struct mbuf **);
  127 static int nfsrv_writedsrpc(fhandle_t *, off_t, int, struct ucred *,
  128     NFSPROC_T *, struct vnode *, struct nfsmount **, int, struct mbuf **,
  129     char *, int *);
  130 static int nfsrv_allocatedsrpc(fhandle_t *, off_t, off_t, struct ucred *,
  131     NFSPROC_T *, struct vnode *, struct nfsmount **, int, int *);
  132 static int nfsrv_setacldsrpc(fhandle_t *, struct ucred *, NFSPROC_T *,
  133     struct vnode *, struct nfsmount **, int, struct acl *, int *);
  134 static int nfsrv_setattrdsrpc(fhandle_t *, struct ucred *, NFSPROC_T *,
  135     struct vnode *, struct nfsmount **, int, struct nfsvattr *, int *);
  136 static int nfsrv_getattrdsrpc(fhandle_t *, struct ucred *, NFSPROC_T *,
  137     struct vnode *, struct nfsmount *, struct nfsvattr *);
  138 static int nfsrv_seekdsrpc(fhandle_t *, off_t *, int, bool *, struct ucred *,
  139     NFSPROC_T *, struct nfsmount *);
  140 static int nfsrv_putfhname(fhandle_t *, char *);
  141 static int nfsrv_pnfslookupds(struct vnode *, struct vnode *,
  142     struct pnfsdsfile *, struct vnode **, NFSPROC_T *);
  143 static void nfsrv_pnfssetfh(struct vnode *, struct pnfsdsfile *, char *, char *,
  144     struct vnode *, NFSPROC_T *);
  145 static int nfsrv_dsremove(struct vnode *, char *, struct ucred *, NFSPROC_T *);
  146 static int nfsrv_dssetacl(struct vnode *, struct acl *, struct ucred *,
  147     NFSPROC_T *);
  148 static int nfsrv_pnfsstatfs(struct statfs *, struct mount *);
  149 
  150 int nfs_pnfsio(task_fn_t *, void *);
  151 
  152 SYSCTL_NODE(_vfs, OID_AUTO, nfsd, CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
  153     "NFS server");
  154 SYSCTL_INT(_vfs_nfsd, OID_AUTO, mirrormnt, CTLFLAG_RW,
  155     &nfsrv_enable_crossmntpt, 0, "Enable nfsd to cross mount points");
  156 SYSCTL_INT(_vfs_nfsd, OID_AUTO, commit_blks, CTLFLAG_RW, &nfs_commit_blks,
  157     0, "");
  158 SYSCTL_INT(_vfs_nfsd, OID_AUTO, commit_miss, CTLFLAG_RW, &nfs_commit_miss,
  159     0, "");
  160 SYSCTL_INT(_vfs_nfsd, OID_AUTO, issue_delegations, CTLFLAG_RW,
  161     &nfsrv_issuedelegs, 0, "Enable nfsd to issue delegations");
  162 SYSCTL_INT(_vfs_nfsd, OID_AUTO, enable_locallocks, CTLFLAG_RW,
  163     &nfsrv_dolocallocks, 0, "Enable nfsd to acquire local locks on files");
  164 SYSCTL_INT(_vfs_nfsd, OID_AUTO, debuglevel, CTLFLAG_RW, &nfsd_debuglevel,
  165     0, "Debug level for NFS server");
  166 SYSCTL_INT(_vfs_nfsd, OID_AUTO, enable_stringtouid, CTLFLAG_RW,
  167     &nfsd_enable_stringtouid, 0, "Enable nfsd to accept numeric owner_names");
  168 static int nfsrv_pnfsgetdsattr = 1;
  169 SYSCTL_INT(_vfs_nfsd, OID_AUTO, pnfsgetdsattr, CTLFLAG_RW,
  170     &nfsrv_pnfsgetdsattr, 0, "When set getattr gets DS attributes via RPC");
  171 
  172 /*
  173  * nfsrv_dsdirsize can only be increased and only when the nfsd threads are
  174  * not running.
  175  * The dsN subdirectories for the increased values must have been created
  176  * on all DS servers before this increase is done.
  177  */
  178 u_int   nfsrv_dsdirsize = 20;
  179 static int
  180 sysctl_dsdirsize(SYSCTL_HANDLER_ARGS)
  181 {
  182         int error, newdsdirsize;
  183 
  184         newdsdirsize = nfsrv_dsdirsize;
  185         error = sysctl_handle_int(oidp, &newdsdirsize, 0, req);
  186         if (error != 0 || req->newptr == NULL)
  187                 return (error);
  188         if (newdsdirsize <= nfsrv_dsdirsize || newdsdirsize > 10000 ||
  189             newnfs_numnfsd != 0)
  190                 return (EINVAL);
  191         nfsrv_dsdirsize = newdsdirsize;
  192         return (0);
  193 }
  194 SYSCTL_PROC(_vfs_nfsd, OID_AUTO, dsdirsize,
  195     CTLTYPE_UINT | CTLFLAG_MPSAFE | CTLFLAG_RW, 0, sizeof(nfsrv_dsdirsize),
  196     sysctl_dsdirsize, "IU", "Number of dsN subdirs on the DS servers");
  197 
  198 #define MAX_REORDERED_RPC       16
  199 #define NUM_HEURISTIC           1031
  200 #define NHUSE_INIT              64
  201 #define NHUSE_INC               16
  202 #define NHUSE_MAX               2048
  203 
  204 static struct nfsheur {
  205         struct vnode *nh_vp;    /* vp to match (unreferenced pointer) */
  206         off_t nh_nextoff;       /* next offset for sequential detection */
  207         int nh_use;             /* use count for selection */
  208         int nh_seqcount;        /* heuristic */
  209 } nfsheur[NUM_HEURISTIC];
  210 
  211 /*
  212  * Heuristic to detect sequential operation.
  213  */
  214 static struct nfsheur *
  215 nfsrv_sequential_heuristic(struct uio *uio, struct vnode *vp)
  216 {
  217         struct nfsheur *nh;
  218         int hi, try;
  219 
  220         /* Locate best candidate. */
  221         try = 32;
  222         hi = ((int)(vm_offset_t)vp / sizeof(struct vnode)) % NUM_HEURISTIC;
  223         nh = &nfsheur[hi];
  224         while (try--) {
  225                 if (nfsheur[hi].nh_vp == vp) {
  226                         nh = &nfsheur[hi];
  227                         break;
  228                 }
  229                 if (nfsheur[hi].nh_use > 0)
  230                         --nfsheur[hi].nh_use;
  231                 hi = (hi + 1) % NUM_HEURISTIC;
  232                 if (nfsheur[hi].nh_use < nh->nh_use)
  233                         nh = &nfsheur[hi];
  234         }
  235 
  236         /* Initialize hint if this is a new file. */
  237         if (nh->nh_vp != vp) {
  238                 nh->nh_vp = vp;
  239                 nh->nh_nextoff = uio->uio_offset;
  240                 nh->nh_use = NHUSE_INIT;
  241                 if (uio->uio_offset == 0)
  242                         nh->nh_seqcount = 4;
  243                 else
  244                         nh->nh_seqcount = 1;
  245         }
  246 
  247         /* Calculate heuristic. */
  248         if ((uio->uio_offset == 0 && nh->nh_seqcount > 0) ||
  249             uio->uio_offset == nh->nh_nextoff) {
  250                 /* See comments in vfs_vnops.c:sequential_heuristic(). */
  251                 nh->nh_seqcount += howmany(uio->uio_resid, 16384);
  252                 if (nh->nh_seqcount > IO_SEQMAX)
  253                         nh->nh_seqcount = IO_SEQMAX;
  254         } else if (qabs(uio->uio_offset - nh->nh_nextoff) <= MAX_REORDERED_RPC *
  255             imax(vp->v_mount->mnt_stat.f_iosize, uio->uio_resid)) {
  256                 /* Probably a reordered RPC, leave seqcount alone. */
  257         } else if (nh->nh_seqcount > 1) {
  258                 nh->nh_seqcount /= 2;
  259         } else {
  260                 nh->nh_seqcount = 0;
  261         }
  262         nh->nh_use += NHUSE_INC;
  263         if (nh->nh_use > NHUSE_MAX)
  264                 nh->nh_use = NHUSE_MAX;
  265         return (nh);
  266 }
  267 
  268 /*
  269  * Get attributes into nfsvattr structure.
  270  */
  271 int
  272 nfsvno_getattr(struct vnode *vp, struct nfsvattr *nvap,
  273     struct nfsrv_descript *nd, struct thread *p, int vpislocked,
  274     nfsattrbit_t *attrbitp)
  275 {
  276         int error, gotattr, lockedit = 0;
  277         struct nfsvattr na;
  278 
  279         if (vpislocked == 0) {
  280                 /*
  281                  * When vpislocked == 0, the vnode is either exclusively
  282                  * locked by this thread or not locked by this thread.
  283                  * As such, shared lock it, if not exclusively locked.
  284                  */
  285                 if (NFSVOPISLOCKED(vp) != LK_EXCLUSIVE) {
  286                         lockedit = 1;
  287                         NFSVOPLOCK(vp, LK_SHARED | LK_RETRY);
  288                 }
  289         }
  290 
  291         /*
  292          * Acquire the Change, Size, TimeAccess, TimeModify and SpaceUsed
  293          * attributes, as required.
  294          * This needs to be done for regular files if:
  295          * - non-NFSv4 RPCs or
  296          * - when attrbitp == NULL or
  297          * - an NFSv4 RPC with any of the above attributes in attrbitp.
  298          * A return of 0 for nfsrv_proxyds() indicates that it has acquired
  299          * these attributes.  nfsrv_proxyds() will return an error if the
  300          * server is not a pNFS one.
  301          */
  302         gotattr = 0;
  303         if (vp->v_type == VREG && nfsrv_devidcnt > 0 && (attrbitp == NULL ||
  304             (nd->nd_flag & ND_NFSV4) == 0 ||
  305             NFSISSET_ATTRBIT(attrbitp, NFSATTRBIT_CHANGE) ||
  306             NFSISSET_ATTRBIT(attrbitp, NFSATTRBIT_SIZE) ||
  307             NFSISSET_ATTRBIT(attrbitp, NFSATTRBIT_TIMEACCESS) ||
  308             NFSISSET_ATTRBIT(attrbitp, NFSATTRBIT_TIMEMODIFY) ||
  309             NFSISSET_ATTRBIT(attrbitp, NFSATTRBIT_SPACEUSED))) {
  310                 error = nfsrv_proxyds(vp, 0, 0, nd->nd_cred, p,
  311                     NFSPROC_GETATTR, NULL, NULL, NULL, &na, NULL, NULL, 0,
  312                     NULL);
  313                 if (error == 0)
  314                         gotattr = 1;
  315         }
  316 
  317         error = VOP_GETATTR(vp, &nvap->na_vattr, nd->nd_cred);
  318         if (lockedit != 0)
  319                 NFSVOPUNLOCK(vp);
  320 
  321         /*
  322          * If we got the Change, Size and Modify Time from the DS,
  323          * replace them.
  324          */
  325         if (gotattr != 0) {
  326                 nvap->na_atime = na.na_atime;
  327                 nvap->na_mtime = na.na_mtime;
  328                 nvap->na_filerev = na.na_filerev;
  329                 nvap->na_size = na.na_size;
  330                 nvap->na_bytes = na.na_bytes;
  331         }
  332         NFSD_DEBUG(4, "nfsvno_getattr: gotattr=%d err=%d chg=%ju\n", gotattr,
  333             error, (uintmax_t)na.na_filerev);
  334 
  335         NFSEXITCODE(error);
  336         return (error);
  337 }
  338 
  339 /*
  340  * Get a file handle for a vnode.
  341  */
  342 int
  343 nfsvno_getfh(struct vnode *vp, fhandle_t *fhp, struct thread *p)
  344 {
  345         int error;
  346 
  347         NFSBZERO((caddr_t)fhp, sizeof(fhandle_t));
  348         fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
  349         error = VOP_VPTOFH(vp, &fhp->fh_fid);
  350 
  351         NFSEXITCODE(error);
  352         return (error);
  353 }
  354 
  355 /*
  356  * Perform access checking for vnodes obtained from file handles that would
  357  * refer to files already opened by a Unix client. You cannot just use
  358  * vn_writechk() and VOP_ACCESSX() for two reasons.
  359  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write
  360  *     case.
  361  * 2 - The owner is to be given access irrespective of mode bits for some
  362  *     operations, so that processes that chmod after opening a file don't
  363  *     break.
  364  */
  365 int
  366 nfsvno_accchk(struct vnode *vp, accmode_t accmode, struct ucred *cred,
  367     struct nfsexstuff *exp, struct thread *p, int override, int vpislocked,
  368     u_int32_t *supportedtypep)
  369 {
  370         struct vattr vattr;
  371         int error = 0, getret = 0;
  372 
  373         if (vpislocked == 0) {
  374                 if (NFSVOPLOCK(vp, LK_SHARED) != 0) {
  375                         error = EPERM;
  376                         goto out;
  377                 }
  378         }
  379         if (accmode & VWRITE) {
  380                 /* Just vn_writechk() changed to check rdonly */
  381                 /*
  382                  * Disallow write attempts on read-only file systems;
  383                  * unless the file is a socket or a block or character
  384                  * device resident on the file system.
  385                  */
  386                 if (NFSVNO_EXRDONLY(exp) ||
  387                     (vp->v_mount->mnt_flag & MNT_RDONLY)) {
  388                         switch (vp->v_type) {
  389                         case VREG:
  390                         case VDIR:
  391                         case VLNK:
  392                                 error = EROFS;
  393                         default:
  394                                 break;
  395                         }
  396                 }
  397                 /*
  398                  * If there's shared text associated with
  399                  * the inode, try to free it up once.  If
  400                  * we fail, we can't allow writing.
  401                  */
  402                 if (VOP_IS_TEXT(vp) && error == 0)
  403                         error = ETXTBSY;
  404         }
  405         if (error != 0) {
  406                 if (vpislocked == 0)
  407                         NFSVOPUNLOCK(vp);
  408                 goto out;
  409         }
  410 
  411         /*
  412          * Should the override still be applied when ACLs are enabled?
  413          */
  414         error = VOP_ACCESSX(vp, accmode, cred, p);
  415         if (error != 0 && (accmode & (VDELETE | VDELETE_CHILD))) {
  416                 /*
  417                  * Try again with VEXPLICIT_DENY, to see if the test for
  418                  * deletion is supported.
  419                  */
  420                 error = VOP_ACCESSX(vp, accmode | VEXPLICIT_DENY, cred, p);
  421                 if (error == 0) {
  422                         if (vp->v_type == VDIR) {
  423                                 accmode &= ~(VDELETE | VDELETE_CHILD);
  424                                 accmode |= VWRITE;
  425                                 error = VOP_ACCESSX(vp, accmode, cred, p);
  426                         } else if (supportedtypep != NULL) {
  427                                 *supportedtypep &= ~NFSACCESS_DELETE;
  428                         }
  429                 }
  430         }
  431 
  432         /*
  433          * Allow certain operations for the owner (reads and writes
  434          * on files that are already open).
  435          */
  436         if (override != NFSACCCHK_NOOVERRIDE &&
  437             (error == EPERM || error == EACCES)) {
  438                 if (cred->cr_uid == 0 && (override & NFSACCCHK_ALLOWROOT))
  439                         error = 0;
  440                 else if (override & NFSACCCHK_ALLOWOWNER) {
  441                         getret = VOP_GETATTR(vp, &vattr, cred);
  442                         if (getret == 0 && cred->cr_uid == vattr.va_uid)
  443                                 error = 0;
  444                 }
  445         }
  446         if (vpislocked == 0)
  447                 NFSVOPUNLOCK(vp);
  448 
  449 out:
  450         NFSEXITCODE(error);
  451         return (error);
  452 }
  453 
  454 /*
  455  * Set attribute(s) vnop.
  456  */
  457 int
  458 nfsvno_setattr(struct vnode *vp, struct nfsvattr *nvap, struct ucred *cred,
  459     struct thread *p, struct nfsexstuff *exp)
  460 {
  461         u_quad_t savsize = 0;
  462         int error, savedit;
  463         time_t savbtime;
  464 
  465         /*
  466          * If this is an exported file system and a pNFS service is running,
  467          * don't VOP_SETATTR() of size for the MDS file system.
  468          */
  469         savedit = 0;
  470         error = 0;
  471         if (vp->v_type == VREG && (vp->v_mount->mnt_flag & MNT_EXPORTED) != 0 &&
  472             nfsrv_devidcnt != 0 && nvap->na_vattr.va_size != VNOVAL &&
  473             nvap->na_vattr.va_size > 0) {
  474                 savsize = nvap->na_vattr.va_size;
  475                 nvap->na_vattr.va_size = VNOVAL;
  476                 if (nvap->na_vattr.va_uid != (uid_t)VNOVAL ||
  477                     nvap->na_vattr.va_gid != (gid_t)VNOVAL ||
  478                     nvap->na_vattr.va_mode != (mode_t)VNOVAL ||
  479                     nvap->na_vattr.va_atime.tv_sec != VNOVAL ||
  480                     nvap->na_vattr.va_mtime.tv_sec != VNOVAL)
  481                         savedit = 1;
  482                 else
  483                         savedit = 2;
  484         }
  485         if (savedit != 2)
  486                 error = VOP_SETATTR(vp, &nvap->na_vattr, cred);
  487         if (savedit != 0)
  488                 nvap->na_vattr.va_size = savsize;
  489         if (error == 0 && (nvap->na_vattr.va_uid != (uid_t)VNOVAL ||
  490             nvap->na_vattr.va_gid != (gid_t)VNOVAL ||
  491             nvap->na_vattr.va_size != VNOVAL ||
  492             nvap->na_vattr.va_mode != (mode_t)VNOVAL ||
  493             nvap->na_vattr.va_atime.tv_sec != VNOVAL ||
  494             nvap->na_vattr.va_mtime.tv_sec != VNOVAL)) {
  495                 /* Never modify birthtime on a DS file. */
  496                 savbtime = nvap->na_vattr.va_birthtime.tv_sec;
  497                 nvap->na_vattr.va_birthtime.tv_sec = VNOVAL;
  498                 /* For a pNFS server, set the attributes on the DS file. */
  499                 error = nfsrv_proxyds(vp, 0, 0, cred, p, NFSPROC_SETATTR,
  500                     NULL, NULL, NULL, nvap, NULL, NULL, 0, NULL);
  501                 nvap->na_vattr.va_birthtime.tv_sec = savbtime;
  502                 if (error == ENOENT)
  503                         error = 0;
  504         }
  505         NFSEXITCODE(error);
  506         return (error);
  507 }
  508 
  509 /*
  510  * Set up nameidata for a lookup() call and do it.
  511  */
  512 int
  513 nfsvno_namei(struct nfsrv_descript *nd, struct nameidata *ndp,
  514     struct vnode *dp, int islocked, struct nfsexstuff *exp, struct thread *p,
  515     struct vnode **retdirp)
  516 {
  517         struct componentname *cnp = &ndp->ni_cnd;
  518         int i;
  519         struct iovec aiov;
  520         struct uio auio;
  521         int lockleaf = (cnp->cn_flags & LOCKLEAF) != 0, linklen;
  522         int error = 0;
  523         char *cp;
  524 
  525         *retdirp = NULL;
  526         cnp->cn_nameptr = cnp->cn_pnbuf;
  527         ndp->ni_lcf = 0;
  528         /*
  529          * Extract and set starting directory.
  530          */
  531         if (dp->v_type != VDIR) {
  532                 if (islocked)
  533                         vput(dp);
  534                 else
  535                         vrele(dp);
  536                 nfsvno_relpathbuf(ndp);
  537                 error = ENOTDIR;
  538                 goto out1;
  539         }
  540         if (islocked)
  541                 NFSVOPUNLOCK(dp);
  542         VREF(dp);
  543         *retdirp = dp;
  544         if (NFSVNO_EXRDONLY(exp))
  545                 cnp->cn_flags |= RDONLY;
  546         ndp->ni_segflg = UIO_SYSSPACE;
  547 
  548         if (nd->nd_flag & ND_PUBLOOKUP) {
  549                 ndp->ni_loopcnt = 0;
  550                 if (cnp->cn_pnbuf[0] == '/') {
  551                         vrele(dp);
  552                         /*
  553                          * Check for degenerate pathnames here, since lookup()
  554                          * panics on them.
  555                          */
  556                         for (i = 1; i < ndp->ni_pathlen; i++)
  557                                 if (cnp->cn_pnbuf[i] != '/')
  558                                         break;
  559                         if (i == ndp->ni_pathlen) {
  560                                 error = NFSERR_ACCES;
  561                                 goto out;
  562                         }
  563                         dp = rootvnode;
  564                         VREF(dp);
  565                 }
  566         } else if ((nfsrv_enable_crossmntpt == 0 && NFSVNO_EXPORTED(exp)) ||
  567             (nd->nd_flag & ND_NFSV4) == 0) {
  568                 /*
  569                  * Only cross mount points for NFSv4 when doing a
  570                  * mount while traversing the file system above
  571                  * the mount point, unless nfsrv_enable_crossmntpt is set.
  572                  */
  573                 cnp->cn_flags |= NOCROSSMOUNT;
  574         }
  575 
  576         /*
  577          * Initialize for scan, set ni_startdir and bump ref on dp again
  578          * because lookup() will dereference ni_startdir.
  579          */
  580 
  581         cnp->cn_thread = p;
  582         ndp->ni_startdir = dp;
  583         ndp->ni_rootdir = rootvnode;
  584         ndp->ni_topdir = NULL;
  585 
  586         if (!lockleaf)
  587                 cnp->cn_flags |= LOCKLEAF;
  588         for (;;) {
  589                 cnp->cn_nameptr = cnp->cn_pnbuf;
  590                 /*
  591                  * Call lookup() to do the real work.  If an error occurs,
  592                  * ndp->ni_vp and ni_dvp are left uninitialized or NULL and
  593                  * we do not have to dereference anything before returning.
  594                  * In either case ni_startdir will be dereferenced and NULLed
  595                  * out.
  596                  */
  597                 error = lookup(ndp);
  598                 if (error)
  599                         break;
  600 
  601                 /*
  602                  * Check for encountering a symbolic link.  Trivial
  603                  * termination occurs if no symlink encountered.
  604                  */
  605                 if ((cnp->cn_flags & ISSYMLINK) == 0) {
  606                         if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0)
  607                                 nfsvno_relpathbuf(ndp);
  608                         if (ndp->ni_vp && !lockleaf)
  609                                 NFSVOPUNLOCK(ndp->ni_vp);
  610                         break;
  611                 }
  612 
  613                 /*
  614                  * Validate symlink
  615                  */
  616                 if ((cnp->cn_flags & LOCKPARENT) && ndp->ni_pathlen == 1)
  617                         NFSVOPUNLOCK(ndp->ni_dvp);
  618                 if (!(nd->nd_flag & ND_PUBLOOKUP)) {
  619                         error = EINVAL;
  620                         goto badlink2;
  621                 }
  622 
  623                 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
  624                         error = ELOOP;
  625                         goto badlink2;
  626                 }
  627                 if (ndp->ni_pathlen > 1)
  628                         cp = uma_zalloc(namei_zone, M_WAITOK);
  629                 else
  630                         cp = cnp->cn_pnbuf;
  631                 aiov.iov_base = cp;
  632                 aiov.iov_len = MAXPATHLEN;
  633                 auio.uio_iov = &aiov;
  634                 auio.uio_iovcnt = 1;
  635                 auio.uio_offset = 0;
  636                 auio.uio_rw = UIO_READ;
  637                 auio.uio_segflg = UIO_SYSSPACE;
  638                 auio.uio_td = NULL;
  639                 auio.uio_resid = MAXPATHLEN;
  640                 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred);
  641                 if (error) {
  642                 badlink1:
  643                         if (ndp->ni_pathlen > 1)
  644                                 uma_zfree(namei_zone, cp);
  645                 badlink2:
  646                         vrele(ndp->ni_dvp);
  647                         vput(ndp->ni_vp);
  648                         break;
  649                 }
  650                 linklen = MAXPATHLEN - auio.uio_resid;
  651                 if (linklen == 0) {
  652                         error = ENOENT;
  653                         goto badlink1;
  654                 }
  655                 if (linklen + ndp->ni_pathlen >= MAXPATHLEN) {
  656                         error = ENAMETOOLONG;
  657                         goto badlink1;
  658                 }
  659 
  660                 /*
  661                  * Adjust or replace path
  662                  */
  663                 if (ndp->ni_pathlen > 1) {
  664                         NFSBCOPY(ndp->ni_next, cp + linklen, ndp->ni_pathlen);
  665                         uma_zfree(namei_zone, cnp->cn_pnbuf);
  666                         cnp->cn_pnbuf = cp;
  667                 } else
  668                         cnp->cn_pnbuf[linklen] = '\0';
  669                 ndp->ni_pathlen += linklen;
  670 
  671                 /*
  672                  * Cleanup refs for next loop and check if root directory
  673                  * should replace current directory.  Normally ni_dvp
  674                  * becomes the new base directory and is cleaned up when
  675                  * we loop.  Explicitly null pointers after invalidation
  676                  * to clarify operation.
  677                  */
  678                 vput(ndp->ni_vp);
  679                 ndp->ni_vp = NULL;
  680 
  681                 if (cnp->cn_pnbuf[0] == '/') {
  682                         vrele(ndp->ni_dvp);
  683                         ndp->ni_dvp = ndp->ni_rootdir;
  684                         VREF(ndp->ni_dvp);
  685                 }
  686                 ndp->ni_startdir = ndp->ni_dvp;
  687                 ndp->ni_dvp = NULL;
  688         }
  689         if (!lockleaf)
  690                 cnp->cn_flags &= ~LOCKLEAF;
  691 
  692 out:
  693         if (error) {
  694                 nfsvno_relpathbuf(ndp);
  695                 ndp->ni_vp = NULL;
  696                 ndp->ni_dvp = NULL;
  697                 ndp->ni_startdir = NULL;
  698         } else if ((ndp->ni_cnd.cn_flags & (WANTPARENT|LOCKPARENT)) == 0) {
  699                 ndp->ni_dvp = NULL;
  700         }
  701 
  702 out1:
  703         NFSEXITCODE2(error, nd);
  704         return (error);
  705 }
  706 
  707 /*
  708  * Set up a pathname buffer and return a pointer to it and, optionally
  709  * set a hash pointer.
  710  */
  711 void
  712 nfsvno_setpathbuf(struct nameidata *ndp, char **bufpp, u_long **hashpp)
  713 {
  714         struct componentname *cnp = &ndp->ni_cnd;
  715 
  716         cnp->cn_flags |= (NOMACCHECK | HASBUF);
  717         cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK);
  718         if (hashpp != NULL)
  719                 *hashpp = NULL;
  720         *bufpp = cnp->cn_pnbuf;
  721 }
  722 
  723 /*
  724  * Release the above path buffer, if not released by nfsvno_namei().
  725  */
  726 void
  727 nfsvno_relpathbuf(struct nameidata *ndp)
  728 {
  729 
  730         if ((ndp->ni_cnd.cn_flags & HASBUF) == 0)
  731                 panic("nfsrelpath");
  732         uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf);
  733         ndp->ni_cnd.cn_flags &= ~HASBUF;
  734 }
  735 
  736 /*
  737  * Readlink vnode op into an mbuf list.
  738  */
  739 int
  740 nfsvno_readlink(struct vnode *vp, struct ucred *cred, int maxextsiz,
  741     struct thread *p, struct mbuf **mpp, struct mbuf **mpendp, int *lenp)
  742 {
  743         struct iovec *iv;
  744         struct uio io, *uiop = &io;
  745         struct mbuf *mp, *mp3;
  746         int len, tlen, error = 0;
  747 
  748         len = NFS_MAXPATHLEN;
  749         if (maxextsiz > 0)
  750                 uiop->uio_iovcnt = nfsrv_createiovec_extpgs(len, maxextsiz,
  751                     &mp3, &mp, &iv);
  752         else
  753                 uiop->uio_iovcnt = nfsrv_createiovec(len, &mp3, &mp, &iv);
  754         uiop->uio_iov = iv;
  755         uiop->uio_offset = 0;
  756         uiop->uio_resid = len;
  757         uiop->uio_rw = UIO_READ;
  758         uiop->uio_segflg = UIO_SYSSPACE;
  759         uiop->uio_td = NULL;
  760         error = VOP_READLINK(vp, uiop, cred);
  761         free(iv, M_TEMP);
  762         if (error) {
  763                 m_freem(mp3);
  764                 *lenp = 0;
  765                 goto out;
  766         }
  767         if (uiop->uio_resid > 0) {
  768                 len -= uiop->uio_resid;
  769                 tlen = NFSM_RNDUP(len);
  770                 if (tlen == 0) {
  771                         m_freem(mp3);
  772                         mp3 = mp = NULL;
  773                 } else if (tlen != NFS_MAXPATHLEN || tlen != len)
  774                         mp = nfsrv_adj(mp3, NFS_MAXPATHLEN - tlen,
  775                             tlen - len);
  776         }
  777         *lenp = len;
  778         *mpp = mp3;
  779         *mpendp = mp;
  780 
  781 out:
  782         NFSEXITCODE(error);
  783         return (error);
  784 }
  785 
  786 /*
  787  * Create an mbuf chain and an associated iovec that can be used to Read
  788  * or Getextattr of data.
  789  * Upon success, return pointers to the first and last mbufs in the chain
  790  * plus the malloc'd iovec and its iovlen.
  791  */
  792 static int
  793 nfsrv_createiovec(int len, struct mbuf **mpp, struct mbuf **mpendp,
  794     struct iovec **ivp)
  795 {
  796         struct mbuf *m, *m2 = NULL, *m3;
  797         struct iovec *iv;
  798         int i, left, siz;
  799 
  800         left = len;
  801         m3 = NULL;
  802         /*
  803          * Generate the mbuf list with the uio_iov ref. to it.
  804          */
  805         i = 0;
  806         while (left > 0) {
  807                 NFSMGET(m);
  808                 MCLGET(m, M_WAITOK);
  809                 m->m_len = 0;
  810                 siz = min(M_TRAILINGSPACE(m), left);
  811                 left -= siz;
  812                 i++;
  813                 if (m3)
  814                         m2->m_next = m;
  815                 else
  816                         m3 = m;
  817                 m2 = m;
  818         }
  819         *ivp = iv = malloc(i * sizeof (struct iovec), M_TEMP, M_WAITOK);
  820         m = m3;
  821         left = len;
  822         i = 0;
  823         while (left > 0) {
  824                 if (m == NULL)
  825                         panic("nfsrv_createiovec iov");
  826                 siz = min(M_TRAILINGSPACE(m), left);
  827                 if (siz > 0) {
  828                         iv->iov_base = mtod(m, caddr_t) + m->m_len;
  829                         iv->iov_len = siz;
  830                         m->m_len += siz;
  831                         left -= siz;
  832                         iv++;
  833                         i++;
  834                 }
  835                 m = m->m_next;
  836         }
  837         *mpp = m3;
  838         *mpendp = m2;
  839         return (i);
  840 }
  841 
  842 /*
  843  * Create an mbuf chain and an associated iovec that can be used to Read
  844  * or Getextattr of data.
  845  * Upon success, return pointers to the first and last mbufs in the chain
  846  * plus the malloc'd iovec and its iovlen.
  847  * Same as above, but creates ext_pgs mbuf(s).
  848  */
  849 static int
  850 nfsrv_createiovec_extpgs(int len, int maxextsiz, struct mbuf **mpp,
  851     struct mbuf **mpendp, struct iovec **ivp)
  852 {
  853         struct mbuf *m, *m2 = NULL, *m3;
  854         struct iovec *iv;
  855         int i, left, pgno, siz;
  856 
  857         left = len;
  858         m3 = NULL;
  859         /*
  860          * Generate the mbuf list with the uio_iov ref. to it.
  861          */
  862         i = 0;
  863         while (left > 0) {
  864                 siz = min(left, maxextsiz);
  865                 m = mb_alloc_ext_plus_pages(siz, M_WAITOK);
  866                 left -= siz;
  867                 i += m->m_epg_npgs;
  868                 if (m3 != NULL)
  869                         m2->m_next = m;
  870                 else
  871                         m3 = m;
  872                 m2 = m;
  873         }
  874         *ivp = iv = malloc(i * sizeof (struct iovec), M_TEMP, M_WAITOK);
  875         m = m3;
  876         left = len;
  877         i = 0;
  878         pgno = 0;
  879         while (left > 0) {
  880                 if (m == NULL)
  881                         panic("nfsvno_createiovec_extpgs iov");
  882                 siz = min(PAGE_SIZE, left);
  883                 if (siz > 0) {
  884                         iv->iov_base = (void *)PHYS_TO_DMAP(m->m_epg_pa[pgno]);
  885                         iv->iov_len = siz;
  886                         m->m_len += siz;
  887                         if (pgno == m->m_epg_npgs - 1)
  888                                 m->m_epg_last_len = siz;
  889                         left -= siz;
  890                         iv++;
  891                         i++;
  892                         pgno++;
  893                 }
  894                 if (pgno == m->m_epg_npgs && left > 0) {
  895                         m = m->m_next;
  896                         if (m == NULL)
  897                                 panic("nfsvno_createiovec_extpgs iov");
  898                         pgno = 0;
  899                 }
  900         }
  901         *mpp = m3;
  902         *mpendp = m2;
  903         return (i);
  904 }
  905 
  906 /*
  907  * Read vnode op call into mbuf list.
  908  */
  909 int
  910 nfsvno_read(struct vnode *vp, off_t off, int cnt, struct ucred *cred,
  911     int maxextsiz, struct thread *p, struct mbuf **mpp,
  912     struct mbuf **mpendp)
  913 {
  914         struct mbuf *m;
  915         struct iovec *iv;
  916         int error = 0, len, tlen, ioflag = 0;
  917         struct mbuf *m3;
  918         struct uio io, *uiop = &io;
  919         struct nfsheur *nh;
  920 
  921         /*
  922          * Attempt to read from a DS file. A return of ENOENT implies
  923          * there is no DS file to read.
  924          */
  925         error = nfsrv_proxyds(vp, off, cnt, cred, p, NFSPROC_READDS, mpp,
  926             NULL, mpendp, NULL, NULL, NULL, 0, NULL);
  927         if (error != ENOENT)
  928                 return (error);
  929 
  930         len = NFSM_RNDUP(cnt);
  931         if (maxextsiz > 0)
  932                 uiop->uio_iovcnt = nfsrv_createiovec_extpgs(len, maxextsiz,
  933                     &m3, &m, &iv);
  934         else
  935                 uiop->uio_iovcnt = nfsrv_createiovec(len, &m3, &m, &iv);
  936         uiop->uio_iov = iv;
  937         uiop->uio_offset = off;
  938         uiop->uio_resid = len;
  939         uiop->uio_rw = UIO_READ;
  940         uiop->uio_segflg = UIO_SYSSPACE;
  941         uiop->uio_td = NULL;
  942         nh = nfsrv_sequential_heuristic(uiop, vp);
  943         ioflag |= nh->nh_seqcount << IO_SEQSHIFT;
  944         /* XXX KDM make this more systematic? */
  945         nfsstatsv1.srvbytes[NFSV4OP_READ] += uiop->uio_resid;
  946         error = VOP_READ(vp, uiop, IO_NODELOCKED | ioflag, cred);
  947         free(iv, M_TEMP);
  948         if (error) {
  949                 m_freem(m3);
  950                 *mpp = NULL;
  951                 goto out;
  952         }
  953         nh->nh_nextoff = uiop->uio_offset;
  954         tlen = len - uiop->uio_resid;
  955         cnt = cnt < tlen ? cnt : tlen;
  956         tlen = NFSM_RNDUP(cnt);
  957         if (tlen == 0) {
  958                 m_freem(m3);
  959                 m3 = m = NULL;
  960         } else if (len != tlen || tlen != cnt)
  961                 m = nfsrv_adj(m3, len - tlen, tlen - cnt);
  962         *mpp = m3;
  963         *mpendp = m;
  964 
  965 out:
  966         NFSEXITCODE(error);
  967         return (error);
  968 }
  969 
  970 /*
  971  * Create the iovec for the mbuf chain passed in as an argument.
  972  * The "cp" argument is where the data starts within the first mbuf in
  973  * the chain. It returns the iovec and the iovcnt.
  974  */
  975 static int
  976 nfsrv_createiovecw(int retlen, struct mbuf *m, char *cp, struct iovec **ivpp,
  977     int *iovcntp)
  978 {
  979         struct mbuf *mp;
  980         struct iovec *ivp;
  981         int cnt, i, len;
  982 
  983         /*
  984          * Loop through the mbuf chain, counting how many mbufs are a
  985          * part of this write operation, so the iovec size is known.
  986          */
  987         cnt = 0;
  988         len = retlen;
  989         mp = m;
  990         i = mtod(mp, caddr_t) + mp->m_len - cp;
  991         while (len > 0) {
  992                 if (i > 0) {
  993                         len -= i;
  994                         cnt++;
  995                 }
  996                 mp = mp->m_next;
  997                 if (!mp) {
  998                         if (len > 0)
  999                                 return (EBADRPC);
 1000                 } else
 1001                         i = mp->m_len;
 1002         }
 1003 
 1004         /* Now, create the iovec. */
 1005         mp = m;
 1006         *ivpp = ivp = malloc(cnt * sizeof (struct iovec), M_TEMP,
 1007             M_WAITOK);
 1008         *iovcntp = cnt;
 1009         i = mtod(mp, caddr_t) + mp->m_len - cp;
 1010         len = retlen;
 1011         while (len > 0) {
 1012                 if (mp == NULL)
 1013                         panic("nfsrv_createiovecw");
 1014                 if (i > 0) {
 1015                         i = min(i, len);
 1016                         ivp->iov_base = cp;
 1017                         ivp->iov_len = i;
 1018                         ivp++;
 1019                         len -= i;
 1020                 }
 1021                 mp = mp->m_next;
 1022                 if (mp) {
 1023                         i = mp->m_len;
 1024                         cp = mtod(mp, caddr_t);
 1025                 }
 1026         }
 1027         return (0);
 1028 }
 1029 
 1030 /*
 1031  * Write vnode op from an mbuf list.
 1032  */
 1033 int
 1034 nfsvno_write(struct vnode *vp, off_t off, int retlen, int *stable,
 1035     struct mbuf *mp, char *cp, struct ucred *cred, struct thread *p)
 1036 {
 1037         struct iovec *iv;
 1038         int cnt, ioflags, error;
 1039         struct uio io, *uiop = &io;
 1040         struct nfsheur *nh;
 1041 
 1042         /*
 1043          * Attempt to write to a DS file. A return of ENOENT implies
 1044          * there is no DS file to write.
 1045          */
 1046         error = nfsrv_proxyds(vp, off, retlen, cred, p, NFSPROC_WRITEDS,
 1047             &mp, cp, NULL, NULL, NULL, NULL, 0, NULL);
 1048         if (error != ENOENT) {
 1049                 *stable = NFSWRITE_FILESYNC;
 1050                 return (error);
 1051         }
 1052 
 1053         if (*stable == NFSWRITE_UNSTABLE)
 1054                 ioflags = IO_NODELOCKED;
 1055         else
 1056                 ioflags = (IO_SYNC | IO_NODELOCKED);
 1057         error = nfsrv_createiovecw(retlen, mp, cp, &iv, &cnt);
 1058         if (error != 0)
 1059                 return (error);
 1060         uiop->uio_iov = iv;
 1061         uiop->uio_iovcnt = cnt;
 1062         uiop->uio_resid = retlen;
 1063         uiop->uio_rw = UIO_WRITE;
 1064         uiop->uio_segflg = UIO_SYSSPACE;
 1065         NFSUIOPROC(uiop, p);
 1066         uiop->uio_offset = off;
 1067         nh = nfsrv_sequential_heuristic(uiop, vp);
 1068         ioflags |= nh->nh_seqcount << IO_SEQSHIFT;
 1069         /* XXX KDM make this more systematic? */
 1070         nfsstatsv1.srvbytes[NFSV4OP_WRITE] += uiop->uio_resid;
 1071         error = VOP_WRITE(vp, uiop, ioflags, cred);
 1072         if (error == 0)
 1073                 nh->nh_nextoff = uiop->uio_offset;
 1074         free(iv, M_TEMP);
 1075 
 1076         NFSEXITCODE(error);
 1077         return (error);
 1078 }
 1079 
 1080 /*
 1081  * Common code for creating a regular file (plus special files for V2).
 1082  */
 1083 int
 1084 nfsvno_createsub(struct nfsrv_descript *nd, struct nameidata *ndp,
 1085     struct vnode **vpp, struct nfsvattr *nvap, int *exclusive_flagp,
 1086     int32_t *cverf, NFSDEV_T rdev, struct nfsexstuff *exp)
 1087 {
 1088         u_quad_t tempsize;
 1089         int error;
 1090         struct thread *p = curthread;
 1091 
 1092         error = nd->nd_repstat;
 1093         if (!error && ndp->ni_vp == NULL) {
 1094                 if (nvap->na_type == VREG || nvap->na_type == VSOCK) {
 1095                         vrele(ndp->ni_startdir);
 1096                         error = VOP_CREATE(ndp->ni_dvp,
 1097                             &ndp->ni_vp, &ndp->ni_cnd, &nvap->na_vattr);
 1098                         /* For a pNFS server, create the data file on a DS. */
 1099                         if (error == 0 && nvap->na_type == VREG) {
 1100                                 /*
 1101                                  * Create a data file on a DS for a pNFS server.
 1102                                  * This function just returns if not
 1103                                  * running a pNFS DS or the creation fails.
 1104                                  */
 1105                                 nfsrv_pnfscreate(ndp->ni_vp, &nvap->na_vattr,
 1106                                     nd->nd_cred, p);
 1107                         }
 1108                         VOP_VPUT_PAIR(ndp->ni_dvp, error == 0 ? &ndp->ni_vp :
 1109                             NULL, false);
 1110                         nfsvno_relpathbuf(ndp);
 1111                         if (!error) {
 1112                                 if (*exclusive_flagp) {
 1113                                         *exclusive_flagp = 0;
 1114                                         NFSVNO_ATTRINIT(nvap);
 1115                                         nvap->na_atime.tv_sec = cverf[0];
 1116                                         nvap->na_atime.tv_nsec = cverf[1];
 1117                                         error = VOP_SETATTR(ndp->ni_vp,
 1118                                             &nvap->na_vattr, nd->nd_cred);
 1119                                         if (error != 0) {
 1120                                                 vput(ndp->ni_vp);
 1121                                                 ndp->ni_vp = NULL;
 1122                                                 error = NFSERR_NOTSUPP;
 1123                                         }
 1124                                 }
 1125                         }
 1126                 /*
 1127                  * NFS V2 Only. nfsrvd_mknod() does this for V3.
 1128                  * (This implies, just get out on an error.)
 1129                  */
 1130                 } else if (nvap->na_type == VCHR || nvap->na_type == VBLK ||
 1131                         nvap->na_type == VFIFO) {
 1132                         if (nvap->na_type == VCHR && rdev == 0xffffffff)
 1133                                 nvap->na_type = VFIFO;
 1134                         if (nvap->na_type != VFIFO &&
 1135                             (error = priv_check_cred(nd->nd_cred, PRIV_VFS_MKNOD_DEV))) {
 1136                                 vrele(ndp->ni_startdir);
 1137                                 nfsvno_relpathbuf(ndp);
 1138                                 vput(ndp->ni_dvp);
 1139                                 goto out;
 1140                         }
 1141                         nvap->na_rdev = rdev;
 1142                         error = VOP_MKNOD(ndp->ni_dvp, &ndp->ni_vp,
 1143                             &ndp->ni_cnd, &nvap->na_vattr);
 1144                         VOP_VPUT_PAIR(ndp->ni_dvp, error == 0 ? &ndp->ni_vp :
 1145                             NULL, false);
 1146                         nfsvno_relpathbuf(ndp);
 1147                         vrele(ndp->ni_startdir);
 1148                         if (error)
 1149                                 goto out;
 1150                 } else {
 1151                         vrele(ndp->ni_startdir);
 1152                         nfsvno_relpathbuf(ndp);
 1153                         vput(ndp->ni_dvp);
 1154                         error = ENXIO;
 1155                         goto out;
 1156                 }
 1157                 *vpp = ndp->ni_vp;
 1158         } else {
 1159                 /*
 1160                  * Handle cases where error is already set and/or
 1161                  * the file exists.
 1162                  * 1 - clean up the lookup
 1163                  * 2 - iff !error and na_size set, truncate it
 1164                  */
 1165                 vrele(ndp->ni_startdir);
 1166                 nfsvno_relpathbuf(ndp);
 1167                 *vpp = ndp->ni_vp;
 1168                 if (ndp->ni_dvp == *vpp)
 1169                         vrele(ndp->ni_dvp);
 1170                 else
 1171                         vput(ndp->ni_dvp);
 1172                 if (!error && nvap->na_size != VNOVAL) {
 1173                         error = nfsvno_accchk(*vpp, VWRITE,
 1174                             nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
 1175                             NFSACCCHK_VPISLOCKED, NULL);
 1176                         if (!error) {
 1177                                 tempsize = nvap->na_size;
 1178                                 NFSVNO_ATTRINIT(nvap);
 1179                                 nvap->na_size = tempsize;
 1180                                 error = VOP_SETATTR(*vpp,
 1181                                     &nvap->na_vattr, nd->nd_cred);
 1182                         }
 1183                 }
 1184                 if (error)
 1185                         vput(*vpp);
 1186         }
 1187 
 1188 out:
 1189         NFSEXITCODE(error);
 1190         return (error);
 1191 }
 1192 
 1193 /*
 1194  * Do a mknod vnode op.
 1195  */
 1196 int
 1197 nfsvno_mknod(struct nameidata *ndp, struct nfsvattr *nvap, struct ucred *cred,
 1198     struct thread *p)
 1199 {
 1200         int error = 0;
 1201         enum vtype vtyp;
 1202 
 1203         vtyp = nvap->na_type;
 1204         /*
 1205          * Iff doesn't exist, create it.
 1206          */
 1207         if (ndp->ni_vp) {
 1208                 vrele(ndp->ni_startdir);
 1209                 nfsvno_relpathbuf(ndp);
 1210                 vput(ndp->ni_dvp);
 1211                 vrele(ndp->ni_vp);
 1212                 error = EEXIST;
 1213                 goto out;
 1214         }
 1215         if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
 1216                 vrele(ndp->ni_startdir);
 1217                 nfsvno_relpathbuf(ndp);
 1218                 vput(ndp->ni_dvp);
 1219                 error = NFSERR_BADTYPE;
 1220                 goto out;
 1221         }
 1222         if (vtyp == VSOCK) {
 1223                 vrele(ndp->ni_startdir);
 1224                 error = VOP_CREATE(ndp->ni_dvp, &ndp->ni_vp,
 1225                     &ndp->ni_cnd, &nvap->na_vattr);
 1226                 VOP_VPUT_PAIR(ndp->ni_dvp, error == 0 ? &ndp->ni_vp : NULL,
 1227                     false);
 1228                 nfsvno_relpathbuf(ndp);
 1229         } else {
 1230                 if (nvap->na_type != VFIFO &&
 1231                     (error = priv_check_cred(cred, PRIV_VFS_MKNOD_DEV))) {
 1232                         vrele(ndp->ni_startdir);
 1233                         nfsvno_relpathbuf(ndp);
 1234                         vput(ndp->ni_dvp);
 1235                         goto out;
 1236                 }
 1237                 error = VOP_MKNOD(ndp->ni_dvp, &ndp->ni_vp,
 1238                     &ndp->ni_cnd, &nvap->na_vattr);
 1239                 VOP_VPUT_PAIR(ndp->ni_dvp, error == 0 ? &ndp->ni_vp : NULL,
 1240                     false);
 1241                 nfsvno_relpathbuf(ndp);
 1242                 vrele(ndp->ni_startdir);
 1243                 /*
 1244                  * Since VOP_MKNOD returns the ni_vp, I can't
 1245                  * see any reason to do the lookup.
 1246                  */
 1247         }
 1248 
 1249 out:
 1250         NFSEXITCODE(error);
 1251         return (error);
 1252 }
 1253 
 1254 /*
 1255  * Mkdir vnode op.
 1256  */
 1257 int
 1258 nfsvno_mkdir(struct nameidata *ndp, struct nfsvattr *nvap, uid_t saved_uid,
 1259     struct ucred *cred, struct thread *p, struct nfsexstuff *exp)
 1260 {
 1261         int error = 0;
 1262 
 1263         if (ndp->ni_vp != NULL) {
 1264                 if (ndp->ni_dvp == ndp->ni_vp)
 1265                         vrele(ndp->ni_dvp);
 1266                 else
 1267                         vput(ndp->ni_dvp);
 1268                 vrele(ndp->ni_vp);
 1269                 nfsvno_relpathbuf(ndp);
 1270                 error = EEXIST;
 1271                 goto out;
 1272         }
 1273         error = VOP_MKDIR(ndp->ni_dvp, &ndp->ni_vp, &ndp->ni_cnd,
 1274             &nvap->na_vattr);
 1275         VOP_VPUT_PAIR(ndp->ni_dvp, error == 0 ? &ndp->ni_vp : NULL, false);
 1276         nfsvno_relpathbuf(ndp);
 1277 
 1278 out:
 1279         NFSEXITCODE(error);
 1280         return (error);
 1281 }
 1282 
 1283 /*
 1284  * symlink vnode op.
 1285  */
 1286 int
 1287 nfsvno_symlink(struct nameidata *ndp, struct nfsvattr *nvap, char *pathcp,
 1288     int pathlen, int not_v2, uid_t saved_uid, struct ucred *cred, struct thread *p,
 1289     struct nfsexstuff *exp)
 1290 {
 1291         int error = 0;
 1292 
 1293         if (ndp->ni_vp) {
 1294                 vrele(ndp->ni_startdir);
 1295                 nfsvno_relpathbuf(ndp);
 1296                 if (ndp->ni_dvp == ndp->ni_vp)
 1297                         vrele(ndp->ni_dvp);
 1298                 else
 1299                         vput(ndp->ni_dvp);
 1300                 vrele(ndp->ni_vp);
 1301                 error = EEXIST;
 1302                 goto out;
 1303         }
 1304 
 1305         error = VOP_SYMLINK(ndp->ni_dvp, &ndp->ni_vp, &ndp->ni_cnd,
 1306             &nvap->na_vattr, pathcp);
 1307         /*
 1308          * Although FreeBSD still had the lookup code in
 1309          * it for 7/current, there doesn't seem to be any
 1310          * point, since VOP_SYMLINK() returns the ni_vp.
 1311          * Just vput it for v2.
 1312          */
 1313         VOP_VPUT_PAIR(ndp->ni_dvp, &ndp->ni_vp, !not_v2 && error == 0);
 1314         vrele(ndp->ni_startdir);
 1315         nfsvno_relpathbuf(ndp);
 1316 
 1317 out:
 1318         NFSEXITCODE(error);
 1319         return (error);
 1320 }
 1321 
 1322 /*
 1323  * Parse symbolic link arguments.
 1324  * This function has an ugly side effect. It will malloc() an area for
 1325  * the symlink and set iov_base to point to it, only if it succeeds.
 1326  * So, if it returns with uiop->uio_iov->iov_base != NULL, that must
 1327  * be FREE'd later.
 1328  */
 1329 int
 1330 nfsvno_getsymlink(struct nfsrv_descript *nd, struct nfsvattr *nvap,
 1331     struct thread *p, char **pathcpp, int *lenp)
 1332 {
 1333         u_int32_t *tl;
 1334         char *pathcp = NULL;
 1335         int error = 0, len;
 1336         struct nfsv2_sattr *sp;
 1337 
 1338         *pathcpp = NULL;
 1339         *lenp = 0;
 1340         if ((nd->nd_flag & ND_NFSV3) &&
 1341             (error = nfsrv_sattr(nd, NULL, nvap, NULL, NULL, p)))
 1342                 goto nfsmout;
 1343         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 1344         len = fxdr_unsigned(int, *tl);
 1345         if (len > NFS_MAXPATHLEN || len <= 0) {
 1346                 error = EBADRPC;
 1347                 goto nfsmout;
 1348         }
 1349         pathcp = malloc(len + 1, M_TEMP, M_WAITOK);
 1350         error = nfsrv_mtostr(nd, pathcp, len);
 1351         if (error)
 1352                 goto nfsmout;
 1353         if (nd->nd_flag & ND_NFSV2) {
 1354                 NFSM_DISSECT(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
 1355                 nvap->na_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
 1356         }
 1357         *pathcpp = pathcp;
 1358         *lenp = len;
 1359         NFSEXITCODE2(0, nd);
 1360         return (0);
 1361 nfsmout:
 1362         if (pathcp)
 1363                 free(pathcp, M_TEMP);
 1364         NFSEXITCODE2(error, nd);
 1365         return (error);
 1366 }
 1367 
 1368 /*
 1369  * Remove a non-directory object.
 1370  */
 1371 int
 1372 nfsvno_removesub(struct nameidata *ndp, int is_v4, struct ucred *cred,
 1373     struct thread *p, struct nfsexstuff *exp)
 1374 {
 1375         struct vnode *vp, *dsdvp[NFSDEV_MAXMIRRORS];
 1376         int error = 0, mirrorcnt;
 1377         char fname[PNFS_FILENAME_LEN + 1];
 1378         fhandle_t fh;
 1379 
 1380         vp = ndp->ni_vp;
 1381         dsdvp[0] = NULL;
 1382         if (vp->v_type == VDIR)
 1383                 error = NFSERR_ISDIR;
 1384         else if (is_v4)
 1385                 error = nfsrv_checkremove(vp, 1, NULL, (nfsquad_t)((u_quad_t)0),
 1386                     p);
 1387         if (error == 0)
 1388                 nfsrv_pnfsremovesetup(vp, p, dsdvp, &mirrorcnt, fname, &fh);
 1389         if (!error)
 1390                 error = VOP_REMOVE(ndp->ni_dvp, vp, &ndp->ni_cnd);
 1391         if (error == 0 && dsdvp[0] != NULL)
 1392                 nfsrv_pnfsremove(dsdvp, mirrorcnt, fname, &fh, p);
 1393         if (ndp->ni_dvp == vp)
 1394                 vrele(ndp->ni_dvp);
 1395         else
 1396                 vput(ndp->ni_dvp);
 1397         vput(vp);
 1398         if ((ndp->ni_cnd.cn_flags & SAVENAME) != 0)
 1399                 nfsvno_relpathbuf(ndp);
 1400         NFSEXITCODE(error);
 1401         return (error);
 1402 }
 1403 
 1404 /*
 1405  * Remove a directory.
 1406  */
 1407 int
 1408 nfsvno_rmdirsub(struct nameidata *ndp, int is_v4, struct ucred *cred,
 1409     struct thread *p, struct nfsexstuff *exp)
 1410 {
 1411         struct vnode *vp;
 1412         int error = 0;
 1413 
 1414         vp = ndp->ni_vp;
 1415         if (vp->v_type != VDIR) {
 1416                 error = ENOTDIR;
 1417                 goto out;
 1418         }
 1419         /*
 1420          * No rmdir "." please.
 1421          */
 1422         if (ndp->ni_dvp == vp) {
 1423                 error = EINVAL;
 1424                 goto out;
 1425         }
 1426         /*
 1427          * The root of a mounted filesystem cannot be deleted.
 1428          */
 1429         if (vp->v_vflag & VV_ROOT)
 1430                 error = EBUSY;
 1431 out:
 1432         if (!error)
 1433                 error = VOP_RMDIR(ndp->ni_dvp, vp, &ndp->ni_cnd);
 1434         if (ndp->ni_dvp == vp)
 1435                 vrele(ndp->ni_dvp);
 1436         else
 1437                 vput(ndp->ni_dvp);
 1438         vput(vp);
 1439         if ((ndp->ni_cnd.cn_flags & SAVENAME) != 0)
 1440                 nfsvno_relpathbuf(ndp);
 1441         NFSEXITCODE(error);
 1442         return (error);
 1443 }
 1444 
 1445 /*
 1446  * Rename vnode op.
 1447  */
 1448 int
 1449 nfsvno_rename(struct nameidata *fromndp, struct nameidata *tondp,
 1450     u_int32_t ndstat, u_int32_t ndflag, struct ucred *cred, struct thread *p)
 1451 {
 1452         struct vnode *fvp, *tvp, *tdvp, *dsdvp[NFSDEV_MAXMIRRORS];
 1453         int error = 0, mirrorcnt;
 1454         char fname[PNFS_FILENAME_LEN + 1];
 1455         fhandle_t fh;
 1456 
 1457         dsdvp[0] = NULL;
 1458         fvp = fromndp->ni_vp;
 1459         if (ndstat) {
 1460                 vrele(fromndp->ni_dvp);
 1461                 vrele(fvp);
 1462                 error = ndstat;
 1463                 goto out1;
 1464         }
 1465         tdvp = tondp->ni_dvp;
 1466         tvp = tondp->ni_vp;
 1467         if (tvp != NULL) {
 1468                 if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
 1469                         error = (ndflag & ND_NFSV2) ? EISDIR : EEXIST;
 1470                         goto out;
 1471                 } else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
 1472                         error = (ndflag & ND_NFSV2) ? ENOTDIR : EEXIST;
 1473                         goto out;
 1474                 }
 1475                 if (tvp->v_type == VDIR && tvp->v_mountedhere) {
 1476                         error = (ndflag & ND_NFSV2) ? ENOTEMPTY : EXDEV;
 1477                         goto out;
 1478                 }
 1479 
 1480                 /*
 1481                  * A rename to '.' or '..' results in a prematurely
 1482                  * unlocked vnode on FreeBSD5, so I'm just going to fail that
 1483                  * here.
 1484                  */
 1485                 if ((tondp->ni_cnd.cn_namelen == 1 &&
 1486                      tondp->ni_cnd.cn_nameptr[0] == '.') ||
 1487                     (tondp->ni_cnd.cn_namelen == 2 &&
 1488                      tondp->ni_cnd.cn_nameptr[0] == '.' &&
 1489                      tondp->ni_cnd.cn_nameptr[1] == '.')) {
 1490                         error = EINVAL;
 1491                         goto out;
 1492                 }
 1493         }
 1494         if (fvp->v_type == VDIR && fvp->v_mountedhere) {
 1495                 error = (ndflag & ND_NFSV2) ? ENOTEMPTY : EXDEV;
 1496                 goto out;
 1497         }
 1498         if (fvp->v_mount != tdvp->v_mount) {
 1499                 error = (ndflag & ND_NFSV2) ? ENOTEMPTY : EXDEV;
 1500                 goto out;
 1501         }
 1502         if (fvp == tdvp) {
 1503                 error = (ndflag & ND_NFSV2) ? ENOTEMPTY : EINVAL;
 1504                 goto out;
 1505         }
 1506         if (fvp == tvp) {
 1507                 /*
 1508                  * If source and destination are the same, there is nothing to
 1509                  * do. Set error to -1 to indicate this.
 1510                  */
 1511                 error = -1;
 1512                 goto out;
 1513         }
 1514         if (ndflag & ND_NFSV4) {
 1515                 if (NFSVOPLOCK(fvp, LK_EXCLUSIVE) == 0) {
 1516                         error = nfsrv_checkremove(fvp, 0, NULL,
 1517                             (nfsquad_t)((u_quad_t)0), p);
 1518                         NFSVOPUNLOCK(fvp);
 1519                 } else
 1520                         error = EPERM;
 1521                 if (tvp && !error)
 1522                         error = nfsrv_checkremove(tvp, 1, NULL,
 1523                             (nfsquad_t)((u_quad_t)0), p);
 1524         } else {
 1525                 /*
 1526                  * For NFSv2 and NFSv3, try to get rid of the delegation, so
 1527                  * that the NFSv4 client won't be confused by the rename.
 1528                  * Since nfsd_recalldelegation() can only be called on an
 1529                  * unlocked vnode at this point and fvp is the file that will
 1530                  * still exist after the rename, just do fvp.
 1531                  */
 1532                 nfsd_recalldelegation(fvp, p);
 1533         }
 1534         if (error == 0 && tvp != NULL) {
 1535                 nfsrv_pnfsremovesetup(tvp, p, dsdvp, &mirrorcnt, fname, &fh);
 1536                 NFSD_DEBUG(4, "nfsvno_rename: pnfsremovesetup"
 1537                     " dsdvp=%p\n", dsdvp[0]);
 1538         }
 1539 out:
 1540         if (!error) {
 1541                 error = VOP_RENAME(fromndp->ni_dvp, fromndp->ni_vp,
 1542                     &fromndp->ni_cnd, tondp->ni_dvp, tondp->ni_vp,
 1543                     &tondp->ni_cnd);
 1544         } else {
 1545                 if (tdvp == tvp)
 1546                         vrele(tdvp);
 1547                 else
 1548                         vput(tdvp);
 1549                 if (tvp)
 1550                         vput(tvp);
 1551                 vrele(fromndp->ni_dvp);
 1552                 vrele(fvp);
 1553                 if (error == -1)
 1554                         error = 0;
 1555         }
 1556 
 1557         /*
 1558          * If dsdvp[0] != NULL, it was set up by nfsrv_pnfsremovesetup() and
 1559          * if the rename succeeded, the DS file for the tvp needs to be
 1560          * removed.
 1561          */
 1562         if (error == 0 && dsdvp[0] != NULL) {
 1563                 nfsrv_pnfsremove(dsdvp, mirrorcnt, fname, &fh, p);
 1564                 NFSD_DEBUG(4, "nfsvno_rename: pnfsremove\n");
 1565         }
 1566 
 1567         vrele(tondp->ni_startdir);
 1568         nfsvno_relpathbuf(tondp);
 1569 out1:
 1570         vrele(fromndp->ni_startdir);
 1571         nfsvno_relpathbuf(fromndp);
 1572         NFSEXITCODE(error);
 1573         return (error);
 1574 }
 1575 
 1576 /*
 1577  * Link vnode op.
 1578  */
 1579 int
 1580 nfsvno_link(struct nameidata *ndp, struct vnode *vp, struct ucred *cred,
 1581     struct thread *p, struct nfsexstuff *exp)
 1582 {
 1583         struct vnode *xp;
 1584         int error = 0;
 1585 
 1586         xp = ndp->ni_vp;
 1587         if (xp != NULL) {
 1588                 error = EEXIST;
 1589         } else {
 1590                 xp = ndp->ni_dvp;
 1591                 if (vp->v_mount != xp->v_mount)
 1592                         error = EXDEV;
 1593         }
 1594         if (!error) {
 1595                 NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY);
 1596                 if (!VN_IS_DOOMED(vp))
 1597                         error = VOP_LINK(ndp->ni_dvp, vp, &ndp->ni_cnd);
 1598                 else
 1599                         error = EPERM;
 1600                 if (ndp->ni_dvp == vp) {
 1601                         vrele(ndp->ni_dvp);
 1602                         NFSVOPUNLOCK(vp);
 1603                 } else {
 1604                         vref(vp);
 1605                         VOP_VPUT_PAIR(ndp->ni_dvp, &vp, true);
 1606                 }
 1607         } else {
 1608                 if (ndp->ni_dvp == ndp->ni_vp)
 1609                         vrele(ndp->ni_dvp);
 1610                 else
 1611                         vput(ndp->ni_dvp);
 1612                 if (ndp->ni_vp)
 1613                         vrele(ndp->ni_vp);
 1614         }
 1615         nfsvno_relpathbuf(ndp);
 1616         NFSEXITCODE(error);
 1617         return (error);
 1618 }
 1619 
 1620 /*
 1621  * Do the fsync() appropriate for the commit.
 1622  */
 1623 int
 1624 nfsvno_fsync(struct vnode *vp, u_int64_t off, int cnt, struct ucred *cred,
 1625     struct thread *td)
 1626 {
 1627         int error = 0;
 1628 
 1629         /*
 1630          * RFC 1813 3.3.21: if count is 0, a flush from offset to the end of
 1631          * file is done.  At this time VOP_FSYNC does not accept offset and
 1632          * byte count parameters so call VOP_FSYNC the whole file for now.
 1633          * The same is true for NFSv4: RFC 3530 Sec. 14.2.3.
 1634          * File systems that do not use the buffer cache (as indicated
 1635          * by MNTK_USES_BCACHE not being set) must use VOP_FSYNC().
 1636          */
 1637         if (cnt == 0 || cnt > MAX_COMMIT_COUNT ||
 1638             (vp->v_mount->mnt_kern_flag & MNTK_USES_BCACHE) == 0) {
 1639                 /*
 1640                  * Give up and do the whole thing
 1641                  */
 1642                 if (vp->v_object && vm_object_mightbedirty(vp->v_object)) {
 1643                         VM_OBJECT_WLOCK(vp->v_object);
 1644                         vm_object_page_clean(vp->v_object, 0, 0, OBJPC_SYNC);
 1645                         VM_OBJECT_WUNLOCK(vp->v_object);
 1646                 }
 1647                 error = VOP_FSYNC(vp, MNT_WAIT, td);
 1648         } else {
 1649                 /*
 1650                  * Locate and synchronously write any buffers that fall
 1651                  * into the requested range.  Note:  we are assuming that
 1652                  * f_iosize is a power of 2.
 1653                  */
 1654                 int iosize = vp->v_mount->mnt_stat.f_iosize;
 1655                 int iomask = iosize - 1;
 1656                 struct bufobj *bo;
 1657                 daddr_t lblkno;
 1658 
 1659                 /*
 1660                  * Align to iosize boundary, super-align to page boundary.
 1661                  */
 1662                 if (off & iomask) {
 1663                         cnt += off & iomask;
 1664                         off &= ~(u_quad_t)iomask;
 1665                 }
 1666                 if (off & PAGE_MASK) {
 1667                         cnt += off & PAGE_MASK;
 1668                         off &= ~(u_quad_t)PAGE_MASK;
 1669                 }
 1670                 lblkno = off / iosize;
 1671 
 1672                 if (vp->v_object && vm_object_mightbedirty(vp->v_object)) {
 1673                         VM_OBJECT_WLOCK(vp->v_object);
 1674                         vm_object_page_clean(vp->v_object, off, off + cnt,
 1675                             OBJPC_SYNC);
 1676                         VM_OBJECT_WUNLOCK(vp->v_object);
 1677                 }
 1678 
 1679                 bo = &vp->v_bufobj;
 1680                 BO_LOCK(bo);
 1681                 while (cnt > 0) {
 1682                         struct buf *bp;
 1683 
 1684                         /*
 1685                          * If we have a buffer and it is marked B_DELWRI we
 1686                          * have to lock and write it.  Otherwise the prior
 1687                          * write is assumed to have already been committed.
 1688                          *
 1689                          * gbincore() can return invalid buffers now so we
 1690                          * have to check that bit as well (though B_DELWRI
 1691                          * should not be set if B_INVAL is set there could be
 1692                          * a race here since we haven't locked the buffer).
 1693                          */
 1694                         if ((bp = gbincore(&vp->v_bufobj, lblkno)) != NULL) {
 1695                                 if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_SLEEPFAIL |
 1696                                     LK_INTERLOCK, BO_LOCKPTR(bo)) == ENOLCK) {
 1697                                         BO_LOCK(bo);
 1698                                         continue; /* retry */
 1699                                 }
 1700                                 if ((bp->b_flags & (B_DELWRI|B_INVAL)) ==
 1701                                     B_DELWRI) {
 1702                                         bremfree(bp);
 1703                                         bp->b_flags &= ~B_ASYNC;
 1704                                         bwrite(bp);
 1705                                         ++nfs_commit_miss;
 1706                                 } else
 1707                                         BUF_UNLOCK(bp);
 1708                                 BO_LOCK(bo);
 1709                         }
 1710                         ++nfs_commit_blks;
 1711                         if (cnt < iosize)
 1712                                 break;
 1713                         cnt -= iosize;
 1714                         ++lblkno;
 1715                 }
 1716                 BO_UNLOCK(bo);
 1717         }
 1718         NFSEXITCODE(error);
 1719         return (error);
 1720 }
 1721 
 1722 /*
 1723  * Statfs vnode op.
 1724  */
 1725 int
 1726 nfsvno_statfs(struct vnode *vp, struct statfs *sf)
 1727 {
 1728         struct statfs *tsf;
 1729         int error;
 1730 
 1731         tsf = NULL;
 1732         if (nfsrv_devidcnt > 0) {
 1733                 /* For a pNFS service, get the DS numbers. */
 1734                 tsf = malloc(sizeof(*tsf), M_TEMP, M_WAITOK | M_ZERO);
 1735                 error = nfsrv_pnfsstatfs(tsf, vp->v_mount);
 1736                 if (error != 0) {
 1737                         free(tsf, M_TEMP);
 1738                         tsf = NULL;
 1739                 }
 1740         }
 1741         error = VFS_STATFS(vp->v_mount, sf);
 1742         if (error == 0) {
 1743                 if (tsf != NULL) {
 1744                         sf->f_blocks = tsf->f_blocks;
 1745                         sf->f_bavail = tsf->f_bavail;
 1746                         sf->f_bfree = tsf->f_bfree;
 1747                         sf->f_bsize = tsf->f_bsize;
 1748                 }
 1749                 /*
 1750                  * Since NFS handles these values as unsigned on the
 1751                  * wire, there is no way to represent negative values,
 1752                  * so set them to 0. Without this, they will appear
 1753                  * to be very large positive values for clients like
 1754                  * Solaris10.
 1755                  */
 1756                 if (sf->f_bavail < 0)
 1757                         sf->f_bavail = 0;
 1758                 if (sf->f_ffree < 0)
 1759                         sf->f_ffree = 0;
 1760         }
 1761         free(tsf, M_TEMP);
 1762         NFSEXITCODE(error);
 1763         return (error);
 1764 }
 1765 
 1766 /*
 1767  * Do the vnode op stuff for Open. Similar to nfsvno_createsub(), but
 1768  * must handle nfsrv_opencheck() calls after any other access checks.
 1769  */
 1770 void
 1771 nfsvno_open(struct nfsrv_descript *nd, struct nameidata *ndp,
 1772     nfsquad_t clientid, nfsv4stateid_t *stateidp, struct nfsstate *stp,
 1773     int *exclusive_flagp, struct nfsvattr *nvap, int32_t *cverf, int create,
 1774     NFSACL_T *aclp, nfsattrbit_t *attrbitp, struct ucred *cred,
 1775     struct nfsexstuff *exp, struct vnode **vpp)
 1776 {
 1777         struct vnode *vp = NULL;
 1778         u_quad_t tempsize;
 1779         struct nfsexstuff nes;
 1780         struct thread *p = curthread;
 1781 
 1782         if (ndp->ni_vp == NULL)
 1783                 nd->nd_repstat = nfsrv_opencheck(clientid,
 1784                     stateidp, stp, NULL, nd, p, nd->nd_repstat);
 1785         if (!nd->nd_repstat) {
 1786                 if (ndp->ni_vp == NULL) {
 1787                         vrele(ndp->ni_startdir);
 1788                         nd->nd_repstat = VOP_CREATE(ndp->ni_dvp,
 1789                             &ndp->ni_vp, &ndp->ni_cnd, &nvap->na_vattr);
 1790                         /* For a pNFS server, create the data file on a DS. */
 1791                         if (nd->nd_repstat == 0) {
 1792                                 /*
 1793                                  * Create a data file on a DS for a pNFS server.
 1794                                  * This function just returns if not
 1795                                  * running a pNFS DS or the creation fails.
 1796                                  */
 1797                                 nfsrv_pnfscreate(ndp->ni_vp, &nvap->na_vattr,
 1798                                     cred, p);
 1799                         }
 1800                         VOP_VPUT_PAIR(ndp->ni_dvp, nd->nd_repstat == 0 ?
 1801                             &ndp->ni_vp : NULL, false);
 1802                         nfsvno_relpathbuf(ndp);
 1803                         if (!nd->nd_repstat) {
 1804                                 if (*exclusive_flagp) {
 1805                                         *exclusive_flagp = 0;
 1806                                         NFSVNO_ATTRINIT(nvap);
 1807                                         nvap->na_atime.tv_sec = cverf[0];
 1808                                         nvap->na_atime.tv_nsec = cverf[1];
 1809                                         nd->nd_repstat = VOP_SETATTR(ndp->ni_vp,
 1810                                             &nvap->na_vattr, cred);
 1811                                         if (nd->nd_repstat != 0) {
 1812                                                 vput(ndp->ni_vp);
 1813                                                 ndp->ni_vp = NULL;
 1814                                                 nd->nd_repstat = NFSERR_NOTSUPP;
 1815                                         } else
 1816                                                 NFSSETBIT_ATTRBIT(attrbitp,
 1817                                                     NFSATTRBIT_TIMEACCESS);
 1818                                 } else {
 1819                                         nfsrv_fixattr(nd, ndp->ni_vp, nvap,
 1820                                             aclp, p, attrbitp, exp);
 1821                                 }
 1822                         }
 1823                         vp = ndp->ni_vp;
 1824                 } else {
 1825                         if (ndp->ni_startdir)
 1826                                 vrele(ndp->ni_startdir);
 1827                         nfsvno_relpathbuf(ndp);
 1828                         vp = ndp->ni_vp;
 1829                         if (create == NFSV4OPEN_CREATE) {
 1830                                 if (ndp->ni_dvp == vp)
 1831                                         vrele(ndp->ni_dvp);
 1832                                 else
 1833                                         vput(ndp->ni_dvp);
 1834                         }
 1835                         if (NFSVNO_ISSETSIZE(nvap) && vp->v_type == VREG) {
 1836                                 if (ndp->ni_cnd.cn_flags & RDONLY)
 1837                                         NFSVNO_SETEXRDONLY(&nes);
 1838                                 else
 1839                                         NFSVNO_EXINIT(&nes);
 1840                                 nd->nd_repstat = nfsvno_accchk(vp, 
 1841                                     VWRITE, cred, &nes, p,
 1842                                     NFSACCCHK_NOOVERRIDE,
 1843                                     NFSACCCHK_VPISLOCKED, NULL);
 1844                                 nd->nd_repstat = nfsrv_opencheck(clientid,
 1845                                     stateidp, stp, vp, nd, p, nd->nd_repstat);
 1846                                 if (!nd->nd_repstat) {
 1847                                         tempsize = nvap->na_size;
 1848                                         NFSVNO_ATTRINIT(nvap);
 1849                                         nvap->na_size = tempsize;
 1850                                         nd->nd_repstat = VOP_SETATTR(vp,
 1851                                             &nvap->na_vattr, cred);
 1852                                 }
 1853                         } else if (vp->v_type == VREG) {
 1854                                 nd->nd_repstat = nfsrv_opencheck(clientid,
 1855                                     stateidp, stp, vp, nd, p, nd->nd_repstat);
 1856                         }
 1857                 }
 1858         } else {
 1859                 if (ndp->ni_cnd.cn_flags & HASBUF)
 1860                         nfsvno_relpathbuf(ndp);
 1861                 if (ndp->ni_startdir && create == NFSV4OPEN_CREATE) {
 1862                         vrele(ndp->ni_startdir);
 1863                         if (ndp->ni_dvp == ndp->ni_vp)
 1864                                 vrele(ndp->ni_dvp);
 1865                         else
 1866                                 vput(ndp->ni_dvp);
 1867                         if (ndp->ni_vp)
 1868                                 vput(ndp->ni_vp);
 1869                 }
 1870         }
 1871         *vpp = vp;
 1872 
 1873         NFSEXITCODE2(0, nd);
 1874 }
 1875 
 1876 /*
 1877  * Updates the file rev and sets the mtime and ctime
 1878  * to the current clock time, returning the va_filerev and va_Xtime
 1879  * values.
 1880  * Return ESTALE to indicate the vnode is VIRF_DOOMED.
 1881  */
 1882 int
 1883 nfsvno_updfilerev(struct vnode *vp, struct nfsvattr *nvap,
 1884     struct nfsrv_descript *nd, struct thread *p)
 1885 {
 1886         struct vattr va;
 1887 
 1888         VATTR_NULL(&va);
 1889         vfs_timestamp(&va.va_mtime);
 1890         if (NFSVOPISLOCKED(vp) != LK_EXCLUSIVE) {
 1891                 NFSVOPLOCK(vp, LK_UPGRADE | LK_RETRY);
 1892                 if (VN_IS_DOOMED(vp))
 1893                         return (ESTALE);
 1894         }
 1895         (void) VOP_SETATTR(vp, &va, nd->nd_cred);
 1896         (void) nfsvno_getattr(vp, nvap, nd, p, 1, NULL);
 1897         return (0);
 1898 }
 1899 
 1900 /*
 1901  * Glue routine to nfsv4_fillattr().
 1902  */
 1903 int
 1904 nfsvno_fillattr(struct nfsrv_descript *nd, struct mount *mp, struct vnode *vp,
 1905     struct nfsvattr *nvap, fhandle_t *fhp, int rderror, nfsattrbit_t *attrbitp,
 1906     struct ucred *cred, struct thread *p, int isdgram, int reterr,
 1907     int supports_nfsv4acls, int at_root, uint64_t mounted_on_fileno)
 1908 {
 1909         struct statfs *sf;
 1910         int error;
 1911 
 1912         sf = NULL;
 1913         if (nfsrv_devidcnt > 0 &&
 1914             (NFSISSET_ATTRBIT(attrbitp, NFSATTRBIT_SPACEAVAIL) ||
 1915              NFSISSET_ATTRBIT(attrbitp, NFSATTRBIT_SPACEFREE) ||
 1916              NFSISSET_ATTRBIT(attrbitp, NFSATTRBIT_SPACETOTAL))) {
 1917                 sf = malloc(sizeof(*sf), M_TEMP, M_WAITOK | M_ZERO);
 1918                 error = nfsrv_pnfsstatfs(sf, mp);
 1919                 if (error != 0) {
 1920                         free(sf, M_TEMP);
 1921                         sf = NULL;
 1922                 }
 1923         }
 1924         error = nfsv4_fillattr(nd, mp, vp, NULL, &nvap->na_vattr, fhp, rderror,
 1925             attrbitp, cred, p, isdgram, reterr, supports_nfsv4acls, at_root,
 1926             mounted_on_fileno, sf);
 1927         free(sf, M_TEMP);
 1928         NFSEXITCODE2(0, nd);
 1929         return (error);
 1930 }
 1931 
 1932 /* Since the Readdir vnode ops vary, put the entire functions in here. */
 1933 /*
 1934  * nfs readdir service
 1935  * - mallocs what it thinks is enough to read
 1936  *      count rounded up to a multiple of DIRBLKSIZ <= NFS_MAXREADDIR
 1937  * - calls VOP_READDIR()
 1938  * - loops around building the reply
 1939  *      if the output generated exceeds count break out of loop
 1940  *      The NFSM_CLGET macro is used here so that the reply will be packed
 1941  *      tightly in mbuf clusters.
 1942  * - it trims out records with d_fileno == 0
 1943  *      this doesn't matter for Unix clients, but they might confuse clients
 1944  *      for other os'.
 1945  * - it trims out records with d_type == DT_WHT
 1946  *      these cannot be seen through NFS (unless we extend the protocol)
 1947  *     The alternate call nfsrvd_readdirplus() does lookups as well.
 1948  * PS: The NFS protocol spec. does not clarify what the "count" byte
 1949  *      argument is a count of.. just name strings and file id's or the
 1950  *      entire reply rpc or ...
 1951  *      I tried just file name and id sizes and it confused the Sun client,
 1952  *      so I am using the full rpc size now. The "paranoia.." comment refers
 1953  *      to including the status longwords that are not a part of the dir.
 1954  *      "entry" structures, but are in the rpc.
 1955  */
 1956 int
 1957 nfsrvd_readdir(struct nfsrv_descript *nd, int isdgram,
 1958     struct vnode *vp, struct nfsexstuff *exp)
 1959 {
 1960         struct dirent *dp;
 1961         u_int32_t *tl;
 1962         int dirlen;
 1963         char *cpos, *cend, *rbuf;
 1964         struct nfsvattr at;
 1965         int nlen, error = 0, getret = 1;
 1966         int siz, cnt, fullsiz, eofflag, ncookies;
 1967         u_int64_t off, toff, verf __unused;
 1968         u_long *cookies = NULL, *cookiep;
 1969         struct uio io;
 1970         struct iovec iv;
 1971         int is_ufs;
 1972         struct thread *p = curthread;
 1973 
 1974         if (nd->nd_repstat) {
 1975                 nfsrv_postopattr(nd, getret, &at);
 1976                 goto out;
 1977         }
 1978         if (nd->nd_flag & ND_NFSV2) {
 1979                 NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 1980                 off = fxdr_unsigned(u_quad_t, *tl++);
 1981         } else {
 1982                 NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
 1983                 off = fxdr_hyper(tl);
 1984                 tl += 2;
 1985                 verf = fxdr_hyper(tl);
 1986                 tl += 2;
 1987         }
 1988         toff = off;
 1989         cnt = fxdr_unsigned(int, *tl);
 1990         if (cnt > NFS_SRVMAXDATA(nd) || cnt < 0)
 1991                 cnt = NFS_SRVMAXDATA(nd);
 1992         siz = ((cnt + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
 1993         fullsiz = siz;
 1994         if (nd->nd_flag & ND_NFSV3) {
 1995                 nd->nd_repstat = getret = nfsvno_getattr(vp, &at, nd, p, 1,
 1996                     NULL);
 1997 #if 0
 1998                 /*
 1999                  * va_filerev is not sufficient as a cookie verifier,
 2000                  * since it is not supposed to change when entries are
 2001                  * removed/added unless that offset cookies returned to
 2002                  * the client are no longer valid.
 2003                  */
 2004                 if (!nd->nd_repstat && toff && verf != at.na_filerev)
 2005                         nd->nd_repstat = NFSERR_BAD_COOKIE;
 2006 #endif
 2007         }
 2008         if (!nd->nd_repstat && vp->v_type != VDIR)
 2009                 nd->nd_repstat = NFSERR_NOTDIR;
 2010         if (nd->nd_repstat == 0 && cnt == 0) {
 2011                 if (nd->nd_flag & ND_NFSV2)
 2012                         /* NFSv2 does not have NFSERR_TOOSMALL */
 2013                         nd->nd_repstat = EPERM;
 2014                 else
 2015                         nd->nd_repstat = NFSERR_TOOSMALL;
 2016         }
 2017         if (!nd->nd_repstat)
 2018                 nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
 2019                     nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
 2020                     NFSACCCHK_VPISLOCKED, NULL);
 2021         if (nd->nd_repstat) {
 2022                 vput(vp);
 2023                 if (nd->nd_flag & ND_NFSV3)
 2024                         nfsrv_postopattr(nd, getret, &at);
 2025                 goto out;
 2026         }
 2027         is_ufs = strcmp(vp->v_mount->mnt_vfc->vfc_name, "ufs") == 0;
 2028         rbuf = malloc(siz, M_TEMP, M_WAITOK);
 2029 again:
 2030         eofflag = 0;
 2031         if (cookies) {
 2032                 free(cookies, M_TEMP);
 2033                 cookies = NULL;
 2034         }
 2035 
 2036         iv.iov_base = rbuf;
 2037         iv.iov_len = siz;
 2038         io.uio_iov = &iv;
 2039         io.uio_iovcnt = 1;
 2040         io.uio_offset = (off_t)off;
 2041         io.uio_resid = siz;
 2042         io.uio_segflg = UIO_SYSSPACE;
 2043         io.uio_rw = UIO_READ;
 2044         io.uio_td = NULL;
 2045         nd->nd_repstat = VOP_READDIR(vp, &io, nd->nd_cred, &eofflag, &ncookies,
 2046             &cookies);
 2047         off = (u_int64_t)io.uio_offset;
 2048         if (io.uio_resid)
 2049                 siz -= io.uio_resid;
 2050 
 2051         if (!cookies && !nd->nd_repstat)
 2052                 nd->nd_repstat = NFSERR_PERM;
 2053         if (nd->nd_flag & ND_NFSV3) {
 2054                 getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
 2055                 if (!nd->nd_repstat)
 2056                         nd->nd_repstat = getret;
 2057         }
 2058 
 2059         /*
 2060          * Handles the failed cases. nd->nd_repstat == 0 past here.
 2061          */
 2062         if (nd->nd_repstat) {
 2063                 vput(vp);
 2064                 free(rbuf, M_TEMP);
 2065                 if (cookies)
 2066                         free(cookies, M_TEMP);
 2067                 if (nd->nd_flag & ND_NFSV3)
 2068                         nfsrv_postopattr(nd, getret, &at);
 2069                 goto out;
 2070         }
 2071         /*
 2072          * If nothing read, return eof
 2073          * rpc reply
 2074          */
 2075         if (siz == 0) {
 2076                 vput(vp);
 2077                 if (nd->nd_flag & ND_NFSV2) {
 2078                         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2079                 } else {
 2080                         nfsrv_postopattr(nd, getret, &at);
 2081                         NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
 2082                         txdr_hyper(at.na_filerev, tl);
 2083                         tl += 2;
 2084                 }
 2085                 *tl++ = newnfs_false;
 2086                 *tl = newnfs_true;
 2087                 free(rbuf, M_TEMP);
 2088                 free(cookies, M_TEMP);
 2089                 goto out;
 2090         }
 2091 
 2092         /*
 2093          * Check for degenerate cases of nothing useful read.
 2094          * If so go try again
 2095          */
 2096         cpos = rbuf;
 2097         cend = rbuf + siz;
 2098         dp = (struct dirent *)cpos;
 2099         cookiep = cookies;
 2100 
 2101         /*
 2102          * For some reason FreeBSD's ufs_readdir() chooses to back the
 2103          * directory offset up to a block boundary, so it is necessary to
 2104          * skip over the records that precede the requested offset. This
 2105          * requires the assumption that file offset cookies monotonically
 2106          * increase.
 2107          */
 2108         while (cpos < cend && ncookies > 0 &&
 2109             (dp->d_fileno == 0 || dp->d_type == DT_WHT ||
 2110              (is_ufs == 1 && ((u_quad_t)(*cookiep)) <= toff))) {
 2111                 cpos += dp->d_reclen;
 2112                 dp = (struct dirent *)cpos;
 2113                 cookiep++;
 2114                 ncookies--;
 2115         }
 2116         if (cpos >= cend || ncookies == 0) {
 2117                 siz = fullsiz;
 2118                 toff = off;
 2119                 goto again;
 2120         }
 2121         vput(vp);
 2122 
 2123         /*
 2124          * If cnt > MCLBYTES and the reply will not be saved, use
 2125          * ext_pgs mbufs for TLS.
 2126          * For NFSv4.0, we do not know for sure if the reply will
 2127          * be saved, so do not use ext_pgs mbufs for NFSv4.0.
 2128          */
 2129         if (cnt > MCLBYTES && siz > MCLBYTES &&
 2130             (nd->nd_flag & (ND_TLS | ND_EXTPG | ND_SAVEREPLY)) == ND_TLS &&
 2131             (nd->nd_flag & (ND_NFSV4 | ND_NFSV41)) != ND_NFSV4)
 2132                 nd->nd_flag |= ND_EXTPG;
 2133 
 2134         /*
 2135          * dirlen is the size of the reply, including all XDR and must
 2136          * not exceed cnt. For NFSv2, RFC1094 didn't clearly indicate
 2137          * if the XDR should be included in "count", but to be safe, we do.
 2138          * (Include the two booleans at the end of the reply in dirlen now.)
 2139          */
 2140         if (nd->nd_flag & ND_NFSV3) {
 2141                 nfsrv_postopattr(nd, getret, &at);
 2142                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2143                 txdr_hyper(at.na_filerev, tl);
 2144                 dirlen = NFSX_V3POSTOPATTR + NFSX_VERF + 2 * NFSX_UNSIGNED;
 2145         } else {
 2146                 dirlen = 2 * NFSX_UNSIGNED;
 2147         }
 2148 
 2149         /* Loop through the records and build reply */
 2150         while (cpos < cend && ncookies > 0) {
 2151                 nlen = dp->d_namlen;
 2152                 if (dp->d_fileno != 0 && dp->d_type != DT_WHT &&
 2153                         nlen <= NFS_MAXNAMLEN) {
 2154                         if (nd->nd_flag & ND_NFSV3)
 2155                                 dirlen += (6*NFSX_UNSIGNED + NFSM_RNDUP(nlen));
 2156                         else
 2157                                 dirlen += (4*NFSX_UNSIGNED + NFSM_RNDUP(nlen));
 2158                         if (dirlen > cnt) {
 2159                                 eofflag = 0;
 2160                                 break;
 2161                         }
 2162 
 2163                         /*
 2164                          * Build the directory record xdr from
 2165                          * the dirent entry.
 2166                          */
 2167                         if (nd->nd_flag & ND_NFSV3) {
 2168                                 NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
 2169                                 *tl++ = newnfs_true;
 2170                                 *tl++ = 0;
 2171                         } else {
 2172                                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2173                                 *tl++ = newnfs_true;
 2174                         }
 2175                         *tl = txdr_unsigned(dp->d_fileno);
 2176                         (void) nfsm_strtom(nd, dp->d_name, nlen);
 2177                         if (nd->nd_flag & ND_NFSV3) {
 2178                                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2179                                 *tl++ = 0;
 2180                         } else
 2181                                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
 2182                         *tl = txdr_unsigned(*cookiep);
 2183                 }
 2184                 cpos += dp->d_reclen;
 2185                 dp = (struct dirent *)cpos;
 2186                 cookiep++;
 2187                 ncookies--;
 2188         }
 2189         if (cpos < cend)
 2190                 eofflag = 0;
 2191         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2192         *tl++ = newnfs_false;
 2193         if (eofflag)
 2194                 *tl = newnfs_true;
 2195         else
 2196                 *tl = newnfs_false;
 2197         free(rbuf, M_TEMP);
 2198         free(cookies, M_TEMP);
 2199 
 2200 out:
 2201         NFSEXITCODE2(0, nd);
 2202         return (0);
 2203 nfsmout:
 2204         vput(vp);
 2205         NFSEXITCODE2(error, nd);
 2206         return (error);
 2207 }
 2208 
 2209 /*
 2210  * Readdirplus for V3 and Readdir for V4.
 2211  */
 2212 int
 2213 nfsrvd_readdirplus(struct nfsrv_descript *nd, int isdgram,
 2214     struct vnode *vp, struct nfsexstuff *exp)
 2215 {
 2216         struct dirent *dp;
 2217         u_int32_t *tl;
 2218         int dirlen;
 2219         char *cpos, *cend, *rbuf;
 2220         struct vnode *nvp;
 2221         fhandle_t nfh;
 2222         struct nfsvattr nva, at, *nvap = &nva;
 2223         struct mbuf *mb0, *mb1;
 2224         struct nfsreferral *refp;
 2225         int nlen, r, error = 0, getret = 1, usevget = 1;
 2226         int siz, cnt, fullsiz, eofflag, ncookies, entrycnt;
 2227         caddr_t bpos0, bpos1;
 2228         u_int64_t off, toff, verf;
 2229         u_long *cookies = NULL, *cookiep;
 2230         nfsattrbit_t attrbits, rderrbits, savbits;
 2231         struct uio io;
 2232         struct iovec iv;
 2233         struct componentname cn;
 2234         int at_root, is_ufs, is_zfs, needs_unbusy, supports_nfsv4acls;
 2235         struct mount *mp, *new_mp;
 2236         uint64_t mounted_on_fileno;
 2237         struct thread *p = curthread;
 2238         int bextpg0, bextpg1, bextpgsiz0, bextpgsiz1;
 2239 
 2240         if (nd->nd_repstat) {
 2241                 nfsrv_postopattr(nd, getret, &at);
 2242                 goto out;
 2243         }
 2244         NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
 2245         off = fxdr_hyper(tl);
 2246         toff = off;
 2247         tl += 2;
 2248         verf = fxdr_hyper(tl);
 2249         tl += 2;
 2250         siz = fxdr_unsigned(int, *tl++);
 2251         cnt = fxdr_unsigned(int, *tl);
 2252 
 2253         /*
 2254          * Use the server's maximum data transfer size as the upper bound
 2255          * on reply datalen.
 2256          */
 2257         if (cnt > NFS_SRVMAXDATA(nd) || cnt < 0)
 2258                 cnt = NFS_SRVMAXDATA(nd);
 2259 
 2260         /*
 2261          * siz is a "hint" of how much directory information (name, fileid,
 2262          * cookie) should be in the reply. At least one client "hints" 0,
 2263          * so I set it to cnt for that case. I also round it up to the
 2264          * next multiple of DIRBLKSIZ.
 2265          * Since the size of a Readdirplus directory entry reply will always
 2266          * be greater than a directory entry returned by VOP_READDIR(), it
 2267          * does not make sense to read more than NFS_SRVMAXDATA() via
 2268          * VOP_READDIR().
 2269          */
 2270         if (siz <= 0)
 2271                 siz = cnt;
 2272         else if (siz > NFS_SRVMAXDATA(nd))
 2273                 siz = NFS_SRVMAXDATA(nd);
 2274         siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
 2275 
 2276         if (nd->nd_flag & ND_NFSV4) {
 2277                 error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
 2278                 if (error)
 2279                         goto nfsmout;
 2280                 NFSSET_ATTRBIT(&savbits, &attrbits);
 2281                 NFSCLRNOTFILLABLE_ATTRBIT(&attrbits, nd);
 2282                 NFSZERO_ATTRBIT(&rderrbits);
 2283                 NFSSETBIT_ATTRBIT(&rderrbits, NFSATTRBIT_RDATTRERROR);
 2284         } else {
 2285                 NFSZERO_ATTRBIT(&attrbits);
 2286         }
 2287         fullsiz = siz;
 2288         nd->nd_repstat = getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
 2289 #if 0
 2290         if (!nd->nd_repstat) {
 2291             if (off && verf != at.na_filerev) {
 2292                 /*
 2293                  * va_filerev is not sufficient as a cookie verifier,
 2294                  * since it is not supposed to change when entries are
 2295                  * removed/added unless that offset cookies returned to
 2296                  * the client are no longer valid.
 2297                  */
 2298                 if (nd->nd_flag & ND_NFSV4) {
 2299                         nd->nd_repstat = NFSERR_NOTSAME;
 2300                 } else {
 2301                         nd->nd_repstat = NFSERR_BAD_COOKIE;
 2302                 }
 2303             }
 2304         }
 2305 #endif
 2306         if (!nd->nd_repstat && vp->v_type != VDIR)
 2307                 nd->nd_repstat = NFSERR_NOTDIR;
 2308         if (!nd->nd_repstat && cnt == 0)
 2309                 nd->nd_repstat = NFSERR_TOOSMALL;
 2310         if (!nd->nd_repstat)
 2311                 nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
 2312                     nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
 2313                     NFSACCCHK_VPISLOCKED, NULL);
 2314         if (nd->nd_repstat) {
 2315                 vput(vp);
 2316                 if (nd->nd_flag & ND_NFSV3)
 2317                         nfsrv_postopattr(nd, getret, &at);
 2318                 goto out;
 2319         }
 2320         is_ufs = strcmp(vp->v_mount->mnt_vfc->vfc_name, "ufs") == 0;
 2321         is_zfs = strcmp(vp->v_mount->mnt_vfc->vfc_name, "zfs") == 0;
 2322 
 2323         rbuf = malloc(siz, M_TEMP, M_WAITOK);
 2324 again:
 2325         eofflag = 0;
 2326         if (cookies) {
 2327                 free(cookies, M_TEMP);
 2328                 cookies = NULL;
 2329         }
 2330 
 2331         iv.iov_base = rbuf;
 2332         iv.iov_len = siz;
 2333         io.uio_iov = &iv;
 2334         io.uio_iovcnt = 1;
 2335         io.uio_offset = (off_t)off;
 2336         io.uio_resid = siz;
 2337         io.uio_segflg = UIO_SYSSPACE;
 2338         io.uio_rw = UIO_READ;
 2339         io.uio_td = NULL;
 2340         nd->nd_repstat = VOP_READDIR(vp, &io, nd->nd_cred, &eofflag, &ncookies,
 2341             &cookies);
 2342         off = (u_int64_t)io.uio_offset;
 2343         if (io.uio_resid)
 2344                 siz -= io.uio_resid;
 2345 
 2346         getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
 2347 
 2348         if (!cookies && !nd->nd_repstat)
 2349                 nd->nd_repstat = NFSERR_PERM;
 2350         if (!nd->nd_repstat)
 2351                 nd->nd_repstat = getret;
 2352         if (nd->nd_repstat) {
 2353                 vput(vp);
 2354                 if (cookies)
 2355                         free(cookies, M_TEMP);
 2356                 free(rbuf, M_TEMP);
 2357                 if (nd->nd_flag & ND_NFSV3)
 2358                         nfsrv_postopattr(nd, getret, &at);
 2359                 goto out;
 2360         }
 2361         /*
 2362          * If nothing read, return eof
 2363          * rpc reply
 2364          */
 2365         if (siz == 0) {
 2366                 vput(vp);
 2367                 if (nd->nd_flag & ND_NFSV3)
 2368                         nfsrv_postopattr(nd, getret, &at);
 2369                 NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
 2370                 txdr_hyper(at.na_filerev, tl);
 2371                 tl += 2;
 2372                 *tl++ = newnfs_false;
 2373                 *tl = newnfs_true;
 2374                 free(cookies, M_TEMP);
 2375                 free(rbuf, M_TEMP);
 2376                 goto out;
 2377         }
 2378 
 2379         /*
 2380          * Check for degenerate cases of nothing useful read.
 2381          * If so go try again
 2382          */
 2383         cpos = rbuf;
 2384         cend = rbuf + siz;
 2385         dp = (struct dirent *)cpos;
 2386         cookiep = cookies;
 2387 
 2388         /*
 2389          * For some reason FreeBSD's ufs_readdir() chooses to back the
 2390          * directory offset up to a block boundary, so it is necessary to
 2391          * skip over the records that precede the requested offset. This
 2392          * requires the assumption that file offset cookies monotonically
 2393          * increase.
 2394          */
 2395         while (cpos < cend && ncookies > 0 &&
 2396           (dp->d_fileno == 0 || dp->d_type == DT_WHT ||
 2397            (is_ufs == 1 && ((u_quad_t)(*cookiep)) <= toff) ||
 2398            ((nd->nd_flag & ND_NFSV4) &&
 2399             ((dp->d_namlen == 1 && dp->d_name[0] == '.') ||
 2400              (dp->d_namlen==2 && dp->d_name[0]=='.' && dp->d_name[1]=='.'))))) {
 2401                 cpos += dp->d_reclen;
 2402                 dp = (struct dirent *)cpos;
 2403                 cookiep++;
 2404                 ncookies--;
 2405         }
 2406         if (cpos >= cend || ncookies == 0) {
 2407                 siz = fullsiz;
 2408                 toff = off;
 2409                 goto again;
 2410         }
 2411 
 2412         /*
 2413          * Busy the file system so that the mount point won't go away
 2414          * and, as such, VFS_VGET() can be used safely.
 2415          */
 2416         mp = vp->v_mount;
 2417         vfs_ref(mp);
 2418         NFSVOPUNLOCK(vp);
 2419         nd->nd_repstat = vfs_busy(mp, 0);
 2420         vfs_rel(mp);
 2421         if (nd->nd_repstat != 0) {
 2422                 vrele(vp);
 2423                 free(cookies, M_TEMP);
 2424                 free(rbuf, M_TEMP);
 2425                 if (nd->nd_flag & ND_NFSV3)
 2426                         nfsrv_postopattr(nd, getret, &at);
 2427                 goto out;
 2428         }
 2429 
 2430         /*
 2431          * Check to see if entries in this directory can be safely acquired
 2432          * via VFS_VGET() or if a switch to VOP_LOOKUP() is required.
 2433          * ZFS snapshot directories need VOP_LOOKUP(), so that any
 2434          * automount of the snapshot directory that is required will
 2435          * be done.
 2436          * This needs to be done here for NFSv4, since NFSv4 never does
 2437          * a VFS_VGET() for "." or "..".
 2438          */
 2439         if (is_zfs == 1) {
 2440                 r = VFS_VGET(mp, at.na_fileid, LK_SHARED, &nvp);
 2441                 if (r == EOPNOTSUPP) {
 2442                         usevget = 0;
 2443                         cn.cn_nameiop = LOOKUP;
 2444                         cn.cn_lkflags = LK_SHARED | LK_RETRY;
 2445                         cn.cn_cred = nd->nd_cred;
 2446                         cn.cn_thread = p;
 2447                 } else if (r == 0)
 2448                         vput(nvp);
 2449         }
 2450 
 2451         /*
 2452          * If the reply is likely to exceed MCLBYTES and the reply will
 2453          * not be saved, use ext_pgs mbufs for TLS.
 2454          * It is difficult to predict how large each entry will be and
 2455          * how many entries have been read, so just assume the directory
 2456          * entries grow by a factor of 4 when attributes are included.
 2457          * For NFSv4.0, we do not know for sure if the reply will
 2458          * be saved, so do not use ext_pgs mbufs for NFSv4.0.
 2459          */
 2460         if (cnt > MCLBYTES && siz > MCLBYTES / 4 &&
 2461             (nd->nd_flag & (ND_TLS | ND_EXTPG | ND_SAVEREPLY)) == ND_TLS &&
 2462             (nd->nd_flag & (ND_NFSV4 | ND_NFSV41)) != ND_NFSV4)
 2463                 nd->nd_flag |= ND_EXTPG;
 2464 
 2465         /*
 2466          * Save this position, in case there is an error before one entry
 2467          * is created.
 2468          */
 2469         mb0 = nd->nd_mb;
 2470         bpos0 = nd->nd_bpos;
 2471         bextpg0 = nd->nd_bextpg;
 2472         bextpgsiz0 = nd->nd_bextpgsiz;
 2473 
 2474         /*
 2475          * Fill in the first part of the reply.
 2476          * dirlen is the reply length in bytes and cannot exceed cnt.
 2477          * (Include the two booleans at the end of the reply in dirlen now,
 2478          *  so we recognize when we have exceeded cnt.)
 2479          */
 2480         if (nd->nd_flag & ND_NFSV3) {
 2481                 dirlen = NFSX_V3POSTOPATTR + NFSX_VERF + 2 * NFSX_UNSIGNED;
 2482                 nfsrv_postopattr(nd, getret, &at);
 2483         } else {
 2484                 dirlen = NFSX_VERF + 2 * NFSX_UNSIGNED;
 2485         }
 2486         NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
 2487         txdr_hyper(at.na_filerev, tl);
 2488 
 2489         /*
 2490          * Save this position, in case there is an empty reply needed.
 2491          */
 2492         mb1 = nd->nd_mb;
 2493         bpos1 = nd->nd_bpos;
 2494         bextpg1 = nd->nd_bextpg;
 2495         bextpgsiz1 = nd->nd_bextpgsiz;
 2496 
 2497         /* Loop through the records and build reply */
 2498         entrycnt = 0;
 2499         while (cpos < cend && ncookies > 0 && dirlen < cnt) {
 2500                 nlen = dp->d_namlen;
 2501                 if (dp->d_fileno != 0 && dp->d_type != DT_WHT &&
 2502                     nlen <= NFS_MAXNAMLEN &&
 2503                     ((nd->nd_flag & ND_NFSV3) || nlen > 2 ||
 2504                      (nlen==2 && (dp->d_name[0]!='.' || dp->d_name[1]!='.'))
 2505                       || (nlen == 1 && dp->d_name[0] != '.'))) {
 2506                         /*
 2507                          * Save the current position in the reply, in case
 2508                          * this entry exceeds cnt.
 2509                          */
 2510                         mb1 = nd->nd_mb;
 2511                         bpos1 = nd->nd_bpos;
 2512                         bextpg1 = nd->nd_bextpg;
 2513                         bextpgsiz1 = nd->nd_bextpgsiz;
 2514 
 2515                         /*
 2516                          * For readdir_and_lookup get the vnode using
 2517                          * the file number.
 2518                          */
 2519                         nvp = NULL;
 2520                         refp = NULL;
 2521                         r = 0;
 2522                         at_root = 0;
 2523                         needs_unbusy = 0;
 2524                         new_mp = mp;
 2525                         mounted_on_fileno = (uint64_t)dp->d_fileno;
 2526                         if ((nd->nd_flag & ND_NFSV3) ||
 2527                             NFSNONZERO_ATTRBIT(&savbits)) {
 2528                                 if (nd->nd_flag & ND_NFSV4)
 2529                                         refp = nfsv4root_getreferral(NULL,
 2530                                             vp, dp->d_fileno);
 2531                                 if (refp == NULL) {
 2532                                         if (usevget)
 2533                                                 r = VFS_VGET(mp, dp->d_fileno,
 2534                                                     LK_SHARED, &nvp);
 2535                                         else
 2536                                                 r = EOPNOTSUPP;
 2537                                         if (r == EOPNOTSUPP) {
 2538                                                 if (usevget) {
 2539                                                         usevget = 0;
 2540                                                         cn.cn_nameiop = LOOKUP;
 2541                                                         cn.cn_lkflags =
 2542                                                             LK_SHARED |
 2543                                                             LK_RETRY;
 2544                                                         cn.cn_cred =
 2545                                                             nd->nd_cred;
 2546                                                         cn.cn_thread = p;
 2547                                                 }
 2548                                                 cn.cn_nameptr = dp->d_name;
 2549                                                 cn.cn_namelen = nlen;
 2550                                                 cn.cn_flags = ISLASTCN |
 2551                                                     NOFOLLOW | LOCKLEAF;
 2552                                                 if (nlen == 2 &&
 2553                                                     dp->d_name[0] == '.' &&
 2554                                                     dp->d_name[1] == '.')
 2555                                                         cn.cn_flags |=
 2556                                                             ISDOTDOT;
 2557                                                 if (NFSVOPLOCK(vp, LK_SHARED)
 2558                                                     != 0) {
 2559                                                         nd->nd_repstat = EPERM;
 2560                                                         break;
 2561                                                 }
 2562                                                 if ((vp->v_vflag & VV_ROOT) != 0
 2563                                                     && (cn.cn_flags & ISDOTDOT)
 2564                                                     != 0) {
 2565                                                         vref(vp);
 2566                                                         nvp = vp;
 2567                                                         r = 0;
 2568                                                 } else {
 2569                                                         r = VOP_LOOKUP(vp, &nvp,
 2570                                                             &cn);
 2571                                                         if (vp != nvp)
 2572                                                                 NFSVOPUNLOCK(vp);
 2573                                                 }
 2574                                         }
 2575 
 2576                                         /*
 2577                                          * For NFSv4, check to see if nvp is
 2578                                          * a mount point and get the mount
 2579                                          * point vnode, as required.
 2580                                          */
 2581                                         if (r == 0 &&
 2582                                             nfsrv_enable_crossmntpt != 0 &&
 2583                                             (nd->nd_flag & ND_NFSV4) != 0 &&
 2584                                             nvp->v_type == VDIR &&
 2585                                             nvp->v_mountedhere != NULL) {
 2586                                                 new_mp = nvp->v_mountedhere;
 2587                                                 r = vfs_busy(new_mp, 0);
 2588                                                 vput(nvp);
 2589                                                 nvp = NULL;
 2590                                                 if (r == 0) {
 2591                                                         r = VFS_ROOT(new_mp,
 2592                                                             LK_SHARED, &nvp);
 2593                                                         needs_unbusy = 1;
 2594                                                         if (r == 0)
 2595                                                                 at_root = 1;
 2596                                                 }
 2597                                         }
 2598                                 }
 2599 
 2600                                 /*
 2601                                  * If we failed to look up the entry, then it
 2602                                  * has become invalid, most likely removed.
 2603                                  */
 2604                                 if (r != 0) {
 2605                                         if (needs_unbusy)
 2606                                                 vfs_unbusy(new_mp);
 2607                                         goto invalid;
 2608                                 }
 2609                                 KASSERT(refp != NULL || nvp != NULL,
 2610                                     ("%s: undetected lookup error", __func__));
 2611 
 2612                                 if (refp == NULL &&
 2613                                     ((nd->nd_flag & ND_NFSV3) ||
 2614                                      NFSNONZERO_ATTRBIT(&attrbits))) {
 2615                                         r = nfsvno_getfh(nvp, &nfh, p);
 2616                                         if (!r)
 2617                                             r = nfsvno_getattr(nvp, nvap, nd, p,
 2618                                                 1, &attrbits);
 2619                                         if (r == 0 && is_zfs == 1 &&
 2620                                             nfsrv_enable_crossmntpt != 0 &&
 2621                                             (nd->nd_flag & ND_NFSV4) != 0 &&
 2622                                             nvp->v_type == VDIR &&
 2623                                             vp->v_mount != nvp->v_mount) {
 2624                                             /*
 2625                                              * For a ZFS snapshot, there is a
 2626                                              * pseudo mount that does not set
 2627                                              * v_mountedhere, so it needs to
 2628                                              * be detected via a different
 2629                                              * mount structure.
 2630                                              */
 2631                                             at_root = 1;
 2632                                             if (new_mp == mp)
 2633                                                 new_mp = nvp->v_mount;
 2634                                         }
 2635                                 }
 2636 
 2637                                 /*
 2638                                  * If we failed to get attributes of the entry,
 2639                                  * then just skip it for NFSv3 (the traditional
 2640                                  * behavior in the old NFS server).
 2641                                  * For NFSv4 the behavior is controlled by
 2642                                  * RDATTRERROR: we either ignore the error or
 2643                                  * fail the request.
 2644                                  * Note that RDATTRERROR is never set for NFSv3.
 2645                                  */
 2646                                 if (r != 0) {
 2647                                         if (!NFSISSET_ATTRBIT(&attrbits,
 2648                                             NFSATTRBIT_RDATTRERROR)) {
 2649                                                 vput(nvp);
 2650                                                 if (needs_unbusy != 0)
 2651                                                         vfs_unbusy(new_mp);
 2652                                                 if ((nd->nd_flag & ND_NFSV3))
 2653                                                         goto invalid;
 2654                                                 nd->nd_repstat = r;
 2655                                                 break;
 2656                                         }
 2657                                 }
 2658                         }
 2659 
 2660                         /*
 2661                          * Build the directory record xdr
 2662                          */
 2663                         if (nd->nd_flag & ND_NFSV3) {
 2664                                 NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
 2665                                 *tl++ = newnfs_true;
 2666                                 *tl++ = 0;
 2667                                 *tl = txdr_unsigned(dp->d_fileno);
 2668                                 dirlen += nfsm_strtom(nd, dp->d_name, nlen);
 2669                                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2670                                 *tl++ = 0;
 2671                                 *tl = txdr_unsigned(*cookiep);
 2672                                 nfsrv_postopattr(nd, 0, nvap);
 2673                                 dirlen += nfsm_fhtom(nd,(u_int8_t *)&nfh,0,1);
 2674                                 dirlen += (5*NFSX_UNSIGNED+NFSX_V3POSTOPATTR);
 2675                                 if (nvp != NULL)
 2676                                         vput(nvp);
 2677                         } else {
 2678                                 NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
 2679                                 *tl++ = newnfs_true;
 2680                                 *tl++ = 0;
 2681                                 *tl = txdr_unsigned(*cookiep);
 2682                                 dirlen += nfsm_strtom(nd, dp->d_name, nlen);
 2683                                 if (nvp != NULL) {
 2684                                         supports_nfsv4acls =
 2685                                             nfs_supportsnfsv4acls(nvp);
 2686                                         NFSVOPUNLOCK(nvp);
 2687                                 } else
 2688                                         supports_nfsv4acls = 0;
 2689                                 if (refp != NULL) {
 2690                                         dirlen += nfsrv_putreferralattr(nd,
 2691                                             &savbits, refp, 0,
 2692                                             &nd->nd_repstat);
 2693                                         if (nd->nd_repstat) {
 2694                                                 if (nvp != NULL)
 2695                                                         vrele(nvp);
 2696                                                 if (needs_unbusy != 0)
 2697                                                         vfs_unbusy(new_mp);
 2698                                                 break;
 2699                                         }
 2700                                 } else if (r) {
 2701                                         dirlen += nfsvno_fillattr(nd, new_mp,
 2702                                             nvp, nvap, &nfh, r, &rderrbits,
 2703                                             nd->nd_cred, p, isdgram, 0,
 2704                                             supports_nfsv4acls, at_root,
 2705                                             mounted_on_fileno);
 2706                                 } else {
 2707                                         dirlen += nfsvno_fillattr(nd, new_mp,
 2708                                             nvp, nvap, &nfh, r, &attrbits,
 2709                                             nd->nd_cred, p, isdgram, 0,
 2710                                             supports_nfsv4acls, at_root,
 2711                                             mounted_on_fileno);
 2712                                 }
 2713                                 if (nvp != NULL)
 2714                                         vrele(nvp);
 2715                                 dirlen += (3 * NFSX_UNSIGNED);
 2716                         }
 2717                         if (needs_unbusy != 0)
 2718                                 vfs_unbusy(new_mp);
 2719                         if (dirlen <= cnt)
 2720                                 entrycnt++;
 2721                 }
 2722 invalid:
 2723                 cpos += dp->d_reclen;
 2724                 dp = (struct dirent *)cpos;
 2725                 cookiep++;
 2726                 ncookies--;
 2727         }
 2728         vrele(vp);
 2729         vfs_unbusy(mp);
 2730 
 2731         /*
 2732          * If dirlen > cnt, we must strip off the last entry. If that
 2733          * results in an empty reply, report NFSERR_TOOSMALL.
 2734          */
 2735         if (dirlen > cnt || nd->nd_repstat) {
 2736                 if (!nd->nd_repstat && entrycnt == 0)
 2737                         nd->nd_repstat = NFSERR_TOOSMALL;
 2738                 if (nd->nd_repstat) {
 2739                         nfsm_trimtrailing(nd, mb0, bpos0, bextpg0, bextpgsiz0);
 2740                         if (nd->nd_flag & ND_NFSV3)
 2741                                 nfsrv_postopattr(nd, getret, &at);
 2742                 } else
 2743                         nfsm_trimtrailing(nd, mb1, bpos1, bextpg1, bextpgsiz1);
 2744                 eofflag = 0;
 2745         } else if (cpos < cend)
 2746                 eofflag = 0;
 2747         if (!nd->nd_repstat) {
 2748                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2749                 *tl++ = newnfs_false;
 2750                 if (eofflag)
 2751                         *tl = newnfs_true;
 2752                 else
 2753                         *tl = newnfs_false;
 2754         }
 2755         free(cookies, M_TEMP);
 2756         free(rbuf, M_TEMP);
 2757 
 2758 out:
 2759         NFSEXITCODE2(0, nd);
 2760         return (0);
 2761 nfsmout:
 2762         vput(vp);
 2763         NFSEXITCODE2(error, nd);
 2764         return (error);
 2765 }
 2766 
 2767 /*
 2768  * Get the settable attributes out of the mbuf list.
 2769  * (Return 0 or EBADRPC)
 2770  */
 2771 int
 2772 nfsrv_sattr(struct nfsrv_descript *nd, vnode_t vp, struct nfsvattr *nvap,
 2773     nfsattrbit_t *attrbitp, NFSACL_T *aclp, struct thread *p)
 2774 {
 2775         u_int32_t *tl;
 2776         struct nfsv2_sattr *sp;
 2777         int error = 0, toclient = 0;
 2778 
 2779         switch (nd->nd_flag & (ND_NFSV2 | ND_NFSV3 | ND_NFSV4)) {
 2780         case ND_NFSV2:
 2781                 NFSM_DISSECT(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
 2782                 /*
 2783                  * Some old clients didn't fill in the high order 16bits.
 2784                  * --> check the low order 2 bytes for 0xffff
 2785                  */
 2786                 if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
 2787                         nvap->na_mode = nfstov_mode(sp->sa_mode);
 2788                 if (sp->sa_uid != newnfs_xdrneg1)
 2789                         nvap->na_uid = fxdr_unsigned(uid_t, sp->sa_uid);
 2790                 if (sp->sa_gid != newnfs_xdrneg1)
 2791                         nvap->na_gid = fxdr_unsigned(gid_t, sp->sa_gid);
 2792                 if (sp->sa_size != newnfs_xdrneg1)
 2793                         nvap->na_size = fxdr_unsigned(u_quad_t, sp->sa_size);
 2794                 if (sp->sa_atime.nfsv2_sec != newnfs_xdrneg1) {
 2795 #ifdef notyet
 2796                         fxdr_nfsv2time(&sp->sa_atime, &nvap->na_atime);
 2797 #else
 2798                         nvap->na_atime.tv_sec =
 2799                                 fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
 2800                         nvap->na_atime.tv_nsec = 0;
 2801 #endif
 2802                 }
 2803                 if (sp->sa_mtime.nfsv2_sec != newnfs_xdrneg1)
 2804                         fxdr_nfsv2time(&sp->sa_mtime, &nvap->na_mtime);
 2805                 break;
 2806         case ND_NFSV3:
 2807                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2808                 if (*tl == newnfs_true) {
 2809                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2810                         nvap->na_mode = nfstov_mode(*tl);
 2811                 }
 2812                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2813                 if (*tl == newnfs_true) {
 2814                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2815                         nvap->na_uid = fxdr_unsigned(uid_t, *tl);
 2816                 }
 2817                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2818                 if (*tl == newnfs_true) {
 2819                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2820                         nvap->na_gid = fxdr_unsigned(gid_t, *tl);
 2821                 }
 2822                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2823                 if (*tl == newnfs_true) {
 2824                         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2825                         nvap->na_size = fxdr_hyper(tl);
 2826                 }
 2827                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2828                 switch (fxdr_unsigned(int, *tl)) {
 2829                 case NFSV3SATTRTIME_TOCLIENT:
 2830                         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2831                         fxdr_nfsv3time(tl, &nvap->na_atime);
 2832                         toclient = 1;
 2833                         break;
 2834                 case NFSV3SATTRTIME_TOSERVER:
 2835                         vfs_timestamp(&nvap->na_atime);
 2836                         nvap->na_vaflags |= VA_UTIMES_NULL;
 2837                         break;
 2838                 }
 2839                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2840                 switch (fxdr_unsigned(int, *tl)) {
 2841                 case NFSV3SATTRTIME_TOCLIENT:
 2842                         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 2843                         fxdr_nfsv3time(tl, &nvap->na_mtime);
 2844                         nvap->na_vaflags &= ~VA_UTIMES_NULL;
 2845                         break;
 2846                 case NFSV3SATTRTIME_TOSERVER:
 2847                         vfs_timestamp(&nvap->na_mtime);
 2848                         if (!toclient)
 2849                                 nvap->na_vaflags |= VA_UTIMES_NULL;
 2850                         break;
 2851                 }
 2852                 break;
 2853         case ND_NFSV4:
 2854                 error = nfsv4_sattr(nd, vp, nvap, attrbitp, aclp, p);
 2855         }
 2856 nfsmout:
 2857         NFSEXITCODE2(error, nd);
 2858         return (error);
 2859 }
 2860 
 2861 /*
 2862  * Handle the setable attributes for V4.
 2863  * Returns NFSERR_BADXDR if it can't be parsed, 0 otherwise.
 2864  */
 2865 int
 2866 nfsv4_sattr(struct nfsrv_descript *nd, vnode_t vp, struct nfsvattr *nvap,
 2867     nfsattrbit_t *attrbitp, NFSACL_T *aclp, struct thread *p)
 2868 {
 2869         u_int32_t *tl;
 2870         int attrsum = 0;
 2871         int i, j;
 2872         int error, attrsize, bitpos, aclsize, aceerr, retnotsup = 0;
 2873         int moderet, toclient = 0;
 2874         u_char *cp, namestr[NFSV4_SMALLSTR + 1];
 2875         uid_t uid;
 2876         gid_t gid;
 2877         u_short mode, mask;             /* Same type as va_mode. */
 2878         struct vattr va;
 2879 
 2880         error = nfsrv_getattrbits(nd, attrbitp, NULL, &retnotsup);
 2881         if (error)
 2882                 goto nfsmout;
 2883         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2884         attrsize = fxdr_unsigned(int, *tl);
 2885 
 2886         /*
 2887          * Loop around getting the setable attributes. If an unsupported
 2888          * one is found, set nd_repstat == NFSERR_ATTRNOTSUPP and return.
 2889          */
 2890         if (retnotsup) {
 2891                 nd->nd_repstat = NFSERR_ATTRNOTSUPP;
 2892                 bitpos = NFSATTRBIT_MAX;
 2893         } else {
 2894                 bitpos = 0;
 2895         }
 2896         moderet = 0;
 2897         for (; bitpos < NFSATTRBIT_MAX; bitpos++) {
 2898             if (attrsum > attrsize) {
 2899                 error = NFSERR_BADXDR;
 2900                 goto nfsmout;
 2901             }
 2902             if (NFSISSET_ATTRBIT(attrbitp, bitpos))
 2903                 switch (bitpos) {
 2904                 case NFSATTRBIT_SIZE:
 2905                         NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
 2906                      if (vp != NULL && vp->v_type != VREG) {
 2907                             error = (vp->v_type == VDIR) ? NFSERR_ISDIR :
 2908                                 NFSERR_INVAL;
 2909                             goto nfsmout;
 2910                         }
 2911                         nvap->na_size = fxdr_hyper(tl);
 2912                         attrsum += NFSX_HYPER;
 2913                         break;
 2914                 case NFSATTRBIT_ACL:
 2915                         error = nfsrv_dissectacl(nd, aclp, &aceerr, &aclsize,
 2916                             p);
 2917                         if (error)
 2918                                 goto nfsmout;
 2919                         if (aceerr && !nd->nd_repstat)
 2920                                 nd->nd_repstat = aceerr;
 2921                         attrsum += aclsize;
 2922                         break;
 2923                 case NFSATTRBIT_ARCHIVE:
 2924                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2925                         if (!nd->nd_repstat)
 2926                                 nd->nd_repstat = NFSERR_ATTRNOTSUPP;
 2927                         attrsum += NFSX_UNSIGNED;
 2928                         break;
 2929                 case NFSATTRBIT_HIDDEN:
 2930                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2931                         if (!nd->nd_repstat)
 2932                                 nd->nd_repstat = NFSERR_ATTRNOTSUPP;
 2933                         attrsum += NFSX_UNSIGNED;
 2934                         break;
 2935                 case NFSATTRBIT_MIMETYPE:
 2936                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2937                         i = fxdr_unsigned(int, *tl);
 2938                         error = nfsm_advance(nd, NFSM_RNDUP(i), -1);
 2939                         if (error)
 2940                                 goto nfsmout;
 2941                         if (!nd->nd_repstat)
 2942                                 nd->nd_repstat = NFSERR_ATTRNOTSUPP;
 2943                         attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(i));
 2944                         break;
 2945                 case NFSATTRBIT_MODE:
 2946                         moderet = NFSERR_INVAL; /* Can't do MODESETMASKED. */
 2947                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2948                         nvap->na_mode = nfstov_mode(*tl);
 2949                         attrsum += NFSX_UNSIGNED;
 2950                         break;
 2951                 case NFSATTRBIT_OWNER:
 2952                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2953                         j = fxdr_unsigned(int, *tl);
 2954                         if (j < 0) {
 2955                                 error = NFSERR_BADXDR;
 2956                                 goto nfsmout;
 2957                         }
 2958                         if (j > NFSV4_SMALLSTR)
 2959                                 cp = malloc(j + 1, M_NFSSTRING, M_WAITOK);
 2960                         else
 2961                                 cp = namestr;
 2962                         error = nfsrv_mtostr(nd, cp, j);
 2963                         if (error) {
 2964                                 if (j > NFSV4_SMALLSTR)
 2965                                         free(cp, M_NFSSTRING);
 2966                                 goto nfsmout;
 2967                         }
 2968                         if (!nd->nd_repstat) {
 2969                                 nd->nd_repstat = nfsv4_strtouid(nd, cp, j,
 2970                                     &uid);
 2971                                 if (!nd->nd_repstat)
 2972                                         nvap->na_uid = uid;
 2973                         }
 2974                         if (j > NFSV4_SMALLSTR)
 2975                                 free(cp, M_NFSSTRING);
 2976                         attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(j));
 2977                         break;
 2978                 case NFSATTRBIT_OWNERGROUP:
 2979                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 2980                         j = fxdr_unsigned(int, *tl);
 2981                         if (j < 0) {
 2982                                 error = NFSERR_BADXDR;
 2983                                 goto nfsmout;
 2984                         }
 2985                         if (j > NFSV4_SMALLSTR)
 2986                                 cp = malloc(j + 1, M_NFSSTRING, M_WAITOK);
 2987                         else
 2988                                 cp = namestr;
 2989                         error = nfsrv_mtostr(nd, cp, j);
 2990                         if (error) {
 2991                                 if (j > NFSV4_SMALLSTR)
 2992                                         free(cp, M_NFSSTRING);
 2993                                 goto nfsmout;
 2994                         }
 2995                         if (!nd->nd_repstat) {
 2996                                 nd->nd_repstat = nfsv4_strtogid(nd, cp, j,
 2997                                     &gid);
 2998                                 if (!nd->nd_repstat)
 2999                                         nvap->na_gid = gid;
 3000                         }
 3001                         if (j > NFSV4_SMALLSTR)
 3002                                 free(cp, M_NFSSTRING);
 3003                         attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(j));
 3004                         break;
 3005                 case NFSATTRBIT_SYSTEM:
 3006                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 3007                         if (!nd->nd_repstat)
 3008                                 nd->nd_repstat = NFSERR_ATTRNOTSUPP;
 3009                         attrsum += NFSX_UNSIGNED;
 3010                         break;
 3011                 case NFSATTRBIT_TIMEACCESSSET:
 3012                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 3013                         attrsum += NFSX_UNSIGNED;
 3014                         if (fxdr_unsigned(int, *tl)==NFSV4SATTRTIME_TOCLIENT) {
 3015                             NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
 3016                             fxdr_nfsv4time(tl, &nvap->na_atime);
 3017                             toclient = 1;
 3018                             attrsum += NFSX_V4TIME;
 3019                         } else {
 3020                             vfs_timestamp(&nvap->na_atime);
 3021                             nvap->na_vaflags |= VA_UTIMES_NULL;
 3022                         }
 3023                         break;
 3024                 case NFSATTRBIT_TIMEBACKUP:
 3025                         NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
 3026                         if (!nd->nd_repstat)
 3027                                 nd->nd_repstat = NFSERR_ATTRNOTSUPP;
 3028                         attrsum += NFSX_V4TIME;
 3029                         break;
 3030                 case NFSATTRBIT_TIMECREATE:
 3031                         NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
 3032                         fxdr_nfsv4time(tl, &nvap->na_btime);
 3033                         attrsum += NFSX_V4TIME;
 3034                         break;
 3035                 case NFSATTRBIT_TIMEMODIFYSET:
 3036                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 3037                         attrsum += NFSX_UNSIGNED;
 3038                         if (fxdr_unsigned(int, *tl)==NFSV4SATTRTIME_TOCLIENT) {
 3039                             NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
 3040                             fxdr_nfsv4time(tl, &nvap->na_mtime);
 3041                             nvap->na_vaflags &= ~VA_UTIMES_NULL;
 3042                             attrsum += NFSX_V4TIME;
 3043                         } else {
 3044                             vfs_timestamp(&nvap->na_mtime);
 3045                             if (!toclient)
 3046                                 nvap->na_vaflags |= VA_UTIMES_NULL;
 3047                         }
 3048                         break;
 3049                 case NFSATTRBIT_MODESETMASKED:
 3050                         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
 3051                         mode = fxdr_unsigned(u_short, *tl++);
 3052                         mask = fxdr_unsigned(u_short, *tl);
 3053                         /*
 3054                          * vp == NULL implies an Open/Create operation.
 3055                          * This attribute can only be used for Setattr and
 3056                          * only for NFSv4.1 or higher.
 3057                          * If moderet != 0, a mode attribute has also been
 3058                          * specified and this attribute cannot be done in the
 3059                          * same Setattr operation.
 3060                          */
 3061                         if ((nd->nd_flag & ND_NFSV41) == 0)
 3062                                 nd->nd_repstat = NFSERR_ATTRNOTSUPP;
 3063                         else if ((mode & ~07777) != 0 || (mask & ~07777) != 0 ||
 3064                             vp == NULL)
 3065                                 nd->nd_repstat = NFSERR_INVAL;
 3066                         else if (moderet == 0)
 3067                                 moderet = VOP_GETATTR(vp, &va, nd->nd_cred);
 3068                         if (moderet == 0)
 3069                                 nvap->na_mode = (mode & mask) |
 3070                                     (va.va_mode & ~mask);
 3071                         else
 3072                                 nd->nd_repstat = moderet;
 3073                         attrsum += 2 * NFSX_UNSIGNED;
 3074                         break;
 3075                 default:
 3076                         nd->nd_repstat = NFSERR_ATTRNOTSUPP;
 3077                         /*
 3078                          * set bitpos so we drop out of the loop.
 3079                          */
 3080                         bitpos = NFSATTRBIT_MAX;
 3081                         break;
 3082                 }
 3083         }
 3084 
 3085         /*
 3086          * some clients pad the attrlist, so we need to skip over the
 3087          * padding.
 3088          */
 3089         if (attrsum > attrsize) {
 3090                 error = NFSERR_BADXDR;
 3091         } else {
 3092                 attrsize = NFSM_RNDUP(attrsize);
 3093                 if (attrsum < attrsize)
 3094                         error = nfsm_advance(nd, attrsize - attrsum, -1);
 3095         }
 3096 nfsmout:
 3097         NFSEXITCODE2(error, nd);
 3098         return (error);
 3099 }
 3100 
 3101 /*
 3102  * Check/setup export credentials.
 3103  */
 3104 int
 3105 nfsd_excred(struct nfsrv_descript *nd, struct nfsexstuff *exp,
 3106     struct ucred *credanon)
 3107 {
 3108         int error = 0;
 3109 
 3110         /*
 3111          * Check/setup credentials.
 3112          */
 3113         if (nd->nd_flag & ND_GSS)
 3114                 exp->nes_exflag &= ~MNT_EXPORTANON;
 3115 
 3116         /*
 3117          * Check to see if the operation is allowed for this security flavor.
 3118          * RFC2623 suggests that the NFSv3 Fsinfo RPC be allowed to
 3119          * AUTH_NONE or AUTH_SYS for file systems requiring RPCSEC_GSS.
 3120          * Also, allow Secinfo, so that it can acquire the correct flavor(s).
 3121          */
 3122         if (nfsvno_testexp(nd, exp) &&
 3123             nd->nd_procnum != NFSV4OP_SECINFO &&
 3124             nd->nd_procnum != NFSPROC_FSINFO) {
 3125                 if (nd->nd_flag & ND_NFSV4)
 3126                         error = NFSERR_WRONGSEC;
 3127                 else
 3128                         error = (NFSERR_AUTHERR | AUTH_TOOWEAK);
 3129                 goto out;
 3130         }
 3131 
 3132         /*
 3133          * Check to see if the file system is exported V4 only.
 3134          */
 3135         if (NFSVNO_EXV4ONLY(exp) && !(nd->nd_flag & ND_NFSV4)) {
 3136                 error = NFSERR_PROGNOTV4;
 3137                 goto out;
 3138         }
 3139 
 3140         /*
 3141          * Now, map the user credentials.
 3142          * (Note that ND_AUTHNONE will only be set for an NFSv3
 3143          *  Fsinfo RPC. If set for anything else, this code might need
 3144          *  to change.)
 3145          */
 3146         if (NFSVNO_EXPORTED(exp)) {
 3147                 if (((nd->nd_flag & ND_GSS) == 0 && nd->nd_cred->cr_uid == 0) ||
 3148                      NFSVNO_EXPORTANON(exp) ||
 3149                      (nd->nd_flag & ND_AUTHNONE) != 0) {
 3150                         nd->nd_cred->cr_uid = credanon->cr_uid;
 3151                         nd->nd_cred->cr_gid = credanon->cr_gid;
 3152                         crsetgroups(nd->nd_cred, credanon->cr_ngroups,
 3153                             credanon->cr_groups);
 3154                 } else if ((nd->nd_flag & ND_GSS) == 0) {
 3155                         /*
 3156                          * If using AUTH_SYS, call nfsrv_getgrpscred() to see
 3157                          * if there is a replacement credential with a group
 3158                          * list set up by "nfsuserd -manage-gids".
 3159                          * If there is no replacement, nfsrv_getgrpscred()
 3160                          * simply returns its argument.
 3161                          */
 3162                         nd->nd_cred = nfsrv_getgrpscred(nd->nd_cred);
 3163                 }
 3164         }
 3165 
 3166 out:
 3167         NFSEXITCODE2(error, nd);
 3168         return (error);
 3169 }
 3170 
 3171 /*
 3172  * Check exports.
 3173  */
 3174 int
 3175 nfsvno_checkexp(struct mount *mp, struct sockaddr *nam, struct nfsexstuff *exp,
 3176     struct ucred **credp)
 3177 {
 3178         int error;
 3179 
 3180         error = VFS_CHECKEXP(mp, nam, &exp->nes_exflag, credp,
 3181             &exp->nes_numsecflavor, exp->nes_secflavors);
 3182         if (error) {
 3183                 if (nfs_rootfhset) {
 3184                         exp->nes_exflag = 0;
 3185                         exp->nes_numsecflavor = 0;
 3186                         error = 0;
 3187                 }
 3188         } else if (exp->nes_numsecflavor < 1 || exp->nes_numsecflavor >
 3189             MAXSECFLAVORS) {
 3190                 printf("nfsvno_checkexp: numsecflavors out of range\n");
 3191                 exp->nes_numsecflavor = 0;
 3192                 error = EACCES;
 3193         }
 3194         NFSEXITCODE(error);
 3195         return (error);
 3196 }
 3197 
 3198 /*
 3199  * Get a vnode for a file handle and export stuff.
 3200  */
 3201 int
 3202 nfsvno_fhtovp(struct mount *mp, fhandle_t *fhp, struct sockaddr *nam,
 3203     int lktype, struct vnode **vpp, struct nfsexstuff *exp,
 3204     struct ucred **credp)
 3205 {
 3206         int error;
 3207 
 3208         *credp = NULL;
 3209         exp->nes_numsecflavor = 0;
 3210         error = VFS_FHTOVP(mp, &fhp->fh_fid, lktype, vpp);
 3211         if (error != 0)
 3212                 /* Make sure the server replies ESTALE to the client. */
 3213                 error = ESTALE;
 3214         if (nam && !error) {
 3215                 error = VFS_CHECKEXP(mp, nam, &exp->nes_exflag, credp,
 3216                     &exp->nes_numsecflavor, exp->nes_secflavors);
 3217                 if (error) {
 3218                         if (nfs_rootfhset) {
 3219                                 exp->nes_exflag = 0;
 3220                                 exp->nes_numsecflavor = 0;
 3221                                 error = 0;
 3222                         } else {
 3223                                 vput(*vpp);
 3224                         }
 3225                 } else if (exp->nes_numsecflavor < 1 || exp->nes_numsecflavor >
 3226                     MAXSECFLAVORS) {
 3227                         printf("nfsvno_fhtovp: numsecflavors out of range\n");
 3228                         exp->nes_numsecflavor = 0;
 3229                         error = EACCES;
 3230                         vput(*vpp);
 3231                 }
 3232         }
 3233         NFSEXITCODE(error);
 3234         return (error);
 3235 }
 3236 
 3237 /*
 3238  * nfsd_fhtovp() - convert a fh to a vnode ptr
 3239  *      - look up fsid in mount list (if not found ret error)
 3240  *      - get vp and export rights by calling nfsvno_fhtovp()
 3241  *      - if cred->cr_uid == 0 or MNT_EXPORTANON set it to credanon
 3242  *        for AUTH_SYS
 3243  *      - if mpp != NULL, return the mount point so that it can
 3244  *        be used for vn_finished_write() by the caller
 3245  */
 3246 void
 3247 nfsd_fhtovp(struct nfsrv_descript *nd, struct nfsrvfh *nfp, int lktype,
 3248     struct vnode **vpp, struct nfsexstuff *exp,
 3249     struct mount **mpp, int startwrite)
 3250 {
 3251         struct mount *mp, *mpw;
 3252         struct ucred *credanon;
 3253         fhandle_t *fhp;
 3254         int error;
 3255 
 3256         if (mpp != NULL)
 3257                 *mpp = NULL;
 3258         *vpp = NULL;
 3259         fhp = (fhandle_t *)nfp->nfsrvfh_data;
 3260         mp = vfs_busyfs(&fhp->fh_fsid);
 3261         if (mp == NULL) {
 3262                 nd->nd_repstat = ESTALE;
 3263                 goto out;
 3264         }
 3265 
 3266         if (startwrite) {
 3267                 mpw = mp;
 3268                 error = vn_start_write(NULL, &mpw, V_WAIT);
 3269                 if (error != 0) {
 3270                         mpw = NULL;
 3271                         vfs_unbusy(mp);
 3272                         nd->nd_repstat = ESTALE;
 3273                         goto out;
 3274                 }
 3275                 if (lktype == LK_SHARED && !(MNT_SHARED_WRITES(mp)))
 3276                         lktype = LK_EXCLUSIVE;
 3277         } else
 3278                 mpw = NULL;
 3279 
 3280         nd->nd_repstat = nfsvno_fhtovp(mp, fhp, nd->nd_nam, lktype, vpp, exp,
 3281             &credanon);
 3282         vfs_unbusy(mp);
 3283 
 3284         /*
 3285          * For NFSv4 without a pseudo root fs, unexported file handles
 3286          * can be returned, so that Lookup works everywhere.
 3287          */
 3288         if (!nd->nd_repstat && exp->nes_exflag == 0 &&
 3289             !(nd->nd_flag & ND_NFSV4)) {
 3290                 vput(*vpp);
 3291                 *vpp = NULL;
 3292                 nd->nd_repstat = EACCES;
 3293         }
 3294 
 3295         /*
 3296          * If TLS is required by the export, check the flags in nd_flag.
 3297          */
 3298         if (nd->nd_repstat == 0 && ((NFSVNO_EXTLS(exp) &&
 3299             (nd->nd_flag & ND_TLS) == 0) ||
 3300              (NFSVNO_EXTLSCERT(exp) &&
 3301               (nd->nd_flag & ND_TLSCERT) == 0) ||
 3302              (NFSVNO_EXTLSCERTUSER(exp) &&
 3303               (nd->nd_flag & ND_TLSCERTUSER) == 0))) {
 3304                 vput(*vpp);
 3305                 nd->nd_repstat = NFSERR_ACCES;
 3306         }
 3307 
 3308         /*
 3309          * Personally, I've never seen any point in requiring a
 3310          * reserved port#, since only in the rare case where the
 3311          * clients are all boxes with secure system privileges,
 3312          * does it provide any enhanced security, but... some people
 3313          * believe it to be useful and keep putting this code back in.
 3314          * (There is also some "security checker" out there that
 3315          *  complains if the nfs server doesn't enforce this.)
 3316          * However, note the following:
 3317          * RFC3530 (NFSv4) specifies that a reserved port# not be
 3318          *      required.
 3319          * RFC2623 recommends that, if a reserved port# is checked for,
 3320          *      that there be a way to turn that off--> ifdef'd.
 3321          */
 3322 #ifdef NFS_REQRSVPORT
 3323         if (!nd->nd_repstat) {
 3324                 struct sockaddr_in *saddr;
 3325                 struct sockaddr_in6 *saddr6;
 3326 
 3327                 saddr = NFSSOCKADDR(nd->nd_nam, struct sockaddr_in *);
 3328                 saddr6 = NFSSOCKADDR(nd->nd_nam, struct sockaddr_in6 *);
 3329                 if (!(nd->nd_flag & ND_NFSV4) &&
 3330                     ((saddr->sin_family == AF_INET &&
 3331                       ntohs(saddr->sin_port) >= IPPORT_RESERVED) ||
 3332                      (saddr6->sin6_family == AF_INET6 &&
 3333                       ntohs(saddr6->sin6_port) >= IPPORT_RESERVED))) {
 3334                         vput(*vpp);
 3335                         nd->nd_repstat = (NFSERR_AUTHERR | AUTH_TOOWEAK);
 3336                 }
 3337         }
 3338 #endif  /* NFS_REQRSVPORT */
 3339 
 3340         /*
 3341          * Check/setup credentials.
 3342          */
 3343         if (!nd->nd_repstat) {
 3344                 nd->nd_saveduid = nd->nd_cred->cr_uid;
 3345                 nd->nd_repstat = nfsd_excred(nd, exp, credanon);
 3346                 if (nd->nd_repstat)
 3347                         vput(*vpp);
 3348         }
 3349         if (credanon != NULL)
 3350                 crfree(credanon);
 3351         if (nd->nd_repstat) {
 3352                 vn_finished_write(mpw);
 3353                 *vpp = NULL;
 3354         } else if (mpp != NULL) {
 3355                 *mpp = mpw;
 3356         }
 3357 
 3358 out:
 3359         NFSEXITCODE2(0, nd);
 3360 }
 3361 
 3362 /*
 3363  * glue for fp.
 3364  */
 3365 static int
 3366 fp_getfvp(struct thread *p, int fd, struct file **fpp, struct vnode **vpp)
 3367 {
 3368         struct filedesc *fdp;
 3369         struct file *fp;
 3370         int error = 0;
 3371 
 3372         fdp = p->td_proc->p_fd;
 3373         if (fd < 0 || fd >= fdp->fd_nfiles ||
 3374             (fp = fdp->fd_ofiles[fd].fde_file) == NULL) {
 3375                 error = EBADF;
 3376                 goto out;
 3377         }
 3378         *fpp = fp;
 3379 
 3380 out:
 3381         NFSEXITCODE(error);
 3382         return (error);
 3383 }
 3384 
 3385 /*
 3386  * Called from nfssvc() to update the exports list. Just call
 3387  * vfs_export(). This has to be done, since the v4 root fake fs isn't
 3388  * in the mount list.
 3389  */
 3390 int
 3391 nfsrv_v4rootexport(void *argp, struct ucred *cred, struct thread *p)
 3392 {
 3393         struct nfsex_args *nfsexargp = (struct nfsex_args *)argp;
 3394         int error = 0;
 3395         struct nameidata nd;
 3396         fhandle_t fh;
 3397 
 3398         error = vfs_export(&nfsv4root_mnt, &nfsexargp->export);
 3399         if ((nfsexargp->export.ex_flags & MNT_DELEXPORT) != 0)
 3400                 nfs_rootfhset = 0;
 3401         else if (error == 0) {
 3402                 if (nfsexargp->fspec == NULL) {
 3403                         error = EPERM;
 3404                         goto out;
 3405                 }
 3406                 /*
 3407                  * If fspec != NULL, this is the v4root path.
 3408                  */
 3409                 NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE,
 3410                     nfsexargp->fspec, p);
 3411                 if ((error = namei(&nd)) != 0)
 3412                         goto out;
 3413                 error = nfsvno_getfh(nd.ni_vp, &fh, p);
 3414                 vrele(nd.ni_vp);
 3415                 if (!error) {
 3416                         nfs_rootfh.nfsrvfh_len = NFSX_MYFH;
 3417                         NFSBCOPY((caddr_t)&fh,
 3418                             nfs_rootfh.nfsrvfh_data,
 3419                             sizeof (fhandle_t));
 3420                         nfs_rootfhset = 1;
 3421                 }
 3422         }
 3423 
 3424 out:
 3425         NFSEXITCODE(error);
 3426         return (error);
 3427 }
 3428 
 3429 /*
 3430  * This function needs to test to see if the system is near its limit
 3431  * for memory allocation via malloc() or mget() and return True iff
 3432  * either of these resources are near their limit.
 3433  * XXX (For now, this is just a stub.)
 3434  */
 3435 int nfsrv_testmalloclimit = 0;
 3436 int
 3437 nfsrv_mallocmget_limit(void)
 3438 {
 3439         static int printmesg = 0;
 3440         static int testval = 1;
 3441 
 3442         if (nfsrv_testmalloclimit && (testval++ % 1000) == 0) {
 3443                 if ((printmesg++ % 100) == 0)
 3444                         printf("nfsd: malloc/mget near limit\n");
 3445                 return (1);
 3446         }
 3447         return (0);
 3448 }
 3449 
 3450 /*
 3451  * BSD specific initialization of a mount point.
 3452  */
 3453 void
 3454 nfsd_mntinit(void)
 3455 {
 3456         static int inited = 0;
 3457 
 3458         if (inited)
 3459                 return;
 3460         inited = 1;
 3461         nfsv4root_mnt.mnt_flag = (MNT_RDONLY | MNT_EXPORTED);
 3462         TAILQ_INIT(&nfsv4root_mnt.mnt_nvnodelist);
 3463         TAILQ_INIT(&nfsv4root_mnt.mnt_lazyvnodelist);
 3464         nfsv4root_mnt.mnt_export = NULL;
 3465         TAILQ_INIT(&nfsv4root_opt);
 3466         TAILQ_INIT(&nfsv4root_newopt);
 3467         nfsv4root_mnt.mnt_opt = &nfsv4root_opt;
 3468         nfsv4root_mnt.mnt_optnew = &nfsv4root_newopt;
 3469         nfsv4root_mnt.mnt_nvnodelistsize = 0;
 3470         nfsv4root_mnt.mnt_lazyvnodelistsize = 0;
 3471 }
 3472 
 3473 /*
 3474  * Get a vnode for a file handle, without checking exports, etc.
 3475  */
 3476 struct vnode *
 3477 nfsvno_getvp(fhandle_t *fhp)
 3478 {
 3479         struct mount *mp;
 3480         struct vnode *vp;
 3481         int error;
 3482 
 3483         mp = vfs_busyfs(&fhp->fh_fsid);
 3484         if (mp == NULL)
 3485                 return (NULL);
 3486         error = VFS_FHTOVP(mp, &fhp->fh_fid, LK_EXCLUSIVE, &vp);
 3487         vfs_unbusy(mp);
 3488         if (error)
 3489                 return (NULL);
 3490         return (vp);
 3491 }
 3492 
 3493 /*
 3494  * Do a local VOP_ADVLOCK().
 3495  */
 3496 int
 3497 nfsvno_advlock(struct vnode *vp, int ftype, u_int64_t first,
 3498     u_int64_t end, struct thread *td)
 3499 {
 3500         int error = 0;
 3501         struct flock fl;
 3502         u_int64_t tlen;
 3503 
 3504         if (nfsrv_dolocallocks == 0)
 3505                 goto out;
 3506         ASSERT_VOP_UNLOCKED(vp, "nfsvno_advlock: vp locked");
 3507 
 3508         fl.l_whence = SEEK_SET;
 3509         fl.l_type = ftype;
 3510         fl.l_start = (off_t)first;
 3511         if (end == NFS64BITSSET) {
 3512                 fl.l_len = 0;
 3513         } else {
 3514                 tlen = end - first;
 3515                 fl.l_len = (off_t)tlen;
 3516         }
 3517         /*
 3518          * For FreeBSD8, the l_pid and l_sysid must be set to the same
 3519          * values for all calls, so that all locks will be held by the
 3520          * nfsd server. (The nfsd server handles conflicts between the
 3521          * various clients.)
 3522          * Since an NFSv4 lockowner is a ClientID plus an array of up to 1024
 3523          * bytes, so it can't be put in l_sysid.
 3524          */
 3525         if (nfsv4_sysid == 0)
 3526                 nfsv4_sysid = nlm_acquire_next_sysid();
 3527         fl.l_pid = (pid_t)0;
 3528         fl.l_sysid = (int)nfsv4_sysid;
 3529 
 3530         if (ftype == F_UNLCK)
 3531                 error = VOP_ADVLOCK(vp, (caddr_t)td->td_proc, F_UNLCK, &fl,
 3532                     (F_POSIX | F_REMOTE));
 3533         else
 3534                 error = VOP_ADVLOCK(vp, (caddr_t)td->td_proc, F_SETLK, &fl,
 3535                     (F_POSIX | F_REMOTE));
 3536 
 3537 out:
 3538         NFSEXITCODE(error);
 3539         return (error);
 3540 }
 3541 
 3542 /*
 3543  * Check the nfsv4 root exports.
 3544  */
 3545 int
 3546 nfsvno_v4rootexport(struct nfsrv_descript *nd)
 3547 {
 3548         struct ucred *credanon;
 3549         int error = 0, numsecflavor, secflavors[MAXSECFLAVORS], i;
 3550         uint64_t exflags;
 3551 
 3552         error = vfs_stdcheckexp(&nfsv4root_mnt, nd->nd_nam, &exflags,
 3553             &credanon, &numsecflavor, secflavors);
 3554         if (error) {
 3555                 error = NFSERR_PROGUNAVAIL;
 3556                 goto out;
 3557         }
 3558         if (credanon != NULL)
 3559                 crfree(credanon);
 3560         for (i = 0; i < numsecflavor; i++) {
 3561                 if (secflavors[i] == AUTH_SYS)
 3562                         nd->nd_flag |= ND_EXAUTHSYS;
 3563                 else if (secflavors[i] == RPCSEC_GSS_KRB5)
 3564                         nd->nd_flag |= ND_EXGSS;
 3565                 else if (secflavors[i] == RPCSEC_GSS_KRB5I)
 3566                         nd->nd_flag |= ND_EXGSSINTEGRITY;
 3567                 else if (secflavors[i] == RPCSEC_GSS_KRB5P)
 3568                         nd->nd_flag |= ND_EXGSSPRIVACY;
 3569         }
 3570 
 3571         /* And set ND_EXxx flags for TLS. */
 3572         if ((exflags & MNT_EXTLS) != 0) {
 3573                 nd->nd_flag |= ND_EXTLS;
 3574                 if ((exflags & MNT_EXTLSCERT) != 0)
 3575                         nd->nd_flag |= ND_EXTLSCERT;
 3576                 if ((exflags & MNT_EXTLSCERTUSER) != 0)
 3577                         nd->nd_flag |= ND_EXTLSCERTUSER;
 3578         }
 3579 
 3580 out:
 3581         NFSEXITCODE(error);
 3582         return (error);
 3583 }
 3584 
 3585 /*
 3586  * Nfs server pseudo system call for the nfsd's
 3587  */
 3588 /*
 3589  * MPSAFE
 3590  */
 3591 static int
 3592 nfssvc_nfsd(struct thread *td, struct nfssvc_args *uap)
 3593 {
 3594         struct file *fp;
 3595         struct nfsd_addsock_args sockarg;
 3596         struct nfsd_nfsd_args nfsdarg;
 3597         struct nfsd_nfsd_oargs onfsdarg;
 3598         struct nfsd_pnfsd_args pnfsdarg;
 3599         struct vnode *vp, *nvp, *curdvp;
 3600         struct pnfsdsfile *pf;
 3601         struct nfsdevice *ds, *fds;
 3602         cap_rights_t rights;
 3603         int buflen, error, ret;
 3604         char *buf, *cp, *cp2, *cp3;
 3605         char fname[PNFS_FILENAME_LEN + 1];
 3606 
 3607         if (uap->flag & NFSSVC_NFSDADDSOCK) {
 3608                 error = copyin(uap->argp, (caddr_t)&sockarg, sizeof (sockarg));
 3609                 if (error)
 3610                         goto out;
 3611                 /*
 3612                  * Since we don't know what rights might be required,
 3613                  * pretend that we need them all. It is better to be too
 3614                  * careful than too reckless.
 3615                  */
 3616                 error = fget(td, sockarg.sock,
 3617                     cap_rights_init_one(&rights, CAP_SOCK_SERVER), &fp);
 3618                 if (error != 0)
 3619                         goto out;
 3620                 if (fp->f_type != DTYPE_SOCKET) {
 3621                         fdrop(fp, td);
 3622                         error = EPERM;
 3623                         goto out;
 3624                 }
 3625                 error = nfsrvd_addsock(fp);
 3626                 fdrop(fp, td);
 3627         } else if (uap->flag & NFSSVC_NFSDNFSD) {
 3628                 if (uap->argp == NULL) {
 3629                         error = EINVAL;
 3630                         goto out;
 3631                 }
 3632                 if ((uap->flag & NFSSVC_NEWSTRUCT) == 0) {
 3633                         error = copyin(uap->argp, &onfsdarg, sizeof(onfsdarg));
 3634                         if (error == 0) {
 3635                                 nfsdarg.principal = onfsdarg.principal;
 3636                                 nfsdarg.minthreads = onfsdarg.minthreads;
 3637                                 nfsdarg.maxthreads = onfsdarg.maxthreads;
 3638                                 nfsdarg.version = 1;
 3639                                 nfsdarg.addr = NULL;
 3640                                 nfsdarg.addrlen = 0;
 3641                                 nfsdarg.dnshost = NULL;
 3642                                 nfsdarg.dnshostlen = 0;
 3643                                 nfsdarg.dspath = NULL;
 3644                                 nfsdarg.dspathlen = 0;
 3645                                 nfsdarg.mdspath = NULL;
 3646                                 nfsdarg.mdspathlen = 0;
 3647                                 nfsdarg.mirrorcnt = 1;
 3648                         }
 3649                 } else
 3650                         error = copyin(uap->argp, &nfsdarg, sizeof(nfsdarg));
 3651                 if (error)
 3652                         goto out;
 3653                 if (nfsdarg.addrlen > 0 && nfsdarg.addrlen < 10000 &&
 3654                     nfsdarg.dnshostlen > 0 && nfsdarg.dnshostlen < 10000 &&
 3655                     nfsdarg.dspathlen > 0 && nfsdarg.dspathlen < 10000 &&
 3656                     nfsdarg.mdspathlen > 0 && nfsdarg.mdspathlen < 10000 &&
 3657                     nfsdarg.mirrorcnt >= 1 &&
 3658                     nfsdarg.mirrorcnt <= NFSDEV_MAXMIRRORS &&
 3659                     nfsdarg.addr != NULL && nfsdarg.dnshost != NULL &&
 3660                     nfsdarg.dspath != NULL && nfsdarg.mdspath != NULL) {
 3661                         NFSD_DEBUG(1, "addrlen=%d dspathlen=%d dnslen=%d"
 3662                             " mdspathlen=%d mirrorcnt=%d\n", nfsdarg.addrlen,
 3663                             nfsdarg.dspathlen, nfsdarg.dnshostlen,
 3664                             nfsdarg.mdspathlen, nfsdarg.mirrorcnt);
 3665                         cp = malloc(nfsdarg.addrlen + 1, M_TEMP, M_WAITOK);
 3666                         error = copyin(nfsdarg.addr, cp, nfsdarg.addrlen);
 3667                         if (error != 0) {
 3668                                 free(cp, M_TEMP);
 3669                                 goto out;
 3670                         }
 3671                         cp[nfsdarg.addrlen] = '\0';     /* Ensure nul term. */
 3672                         nfsdarg.addr = cp;
 3673                         cp = malloc(nfsdarg.dnshostlen + 1, M_TEMP, M_WAITOK);
 3674                         error = copyin(nfsdarg.dnshost, cp, nfsdarg.dnshostlen);
 3675                         if (error != 0) {
 3676                                 free(nfsdarg.addr, M_TEMP);
 3677                                 free(cp, M_TEMP);
 3678                                 goto out;
 3679                         }
 3680                         cp[nfsdarg.dnshostlen] = '\0';  /* Ensure nul term. */
 3681                         nfsdarg.dnshost = cp;
 3682                         cp = malloc(nfsdarg.dspathlen + 1, M_TEMP, M_WAITOK);
 3683                         error = copyin(nfsdarg.dspath, cp, nfsdarg.dspathlen);
 3684                         if (error != 0) {
 3685                                 free(nfsdarg.addr, M_TEMP);
 3686                                 free(nfsdarg.dnshost, M_TEMP);
 3687                                 free(cp, M_TEMP);
 3688                                 goto out;
 3689                         }
 3690                         cp[nfsdarg.dspathlen] = '\0';   /* Ensure nul term. */
 3691                         nfsdarg.dspath = cp;
 3692                         cp = malloc(nfsdarg.mdspathlen + 1, M_TEMP, M_WAITOK);
 3693                         error = copyin(nfsdarg.mdspath, cp, nfsdarg.mdspathlen);
 3694                         if (error != 0) {
 3695                                 free(nfsdarg.addr, M_TEMP);
 3696                                 free(nfsdarg.dnshost, M_TEMP);
 3697                                 free(nfsdarg.dspath, M_TEMP);
 3698                                 free(cp, M_TEMP);
 3699                                 goto out;
 3700                         }
 3701                         cp[nfsdarg.mdspathlen] = '\0';  /* Ensure nul term. */
 3702                         nfsdarg.mdspath = cp;
 3703                 } else {
 3704                         nfsdarg.addr = NULL;
 3705                         nfsdarg.addrlen = 0;
 3706                         nfsdarg.dnshost = NULL;
 3707                         nfsdarg.dnshostlen = 0;
 3708                         nfsdarg.dspath = NULL;
 3709                         nfsdarg.dspathlen = 0;
 3710                         nfsdarg.mdspath = NULL;
 3711                         nfsdarg.mdspathlen = 0;
 3712                         nfsdarg.mirrorcnt = 1;
 3713                 }
 3714                 error = nfsrvd_nfsd(td, &nfsdarg);
 3715                 free(nfsdarg.addr, M_TEMP);
 3716                 free(nfsdarg.dnshost, M_TEMP);
 3717                 free(nfsdarg.dspath, M_TEMP);
 3718                 free(nfsdarg.mdspath, M_TEMP);
 3719         } else if (uap->flag & NFSSVC_PNFSDS) {
 3720                 error = copyin(uap->argp, &pnfsdarg, sizeof(pnfsdarg));
 3721                 if (error == 0 && (pnfsdarg.op == PNFSDOP_DELDSSERVER ||
 3722                     pnfsdarg.op == PNFSDOP_FORCEDELDS)) {
 3723                         cp = malloc(PATH_MAX + 1, M_TEMP, M_WAITOK);
 3724                         error = copyinstr(pnfsdarg.dspath, cp, PATH_MAX + 1,
 3725                             NULL);
 3726                         if (error == 0)
 3727                                 error = nfsrv_deldsserver(pnfsdarg.op, cp, td);
 3728                         free(cp, M_TEMP);
 3729                 } else if (error == 0 && pnfsdarg.op == PNFSDOP_COPYMR) {
 3730                         cp = malloc(PATH_MAX + 1, M_TEMP, M_WAITOK);
 3731                         buflen = sizeof(*pf) * NFSDEV_MAXMIRRORS;
 3732                         buf = malloc(buflen, M_TEMP, M_WAITOK);
 3733                         error = copyinstr(pnfsdarg.mdspath, cp, PATH_MAX + 1,
 3734                             NULL);
 3735                         NFSD_DEBUG(4, "pnfsdcopymr cp mdspath=%d\n", error);
 3736                         if (error == 0 && pnfsdarg.dspath != NULL) {
 3737                                 cp2 = malloc(PATH_MAX + 1, M_TEMP, M_WAITOK);
 3738                                 error = copyinstr(pnfsdarg.dspath, cp2,
 3739                                     PATH_MAX + 1, NULL);
 3740                                 NFSD_DEBUG(4, "pnfsdcopymr cp dspath=%d\n",
 3741                                     error);
 3742                         } else
 3743                                 cp2 = NULL;
 3744                         if (error == 0 && pnfsdarg.curdspath != NULL) {
 3745                                 cp3 = malloc(PATH_MAX + 1, M_TEMP, M_WAITOK);
 3746                                 error = copyinstr(pnfsdarg.curdspath, cp3,
 3747                                     PATH_MAX + 1, NULL);
 3748                                 NFSD_DEBUG(4, "pnfsdcopymr cp curdspath=%d\n",
 3749                                     error);
 3750                         } else
 3751                                 cp3 = NULL;
 3752                         curdvp = NULL;
 3753                         fds = NULL;
 3754                         if (error == 0)
 3755                                 error = nfsrv_mdscopymr(cp, cp2, cp3, buf,
 3756                                     &buflen, fname, td, &vp, &nvp, &pf, &ds,
 3757                                     &fds);
 3758                         NFSD_DEBUG(4, "nfsrv_mdscopymr=%d\n", error);
 3759                         if (error == 0) {
 3760                                 if (pf->dsf_dir >= nfsrv_dsdirsize) {
 3761                                         printf("copymr: dsdir out of range\n");
 3762                                         pf->dsf_dir = 0;
 3763                                 }
 3764                                 NFSD_DEBUG(4, "copymr: buflen=%d\n", buflen);
 3765                                 error = nfsrv_copymr(vp, nvp,
 3766                                     ds->nfsdev_dsdir[pf->dsf_dir], ds, pf,
 3767                                     (struct pnfsdsfile *)buf,
 3768                                     buflen / sizeof(*pf), td->td_ucred, td);
 3769                                 vput(vp);
 3770                                 vput(nvp);
 3771                                 if (fds != NULL && error == 0) {
 3772                                         curdvp = fds->nfsdev_dsdir[pf->dsf_dir];
 3773                                         ret = vn_lock(curdvp, LK_EXCLUSIVE);
 3774                                         if (ret == 0) {
 3775                                                 nfsrv_dsremove(curdvp, fname,
 3776                                                     td->td_ucred, td);
 3777                                                 NFSVOPUNLOCK(curdvp);
 3778                                         }
 3779                                 }
 3780                                 NFSD_DEBUG(4, "nfsrv_copymr=%d\n", error);
 3781                         }
 3782                         free(cp, M_TEMP);
 3783                         free(cp2, M_TEMP);
 3784                         free(cp3, M_TEMP);
 3785                         free(buf, M_TEMP);
 3786                 }
 3787         } else {
 3788                 error = nfssvc_srvcall(td, uap, td->td_ucred);
 3789         }
 3790 
 3791 out:
 3792         NFSEXITCODE(error);
 3793         return (error);
 3794 }
 3795 
 3796 static int
 3797 nfssvc_srvcall(struct thread *p, struct nfssvc_args *uap, struct ucred *cred)
 3798 {
 3799         struct nfsex_args export;
 3800         struct nfsex_oldargs oexp;
 3801         struct file *fp = NULL;
 3802         int stablefd, i, len;
 3803         struct nfsd_clid adminrevoke;
 3804         struct nfsd_dumplist dumplist;
 3805         struct nfsd_dumpclients *dumpclients;
 3806         struct nfsd_dumplocklist dumplocklist;
 3807         struct nfsd_dumplocks *dumplocks;
 3808         struct nameidata nd;
 3809         vnode_t vp;
 3810         int error = EINVAL, igotlock;
 3811         struct proc *procp;
 3812         gid_t *grps;
 3813         static int suspend_nfsd = 0;
 3814 
 3815         if (uap->flag & NFSSVC_PUBLICFH) {
 3816                 NFSBZERO((caddr_t)&nfs_pubfh.nfsrvfh_data,
 3817                     sizeof (fhandle_t));
 3818                 error = copyin(uap->argp,
 3819                     &nfs_pubfh.nfsrvfh_data, sizeof (fhandle_t));
 3820                 if (!error)
 3821                         nfs_pubfhset = 1;
 3822         } else if ((uap->flag & (NFSSVC_V4ROOTEXPORT | NFSSVC_NEWSTRUCT)) ==
 3823             (NFSSVC_V4ROOTEXPORT | NFSSVC_NEWSTRUCT)) {
 3824                 error = copyin(uap->argp,(caddr_t)&export,
 3825                     sizeof (struct nfsex_args));
 3826                 if (!error) {
 3827                         grps = NULL;
 3828                         if (export.export.ex_ngroups > NGROUPS_MAX ||
 3829                             export.export.ex_ngroups < 0)
 3830                                 error = EINVAL;
 3831                         else if (export.export.ex_ngroups > 0) {
 3832                                 grps = malloc(export.export.ex_ngroups *
 3833                                     sizeof(gid_t), M_TEMP, M_WAITOK);
 3834                                 error = copyin(export.export.ex_groups, grps,
 3835                                     export.export.ex_ngroups * sizeof(gid_t));
 3836                                 export.export.ex_groups = grps;
 3837                         } else
 3838                                 export.export.ex_groups = NULL;
 3839                         if (!error)
 3840                                 error = nfsrv_v4rootexport(&export, cred, p);
 3841                         free(grps, M_TEMP);
 3842                 }
 3843         } else if ((uap->flag & (NFSSVC_V4ROOTEXPORT | NFSSVC_NEWSTRUCT)) ==
 3844             NFSSVC_V4ROOTEXPORT) {
 3845                 error = copyin(uap->argp,(caddr_t)&oexp,
 3846                     sizeof (struct nfsex_oldargs));
 3847                 if (!error) {
 3848                         memset(&export.export, 0, sizeof(export.export));
 3849                         export.export.ex_flags = (uint64_t)oexp.export.ex_flags;
 3850                         export.export.ex_root = oexp.export.ex_root;
 3851                         export.export.ex_uid = oexp.export.ex_anon.cr_uid;
 3852                         export.export.ex_ngroups =
 3853                             oexp.export.ex_anon.cr_ngroups;
 3854                         export.export.ex_groups = NULL;
 3855                         if (export.export.ex_ngroups > XU_NGROUPS ||
 3856                             export.export.ex_ngroups < 0)
 3857                                 error = EINVAL;
 3858                         else if (export.export.ex_ngroups > 0) {
 3859                                 export.export.ex_groups = malloc(
 3860                                     export.export.ex_ngroups * sizeof(gid_t),
 3861                                     M_TEMP, M_WAITOK);
 3862                                 for (i = 0; i < export.export.ex_ngroups; i++)
 3863                                         export.export.ex_groups[i] =
 3864                                             oexp.export.ex_anon.cr_groups[i];
 3865                         }
 3866                         export.export.ex_addr = oexp.export.ex_addr;
 3867                         export.export.ex_addrlen = oexp.export.ex_addrlen;
 3868                         export.export.ex_mask = oexp.export.ex_mask;
 3869                         export.export.ex_masklen = oexp.export.ex_masklen;
 3870                         export.export.ex_indexfile = oexp.export.ex_indexfile;
 3871                         export.export.ex_numsecflavors =
 3872                             oexp.export.ex_numsecflavors;
 3873                         if (export.export.ex_numsecflavors >= MAXSECFLAVORS ||
 3874                             export.export.ex_numsecflavors < 0)
 3875                                 error = EINVAL;
 3876                         else {
 3877                                 for (i = 0; i < export.export.ex_numsecflavors;
 3878                                     i++)
 3879                                         export.export.ex_secflavors[i] =
 3880                                             oexp.export.ex_secflavors[i];
 3881                         }
 3882                         export.fspec = oexp.fspec;
 3883                         if (error == 0)
 3884                                 error = nfsrv_v4rootexport(&export, cred, p);
 3885                         free(export.export.ex_groups, M_TEMP);
 3886                 }
 3887         } else if (uap->flag & NFSSVC_NOPUBLICFH) {
 3888                 nfs_pubfhset = 0;
 3889                 error = 0;
 3890         } else if (uap->flag & NFSSVC_STABLERESTART) {
 3891                 error = copyin(uap->argp, (caddr_t)&stablefd,
 3892                     sizeof (int));
 3893                 if (!error)
 3894                         error = fp_getfvp(p, stablefd, &fp, &vp);
 3895                 if (!error && (NFSFPFLAG(fp) & (FREAD | FWRITE)) != (FREAD | FWRITE))
 3896                         error = EBADF;
 3897                 if (!error && newnfs_numnfsd != 0)
 3898                         error = EPERM;
 3899                 if (!error) {
 3900                         nfsrv_stablefirst.nsf_fp = fp;
 3901                         nfsrv_setupstable(p);
 3902                 }
 3903         } else if (uap->flag & NFSSVC_ADMINREVOKE) {
 3904                 error = copyin(uap->argp, (caddr_t)&adminrevoke,
 3905                     sizeof (struct nfsd_clid));
 3906                 if (!error)
 3907                         error = nfsrv_adminrevoke(&adminrevoke, p);
 3908         } else if (uap->flag & NFSSVC_DUMPCLIENTS) {
 3909                 error = copyin(uap->argp, (caddr_t)&dumplist,
 3910                     sizeof (struct nfsd_dumplist));
 3911                 if (!error && (dumplist.ndl_size < 1 ||
 3912                         dumplist.ndl_size > NFSRV_MAXDUMPLIST))
 3913                         error = EPERM;
 3914                 if (!error) {
 3915                     len = sizeof (struct nfsd_dumpclients) * dumplist.ndl_size;
 3916                     dumpclients = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
 3917                     nfsrv_dumpclients(dumpclients, dumplist.ndl_size);
 3918                     error = copyout(dumpclients, dumplist.ndl_list, len);
 3919                     free(dumpclients, M_TEMP);
 3920                 }
 3921         } else if (uap->flag & NFSSVC_DUMPLOCKS) {
 3922                 error = copyin(uap->argp, (caddr_t)&dumplocklist,
 3923                     sizeof (struct nfsd_dumplocklist));
 3924                 if (!error && (dumplocklist.ndllck_size < 1 ||
 3925                         dumplocklist.ndllck_size > NFSRV_MAXDUMPLIST))
 3926                         error = EPERM;
 3927                 if (!error)
 3928                         error = nfsrv_lookupfilename(&nd,
 3929                                 dumplocklist.ndllck_fname, p);
 3930                 if (!error) {
 3931                         len = sizeof (struct nfsd_dumplocks) *
 3932                                 dumplocklist.ndllck_size;
 3933                         dumplocks = malloc(len, M_TEMP, M_WAITOK | M_ZERO);
 3934                         nfsrv_dumplocks(nd.ni_vp, dumplocks,
 3935                             dumplocklist.ndllck_size, p);
 3936                         vput(nd.ni_vp);
 3937                         error = copyout(dumplocks, dumplocklist.ndllck_list,
 3938                             len);
 3939                         free(dumplocks, M_TEMP);
 3940                 }
 3941         } else if (uap->flag & NFSSVC_BACKUPSTABLE) {
 3942                 procp = p->td_proc;
 3943                 PROC_LOCK(procp);
 3944                 nfsd_master_pid = procp->p_pid;
 3945                 bcopy(procp->p_comm, nfsd_master_comm, MAXCOMLEN + 1);
 3946                 nfsd_master_start = procp->p_stats->p_start;
 3947                 nfsd_master_proc = procp;
 3948                 PROC_UNLOCK(procp);
 3949         } else if ((uap->flag & NFSSVC_SUSPENDNFSD) != 0) {
 3950                 NFSLOCKV4ROOTMUTEX();
 3951                 if (suspend_nfsd == 0) {
 3952                         /* Lock out all nfsd threads */
 3953                         do {
 3954                                 igotlock = nfsv4_lock(&nfsd_suspend_lock, 1,
 3955                                     NULL, NFSV4ROOTLOCKMUTEXPTR, NULL);
 3956                         } while (igotlock == 0 && suspend_nfsd == 0);
 3957                         suspend_nfsd = 1;
 3958                 }
 3959                 NFSUNLOCKV4ROOTMUTEX();
 3960                 error = 0;
 3961         } else if ((uap->flag & NFSSVC_RESUMENFSD) != 0) {
 3962                 NFSLOCKV4ROOTMUTEX();
 3963                 if (suspend_nfsd != 0) {
 3964                         nfsv4_unlock(&nfsd_suspend_lock, 0);
 3965                         suspend_nfsd = 0;
 3966                 }
 3967                 NFSUNLOCKV4ROOTMUTEX();
 3968                 error = 0;
 3969         }
 3970 
 3971         NFSEXITCODE(error);
 3972         return (error);
 3973 }
 3974 
 3975 /*
 3976  * Check exports.
 3977  * Returns 0 if ok, 1 otherwise.
 3978  */
 3979 int
 3980 nfsvno_testexp(struct nfsrv_descript *nd, struct nfsexstuff *exp)
 3981 {
 3982         int i;
 3983 
 3984         /*
 3985          * This seems odd, but allow the case where the security flavor
 3986          * list is empty. This happens when NFSv4 is traversing non-exported
 3987          * file systems. Exported file systems should always have a non-empty
 3988          * security flavor list.
 3989          */
 3990         if (exp->nes_numsecflavor == 0)
 3991                 return (0);
 3992 
 3993         for (i = 0; i < exp->nes_numsecflavor; i++) {
 3994                 /*
 3995                  * The tests for privacy and integrity must be first,
 3996                  * since ND_GSS is set for everything but AUTH_SYS.
 3997                  */
 3998                 if (exp->nes_secflavors[i] == RPCSEC_GSS_KRB5P &&
 3999                     (nd->nd_flag & ND_GSSPRIVACY))
 4000                         return (0);
 4001                 if (exp->nes_secflavors[i] == RPCSEC_GSS_KRB5I &&
 4002                     (nd->nd_flag & ND_GSSINTEGRITY))
 4003                         return (0);
 4004                 if (exp->nes_secflavors[i] == RPCSEC_GSS_KRB5 &&
 4005                     (nd->nd_flag & ND_GSS))
 4006                         return (0);
 4007                 if (exp->nes_secflavors[i] == AUTH_SYS &&
 4008                     (nd->nd_flag & ND_GSS) == 0)
 4009                         return (0);
 4010         }
 4011         return (1);
 4012 }
 4013 
 4014 /*
 4015  * Calculate a hash value for the fid in a file handle.
 4016  */
 4017 uint32_t
 4018 nfsrv_hashfh(fhandle_t *fhp)
 4019 {
 4020         uint32_t hashval;
 4021 
 4022         hashval = hash32_buf(&fhp->fh_fid, sizeof(struct fid), 0);
 4023         return (hashval);
 4024 }
 4025 
 4026 /*
 4027  * Calculate a hash value for the sessionid.
 4028  */
 4029 uint32_t
 4030 nfsrv_hashsessionid(uint8_t *sessionid)
 4031 {
 4032         uint32_t hashval;
 4033 
 4034         hashval = hash32_buf(sessionid, NFSX_V4SESSIONID, 0);
 4035         return (hashval);
 4036 }
 4037 
 4038 /*
 4039  * Signal the userland master nfsd to backup the stable restart file.
 4040  */
 4041 void
 4042 nfsrv_backupstable(void)
 4043 {
 4044         struct proc *procp;
 4045 
 4046         if (nfsd_master_proc != NULL) {
 4047                 procp = pfind(nfsd_master_pid);
 4048                 /* Try to make sure it is the correct process. */
 4049                 if (procp == nfsd_master_proc &&
 4050                     procp->p_stats->p_start.tv_sec ==
 4051                     nfsd_master_start.tv_sec &&
 4052                     procp->p_stats->p_start.tv_usec ==
 4053                     nfsd_master_start.tv_usec &&
 4054                     strcmp(procp->p_comm, nfsd_master_comm) == 0)
 4055                         kern_psignal(procp, SIGUSR2);
 4056                 else
 4057                         nfsd_master_proc = NULL;
 4058 
 4059                 if (procp != NULL)
 4060                         PROC_UNLOCK(procp);
 4061         }
 4062 }
 4063 
 4064 /*
 4065  * Create a DS data file for nfsrv_pnfscreate(). Called for each mirror.
 4066  * The arguments are in a structure, so that they can be passed through
 4067  * taskqueue for a kernel process to execute this function.
 4068  */
 4069 struct nfsrvdscreate {
 4070         int                     done;
 4071         int                     inprog;
 4072         struct task             tsk;
 4073         struct ucred            *tcred;
 4074         struct vnode            *dvp;
 4075         NFSPROC_T               *p;
 4076         struct pnfsdsfile       *pf;
 4077         int                     err;
 4078         fhandle_t               fh;
 4079         struct vattr            va;
 4080         struct vattr            createva;
 4081 };
 4082 
 4083 int
 4084 nfsrv_dscreate(struct vnode *dvp, struct vattr *vap, struct vattr *nvap,
 4085     fhandle_t *fhp, struct pnfsdsfile *pf, struct pnfsdsattr *dsa,
 4086     char *fnamep, struct ucred *tcred, NFSPROC_T *p, struct vnode **nvpp)
 4087 {
 4088         struct vnode *nvp;
 4089         struct nameidata named;
 4090         struct vattr va;
 4091         char *bufp;
 4092         u_long *hashp;
 4093         struct nfsnode *np;
 4094         struct nfsmount *nmp;
 4095         int error;
 4096 
 4097         NFSNAMEICNDSET(&named.ni_cnd, tcred, CREATE,
 4098             LOCKPARENT | LOCKLEAF | SAVESTART | NOCACHE);
 4099         nfsvno_setpathbuf(&named, &bufp, &hashp);
 4100         named.ni_cnd.cn_lkflags = LK_EXCLUSIVE;
 4101         named.ni_cnd.cn_thread = p;
 4102         named.ni_cnd.cn_nameptr = bufp;
 4103         if (fnamep != NULL) {
 4104                 strlcpy(bufp, fnamep, PNFS_FILENAME_LEN + 1);
 4105                 named.ni_cnd.cn_namelen = strlen(bufp);
 4106         } else
 4107                 named.ni_cnd.cn_namelen = nfsrv_putfhname(fhp, bufp);
 4108         NFSD_DEBUG(4, "nfsrv_dscreate: dvp=%p fname=%s\n", dvp, bufp);
 4109 
 4110         /* Create the date file in the DS mount. */
 4111         error = NFSVOPLOCK(dvp, LK_EXCLUSIVE);
 4112         if (error == 0) {
 4113                 error = VOP_CREATE(dvp, &nvp, &named.ni_cnd, vap);
 4114                 vref(dvp);
 4115                 VOP_VPUT_PAIR(dvp, error == 0 ? &nvp : NULL, false);
 4116                 if (error == 0) {
 4117                         /* Set the ownership of the file. */
 4118                         error = VOP_SETATTR(nvp, nvap, tcred);
 4119                         NFSD_DEBUG(4, "nfsrv_dscreate:"
 4120                             " setattr-uid=%d\n", error);
 4121                         if (error != 0)
 4122                                 vput(nvp);
 4123                 }
 4124                 if (error != 0)
 4125                         printf("pNFS: pnfscreate failed=%d\n", error);
 4126         } else
 4127                 printf("pNFS: pnfscreate vnlock=%d\n", error);
 4128         if (error == 0) {
 4129                 np = VTONFS(nvp);
 4130                 nmp = VFSTONFS(nvp->v_mount);
 4131                 if (strcmp(nvp->v_mount->mnt_vfc->vfc_name, "nfs")
 4132                     != 0 || nmp->nm_nam->sa_len > sizeof(
 4133                     struct sockaddr_in6) ||
 4134                     np->n_fhp->nfh_len != NFSX_MYFH) {
 4135                         printf("Bad DS file: fstype=%s salen=%d"
 4136                             " fhlen=%d\n",
 4137                             nvp->v_mount->mnt_vfc->vfc_name,
 4138                             nmp->nm_nam->sa_len, np->n_fhp->nfh_len);
 4139                         error = ENOENT;
 4140                 }
 4141 
 4142                 /* Set extattrs for the DS on the MDS file. */
 4143                 if (error == 0) {
 4144                         if (dsa != NULL) {
 4145                                 error = VOP_GETATTR(nvp, &va, tcred);
 4146                                 if (error == 0) {
 4147                                         dsa->dsa_filerev = va.va_filerev;
 4148                                         dsa->dsa_size = va.va_size;
 4149                                         dsa->dsa_atime = va.va_atime;
 4150                                         dsa->dsa_mtime = va.va_mtime;
 4151                                         dsa->dsa_bytes = va.va_bytes;
 4152                                 }
 4153                         }
 4154                         if (error == 0) {
 4155                                 NFSBCOPY(np->n_fhp->nfh_fh, &pf->dsf_fh,
 4156                                     NFSX_MYFH);
 4157                                 NFSBCOPY(nmp->nm_nam, &pf->dsf_sin,
 4158                                     nmp->nm_nam->sa_len);
 4159                                 NFSBCOPY(named.ni_cnd.cn_nameptr,
 4160                                     pf->dsf_filename,
 4161                                     sizeof(pf->dsf_filename));
 4162                         }
 4163                 } else
 4164                         printf("pNFS: pnfscreate can't get DS"
 4165                             " attr=%d\n", error);
 4166                 if (nvpp != NULL && error == 0)
 4167                         *nvpp = nvp;
 4168                 else
 4169                         vput(nvp);
 4170         }
 4171         nfsvno_relpathbuf(&named);
 4172         return (error);
 4173 }
 4174 
 4175 /*
 4176  * Start up the thread that will execute nfsrv_dscreate().
 4177  */
 4178 static void
 4179 start_dscreate(void *arg, int pending)
 4180 {
 4181         struct nfsrvdscreate *dsc;
 4182 
 4183         dsc = (struct nfsrvdscreate *)arg;
 4184         dsc->err = nfsrv_dscreate(dsc->dvp, &dsc->createva, &dsc->va, &dsc->fh,
 4185             dsc->pf, NULL, NULL, dsc->tcred, dsc->p, NULL);
 4186         dsc->done = 1;
 4187         NFSD_DEBUG(4, "start_dscreate: err=%d\n", dsc->err);
 4188 }
 4189 
 4190 /*
 4191  * Create a pNFS data file on the Data Server(s).
 4192  */
 4193 static void
 4194 nfsrv_pnfscreate(struct vnode *vp, struct vattr *vap, struct ucred *cred,
 4195     NFSPROC_T *p)
 4196 {
 4197         struct nfsrvdscreate *dsc, *tdsc = NULL;
 4198         struct nfsdevice *ds, *tds, *fds;
 4199         struct mount *mp;
 4200         struct pnfsdsfile *pf, *tpf;
 4201         struct pnfsdsattr dsattr;
 4202         struct vattr va;
 4203         struct vnode *dvp[NFSDEV_MAXMIRRORS];
 4204         struct nfsmount *nmp;
 4205         fhandle_t fh;
 4206         uid_t vauid;
 4207         gid_t vagid;
 4208         u_short vamode;
 4209         struct ucred *tcred;
 4210         int dsdir[NFSDEV_MAXMIRRORS], error, i, mirrorcnt, ret;
 4211         int failpos, timo;
 4212 
 4213         /* Get a DS server directory in a round-robin order. */
 4214         mirrorcnt = 1;
 4215         mp = vp->v_mount;
 4216         ds = fds = NULL;
 4217         NFSDDSLOCK();
 4218         /*
 4219          * Search for the first entry that handles this MDS fs, but use the
 4220          * first entry for all MDS fs's otherwise.
 4221          */
 4222         TAILQ_FOREACH(tds, &nfsrv_devidhead, nfsdev_list) {
 4223                 if (tds->nfsdev_nmp != NULL) {
 4224                         if (tds->nfsdev_mdsisset == 0 && ds == NULL)
 4225                                 ds = tds;
 4226                         else if (tds->nfsdev_mdsisset != 0 && fsidcmp(
 4227                             &mp->mnt_stat.f_fsid, &tds->nfsdev_mdsfsid) == 0) {
 4228                                 ds = fds = tds;
 4229                                 break;
 4230                         }
 4231                 }
 4232         }
 4233         if (ds == NULL) {
 4234                 NFSDDSUNLOCK();
 4235                 NFSD_DEBUG(4, "nfsrv_pnfscreate: no srv\n");
 4236                 return;
 4237         }
 4238         i = dsdir[0] = ds->nfsdev_nextdir;
 4239         ds->nfsdev_nextdir = (ds->nfsdev_nextdir + 1) % nfsrv_dsdirsize;
 4240         dvp[0] = ds->nfsdev_dsdir[i];
 4241         tds = TAILQ_NEXT(ds, nfsdev_list);
 4242         if (nfsrv_maxpnfsmirror > 1 && tds != NULL) {
 4243                 TAILQ_FOREACH_FROM(tds, &nfsrv_devidhead, nfsdev_list) {
 4244                         if (tds->nfsdev_nmp != NULL &&
 4245                             ((tds->nfsdev_mdsisset == 0 && fds == NULL) ||
 4246                              (tds->nfsdev_mdsisset != 0 && fds != NULL &&
 4247                               fsidcmp(&mp->mnt_stat.f_fsid,
 4248                               &tds->nfsdev_mdsfsid) == 0))) {
 4249                                 dsdir[mirrorcnt] = i;
 4250                                 dvp[mirrorcnt] = tds->nfsdev_dsdir[i];
 4251                                 mirrorcnt++;
 4252                                 if (mirrorcnt >= nfsrv_maxpnfsmirror)
 4253                                         break;
 4254                         }
 4255                 }
 4256         }
 4257         /* Put at end of list to implement round-robin usage. */
 4258         TAILQ_REMOVE(&nfsrv_devidhead, ds, nfsdev_list);
 4259         TAILQ_INSERT_TAIL(&nfsrv_devidhead, ds, nfsdev_list);
 4260         NFSDDSUNLOCK();
 4261         dsc = NULL;
 4262         if (mirrorcnt > 1)
 4263                 tdsc = dsc = malloc(sizeof(*dsc) * (mirrorcnt - 1), M_TEMP,
 4264                     M_WAITOK | M_ZERO);
 4265         tpf = pf = malloc(sizeof(*pf) * nfsrv_maxpnfsmirror, M_TEMP, M_WAITOK |
 4266             M_ZERO);
 4267 
 4268         error = nfsvno_getfh(vp, &fh, p);
 4269         if (error == 0)
 4270                 error = VOP_GETATTR(vp, &va, cred);
 4271         if (error == 0) {
 4272                 /* Set the attributes for "vp" to Setattr the DS vp. */
 4273                 vauid = va.va_uid;
 4274                 vagid = va.va_gid;
 4275                 vamode = va.va_mode;
 4276                 VATTR_NULL(&va);
 4277                 va.va_uid = vauid;
 4278                 va.va_gid = vagid;
 4279                 va.va_mode = vamode;
 4280                 va.va_size = 0;
 4281         } else
 4282                 printf("pNFS: pnfscreate getfh+attr=%d\n", error);
 4283 
 4284         NFSD_DEBUG(4, "nfsrv_pnfscreate: cruid=%d crgid=%d\n", cred->cr_uid,
 4285             cred->cr_gid);
 4286         /* Make data file name based on FH. */
 4287         tcred = newnfs_getcred();
 4288 
 4289         /*
 4290          * Create the file on each DS mirror, using kernel process(es) for the
 4291          * additional mirrors.
 4292          */
 4293         failpos = -1;
 4294         for (i = 0; i < mirrorcnt - 1 && error == 0; i++, tpf++, tdsc++) {
 4295                 tpf->dsf_dir = dsdir[i];
 4296                 tdsc->tcred = tcred;
 4297                 tdsc->p = p;
 4298                 tdsc->pf = tpf;
 4299                 tdsc->createva = *vap;
 4300                 NFSBCOPY(&fh, &tdsc->fh, sizeof(fh));
 4301                 tdsc->va = va;
 4302                 tdsc->dvp = dvp[i];
 4303                 tdsc->done = 0;
 4304                 tdsc->inprog = 0;
 4305                 tdsc->err = 0;
 4306                 ret = EIO;
 4307                 if (nfs_pnfsiothreads != 0) {
 4308                         ret = nfs_pnfsio(start_dscreate, tdsc);
 4309                         NFSD_DEBUG(4, "nfsrv_pnfscreate: nfs_pnfsio=%d\n", ret);
 4310                 }
 4311                 if (ret != 0) {
 4312                         ret = nfsrv_dscreate(dvp[i], vap, &va, &fh, tpf, NULL,
 4313                             NULL, tcred, p, NULL);
 4314                         if (ret != 0) {
 4315                                 KASSERT(error == 0, ("nfsrv_dscreate err=%d",
 4316                                     error));
 4317                                 if (failpos == -1 && nfsds_failerr(ret))
 4318                                         failpos = i;
 4319                                 else
 4320                                         error = ret;
 4321                         }
 4322                 }
 4323         }
 4324         if (error == 0) {
 4325                 tpf->dsf_dir = dsdir[mirrorcnt - 1];
 4326                 error = nfsrv_dscreate(dvp[mirrorcnt - 1], vap, &va, &fh, tpf,
 4327                     &dsattr, NULL, tcred, p, NULL);
 4328                 if (failpos == -1 && mirrorcnt > 1 && nfsds_failerr(error)) {
 4329                         failpos = mirrorcnt - 1;
 4330                         error = 0;
 4331                 }
 4332         }
 4333         timo = hz / 50;         /* Wait for 20msec. */
 4334         if (timo < 1)
 4335                 timo = 1;
 4336         /* Wait for kernel task(s) to complete. */
 4337         for (tdsc = dsc, i = 0; i < mirrorcnt - 1; i++, tdsc++) {
 4338                 while (tdsc->inprog != 0 && tdsc->done == 0)
 4339                         tsleep(&tdsc->tsk, PVFS, "srvdcr", timo);
 4340                 if (tdsc->err != 0) {
 4341                         if (failpos == -1 && nfsds_failerr(tdsc->err))
 4342                                 failpos = i;
 4343                         else if (error == 0)
 4344                                 error = tdsc->err;
 4345                 }
 4346         }
 4347 
 4348         /*
 4349          * If failpos has been set, that mirror has failed, so it needs
 4350          * to be disabled.
 4351          */
 4352         if (failpos >= 0) {
 4353                 nmp = VFSTONFS(dvp[failpos]->v_mount);
 4354                 NFSLOCKMNT(nmp);
 4355                 if ((nmp->nm_privflag & (NFSMNTP_FORCEDISM |
 4356                      NFSMNTP_CANCELRPCS)) == 0) {
 4357                         nmp->nm_privflag |= NFSMNTP_CANCELRPCS;
 4358                         NFSUNLOCKMNT(nmp);
 4359                         ds = nfsrv_deldsnmp(PNFSDOP_DELDSSERVER, nmp, p);
 4360                         NFSD_DEBUG(4, "dscreatfail fail=%d ds=%p\n", failpos,
 4361                             ds);
 4362                         if (ds != NULL)
 4363                                 nfsrv_killrpcs(nmp);
 4364                         NFSLOCKMNT(nmp);
 4365                         nmp->nm_privflag &= ~NFSMNTP_CANCELRPCS;
 4366                         wakeup(nmp);
 4367                 }
 4368                 NFSUNLOCKMNT(nmp);
 4369         }
 4370 
 4371         NFSFREECRED(tcred);
 4372         if (error == 0) {
 4373                 ASSERT_VOP_ELOCKED(vp, "nfsrv_pnfscreate vp");
 4374 
 4375                 NFSD_DEBUG(4, "nfsrv_pnfscreate: mirrorcnt=%d maxmirror=%d\n",
 4376                     mirrorcnt, nfsrv_maxpnfsmirror);
 4377                 /*
 4378                  * For all mirrors that couldn't be created, fill in the
 4379                  * *pf structure, but with an IP address == 0.0.0.0.
 4380                  */
 4381                 tpf = pf + mirrorcnt;
 4382                 for (i = mirrorcnt; i < nfsrv_maxpnfsmirror; i++, tpf++) {
 4383                         *tpf = *pf;
 4384                         tpf->dsf_sin.sin_family = AF_INET;
 4385                         tpf->dsf_sin.sin_len = sizeof(struct sockaddr_in);
 4386                         tpf->dsf_sin.sin_addr.s_addr = 0;
 4387                         tpf->dsf_sin.sin_port = 0;
 4388                 }
 4389 
 4390                 error = vn_extattr_set(vp, IO_NODELOCKED,
 4391                     EXTATTR_NAMESPACE_SYSTEM, "pnfsd.dsfile",
 4392                     sizeof(*pf) * nfsrv_maxpnfsmirror, (char *)pf, p);
 4393                 if (error == 0)
 4394                         error = vn_extattr_set(vp, IO_NODELOCKED,
 4395                             EXTATTR_NAMESPACE_SYSTEM, "pnfsd.dsattr",
 4396                             sizeof(dsattr), (char *)&dsattr, p);
 4397                 if (error != 0)
 4398                         printf("pNFS: pnfscreate setextattr=%d\n",
 4399                             error);
 4400         } else
 4401                 printf("pNFS: pnfscreate=%d\n", error);
 4402         free(pf, M_TEMP);
 4403         free(dsc, M_TEMP);
 4404 }
 4405 
 4406 /*
 4407  * Get the information needed to remove the pNFS Data Server file from the
 4408  * Metadata file.  Upon success, ddvp is set non-NULL to the locked
 4409  * DS directory vnode.  The caller must unlock *ddvp when done with it.
 4410  */
 4411 static void
 4412 nfsrv_pnfsremovesetup(struct vnode *vp, NFSPROC_T *p, struct vnode **dvpp,
 4413     int *mirrorcntp, char *fname, fhandle_t *fhp)
 4414 {
 4415         struct vattr va;
 4416         struct ucred *tcred;
 4417         char *buf;
 4418         int buflen, error;
 4419 
 4420         dvpp[0] = NULL;
 4421         /* If not an exported regular file or not a pNFS server, just return. */
 4422         if (vp->v_type != VREG || (vp->v_mount->mnt_flag & MNT_EXPORTED) == 0 ||
 4423             nfsrv_devidcnt == 0)
 4424                 return;
 4425 
 4426         /* Check to see if this is the last hard link. */
 4427         tcred = newnfs_getcred();
 4428         error = VOP_GETATTR(vp, &va, tcred);
 4429         NFSFREECRED(tcred);
 4430         if (error != 0) {
 4431                 printf("pNFS: nfsrv_pnfsremovesetup getattr=%d\n", error);
 4432                 return;
 4433         }
 4434         if (va.va_nlink > 1)
 4435                 return;
 4436 
 4437         error = nfsvno_getfh(vp, fhp, p);
 4438         if (error != 0) {
 4439                 printf("pNFS: nfsrv_pnfsremovesetup getfh=%d\n", error);
 4440                 return;
 4441         }
 4442 
 4443         buflen = 1024;
 4444         buf = malloc(buflen, M_TEMP, M_WAITOK);
 4445         /* Get the directory vnode for the DS mount and the file handle. */
 4446         error = nfsrv_dsgetsockmnt(vp, 0, buf, &buflen, mirrorcntp, p, dvpp,
 4447             NULL, NULL, fname, NULL, NULL, NULL, NULL, NULL);
 4448         free(buf, M_TEMP);
 4449         if (error != 0)
 4450                 printf("pNFS: nfsrv_pnfsremovesetup getsockmnt=%d\n", error);
 4451 }
 4452 
 4453 /*
 4454  * Remove a DS data file for nfsrv_pnfsremove(). Called for each mirror.
 4455  * The arguments are in a structure, so that they can be passed through
 4456  * taskqueue for a kernel process to execute this function.
 4457  */
 4458 struct nfsrvdsremove {
 4459         int                     done;
 4460         int                     inprog;
 4461         struct task             tsk;
 4462         struct ucred            *tcred;
 4463         struct vnode            *dvp;
 4464         NFSPROC_T               *p;
 4465         int                     err;
 4466         char                    fname[PNFS_FILENAME_LEN + 1];
 4467 };
 4468 
 4469 static int
 4470 nfsrv_dsremove(struct vnode *dvp, char *fname, struct ucred *tcred,
 4471     NFSPROC_T *p)
 4472 {
 4473         struct nameidata named;
 4474         struct vnode *nvp;
 4475         char *bufp;
 4476         u_long *hashp;
 4477         int error;
 4478 
 4479         error = NFSVOPLOCK(dvp, LK_EXCLUSIVE);
 4480         if (error != 0)
 4481                 return (error);
 4482         named.ni_cnd.cn_nameiop = DELETE;
 4483         named.ni_cnd.cn_lkflags = LK_EXCLUSIVE | LK_RETRY;
 4484         named.ni_cnd.cn_cred = tcred;
 4485         named.ni_cnd.cn_thread = p;
 4486         named.ni_cnd.cn_flags = ISLASTCN | LOCKPARENT | LOCKLEAF | SAVENAME;
 4487         nfsvno_setpathbuf(&named, &bufp, &hashp);
 4488         named.ni_cnd.cn_nameptr = bufp;
 4489         named.ni_cnd.cn_namelen = strlen(fname);
 4490         strlcpy(bufp, fname, NAME_MAX);
 4491         NFSD_DEBUG(4, "nfsrv_pnfsremove: filename=%s\n", bufp);
 4492         error = VOP_LOOKUP(dvp, &nvp, &named.ni_cnd);
 4493         NFSD_DEBUG(4, "nfsrv_pnfsremove: aft LOOKUP=%d\n", error);
 4494         if (error == 0) {
 4495                 error = VOP_REMOVE(dvp, nvp, &named.ni_cnd);
 4496                 vput(nvp);
 4497         }
 4498         NFSVOPUNLOCK(dvp);
 4499         nfsvno_relpathbuf(&named);
 4500         if (error != 0)
 4501                 printf("pNFS: nfsrv_pnfsremove failed=%d\n", error);
 4502         return (error);
 4503 }
 4504 
 4505 /*
 4506  * Start up the thread that will execute nfsrv_dsremove().
 4507  */
 4508 static void
 4509 start_dsremove(void *arg, int pending)
 4510 {
 4511         struct nfsrvdsremove *dsrm;
 4512 
 4513         dsrm = (struct nfsrvdsremove *)arg;
 4514         dsrm->err = nfsrv_dsremove(dsrm->dvp, dsrm->fname, dsrm->tcred,
 4515             dsrm->p);
 4516         dsrm->done = 1;
 4517         NFSD_DEBUG(4, "start_dsremove: err=%d\n", dsrm->err);
 4518 }
 4519 
 4520 /*
 4521  * Remove a pNFS data file from a Data Server.
 4522  * nfsrv_pnfsremovesetup() must have been called before the MDS file was
 4523  * removed to set up the dvp and fill in the FH.
 4524  */
 4525 static void
 4526 nfsrv_pnfsremove(struct vnode **dvp, int mirrorcnt, char *fname, fhandle_t *fhp,
 4527     NFSPROC_T *p)
 4528 {
 4529         struct ucred *tcred;
 4530         struct nfsrvdsremove *dsrm, *tdsrm;
 4531         struct nfsdevice *ds;
 4532         struct nfsmount *nmp;
 4533         int failpos, i, ret, timo;
 4534 
 4535         tcred = newnfs_getcred();
 4536         dsrm = NULL;
 4537         if (mirrorcnt > 1)
 4538                 dsrm = malloc(sizeof(*dsrm) * mirrorcnt - 1, M_TEMP, M_WAITOK);
 4539         /*
 4540          * Remove the file on each DS mirror, using kernel process(es) for the
 4541          * additional mirrors.
 4542          */
 4543         failpos = -1;
 4544         for (tdsrm = dsrm, i = 0; i < mirrorcnt - 1; i++, tdsrm++) {
 4545                 tdsrm->tcred = tcred;
 4546                 tdsrm->p = p;
 4547                 tdsrm->dvp = dvp[i];
 4548                 strlcpy(tdsrm->fname, fname, PNFS_FILENAME_LEN + 1);
 4549                 tdsrm->inprog = 0;
 4550                 tdsrm->done = 0;
 4551                 tdsrm->err = 0;
 4552                 ret = EIO;
 4553                 if (nfs_pnfsiothreads != 0) {
 4554                         ret = nfs_pnfsio(start_dsremove, tdsrm);
 4555                         NFSD_DEBUG(4, "nfsrv_pnfsremove: nfs_pnfsio=%d\n", ret);
 4556                 }
 4557                 if (ret != 0) {
 4558                         ret = nfsrv_dsremove(dvp[i], fname, tcred, p);
 4559                         if (failpos == -1 && nfsds_failerr(ret))
 4560                                 failpos = i;
 4561                 }
 4562         }
 4563         ret = nfsrv_dsremove(dvp[mirrorcnt - 1], fname, tcred, p);
 4564         if (failpos == -1 && mirrorcnt > 1 && nfsds_failerr(ret))
 4565                 failpos = mirrorcnt - 1;
 4566         timo = hz / 50;         /* Wait for 20msec. */
 4567         if (timo < 1)
 4568                 timo = 1;
 4569         /* Wait for kernel task(s) to complete. */
 4570         for (tdsrm = dsrm, i = 0; i < mirrorcnt - 1; i++, tdsrm++) {
 4571                 while (tdsrm->inprog != 0 && tdsrm->done == 0)
 4572                         tsleep(&tdsrm->tsk, PVFS, "srvdsrm", timo);
 4573                 if (failpos == -1 && nfsds_failerr(tdsrm->err))
 4574                         failpos = i;
 4575         }
 4576 
 4577         /*
 4578          * If failpos has been set, that mirror has failed, so it needs
 4579          * to be disabled.
 4580          */
 4581         if (failpos >= 0) {
 4582                 nmp = VFSTONFS(dvp[failpos]->v_mount);
 4583                 NFSLOCKMNT(nmp);
 4584                 if ((nmp->nm_privflag & (NFSMNTP_FORCEDISM |
 4585                      NFSMNTP_CANCELRPCS)) == 0) {
 4586                         nmp->nm_privflag |= NFSMNTP_CANCELRPCS;
 4587                         NFSUNLOCKMNT(nmp);
 4588                         ds = nfsrv_deldsnmp(PNFSDOP_DELDSSERVER, nmp, p);
 4589                         NFSD_DEBUG(4, "dsremovefail fail=%d ds=%p\n", failpos,
 4590                             ds);
 4591                         if (ds != NULL)
 4592                                 nfsrv_killrpcs(nmp);
 4593                         NFSLOCKMNT(nmp);
 4594                         nmp->nm_privflag &= ~NFSMNTP_CANCELRPCS;
 4595                         wakeup(nmp);
 4596                 }
 4597                 NFSUNLOCKMNT(nmp);
 4598         }
 4599 
 4600         /* Get rid all layouts for the file. */
 4601         nfsrv_freefilelayouts(fhp);
 4602 
 4603         NFSFREECRED(tcred);
 4604         free(dsrm, M_TEMP);
 4605 }
 4606 
 4607 /*
 4608  * Generate a file name based on the file handle and put it in *bufp.
 4609  * Return the number of bytes generated.
 4610  */
 4611 static int
 4612 nfsrv_putfhname(fhandle_t *fhp, char *bufp)
 4613 {
 4614         int i;
 4615         uint8_t *cp;
 4616         const uint8_t *hexdigits = "0123456789abcdef";
 4617 
 4618         cp = (uint8_t *)fhp;
 4619         for (i = 0; i < sizeof(*fhp); i++) {
 4620                 bufp[2 * i] = hexdigits[(*cp >> 4) & 0xf];
 4621                 bufp[2 * i + 1] = hexdigits[*cp++ & 0xf];
 4622         }
 4623         bufp[2 * i] = '\0';
 4624         return (2 * i);
 4625 }
 4626 
 4627 /*
 4628  * Update the Metadata file's attributes from the DS file when a Read/Write
 4629  * layout is returned.
 4630  * Basically just call nfsrv_proxyds() with procedure == NFSPROC_LAYOUTRETURN
 4631  * so that it does a nfsrv_getattrdsrpc() and nfsrv_setextattr() on the DS file.
 4632  */
 4633 int
 4634 nfsrv_updatemdsattr(struct vnode *vp, struct nfsvattr *nap, NFSPROC_T *p)
 4635 {
 4636         struct ucred *tcred;
 4637         int error;
 4638 
 4639         /* Do this as root so that it won't fail with EACCES. */
 4640         tcred = newnfs_getcred();
 4641         error = nfsrv_proxyds(vp, 0, 0, tcred, p, NFSPROC_LAYOUTRETURN,
 4642             NULL, NULL, NULL, nap, NULL, NULL, 0, NULL);
 4643         NFSFREECRED(tcred);
 4644         return (error);
 4645 }
 4646 
 4647 /*
 4648  * Set the NFSv4 ACL on the DS file to the same ACL as the MDS file.
 4649  */
 4650 static int
 4651 nfsrv_dssetacl(struct vnode *vp, struct acl *aclp, struct ucred *cred,
 4652     NFSPROC_T *p)
 4653 {
 4654         int error;
 4655 
 4656         error = nfsrv_proxyds(vp, 0, 0, cred, p, NFSPROC_SETACL,
 4657             NULL, NULL, NULL, NULL, aclp, NULL, 0, NULL);
 4658         return (error);
 4659 }
 4660 
 4661 static int
 4662 nfsrv_proxyds(struct vnode *vp, off_t off, int cnt, struct ucred *cred,
 4663     struct thread *p, int ioproc, struct mbuf **mpp, char *cp,
 4664     struct mbuf **mpp2, struct nfsvattr *nap, struct acl *aclp,
 4665     off_t *offp, int content, bool *eofp)
 4666 {
 4667         struct nfsmount *nmp[NFSDEV_MAXMIRRORS], *failnmp;
 4668         fhandle_t fh[NFSDEV_MAXMIRRORS];
 4669         struct vnode *dvp[NFSDEV_MAXMIRRORS];
 4670         struct nfsdevice *ds;
 4671         struct pnfsdsattr dsattr;
 4672         struct opnfsdsattr odsattr;
 4673         char *buf;
 4674         int buflen, error, failpos, i, mirrorcnt, origmircnt, trycnt;
 4675 
 4676         NFSD_DEBUG(4, "in nfsrv_proxyds\n");
 4677         /*
 4678          * If not a regular file, not exported or not a pNFS server,
 4679          * just return ENOENT.
 4680          */
 4681         if (vp->v_type != VREG || (vp->v_mount->mnt_flag & MNT_EXPORTED) == 0 ||
 4682             nfsrv_devidcnt == 0)
 4683                 return (ENOENT);
 4684 
 4685         buflen = 1024;
 4686         buf = malloc(buflen, M_TEMP, M_WAITOK);
 4687         error = 0;
 4688 
 4689         /*
 4690          * For Getattr, get the Change attribute (va_filerev) and size (va_size)
 4691          * from the MetaData file's extended attribute.
 4692          */
 4693         if (ioproc == NFSPROC_GETATTR) {
 4694                 error = vn_extattr_get(vp, IO_NODELOCKED,
 4695                     EXTATTR_NAMESPACE_SYSTEM, "pnfsd.dsattr", &buflen, buf,
 4696                     p);
 4697                 if (error == 0) {
 4698                         if (buflen == sizeof(odsattr)) {
 4699                                 NFSBCOPY(buf, &odsattr, buflen);
 4700                                 nap->na_filerev = odsattr.dsa_filerev;
 4701                                 nap->na_size = odsattr.dsa_size;
 4702                                 nap->na_atime = odsattr.dsa_atime;
 4703                                 nap->na_mtime = odsattr.dsa_mtime;
 4704                                 /*
 4705                                  * Fake na_bytes by rounding up na_size.
 4706                                  * Since we don't know the block size, just
 4707                                  * use BLKDEV_IOSIZE.
 4708                                  */
 4709                                 nap->na_bytes = (odsattr.dsa_size +
 4710                                     BLKDEV_IOSIZE - 1) & ~(BLKDEV_IOSIZE - 1);
 4711                         } else if (buflen == sizeof(dsattr)) {
 4712                                 NFSBCOPY(buf, &dsattr, buflen);
 4713                                 nap->na_filerev = dsattr.dsa_filerev;
 4714                                 nap->na_size = dsattr.dsa_size;
 4715                                 nap->na_atime = dsattr.dsa_atime;
 4716                                 nap->na_mtime = dsattr.dsa_mtime;
 4717                                 nap->na_bytes = dsattr.dsa_bytes;
 4718                         } else
 4719                                 error = ENXIO;
 4720                 }
 4721                 if (error == 0) {
 4722                         /*
 4723                          * If nfsrv_pnfsgetdsattr is 0 or nfsrv_checkdsattr()
 4724                          * returns 0, just return now.  nfsrv_checkdsattr()
 4725                          * returns 0 if there is no Read/Write layout
 4726                          * plus either an Open/Write_access or Write
 4727                          * delegation issued to a client for the file.
 4728                          */
 4729                         if (nfsrv_pnfsgetdsattr == 0 ||
 4730                             nfsrv_checkdsattr(vp, p) == 0) {
 4731                                 free(buf, M_TEMP);
 4732                                 return (error);
 4733                         }
 4734                 }
 4735 
 4736                 /*
 4737                  * Clear ENOATTR so the code below will attempt to do a
 4738                  * nfsrv_getattrdsrpc() to get the attributes and (re)create
 4739                  * the extended attribute.
 4740                  */
 4741                 if (error == ENOATTR)
 4742                         error = 0;
 4743         }
 4744 
 4745         origmircnt = -1;
 4746         trycnt = 0;
 4747 tryagain:
 4748         if (error == 0) {
 4749                 buflen = 1024;
 4750                 if (ioproc == NFSPROC_READDS && NFSVOPISLOCKED(vp) ==
 4751                     LK_EXCLUSIVE)
 4752                         printf("nfsrv_proxyds: Readds vp exclusively locked\n");
 4753                 error = nfsrv_dsgetsockmnt(vp, LK_SHARED, buf, &buflen,
 4754                     &mirrorcnt, p, dvp, fh, NULL, NULL, NULL, NULL, NULL,
 4755                     NULL, NULL);
 4756                 if (error == 0) {
 4757                         for (i = 0; i < mirrorcnt; i++)
 4758                                 nmp[i] = VFSTONFS(dvp[i]->v_mount);
 4759                 } else
 4760                         printf("pNFS: proxy getextattr sockaddr=%d\n", error);
 4761         } else
 4762                 printf("pNFS: nfsrv_dsgetsockmnt=%d\n", error);
 4763         if (error == 0) {
 4764                 failpos = -1;
 4765                 if (origmircnt == -1)
 4766                         origmircnt = mirrorcnt;
 4767                 /*
 4768                  * If failpos is set to a mirror#, then that mirror has
 4769                  * failed and will be disabled. For Read, Getattr and Seek, the
 4770                  * function only tries one mirror, so if that mirror has
 4771                  * failed, it will need to be retried. As such, increment
 4772                  * tryitagain for these cases.
 4773                  * For Write, Setattr and Setacl, the function tries all
 4774                  * mirrors and will not return an error for the case where
 4775                  * one mirror has failed. For these cases, the functioning
 4776                  * mirror(s) will have been modified, so a retry isn't
 4777                  * necessary. These functions will set failpos for the
 4778                  * failed mirror#.
 4779                  */
 4780                 if (ioproc == NFSPROC_READDS) {
 4781                         error = nfsrv_readdsrpc(fh, off, cnt, cred, p, nmp[0],
 4782                             mpp, mpp2);
 4783                         if (nfsds_failerr(error) && mirrorcnt > 1) {
 4784                                 /*
 4785                                  * Setting failpos will cause the mirror
 4786                                  * to be disabled and then a retry of this
 4787                                  * read is required.
 4788                                  */
 4789                                 failpos = 0;
 4790                                 error = 0;
 4791                                 trycnt++;
 4792                         }
 4793                 } else if (ioproc == NFSPROC_WRITEDS)
 4794                         error = nfsrv_writedsrpc(fh, off, cnt, cred, p, vp,
 4795                             &nmp[0], mirrorcnt, mpp, cp, &failpos);
 4796                 else if (ioproc == NFSPROC_SETATTR)
 4797                         error = nfsrv_setattrdsrpc(fh, cred, p, vp, &nmp[0],
 4798                             mirrorcnt, nap, &failpos);
 4799                 else if (ioproc == NFSPROC_SETACL)
 4800                         error = nfsrv_setacldsrpc(fh, cred, p, vp, &nmp[0],
 4801                             mirrorcnt, aclp, &failpos);
 4802                 else if (ioproc == NFSPROC_SEEKDS) {
 4803                         error = nfsrv_seekdsrpc(fh, offp, content, eofp, cred,
 4804                             p, nmp[0]);
 4805                         if (nfsds_failerr(error) && mirrorcnt > 1) {
 4806                                 /*
 4807                                  * Setting failpos will cause the mirror
 4808                                  * to be disabled and then a retry of this
 4809                                  * read is required.
 4810                                  */
 4811                                 failpos = 0;
 4812                                 error = 0;
 4813                                 trycnt++;
 4814                         }
 4815                 } else if (ioproc == NFSPROC_ALLOCATE)
 4816                         error = nfsrv_allocatedsrpc(fh, off, *offp, cred, p, vp,
 4817                             &nmp[0], mirrorcnt, &failpos);
 4818                 else {
 4819                         error = nfsrv_getattrdsrpc(&fh[mirrorcnt - 1], cred, p,
 4820                             vp, nmp[mirrorcnt - 1], nap);
 4821                         if (nfsds_failerr(error) && mirrorcnt > 1) {
 4822                                 /*
 4823                                  * Setting failpos will cause the mirror
 4824                                  * to be disabled and then a retry of this
 4825                                  * getattr is required.
 4826                                  */
 4827                                 failpos = mirrorcnt - 1;
 4828                                 error = 0;
 4829                                 trycnt++;
 4830                         }
 4831                 }
 4832                 ds = NULL;
 4833                 if (failpos >= 0) {
 4834                         failnmp = nmp[failpos];
 4835                         NFSLOCKMNT(failnmp);
 4836                         if ((failnmp->nm_privflag & (NFSMNTP_FORCEDISM |
 4837                              NFSMNTP_CANCELRPCS)) == 0) {
 4838                                 failnmp->nm_privflag |= NFSMNTP_CANCELRPCS;
 4839                                 NFSUNLOCKMNT(failnmp);
 4840                                 ds = nfsrv_deldsnmp(PNFSDOP_DELDSSERVER,
 4841                                     failnmp, p);
 4842                                 NFSD_DEBUG(4, "dsldsnmp fail=%d ds=%p\n",
 4843                                     failpos, ds);
 4844                                 if (ds != NULL)
 4845                                         nfsrv_killrpcs(failnmp);
 4846                                 NFSLOCKMNT(failnmp);
 4847                                 failnmp->nm_privflag &= ~NFSMNTP_CANCELRPCS;
 4848                                 wakeup(failnmp);
 4849                         }
 4850                         NFSUNLOCKMNT(failnmp);
 4851                 }
 4852                 for (i = 0; i < mirrorcnt; i++)
 4853                         NFSVOPUNLOCK(dvp[i]);
 4854                 NFSD_DEBUG(4, "nfsrv_proxyds: aft RPC=%d trya=%d\n", error,
 4855                     trycnt);
 4856                 /* Try the Read/Getattr again if a mirror was deleted. */
 4857                 if (ds != NULL && trycnt > 0 && trycnt < origmircnt)
 4858                         goto tryagain;
 4859         } else {
 4860                 /* Return ENOENT for any Extended Attribute error. */
 4861                 error = ENOENT;
 4862         }
 4863         free(buf, M_TEMP);
 4864         NFSD_DEBUG(4, "nfsrv_proxyds: error=%d\n", error);
 4865         return (error);
 4866 }
 4867 
 4868 /*
 4869  * Get the DS mount point, fh and directory from the "pnfsd.dsfile" extended
 4870  * attribute.
 4871  * newnmpp - If it points to a non-NULL nmp, that is the destination and needs
 4872  *           to be checked.  If it points to a NULL nmp, then it returns
 4873  *           a suitable destination.
 4874  * curnmp - If non-NULL, it is the source mount for the copy.
 4875  */
 4876 int
 4877 nfsrv_dsgetsockmnt(struct vnode *vp, int lktype, char *buf, int *buflenp,
 4878     int *mirrorcntp, NFSPROC_T *p, struct vnode **dvpp, fhandle_t *fhp,
 4879     char *devid, char *fnamep, struct vnode **nvpp, struct nfsmount **newnmpp,
 4880     struct nfsmount *curnmp, int *ippos, int *dsdirp)
 4881 {
 4882         struct vnode *dvp, *nvp = NULL, **tdvpp;
 4883         struct mount *mp;
 4884         struct nfsmount *nmp, *newnmp;
 4885         struct sockaddr *sad;
 4886         struct sockaddr_in *sin;
 4887         struct nfsdevice *ds, *tds, *fndds;
 4888         struct pnfsdsfile *pf;
 4889         uint32_t dsdir;
 4890         int error, fhiszero, fnd, gotone, i, mirrorcnt;
 4891 
 4892         ASSERT_VOP_LOCKED(vp, "nfsrv_dsgetsockmnt vp");
 4893         *mirrorcntp = 1;
 4894         tdvpp = dvpp;
 4895         if (nvpp != NULL)
 4896                 *nvpp = NULL;
 4897         if (dvpp != NULL)
 4898                 *dvpp = NULL;
 4899         if (ippos != NULL)
 4900                 *ippos = -1;
 4901         if (newnmpp != NULL)
 4902                 newnmp = *newnmpp;
 4903         else
 4904                 newnmp = NULL;
 4905         mp = vp->v_mount;
 4906         error = vn_extattr_get(vp, IO_NODELOCKED, EXTATTR_NAMESPACE_SYSTEM,
 4907             "pnfsd.dsfile", buflenp, buf, p);
 4908         mirrorcnt = *buflenp / sizeof(*pf);
 4909         if (error == 0 && (mirrorcnt < 1 || mirrorcnt > NFSDEV_MAXMIRRORS ||
 4910             *buflenp != sizeof(*pf) * mirrorcnt))
 4911                 error = ENOATTR;
 4912 
 4913         pf = (struct pnfsdsfile *)buf;
 4914         /* If curnmp != NULL, check for a match in the mirror list. */
 4915         if (curnmp != NULL && error == 0) {
 4916                 fnd = 0;
 4917                 for (i = 0; i < mirrorcnt; i++, pf++) {
 4918                         sad = (struct sockaddr *)&pf->dsf_sin;
 4919                         if (nfsaddr2_match(sad, curnmp->nm_nam)) {
 4920                                 if (ippos != NULL)
 4921                                         *ippos = i;
 4922                                 fnd = 1;
 4923                                 break;
 4924                         }
 4925                 }
 4926                 if (fnd == 0)
 4927                         error = ENXIO;
 4928         }
 4929 
 4930         gotone = 0;
 4931         pf = (struct pnfsdsfile *)buf;
 4932         NFSD_DEBUG(4, "nfsrv_dsgetsockmnt: mirrorcnt=%d err=%d\n", mirrorcnt,
 4933             error);
 4934         for (i = 0; i < mirrorcnt && error == 0; i++, pf++) {
 4935                 fhiszero = 0;
 4936                 sad = (struct sockaddr *)&pf->dsf_sin;
 4937                 sin = &pf->dsf_sin;
 4938                 dsdir = pf->dsf_dir;
 4939                 if (dsdir >= nfsrv_dsdirsize) {
 4940                         printf("nfsrv_dsgetsockmnt: dsdir=%d\n", dsdir);
 4941                         error = ENOATTR;
 4942                 } else if (nvpp != NULL && newnmp != NULL &&
 4943                     nfsaddr2_match(sad, newnmp->nm_nam))
 4944                         error = EEXIST;
 4945                 if (error == 0) {
 4946                         if (ippos != NULL && curnmp == NULL &&
 4947                             sad->sa_family == AF_INET &&
 4948                             sin->sin_addr.s_addr == 0)
 4949                                 *ippos = i;
 4950                         if (NFSBCMP(&zerofh, &pf->dsf_fh, sizeof(zerofh)) == 0)
 4951                                 fhiszero = 1;
 4952                         /* Use the socket address to find the mount point. */
 4953                         fndds = NULL;
 4954                         NFSDDSLOCK();
 4955                         /* Find a match for the IP address. */
 4956                         TAILQ_FOREACH(ds, &nfsrv_devidhead, nfsdev_list) {
 4957                                 if (ds->nfsdev_nmp != NULL) {
 4958                                         dvp = ds->nfsdev_dvp;
 4959                                         nmp = VFSTONFS(dvp->v_mount);
 4960                                         if (nmp != ds->nfsdev_nmp)
 4961                                                 printf("different2 nmp %p %p\n",
 4962                                                     nmp, ds->nfsdev_nmp);
 4963                                         if (nfsaddr2_match(sad, nmp->nm_nam)) {
 4964                                                 fndds = ds;
 4965                                                 break;
 4966                                         }
 4967                                 }
 4968                         }
 4969                         if (fndds != NULL && newnmpp != NULL &&
 4970                             newnmp == NULL) {
 4971                                 /* Search for a place to make a mirror copy. */
 4972                                 TAILQ_FOREACH(tds, &nfsrv_devidhead,
 4973                                     nfsdev_list) {
 4974                                         if (tds->nfsdev_nmp != NULL &&
 4975                                             fndds != tds &&
 4976                                             ((tds->nfsdev_mdsisset == 0 &&
 4977                                               fndds->nfsdev_mdsisset == 0) ||
 4978                                              (tds->nfsdev_mdsisset != 0 &&
 4979                                               fndds->nfsdev_mdsisset != 0 &&
 4980                                               fsidcmp(&tds->nfsdev_mdsfsid,
 4981                                               &mp->mnt_stat.f_fsid) == 0))) {
 4982                                                 *newnmpp = tds->nfsdev_nmp;
 4983                                                 break;
 4984                                         }
 4985                                 }
 4986                                 if (tds != NULL) {
 4987                                         /*
 4988                                          * Move this entry to the end of the
 4989                                          * list, so it won't be selected as
 4990                                          * easily the next time.
 4991                                          */
 4992                                         TAILQ_REMOVE(&nfsrv_devidhead, tds,
 4993                                             nfsdev_list);
 4994                                         TAILQ_INSERT_TAIL(&nfsrv_devidhead, tds,
 4995                                             nfsdev_list);
 4996                                 }
 4997                         }
 4998                         NFSDDSUNLOCK();
 4999                         if (fndds != NULL) {
 5000                                 dvp = fndds->nfsdev_dsdir[dsdir];
 5001                                 if (lktype != 0 || fhiszero != 0 ||
 5002                                     (nvpp != NULL && *nvpp == NULL)) {
 5003                                         if (fhiszero != 0)
 5004                                                 error = vn_lock(dvp,
 5005                                                     LK_EXCLUSIVE);
 5006                                         else if (lktype != 0)
 5007                                                 error = vn_lock(dvp, lktype);
 5008                                         else
 5009                                                 error = vn_lock(dvp, LK_SHARED);
 5010                                         /*
 5011                                          * If the file handle is all 0's, try to
 5012                                          * do a Lookup against the DS to acquire
 5013                                          * it.
 5014                                          * If dvpp == NULL or the Lookup fails,
 5015                                          * unlock dvp after the call.
 5016                                          */
 5017                                         if (error == 0 && (fhiszero != 0 ||
 5018                                             (nvpp != NULL && *nvpp == NULL))) {
 5019                                                 error = nfsrv_pnfslookupds(vp,
 5020                                                     dvp, pf, &nvp, p);
 5021                                                 if (error == 0) {
 5022                                                         if (fhiszero != 0)
 5023                                                                 nfsrv_pnfssetfh(
 5024                                                                     vp, pf,
 5025                                                                     devid,
 5026                                                                     fnamep,
 5027                                                                     nvp, p);
 5028                                                         if (nvpp != NULL &&
 5029                                                             *nvpp == NULL) {
 5030                                                                 *nvpp = nvp;
 5031                                                                 *dsdirp = dsdir;
 5032                                                         } else
 5033                                                                 vput(nvp);
 5034                                                 }
 5035                                                 if (error != 0 || lktype == 0)
 5036                                                         NFSVOPUNLOCK(dvp);
 5037                                         }
 5038                                 }
 5039                                 if (error == 0) {
 5040                                         gotone++;
 5041                                         NFSD_DEBUG(4, "gotone=%d\n", gotone);
 5042                                         if (devid != NULL) {
 5043                                                 NFSBCOPY(fndds->nfsdev_deviceid,
 5044                                                     devid, NFSX_V4DEVICEID);
 5045                                                 devid += NFSX_V4DEVICEID;
 5046                                         }
 5047                                         if (dvpp != NULL)
 5048                                                 *tdvpp++ = dvp;
 5049                                         if (fhp != NULL)
 5050                                                 NFSBCOPY(&pf->dsf_fh, fhp++,
 5051                                                     NFSX_MYFH);
 5052                                         if (fnamep != NULL && gotone == 1)
 5053                                                 strlcpy(fnamep,
 5054                                                     pf->dsf_filename,
 5055                                                     sizeof(pf->dsf_filename));
 5056                                 } else
 5057                                         NFSD_DEBUG(4, "nfsrv_dsgetsockmnt "
 5058                                             "err=%d\n", error);
 5059                         }
 5060                 }
 5061         }
 5062         if (error == 0 && gotone == 0)
 5063                 error = ENOENT;
 5064 
 5065         NFSD_DEBUG(4, "eo nfsrv_dsgetsockmnt: gotone=%d err=%d\n", gotone,
 5066             error);
 5067         if (error == 0)
 5068                 *mirrorcntp = gotone;
 5069         else {
 5070                 if (gotone > 0 && dvpp != NULL) {
 5071                         /*
 5072                          * If the error didn't occur on the first one and
 5073                          * dvpp != NULL, the one(s) prior to the failure will
 5074                          * have locked dvp's that need to be unlocked.
 5075                          */
 5076                         for (i = 0; i < gotone; i++) {
 5077                                 NFSVOPUNLOCK(*dvpp);
 5078                                 *dvpp++ = NULL;
 5079                         }
 5080                 }
 5081                 /*
 5082                  * If it found the vnode to be copied from before a failure,
 5083                  * it needs to be vput()'d.
 5084                  */
 5085                 if (nvpp != NULL && *nvpp != NULL) {
 5086                         vput(*nvpp);
 5087                         *nvpp = NULL;
 5088                 }
 5089         }
 5090         return (error);
 5091 }
 5092 
 5093 /*
 5094  * Set the extended attribute for the Change attribute.
 5095  */
 5096 static int
 5097 nfsrv_setextattr(struct vnode *vp, struct nfsvattr *nap, NFSPROC_T *p)
 5098 {
 5099         struct pnfsdsattr dsattr;
 5100         int error;
 5101 
 5102         ASSERT_VOP_ELOCKED(vp, "nfsrv_setextattr vp");
 5103         dsattr.dsa_filerev = nap->na_filerev;
 5104         dsattr.dsa_size = nap->na_size;
 5105         dsattr.dsa_atime = nap->na_atime;
 5106         dsattr.dsa_mtime = nap->na_mtime;
 5107         dsattr.dsa_bytes = nap->na_bytes;
 5108         error = vn_extattr_set(vp, IO_NODELOCKED, EXTATTR_NAMESPACE_SYSTEM,
 5109             "pnfsd.dsattr", sizeof(dsattr), (char *)&dsattr, p);
 5110         if (error != 0)
 5111                 printf("pNFS: setextattr=%d\n", error);
 5112         return (error);
 5113 }
 5114 
 5115 static int
 5116 nfsrv_readdsrpc(fhandle_t *fhp, off_t off, int len, struct ucred *cred,
 5117     NFSPROC_T *p, struct nfsmount *nmp, struct mbuf **mpp, struct mbuf **mpendp)
 5118 {
 5119         uint32_t *tl;
 5120         struct nfsrv_descript *nd;
 5121         nfsv4stateid_t st;
 5122         struct mbuf *m, *m2;
 5123         int error = 0, retlen, tlen, trimlen;
 5124 
 5125         NFSD_DEBUG(4, "in nfsrv_readdsrpc\n");
 5126         nd = malloc(sizeof(*nd), M_TEMP, M_WAITOK | M_ZERO);
 5127         *mpp = NULL;
 5128         /*
 5129          * Use a stateid where other is an alternating 01010 pattern and
 5130          * seqid is 0xffffffff.  This value is not defined as special by
 5131          * the RFC and is used by the FreeBSD NFS server to indicate an
 5132          * MDS->DS proxy operation.
 5133          */
 5134         st.other[0] = 0x55555555;
 5135         st.other[1] = 0x55555555;
 5136         st.other[2] = 0x55555555;
 5137         st.seqid = 0xffffffff;
 5138         nfscl_reqstart(nd, NFSPROC_READDS, nmp, (u_int8_t *)fhp, sizeof(*fhp),
 5139             NULL, NULL, 0, 0);
 5140         nfsm_stateidtom(nd, &st, NFSSTATEID_PUTSTATEID);
 5141         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED * 3);
 5142         txdr_hyper(off, tl);
 5143         *(tl + 2) = txdr_unsigned(len);
 5144         error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
 5145             NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
 5146         if (error != 0) {
 5147                 free(nd, M_TEMP);
 5148                 return (error);
 5149         }
 5150         if (nd->nd_repstat == 0) {
 5151                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 5152                 NFSM_STRSIZ(retlen, len);
 5153                 if (retlen > 0) {
 5154                         /* Trim off the pre-data XDR from the mbuf chain. */
 5155                         m = nd->nd_mrep;
 5156                         while (m != NULL && m != nd->nd_md) {
 5157                                 if (m->m_next == nd->nd_md) {
 5158                                         m->m_next = NULL;
 5159                                         m_freem(nd->nd_mrep);
 5160                                         nd->nd_mrep = m = nd->nd_md;
 5161                                 } else
 5162                                         m = m->m_next;
 5163                         }
 5164                         if (m == NULL) {
 5165                                 printf("nfsrv_readdsrpc: busted mbuf list\n");
 5166                                 error = ENOENT;
 5167                                 goto nfsmout;
 5168                         }
 5169 
 5170                         /*
 5171                          * Now, adjust first mbuf so that any XDR before the
 5172                          * read data is skipped over.
 5173                          */
 5174                         trimlen = nd->nd_dpos - mtod(m, char *);
 5175                         if (trimlen > 0) {
 5176                                 m->m_len -= trimlen;
 5177                                 NFSM_DATAP(m, trimlen);
 5178                         }
 5179 
 5180                         /*
 5181                          * Truncate the mbuf chain at retlen bytes of data,
 5182                          * plus XDR padding that brings the length up to a
 5183                          * multiple of 4.
 5184                          */
 5185                         tlen = NFSM_RNDUP(retlen);
 5186                         do {
 5187                                 if (m->m_len >= tlen) {
 5188                                         m->m_len = tlen;
 5189                                         tlen = 0;
 5190                                         m2 = m->m_next;
 5191                                         m->m_next = NULL;
 5192                                         m_freem(m2);
 5193                                         break;
 5194                                 }
 5195                                 tlen -= m->m_len;
 5196                                 m = m->m_next;
 5197                         } while (m != NULL);
 5198                         if (tlen > 0) {
 5199                                 printf("nfsrv_readdsrpc: busted mbuf list\n");
 5200                                 error = ENOENT;
 5201                                 goto nfsmout;
 5202                         }
 5203                         *mpp = nd->nd_mrep;
 5204                         *mpendp = m;
 5205                         nd->nd_mrep = NULL;
 5206                 }
 5207         } else
 5208                 error = nd->nd_repstat;
 5209 nfsmout:
 5210         /* If nd->nd_mrep is already NULL, this is a no-op. */
 5211         m_freem(nd->nd_mrep);
 5212         free(nd, M_TEMP);
 5213         NFSD_DEBUG(4, "nfsrv_readdsrpc error=%d\n", error);
 5214         return (error);
 5215 }
 5216 
 5217 /*
 5218  * Do a write RPC on a DS data file, using this structure for the arguments,
 5219  * so that this function can be executed by a separate kernel process.
 5220  */
 5221 struct nfsrvwritedsdorpc {
 5222         int                     done;
 5223         int                     inprog;
 5224         struct task             tsk;
 5225         fhandle_t               fh;
 5226         off_t                   off;
 5227         int                     len;
 5228         struct nfsmount         *nmp;
 5229         struct ucred            *cred;
 5230         NFSPROC_T               *p;
 5231         struct mbuf             *m;
 5232         int                     err;
 5233 };
 5234 
 5235 static int
 5236 nfsrv_writedsdorpc(struct nfsmount *nmp, fhandle_t *fhp, off_t off, int len,
 5237     struct nfsvattr *nap, struct mbuf *m, struct ucred *cred, NFSPROC_T *p)
 5238 {
 5239         uint32_t *tl;
 5240         struct nfsrv_descript *nd;
 5241         nfsattrbit_t attrbits;
 5242         nfsv4stateid_t st;
 5243         int commit, error, retlen;
 5244 
 5245         nd = malloc(sizeof(*nd), M_TEMP, M_WAITOK | M_ZERO);
 5246         nfscl_reqstart(nd, NFSPROC_WRITE, nmp, (u_int8_t *)fhp,
 5247             sizeof(fhandle_t), NULL, NULL, 0, 0);
 5248 
 5249         /*
 5250          * Use a stateid where other is an alternating 01010 pattern and
 5251          * seqid is 0xffffffff.  This value is not defined as special by
 5252          * the RFC and is used by the FreeBSD NFS server to indicate an
 5253          * MDS->DS proxy operation.
 5254          */
 5255         st.other[0] = 0x55555555;
 5256         st.other[1] = 0x55555555;
 5257         st.other[2] = 0x55555555;
 5258         st.seqid = 0xffffffff;
 5259         nfsm_stateidtom(nd, &st, NFSSTATEID_PUTSTATEID);
 5260         NFSM_BUILD(tl, u_int32_t *, NFSX_HYPER + 2 * NFSX_UNSIGNED);
 5261         txdr_hyper(off, tl);
 5262         tl += 2;
 5263         /*
 5264          * Do all writes FileSync, since the server doesn't hold onto dirty
 5265          * buffers.  Since clients should be accessing the DS servers directly
 5266          * using the pNFS layouts, this just needs to work correctly as a
 5267          * fallback.
 5268          */
 5269         *tl++ = txdr_unsigned(NFSWRITE_FILESYNC);
 5270         *tl = txdr_unsigned(len);
 5271         NFSD_DEBUG(4, "nfsrv_writedsdorpc: len=%d\n", len);
 5272 
 5273         /* Put data in mbuf chain. */
 5274         nd->nd_mb->m_next = m;
 5275 
 5276         /* Set nd_mb and nd_bpos to end of data. */
 5277         while (m->m_next != NULL)
 5278                 m = m->m_next;
 5279         nd->nd_mb = m;
 5280         nfsm_set(nd, m->m_len);
 5281         NFSD_DEBUG(4, "nfsrv_writedsdorpc: lastmb len=%d\n", m->m_len);
 5282 
 5283         /* Do a Getattr for the attributes that change upon writing. */
 5284         NFSZERO_ATTRBIT(&attrbits);
 5285         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_SIZE);
 5286         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
 5287         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESS);
 5288         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFY);
 5289         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_SPACEUSED);
 5290         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
 5291         *tl = txdr_unsigned(NFSV4OP_GETATTR);
 5292         (void) nfsrv_putattrbit(nd, &attrbits);
 5293         error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p,
 5294             cred, NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
 5295         if (error != 0) {
 5296                 free(nd, M_TEMP);
 5297                 return (error);
 5298         }
 5299         NFSD_DEBUG(4, "nfsrv_writedsdorpc: aft writerpc=%d\n", nd->nd_repstat);
 5300         /* Get rid of weak cache consistency data for now. */
 5301         if ((nd->nd_flag & (ND_NOMOREDATA | ND_NFSV4 | ND_V4WCCATTR)) ==
 5302             (ND_NFSV4 | ND_V4WCCATTR)) {
 5303                 error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0, NULL, NULL,
 5304                     NULL, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL);
 5305                 NFSD_DEBUG(4, "nfsrv_writedsdorpc: wcc attr=%d\n", error);
 5306                 if (error != 0)
 5307                         goto nfsmout;
 5308                 /*
 5309                  * Get rid of Op# and status for next op.
 5310                  */
 5311                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
 5312                 if (*++tl != 0)
 5313                         nd->nd_flag |= ND_NOMOREDATA;
 5314         }
 5315         if (nd->nd_repstat == 0) {
 5316                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED + NFSX_VERF);
 5317                 retlen = fxdr_unsigned(int, *tl++);
 5318                 commit = fxdr_unsigned(int, *tl);
 5319                 if (commit != NFSWRITE_FILESYNC)
 5320                         error = NFSERR_IO;
 5321                 NFSD_DEBUG(4, "nfsrv_writedsdorpc:retlen=%d commit=%d err=%d\n",
 5322                     retlen, commit, error);
 5323         } else
 5324                 error = nd->nd_repstat;
 5325         /* We have no use for the Write Verifier since we use FileSync. */
 5326 
 5327         /*
 5328          * Get the Change, Size, Access Time and Modify Time attributes and set
 5329          * on the Metadata file, so its attributes will be what the file's
 5330          * would be if it had been written.
 5331          */
 5332         if (error == 0) {
 5333                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
 5334                 error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0, NULL, NULL,
 5335                     NULL, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL);
 5336         }
 5337         NFSD_DEBUG(4, "nfsrv_writedsdorpc: aft loadattr=%d\n", error);
 5338 nfsmout:
 5339         m_freem(nd->nd_mrep);
 5340         free(nd, M_TEMP);
 5341         NFSD_DEBUG(4, "nfsrv_writedsdorpc error=%d\n", error);
 5342         return (error);
 5343 }
 5344 
 5345 /*
 5346  * Start up the thread that will execute nfsrv_writedsdorpc().
 5347  */
 5348 static void
 5349 start_writedsdorpc(void *arg, int pending)
 5350 {
 5351         struct nfsrvwritedsdorpc *drpc;
 5352 
 5353         drpc = (struct nfsrvwritedsdorpc *)arg;
 5354         drpc->err = nfsrv_writedsdorpc(drpc->nmp, &drpc->fh, drpc->off,
 5355             drpc->len, NULL, drpc->m, drpc->cred, drpc->p);
 5356         drpc->done = 1;
 5357         NFSD_DEBUG(4, "start_writedsdorpc: err=%d\n", drpc->err);
 5358 }
 5359 
 5360 static int
 5361 nfsrv_writedsrpc(fhandle_t *fhp, off_t off, int len, struct ucred *cred,
 5362     NFSPROC_T *p, struct vnode *vp, struct nfsmount **nmpp, int mirrorcnt,
 5363     struct mbuf **mpp, char *cp, int *failposp)
 5364 {
 5365         struct nfsrvwritedsdorpc *drpc, *tdrpc = NULL;
 5366         struct nfsvattr na;
 5367         struct mbuf *m;
 5368         int error, i, offs, ret, timo;
 5369 
 5370         NFSD_DEBUG(4, "in nfsrv_writedsrpc\n");
 5371         KASSERT(*mpp != NULL, ("nfsrv_writedsrpc: NULL mbuf chain"));
 5372         drpc = NULL;
 5373         if (mirrorcnt > 1)
 5374                 tdrpc = drpc = malloc(sizeof(*drpc) * (mirrorcnt - 1), M_TEMP,
 5375                     M_WAITOK);
 5376 
 5377         /* Calculate offset in mbuf chain that data starts. */
 5378         offs = cp - mtod(*mpp, char *);
 5379         NFSD_DEBUG(4, "nfsrv_writedsrpc: mcopy offs=%d len=%d\n", offs, len);
 5380 
 5381         /*
 5382          * Do the write RPC for every DS, using a separate kernel process
 5383          * for every DS except the last one.
 5384          */
 5385         error = 0;
 5386         for (i = 0; i < mirrorcnt - 1; i++, tdrpc++) {
 5387                 tdrpc->done = 0;
 5388                 NFSBCOPY(fhp, &tdrpc->fh, sizeof(*fhp));
 5389                 tdrpc->off = off;
 5390                 tdrpc->len = len;
 5391                 tdrpc->nmp = *nmpp;
 5392                 tdrpc->cred = cred;
 5393                 tdrpc->p = p;
 5394                 tdrpc->inprog = 0;
 5395                 tdrpc->err = 0;
 5396                 tdrpc->m = m_copym(*mpp, offs, NFSM_RNDUP(len), M_WAITOK);
 5397                 ret = EIO;
 5398                 if (nfs_pnfsiothreads != 0) {
 5399                         ret = nfs_pnfsio(start_writedsdorpc, tdrpc);
 5400                         NFSD_DEBUG(4, "nfsrv_writedsrpc: nfs_pnfsio=%d\n",
 5401                             ret);
 5402                 }
 5403                 if (ret != 0) {
 5404                         ret = nfsrv_writedsdorpc(*nmpp, fhp, off, len, NULL,
 5405                             tdrpc->m, cred, p);
 5406                         if (nfsds_failerr(ret) && *failposp == -1)
 5407                                 *failposp = i;
 5408                         else if (error == 0 && ret != 0)
 5409                                 error = ret;
 5410                 }
 5411                 nmpp++;
 5412                 fhp++;
 5413         }
 5414         m = m_copym(*mpp, offs, NFSM_RNDUP(len), M_WAITOK);
 5415         ret = nfsrv_writedsdorpc(*nmpp, fhp, off, len, &na, m, cred, p);
 5416         if (nfsds_failerr(ret) && *failposp == -1 && mirrorcnt > 1)
 5417                 *failposp = mirrorcnt - 1;
 5418         else if (error == 0 && ret != 0)
 5419                 error = ret;
 5420         if (error == 0)
 5421                 error = nfsrv_setextattr(vp, &na, p);
 5422         NFSD_DEBUG(4, "nfsrv_writedsrpc: aft setextat=%d\n", error);
 5423         tdrpc = drpc;
 5424         timo = hz / 50;         /* Wait for 20msec. */
 5425         if (timo < 1)
 5426                 timo = 1;
 5427         for (i = 0; i < mirrorcnt - 1; i++, tdrpc++) {
 5428                 /* Wait for RPCs on separate threads to complete. */
 5429                 while (tdrpc->inprog != 0 && tdrpc->done == 0)
 5430                         tsleep(&tdrpc->tsk, PVFS, "srvwrds", timo);
 5431                 if (nfsds_failerr(tdrpc->err) && *failposp == -1)
 5432                         *failposp = i;
 5433                 else if (error == 0 && tdrpc->err != 0)
 5434                         error = tdrpc->err;
 5435         }
 5436         free(drpc, M_TEMP);
 5437         return (error);
 5438 }
 5439 
 5440 /*
 5441  * Do a allocate RPC on a DS data file, using this structure for the arguments,
 5442  * so that this function can be executed by a separate kernel process.
 5443  */
 5444 struct nfsrvallocatedsdorpc {
 5445         int                     done;
 5446         int                     inprog;
 5447         struct task             tsk;
 5448         fhandle_t               fh;
 5449         off_t                   off;
 5450         off_t                   len;
 5451         struct nfsmount         *nmp;
 5452         struct ucred            *cred;
 5453         NFSPROC_T               *p;
 5454         int                     err;
 5455 };
 5456 
 5457 static int
 5458 nfsrv_allocatedsdorpc(struct nfsmount *nmp, fhandle_t *fhp, off_t off,
 5459     off_t len, struct nfsvattr *nap, struct ucred *cred, NFSPROC_T *p)
 5460 {
 5461         uint32_t *tl;
 5462         struct nfsrv_descript *nd;
 5463         nfsattrbit_t attrbits;
 5464         nfsv4stateid_t st;
 5465         int error;
 5466 
 5467         nd = malloc(sizeof(*nd), M_TEMP, M_WAITOK | M_ZERO);
 5468         nfscl_reqstart(nd, NFSPROC_ALLOCATE, nmp, (u_int8_t *)fhp,
 5469             sizeof(fhandle_t), NULL, NULL, 0, 0);
 5470 
 5471         /*
 5472          * Use a stateid where other is an alternating 01010 pattern and
 5473          * seqid is 0xffffffff.  This value is not defined as special by
 5474          * the RFC and is used by the FreeBSD NFS server to indicate an
 5475          * MDS->DS proxy operation.
 5476          */
 5477         st.other[0] = 0x55555555;
 5478         st.other[1] = 0x55555555;
 5479         st.other[2] = 0x55555555;
 5480         st.seqid = 0xffffffff;
 5481         nfsm_stateidtom(nd, &st, NFSSTATEID_PUTSTATEID);
 5482         NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_UNSIGNED);
 5483         txdr_hyper(off, tl); tl += 2;
 5484         txdr_hyper(len, tl); tl += 2;
 5485         NFSD_DEBUG(4, "nfsrv_allocatedsdorpc: len=%jd\n", (intmax_t)len);
 5486 
 5487         *tl = txdr_unsigned(NFSV4OP_GETATTR);
 5488         NFSGETATTR_ATTRBIT(&attrbits);
 5489         nfsrv_putattrbit(nd, &attrbits);
 5490         error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p,
 5491             cred, NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
 5492         if (error != 0) {
 5493                 free(nd, M_TEMP);
 5494                 return (error);
 5495         }
 5496         NFSD_DEBUG(4, "nfsrv_allocatedsdorpc: aft allocaterpc=%d\n",
 5497             nd->nd_repstat);
 5498         if (nd->nd_repstat == 0) {
 5499                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
 5500                 error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0, NULL, NULL,
 5501                     NULL, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL);
 5502         } else
 5503                 error = nd->nd_repstat;
 5504         NFSD_DEBUG(4, "nfsrv_allocatedsdorpc: aft loadattr=%d\n", error);
 5505 nfsmout:
 5506         m_freem(nd->nd_mrep);
 5507         free(nd, M_TEMP);
 5508         NFSD_DEBUG(4, "nfsrv_allocatedsdorpc error=%d\n", error);
 5509         return (error);
 5510 }
 5511 
 5512 /*
 5513  * Start up the thread that will execute nfsrv_allocatedsdorpc().
 5514  */
 5515 static void
 5516 start_allocatedsdorpc(void *arg, int pending)
 5517 {
 5518         struct nfsrvallocatedsdorpc *drpc;
 5519 
 5520         drpc = (struct nfsrvallocatedsdorpc *)arg;
 5521         drpc->err = nfsrv_allocatedsdorpc(drpc->nmp, &drpc->fh, drpc->off,
 5522             drpc->len, NULL, drpc->cred, drpc->p);
 5523         drpc->done = 1;
 5524         NFSD_DEBUG(4, "start_allocatedsdorpc: err=%d\n", drpc->err);
 5525 }
 5526 
 5527 static int
 5528 nfsrv_allocatedsrpc(fhandle_t *fhp, off_t off, off_t len, struct ucred *cred,
 5529     NFSPROC_T *p, struct vnode *vp, struct nfsmount **nmpp, int mirrorcnt,
 5530     int *failposp)
 5531 {
 5532         struct nfsrvallocatedsdorpc *drpc, *tdrpc = NULL;
 5533         struct nfsvattr na;
 5534         int error, i, ret, timo;
 5535 
 5536         NFSD_DEBUG(4, "in nfsrv_allocatedsrpc\n");
 5537         drpc = NULL;
 5538         if (mirrorcnt > 1)
 5539                 tdrpc = drpc = malloc(sizeof(*drpc) * (mirrorcnt - 1), M_TEMP,
 5540                     M_WAITOK);
 5541 
 5542         /*
 5543          * Do the allocate RPC for every DS, using a separate kernel process
 5544          * for every DS except the last one.
 5545          */
 5546         error = 0;
 5547         for (i = 0; i < mirrorcnt - 1; i++, tdrpc++) {
 5548                 tdrpc->done = 0;
 5549                 NFSBCOPY(fhp, &tdrpc->fh, sizeof(*fhp));
 5550                 tdrpc->off = off;
 5551                 tdrpc->len = len;
 5552                 tdrpc->nmp = *nmpp;
 5553                 tdrpc->cred = cred;
 5554                 tdrpc->p = p;
 5555                 tdrpc->inprog = 0;
 5556                 tdrpc->err = 0;
 5557                 ret = EIO;
 5558                 if (nfs_pnfsiothreads != 0) {
 5559                         ret = nfs_pnfsio(start_allocatedsdorpc, tdrpc);
 5560                         NFSD_DEBUG(4, "nfsrv_allocatedsrpc: nfs_pnfsio=%d\n",
 5561                             ret);
 5562                 }
 5563                 if (ret != 0) {
 5564                         ret = nfsrv_allocatedsdorpc(*nmpp, fhp, off, len, NULL,
 5565                             cred, p);
 5566                         if (nfsds_failerr(ret) && *failposp == -1)
 5567                                 *failposp = i;
 5568                         else if (error == 0 && ret != 0)
 5569                                 error = ret;
 5570                 }
 5571                 nmpp++;
 5572                 fhp++;
 5573         }
 5574         ret = nfsrv_allocatedsdorpc(*nmpp, fhp, off, len, &na, cred, p);
 5575         if (nfsds_failerr(ret) && *failposp == -1 && mirrorcnt > 1)
 5576                 *failposp = mirrorcnt - 1;
 5577         else if (error == 0 && ret != 0)
 5578                 error = ret;
 5579         if (error == 0)
 5580                 error = nfsrv_setextattr(vp, &na, p);
 5581         NFSD_DEBUG(4, "nfsrv_allocatedsrpc: aft setextat=%d\n", error);
 5582         tdrpc = drpc;
 5583         timo = hz / 50;         /* Wait for 20msec. */
 5584         if (timo < 1)
 5585                 timo = 1;
 5586         for (i = 0; i < mirrorcnt - 1; i++, tdrpc++) {
 5587                 /* Wait for RPCs on separate threads to complete. */
 5588                 while (tdrpc->inprog != 0 && tdrpc->done == 0)
 5589                         tsleep(&tdrpc->tsk, PVFS, "srvalds", timo);
 5590                 if (nfsds_failerr(tdrpc->err) && *failposp == -1)
 5591                         *failposp = i;
 5592                 else if (error == 0 && tdrpc->err != 0)
 5593                         error = tdrpc->err;
 5594         }
 5595         free(drpc, M_TEMP);
 5596         return (error);
 5597 }
 5598 
 5599 static int
 5600 nfsrv_setattrdsdorpc(fhandle_t *fhp, struct ucred *cred, NFSPROC_T *p,
 5601     struct vnode *vp, struct nfsmount *nmp, struct nfsvattr *nap,
 5602     struct nfsvattr *dsnap)
 5603 {
 5604         uint32_t *tl;
 5605         struct nfsrv_descript *nd;
 5606         nfsv4stateid_t st;
 5607         nfsattrbit_t attrbits;
 5608         int error;
 5609 
 5610         NFSD_DEBUG(4, "in nfsrv_setattrdsdorpc\n");
 5611         nd = malloc(sizeof(*nd), M_TEMP, M_WAITOK | M_ZERO);
 5612         /*
 5613          * Use a stateid where other is an alternating 01010 pattern and
 5614          * seqid is 0xffffffff.  This value is not defined as special by
 5615          * the RFC and is used by the FreeBSD NFS server to indicate an
 5616          * MDS->DS proxy operation.
 5617          */
 5618         st.other[0] = 0x55555555;
 5619         st.other[1] = 0x55555555;
 5620         st.other[2] = 0x55555555;
 5621         st.seqid = 0xffffffff;
 5622         nfscl_reqstart(nd, NFSPROC_SETATTR, nmp, (u_int8_t *)fhp, sizeof(*fhp),
 5623             NULL, NULL, 0, 0);
 5624         nfsm_stateidtom(nd, &st, NFSSTATEID_PUTSTATEID);
 5625         nfscl_fillsattr(nd, &nap->na_vattr, vp, NFSSATTR_FULL, 0);
 5626 
 5627         /* Do a Getattr for the attributes that change due to writing. */
 5628         NFSZERO_ATTRBIT(&attrbits);
 5629         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_SIZE);
 5630         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
 5631         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESS);
 5632         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFY);
 5633         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_SPACEUSED);
 5634         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
 5635         *tl = txdr_unsigned(NFSV4OP_GETATTR);
 5636         (void) nfsrv_putattrbit(nd, &attrbits);
 5637         error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
 5638             NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
 5639         if (error != 0) {
 5640                 free(nd, M_TEMP);
 5641                 return (error);
 5642         }
 5643         NFSD_DEBUG(4, "nfsrv_setattrdsdorpc: aft setattrrpc=%d\n",
 5644             nd->nd_repstat);
 5645         /* Get rid of weak cache consistency data for now. */
 5646         if ((nd->nd_flag & (ND_NOMOREDATA | ND_NFSV4 | ND_V4WCCATTR)) ==
 5647             (ND_NFSV4 | ND_V4WCCATTR)) {
 5648                 error = nfsv4_loadattr(nd, NULL, dsnap, NULL, NULL, 0, NULL,
 5649                     NULL, NULL, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL);
 5650                 NFSD_DEBUG(4, "nfsrv_setattrdsdorpc: wcc attr=%d\n", error);
 5651                 if (error != 0)
 5652                         goto nfsmout;
 5653                 /*
 5654                  * Get rid of Op# and status for next op.
 5655                  */
 5656                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
 5657                 if (*++tl != 0)
 5658                         nd->nd_flag |= ND_NOMOREDATA;
 5659         }
 5660         error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
 5661         if (error != 0)
 5662                 goto nfsmout;
 5663         if (nd->nd_repstat != 0)
 5664                 error = nd->nd_repstat;
 5665         /*
 5666          * Get the Change, Size, Access Time and Modify Time attributes and set
 5667          * on the Metadata file, so its attributes will be what the file's
 5668          * would be if it had been written.
 5669          */
 5670         if (error == 0) {
 5671                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
 5672                 error = nfsv4_loadattr(nd, NULL, dsnap, NULL, NULL, 0, NULL,
 5673                     NULL, NULL, NULL, NULL, 0, NULL, NULL, NULL, NULL, NULL);
 5674         }
 5675         NFSD_DEBUG(4, "nfsrv_setattrdsdorpc: aft setattr loadattr=%d\n", error);
 5676 nfsmout:
 5677         m_freem(nd->nd_mrep);
 5678         free(nd, M_TEMP);
 5679         NFSD_DEBUG(4, "nfsrv_setattrdsdorpc error=%d\n", error);
 5680         return (error);
 5681 }
 5682 
 5683 struct nfsrvsetattrdsdorpc {
 5684         int                     done;
 5685         int                     inprog;
 5686         struct task             tsk;
 5687         fhandle_t               fh;
 5688         struct nfsmount         *nmp;
 5689         struct vnode            *vp;
 5690         struct ucred            *cred;
 5691         NFSPROC_T               *p;
 5692         struct nfsvattr         na;
 5693         struct nfsvattr         dsna;
 5694         int                     err;
 5695 };
 5696 
 5697 /*
 5698  * Start up the thread that will execute nfsrv_setattrdsdorpc().
 5699  */
 5700 static void
 5701 start_setattrdsdorpc(void *arg, int pending)
 5702 {
 5703         struct nfsrvsetattrdsdorpc *drpc;
 5704 
 5705         drpc = (struct nfsrvsetattrdsdorpc *)arg;
 5706         drpc->err = nfsrv_setattrdsdorpc(&drpc->fh, drpc->cred, drpc->p,
 5707             drpc->vp, drpc->nmp, &drpc->na, &drpc->dsna);
 5708         drpc->done = 1;
 5709 }
 5710 
 5711 static int
 5712 nfsrv_setattrdsrpc(fhandle_t *fhp, struct ucred *cred, NFSPROC_T *p,
 5713     struct vnode *vp, struct nfsmount **nmpp, int mirrorcnt,
 5714     struct nfsvattr *nap, int *failposp)
 5715 {
 5716         struct nfsrvsetattrdsdorpc *drpc, *tdrpc = NULL;
 5717         struct nfsvattr na;
 5718         int error, i, ret, timo;
 5719 
 5720         NFSD_DEBUG(4, "in nfsrv_setattrdsrpc\n");
 5721         drpc = NULL;
 5722         if (mirrorcnt > 1)
 5723                 tdrpc = drpc = malloc(sizeof(*drpc) * (mirrorcnt - 1), M_TEMP,
 5724                     M_WAITOK);
 5725 
 5726         /*
 5727          * Do the setattr RPC for every DS, using a separate kernel process
 5728          * for every DS except the last one.
 5729          */
 5730         error = 0;
 5731         for (i = 0; i < mirrorcnt - 1; i++, tdrpc++) {
 5732                 tdrpc->done = 0;
 5733                 tdrpc->inprog = 0;
 5734                 NFSBCOPY(fhp, &tdrpc->fh, sizeof(*fhp));
 5735                 tdrpc->nmp = *nmpp;
 5736                 tdrpc->vp = vp;
 5737                 tdrpc->cred = cred;
 5738                 tdrpc->p = p;
 5739                 tdrpc->na = *nap;
 5740                 tdrpc->err = 0;
 5741                 ret = EIO;
 5742                 if (nfs_pnfsiothreads != 0) {
 5743                         ret = nfs_pnfsio(start_setattrdsdorpc, tdrpc);
 5744                         NFSD_DEBUG(4, "nfsrv_setattrdsrpc: nfs_pnfsio=%d\n",
 5745                             ret);
 5746                 }
 5747                 if (ret != 0) {
 5748                         ret = nfsrv_setattrdsdorpc(fhp, cred, p, vp, *nmpp, nap,
 5749                             &na);
 5750                         if (nfsds_failerr(ret) && *failposp == -1)
 5751                                 *failposp = i;
 5752                         else if (error == 0 && ret != 0)
 5753                                 error = ret;
 5754                 }
 5755                 nmpp++;
 5756                 fhp++;
 5757         }
 5758         ret = nfsrv_setattrdsdorpc(fhp, cred, p, vp, *nmpp, nap, &na);
 5759         if (nfsds_failerr(ret) && *failposp == -1 && mirrorcnt > 1)
 5760                 *failposp = mirrorcnt - 1;
 5761         else if (error == 0 && ret != 0)
 5762                 error = ret;
 5763         if (error == 0)
 5764                 error = nfsrv_setextattr(vp, &na, p);
 5765         NFSD_DEBUG(4, "nfsrv_setattrdsrpc: aft setextat=%d\n", error);
 5766         tdrpc = drpc;
 5767         timo = hz / 50;         /* Wait for 20msec. */
 5768         if (timo < 1)
 5769                 timo = 1;
 5770         for (i = 0; i < mirrorcnt - 1; i++, tdrpc++) {
 5771                 /* Wait for RPCs on separate threads to complete. */
 5772                 while (tdrpc->inprog != 0 && tdrpc->done == 0)
 5773                         tsleep(&tdrpc->tsk, PVFS, "srvsads", timo);
 5774                 if (nfsds_failerr(tdrpc->err) && *failposp == -1)
 5775                         *failposp = i;
 5776                 else if (error == 0 && tdrpc->err != 0)
 5777                         error = tdrpc->err;
 5778         }
 5779         free(drpc, M_TEMP);
 5780         return (error);
 5781 }
 5782 
 5783 /*
 5784  * Do a Setattr of an NFSv4 ACL on the DS file.
 5785  */
 5786 static int
 5787 nfsrv_setacldsdorpc(fhandle_t *fhp, struct ucred *cred, NFSPROC_T *p,
 5788     struct vnode *vp, struct nfsmount *nmp, struct acl *aclp)
 5789 {
 5790         struct nfsrv_descript *nd;
 5791         nfsv4stateid_t st;
 5792         nfsattrbit_t attrbits;
 5793         int error;
 5794 
 5795         NFSD_DEBUG(4, "in nfsrv_setacldsdorpc\n");
 5796         nd = malloc(sizeof(*nd), M_TEMP, M_WAITOK | M_ZERO);
 5797         /*
 5798          * Use a stateid where other is an alternating 01010 pattern and
 5799          * seqid is 0xffffffff.  This value is not defined as special by
 5800          * the RFC and is used by the FreeBSD NFS server to indicate an
 5801          * MDS->DS proxy operation.
 5802          */
 5803         st.other[0] = 0x55555555;
 5804         st.other[1] = 0x55555555;
 5805         st.other[2] = 0x55555555;
 5806         st.seqid = 0xffffffff;
 5807         nfscl_reqstart(nd, NFSPROC_SETACL, nmp, (u_int8_t *)fhp, sizeof(*fhp),
 5808             NULL, NULL, 0, 0);
 5809         nfsm_stateidtom(nd, &st, NFSSTATEID_PUTSTATEID);
 5810         NFSZERO_ATTRBIT(&attrbits);
 5811         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_ACL);
 5812         /*
 5813          * The "vp" argument to nfsv4_fillattr() is only used for vnode_type(),
 5814          * so passing in the metadata "vp" will be ok, since it is of
 5815          * the same type (VREG).
 5816          */
 5817         nfsv4_fillattr(nd, NULL, vp, aclp, NULL, NULL, 0, &attrbits, NULL,
 5818             NULL, 0, 0, 0, 0, 0, NULL);
 5819         error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
 5820             NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
 5821         if (error != 0) {
 5822                 free(nd, M_TEMP);
 5823                 return (error);
 5824         }
 5825         NFSD_DEBUG(4, "nfsrv_setacldsdorpc: aft setaclrpc=%d\n",
 5826             nd->nd_repstat);
 5827         error = nd->nd_repstat;
 5828         m_freem(nd->nd_mrep);
 5829         free(nd, M_TEMP);
 5830         return (error);
 5831 }
 5832 
 5833 struct nfsrvsetacldsdorpc {
 5834         int                     done;
 5835         int                     inprog;
 5836         struct task             tsk;
 5837         fhandle_t               fh;
 5838         struct nfsmount         *nmp;
 5839         struct vnode            *vp;
 5840         struct ucred            *cred;
 5841         NFSPROC_T               *p;
 5842         struct acl              *aclp;
 5843         int                     err;
 5844 };
 5845 
 5846 /*
 5847  * Start up the thread that will execute nfsrv_setacldsdorpc().
 5848  */
 5849 static void
 5850 start_setacldsdorpc(void *arg, int pending)
 5851 {
 5852         struct nfsrvsetacldsdorpc *drpc;
 5853 
 5854         drpc = (struct nfsrvsetacldsdorpc *)arg;
 5855         drpc->err = nfsrv_setacldsdorpc(&drpc->fh, drpc->cred, drpc->p,
 5856             drpc->vp, drpc->nmp, drpc->aclp);
 5857         drpc->done = 1;
 5858 }
 5859 
 5860 static int
 5861 nfsrv_setacldsrpc(fhandle_t *fhp, struct ucred *cred, NFSPROC_T *p,
 5862     struct vnode *vp, struct nfsmount **nmpp, int mirrorcnt, struct acl *aclp,
 5863     int *failposp)
 5864 {
 5865         struct nfsrvsetacldsdorpc *drpc, *tdrpc = NULL;
 5866         int error, i, ret, timo;
 5867 
 5868         NFSD_DEBUG(4, "in nfsrv_setacldsrpc\n");
 5869         drpc = NULL;
 5870         if (mirrorcnt > 1)
 5871                 tdrpc = drpc = malloc(sizeof(*drpc) * (mirrorcnt - 1), M_TEMP,
 5872                     M_WAITOK);
 5873 
 5874         /*
 5875          * Do the setattr RPC for every DS, using a separate kernel process
 5876          * for every DS except the last one.
 5877          */
 5878         error = 0;
 5879         for (i = 0; i < mirrorcnt - 1; i++, tdrpc++) {
 5880                 tdrpc->done = 0;
 5881                 tdrpc->inprog = 0;
 5882                 NFSBCOPY(fhp, &tdrpc->fh, sizeof(*fhp));
 5883                 tdrpc->nmp = *nmpp;
 5884                 tdrpc->vp = vp;
 5885                 tdrpc->cred = cred;
 5886                 tdrpc->p = p;
 5887                 tdrpc->aclp = aclp;
 5888                 tdrpc->err = 0;
 5889                 ret = EIO;
 5890                 if (nfs_pnfsiothreads != 0) {
 5891                         ret = nfs_pnfsio(start_setacldsdorpc, tdrpc);
 5892                         NFSD_DEBUG(4, "nfsrv_setacldsrpc: nfs_pnfsio=%d\n",
 5893                             ret);
 5894                 }
 5895                 if (ret != 0) {
 5896                         ret = nfsrv_setacldsdorpc(fhp, cred, p, vp, *nmpp,
 5897                             aclp);
 5898                         if (nfsds_failerr(ret) && *failposp == -1)
 5899                                 *failposp = i;
 5900                         else if (error == 0 && ret != 0)
 5901                                 error = ret;
 5902                 }
 5903                 nmpp++;
 5904                 fhp++;
 5905         }
 5906         ret = nfsrv_setacldsdorpc(fhp, cred, p, vp, *nmpp, aclp);
 5907         if (nfsds_failerr(ret) && *failposp == -1 && mirrorcnt > 1)
 5908                 *failposp = mirrorcnt - 1;
 5909         else if (error == 0 && ret != 0)
 5910                 error = ret;
 5911         NFSD_DEBUG(4, "nfsrv_setacldsrpc: aft setextat=%d\n", error);
 5912         tdrpc = drpc;
 5913         timo = hz / 50;         /* Wait for 20msec. */
 5914         if (timo < 1)
 5915                 timo = 1;
 5916         for (i = 0; i < mirrorcnt - 1; i++, tdrpc++) {
 5917                 /* Wait for RPCs on separate threads to complete. */
 5918                 while (tdrpc->inprog != 0 && tdrpc->done == 0)
 5919                         tsleep(&tdrpc->tsk, PVFS, "srvacds", timo);
 5920                 if (nfsds_failerr(tdrpc->err) && *failposp == -1)
 5921                         *failposp = i;
 5922                 else if (error == 0 && tdrpc->err != 0)
 5923                         error = tdrpc->err;
 5924         }
 5925         free(drpc, M_TEMP);
 5926         return (error);
 5927 }
 5928 
 5929 /*
 5930  * Getattr call to the DS for the attributes that change due to writing.
 5931  */
 5932 static int
 5933 nfsrv_getattrdsrpc(fhandle_t *fhp, struct ucred *cred, NFSPROC_T *p,
 5934     struct vnode *vp, struct nfsmount *nmp, struct nfsvattr *nap)
 5935 {
 5936         struct nfsrv_descript *nd;
 5937         int error;
 5938         nfsattrbit_t attrbits;
 5939 
 5940         NFSD_DEBUG(4, "in nfsrv_getattrdsrpc\n");
 5941         nd = malloc(sizeof(*nd), M_TEMP, M_WAITOK | M_ZERO);
 5942         nfscl_reqstart(nd, NFSPROC_GETATTR, nmp, (u_int8_t *)fhp,
 5943             sizeof(fhandle_t), NULL, NULL, 0, 0);
 5944         NFSZERO_ATTRBIT(&attrbits);
 5945         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_SIZE);
 5946         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
 5947         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESS);
 5948         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFY);
 5949         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_SPACEUSED);
 5950         (void) nfsrv_putattrbit(nd, &attrbits);
 5951         error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
 5952             NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
 5953         if (error != 0) {
 5954                 free(nd, M_TEMP);
 5955                 return (error);
 5956         }
 5957         NFSD_DEBUG(4, "nfsrv_getattrdsrpc: aft getattrrpc=%d\n",
 5958             nd->nd_repstat);
 5959         if (nd->nd_repstat == 0) {
 5960                 error = nfsv4_loadattr(nd, NULL, nap, NULL, NULL, 0,
 5961                     NULL, NULL, NULL, NULL, NULL, 0, NULL, NULL, NULL,
 5962                     NULL, NULL);
 5963                 /*
 5964                  * We can only save the updated values in the extended
 5965                  * attribute if the vp is exclusively locked.
 5966                  * This should happen when any of the following operations
 5967                  * occur on the vnode:
 5968                  *    Close, Delegreturn, LayoutCommit, LayoutReturn
 5969                  * As such, the updated extended attribute should get saved
 5970                  * before nfsrv_checkdsattr() returns 0 and allows the cached
 5971                  * attributes to be returned without calling this function.
 5972                  */
 5973                 if (error == 0 && VOP_ISLOCKED(vp) == LK_EXCLUSIVE) {
 5974                         error = nfsrv_setextattr(vp, nap, p);
 5975                         NFSD_DEBUG(4, "nfsrv_getattrdsrpc: aft setextat=%d\n",
 5976                             error);
 5977                 }
 5978         } else
 5979                 error = nd->nd_repstat;
 5980         m_freem(nd->nd_mrep);
 5981         free(nd, M_TEMP);
 5982         NFSD_DEBUG(4, "nfsrv_getattrdsrpc error=%d\n", error);
 5983         return (error);
 5984 }
 5985 
 5986 /*
 5987  * Seek call to a DS.
 5988  */
 5989 static int
 5990 nfsrv_seekdsrpc(fhandle_t *fhp, off_t *offp, int content, bool *eofp,
 5991     struct ucred *cred, NFSPROC_T *p, struct nfsmount *nmp)
 5992 {
 5993         uint32_t *tl;
 5994         struct nfsrv_descript *nd;
 5995         nfsv4stateid_t st;
 5996         int error;
 5997 
 5998         NFSD_DEBUG(4, "in nfsrv_seekdsrpc\n");
 5999         /*
 6000          * Use a stateid where other is an alternating 01010 pattern and
 6001          * seqid is 0xffffffff.  This value is not defined as special by
 6002          * the RFC and is used by the FreeBSD NFS server to indicate an
 6003          * MDS->DS proxy operation.
 6004          */
 6005         st.other[0] = 0x55555555;
 6006         st.other[1] = 0x55555555;
 6007         st.other[2] = 0x55555555;
 6008         st.seqid = 0xffffffff;
 6009         nd = malloc(sizeof(*nd), M_TEMP, M_WAITOK | M_ZERO);
 6010         nfscl_reqstart(nd, NFSPROC_SEEKDS, nmp, (u_int8_t *)fhp,
 6011             sizeof(fhandle_t), NULL, NULL, 0, 0);
 6012         nfsm_stateidtom(nd, &st, NFSSTATEID_PUTSTATEID);
 6013         NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
 6014         txdr_hyper(*offp, tl); tl += 2;
 6015         *tl = txdr_unsigned(content);
 6016         error = newnfs_request(nd, nmp, NULL, &nmp->nm_sockreq, NULL, p, cred,
 6017             NFS_PROG, NFS_VER4, NULL, 1, NULL, NULL);
 6018         if (error != 0) {
 6019                 free(nd, M_TEMP);
 6020                 return (error);
 6021         }
 6022         NFSD_DEBUG(4, "nfsrv_seekdsrpc: aft seekrpc=%d\n", nd->nd_repstat);
 6023         if (nd->nd_repstat == 0) {
 6024                 NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED + NFSX_HYPER);
 6025                 if (*tl++ == newnfs_true)
 6026                         *eofp = true;
 6027                 else
 6028                         *eofp = false;
 6029                 *offp = fxdr_hyper(tl);
 6030         } else
 6031                 error = nd->nd_repstat;
 6032 nfsmout:
 6033         m_freem(nd->nd_mrep);
 6034         free(nd, M_TEMP);
 6035         NFSD_DEBUG(4, "nfsrv_seekdsrpc error=%d\n", error);
 6036         return (error);
 6037 }
 6038 
 6039 /*
 6040  * Get the device id and file handle for a DS file.
 6041  */
 6042 int
 6043 nfsrv_dsgetdevandfh(struct vnode *vp, NFSPROC_T *p, int *mirrorcntp,
 6044     fhandle_t *fhp, char *devid)
 6045 {
 6046         int buflen, error;
 6047         char *buf;
 6048 
 6049         buflen = 1024;
 6050         buf = malloc(buflen, M_TEMP, M_WAITOK);
 6051         error = nfsrv_dsgetsockmnt(vp, 0, buf, &buflen, mirrorcntp, p, NULL,
 6052             fhp, devid, NULL, NULL, NULL, NULL, NULL, NULL);
 6053         free(buf, M_TEMP);
 6054         return (error);
 6055 }
 6056 
 6057 /*
 6058  * Do a Lookup against the DS for the filename.
 6059  */
 6060 static int
 6061 nfsrv_pnfslookupds(struct vnode *vp, struct vnode *dvp, struct pnfsdsfile *pf,
 6062     struct vnode **nvpp, NFSPROC_T *p)
 6063 {
 6064         struct nameidata named;
 6065         struct ucred *tcred;
 6066         char *bufp;
 6067         u_long *hashp;
 6068         struct vnode *nvp;
 6069         int error;
 6070 
 6071         tcred = newnfs_getcred();
 6072         named.ni_cnd.cn_nameiop = LOOKUP;
 6073         named.ni_cnd.cn_lkflags = LK_SHARED | LK_RETRY;
 6074         named.ni_cnd.cn_cred = tcred;
 6075         named.ni_cnd.cn_thread = p;
 6076         named.ni_cnd.cn_flags = ISLASTCN | LOCKPARENT | LOCKLEAF | SAVENAME;
 6077         nfsvno_setpathbuf(&named, &bufp, &hashp);
 6078         named.ni_cnd.cn_nameptr = bufp;
 6079         named.ni_cnd.cn_namelen = strlen(pf->dsf_filename);
 6080         strlcpy(bufp, pf->dsf_filename, NAME_MAX);
 6081         NFSD_DEBUG(4, "nfsrv_pnfslookupds: filename=%s\n", bufp);
 6082         error = VOP_LOOKUP(dvp, &nvp, &named.ni_cnd);
 6083         NFSD_DEBUG(4, "nfsrv_pnfslookupds: aft LOOKUP=%d\n", error);
 6084         NFSFREECRED(tcred);
 6085         nfsvno_relpathbuf(&named);
 6086         if (error == 0)
 6087                 *nvpp = nvp;
 6088         NFSD_DEBUG(4, "eo nfsrv_pnfslookupds=%d\n", error);
 6089         return (error);
 6090 }
 6091 
 6092 /*
 6093  * Set the file handle to the correct one.
 6094  */
 6095 static void
 6096 nfsrv_pnfssetfh(struct vnode *vp, struct pnfsdsfile *pf, char *devid,
 6097     char *fnamep, struct vnode *nvp, NFSPROC_T *p)
 6098 {
 6099         struct nfsnode *np;
 6100         int ret = 0;
 6101 
 6102         np = VTONFS(nvp);
 6103         NFSBCOPY(np->n_fhp->nfh_fh, &pf->dsf_fh, NFSX_MYFH);
 6104         /*
 6105          * We can only do a vn_set_extattr() if the vnode is exclusively
 6106          * locked and vn_start_write() has been done.  If devid != NULL or
 6107          * fnamep != NULL or the vnode is shared locked, vn_start_write()
 6108          * may not have been done.
 6109          * If not done now, it will be done on a future call.
 6110          */
 6111         if (devid == NULL && fnamep == NULL && NFSVOPISLOCKED(vp) ==
 6112             LK_EXCLUSIVE)
 6113                 ret = vn_extattr_set(vp, IO_NODELOCKED,
 6114                     EXTATTR_NAMESPACE_SYSTEM, "pnfsd.dsfile", sizeof(*pf),
 6115                     (char *)pf, p);
 6116         NFSD_DEBUG(4, "eo nfsrv_pnfssetfh=%d\n", ret);
 6117 }
 6118 
 6119 /*
 6120  * Cause RPCs waiting on "nmp" to fail.  This is called for a DS mount point
 6121  * when the DS has failed.
 6122  */
 6123 void
 6124 nfsrv_killrpcs(struct nfsmount *nmp)
 6125 {
 6126 
 6127         /*
 6128          * Call newnfs_nmcancelreqs() to cause
 6129          * any RPCs in progress on the mount point to
 6130          * fail.
 6131          * This will cause any process waiting for an
 6132          * RPC to complete while holding a vnode lock
 6133          * on the mounted-on vnode (such as "df" or
 6134          * a non-forced "umount") to fail.
 6135          * This will unlock the mounted-on vnode so
 6136          * a forced dismount can succeed.
 6137          * The NFSMNTP_CANCELRPCS flag should be set when this function is
 6138          * called.
 6139          */
 6140         newnfs_nmcancelreqs(nmp);
 6141 }
 6142 
 6143 /*
 6144  * Sum up the statfs info for each of the DSs, so that the client will
 6145  * receive the total for all DSs.
 6146  */
 6147 static int
 6148 nfsrv_pnfsstatfs(struct statfs *sf, struct mount *mp)
 6149 {
 6150         struct statfs *tsf;
 6151         struct nfsdevice *ds;
 6152         struct vnode **dvpp, **tdvpp, *dvp;
 6153         uint64_t tot;
 6154         int cnt, error = 0, i;
 6155 
 6156         if (nfsrv_devidcnt <= 0)
 6157                 return (ENXIO);
 6158         dvpp = mallocarray(nfsrv_devidcnt, sizeof(*dvpp), M_TEMP, M_WAITOK);
 6159         tsf = malloc(sizeof(*tsf), M_TEMP, M_WAITOK);
 6160 
 6161         /* Get an array of the dvps for the DSs. */
 6162         tdvpp = dvpp;
 6163         i = 0;
 6164         NFSDDSLOCK();
 6165         /* First, search for matches for same file system. */
 6166         TAILQ_FOREACH(ds, &nfsrv_devidhead, nfsdev_list) {
 6167                 if (ds->nfsdev_nmp != NULL && ds->nfsdev_mdsisset != 0 &&
 6168                     fsidcmp(&ds->nfsdev_mdsfsid, &mp->mnt_stat.f_fsid) == 0) {
 6169                         if (++i > nfsrv_devidcnt)
 6170                                 break;
 6171                         *tdvpp++ = ds->nfsdev_dvp;
 6172                 }
 6173         }
 6174         /*
 6175          * If no matches for same file system, total all servers not assigned
 6176          * to a file system.
 6177          */
 6178         if (i == 0) {
 6179                 TAILQ_FOREACH(ds, &nfsrv_devidhead, nfsdev_list) {
 6180                         if (ds->nfsdev_nmp != NULL &&
 6181                             ds->nfsdev_mdsisset == 0) {
 6182                                 if (++i > nfsrv_devidcnt)
 6183                                         break;
 6184                                 *tdvpp++ = ds->nfsdev_dvp;
 6185                         }
 6186                 }
 6187         }
 6188         NFSDDSUNLOCK();
 6189         cnt = i;
 6190 
 6191         /* Do a VFS_STATFS() for each of the DSs and sum them up. */
 6192         tdvpp = dvpp;
 6193         for (i = 0; i < cnt && error == 0; i++) {
 6194                 dvp = *tdvpp++;
 6195                 error = VFS_STATFS(dvp->v_mount, tsf);
 6196                 if (error == 0) {
 6197                         if (sf->f_bsize == 0) {
 6198                                 if (tsf->f_bsize > 0)
 6199                                         sf->f_bsize = tsf->f_bsize;
 6200                                 else
 6201                                         sf->f_bsize = 8192;
 6202                         }
 6203                         if (tsf->f_blocks > 0) {
 6204                                 if (sf->f_bsize != tsf->f_bsize) {
 6205                                         tot = tsf->f_blocks * tsf->f_bsize;
 6206                                         sf->f_blocks += (tot / sf->f_bsize);
 6207                                 } else
 6208                                         sf->f_blocks += tsf->f_blocks;
 6209                         }
 6210                         if (tsf->f_bfree > 0) {
 6211                                 if (sf->f_bsize != tsf->f_bsize) {
 6212                                         tot = tsf->f_bfree * tsf->f_bsize;
 6213                                         sf->f_bfree += (tot / sf->f_bsize);
 6214                                 } else
 6215                                         sf->f_bfree += tsf->f_bfree;
 6216                         }
 6217                         if (tsf->f_bavail > 0) {
 6218                                 if (sf->f_bsize != tsf->f_bsize) {
 6219                                         tot = tsf->f_bavail * tsf->f_bsize;
 6220                                         sf->f_bavail += (tot / sf->f_bsize);
 6221                                 } else
 6222                                         sf->f_bavail += tsf->f_bavail;
 6223                         }
 6224                 }
 6225         }
 6226         free(tsf, M_TEMP);
 6227         free(dvpp, M_TEMP);
 6228         return (error);
 6229 }
 6230 
 6231 /*
 6232  * Set an NFSv4 acl.
 6233  */
 6234 int
 6235 nfsrv_setacl(struct vnode *vp, NFSACL_T *aclp, struct ucred *cred, NFSPROC_T *p)
 6236 {
 6237         int error;
 6238 
 6239         if (nfsrv_useacl == 0 || nfs_supportsnfsv4acls(vp) == 0) {
 6240                 error = NFSERR_ATTRNOTSUPP;
 6241                 goto out;
 6242         }
 6243         /*
 6244          * With NFSv4 ACLs, chmod(2) may need to add additional entries.
 6245          * Make sure it has enough room for that - splitting every entry
 6246          * into two and appending "canonical six" entries at the end.
 6247          * Cribbed out of kern/vfs_acl.c - Rick M.
 6248          */
 6249         if (aclp->acl_cnt > (ACL_MAX_ENTRIES - 6) / 2) {
 6250                 error = NFSERR_ATTRNOTSUPP;
 6251                 goto out;
 6252         }
 6253         error = VOP_SETACL(vp, ACL_TYPE_NFS4, aclp, cred, p);
 6254         if (error == 0) {
 6255                 error = nfsrv_dssetacl(vp, aclp, cred, p);
 6256                 if (error == ENOENT)
 6257                         error = 0;
 6258         }
 6259 
 6260 out:
 6261         NFSEXITCODE(error);
 6262         return (error);
 6263 }
 6264 
 6265 /*
 6266  * Seek vnode op call (actually it is a VOP_IOCTL()).
 6267  * This function is called with the vnode locked, but unlocks and vrele()s
 6268  * the vp before returning.
 6269  */
 6270 int
 6271 nfsvno_seek(struct nfsrv_descript *nd, struct vnode *vp, u_long cmd,
 6272     off_t *offp, int content, bool *eofp, struct ucred *cred, NFSPROC_T *p)
 6273 {
 6274         struct nfsvattr at;
 6275         int error, ret;
 6276 
 6277         ASSERT_VOP_LOCKED(vp, "nfsvno_seek vp");
 6278         /*
 6279          * Attempt to seek on a DS file. A return of ENOENT implies
 6280          * there is no DS file to seek on.
 6281          */
 6282         error = nfsrv_proxyds(vp, 0, 0, cred, p, NFSPROC_SEEKDS, NULL,
 6283             NULL, NULL, NULL, NULL, offp, content, eofp);
 6284         if (error != ENOENT) {
 6285                 vput(vp);
 6286                 return (error);
 6287         }
 6288 
 6289         /*
 6290          * Do the VOP_IOCTL() call.  For the case where *offp == file_size,
 6291          * VOP_IOCTL() will return ENXIO.  However, the correct reply for
 6292          * NFSv4.2 is *eofp == true and error == 0 for this case.
 6293          */
 6294         NFSVOPUNLOCK(vp);
 6295         error = VOP_IOCTL(vp, cmd, offp, 0, cred, p);
 6296         *eofp = false;
 6297         if (error == ENXIO || (error == 0 && cmd == FIOSEEKHOLE)) {
 6298                 /* Handle the cases where we might be at EOF. */
 6299                 ret = nfsvno_getattr(vp, &at, nd, p, 0, NULL);
 6300                 if (ret == 0 && *offp == at.na_size) {
 6301                         *eofp = true;
 6302                         error = 0;
 6303                 }
 6304                 if (ret != 0 && error == 0)
 6305                         error = ret;
 6306         }
 6307         vrele(vp);
 6308         NFSEXITCODE(error);
 6309         return (error);
 6310 }
 6311 
 6312 /*
 6313  * Allocate vnode op call.
 6314  */
 6315 int
 6316 nfsvno_allocate(struct vnode *vp, off_t off, off_t len, struct ucred *cred,
 6317     NFSPROC_T *p)
 6318 {
 6319         int error, trycnt;
 6320 
 6321         ASSERT_VOP_ELOCKED(vp, "nfsvno_allocate vp");
 6322         /*
 6323          * Attempt to allocate on a DS file. A return of ENOENT implies
 6324          * there is no DS file to allocate on.
 6325          */
 6326         error = nfsrv_proxyds(vp, off, 0, cred, p, NFSPROC_ALLOCATE, NULL,
 6327             NULL, NULL, NULL, NULL, &len, 0, NULL);
 6328         if (error != ENOENT)
 6329                 return (error);
 6330         error = 0;
 6331 
 6332         /*
 6333          * Do the actual VOP_ALLOCATE(), looping a reasonable number of
 6334          * times to achieve completion.
 6335          */
 6336         trycnt = 0;
 6337         while (error == 0 && len > 0 && trycnt++ < 20)
 6338                 error = VOP_ALLOCATE(vp, &off, &len);
 6339         if (error == 0 && len > 0)
 6340                 error = NFSERR_IO;
 6341         NFSEXITCODE(error);
 6342         return (error);
 6343 }
 6344 
 6345 /*
 6346  * Get Extended Atribute vnode op into an mbuf list.
 6347  */
 6348 int
 6349 nfsvno_getxattr(struct vnode *vp, char *name, uint32_t maxresp,
 6350     struct ucred *cred, uint64_t flag, int maxextsiz, struct thread *p,
 6351     struct mbuf **mpp, struct mbuf **mpendp, int *lenp)
 6352 {
 6353         struct iovec *iv;
 6354         struct uio io, *uiop = &io;
 6355         struct mbuf *m, *m2;
 6356         int alen, error, len, tlen;
 6357         size_t siz;
 6358 
 6359         /* First, find out the size of the extended attribute. */
 6360         error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
 6361             &siz, cred, p);
 6362         if (error != 0)
 6363                 return (NFSERR_NOXATTR);
 6364         if (siz > maxresp - NFS_MAXXDR)
 6365                 return (NFSERR_XATTR2BIG);
 6366         len = siz;
 6367         tlen = NFSM_RNDUP(len);
 6368         if (tlen > 0) {
 6369                 /*
 6370                  * If cnt > MCLBYTES and the reply will not be saved, use
 6371                  * ext_pgs mbufs for TLS.
 6372                  * For NFSv4.0, we do not know for sure if the reply will
 6373                  * be saved, so do not use ext_pgs mbufs for NFSv4.0.
 6374                  * Always use ext_pgs mbufs if ND_EXTPG is set.
 6375                  */
 6376                 if ((flag & ND_EXTPG) != 0 || (tlen > MCLBYTES &&
 6377                     (flag & (ND_TLS | ND_SAVEREPLY)) == ND_TLS &&
 6378                     (flag & (ND_NFSV4 | ND_NFSV41)) != ND_NFSV4))
 6379                         uiop->uio_iovcnt = nfsrv_createiovec_extpgs(tlen,
 6380                             maxextsiz, &m, &m2, &iv);
 6381                 else
 6382                         uiop->uio_iovcnt = nfsrv_createiovec(tlen, &m, &m2,
 6383                             &iv);
 6384                 uiop->uio_iov = iv;
 6385         } else {
 6386                 uiop->uio_iovcnt = 0;
 6387                 uiop->uio_iov = iv = NULL;
 6388                 m = m2 = NULL;
 6389         }
 6390         uiop->uio_offset = 0;
 6391         uiop->uio_resid = tlen;
 6392         uiop->uio_rw = UIO_READ;
 6393         uiop->uio_segflg = UIO_SYSSPACE;
 6394         uiop->uio_td = p;
 6395 #ifdef MAC
 6396         error = mac_vnode_check_getextattr(cred, vp, EXTATTR_NAMESPACE_USER,
 6397             name);
 6398         if (error != 0)
 6399                 goto out;
 6400 #endif
 6401 
 6402         if (tlen > 0)
 6403                 error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, uiop,
 6404                     NULL, cred, p);
 6405         if (error != 0)
 6406                 goto out;
 6407         if (uiop->uio_resid > 0) {
 6408                 alen = tlen;
 6409                 len = tlen - uiop->uio_resid;
 6410                 tlen = NFSM_RNDUP(len);
 6411                 if (alen != tlen)
 6412                         printf("nfsvno_getxattr: weird size read\n");
 6413                 if (tlen == 0) {
 6414                         m_freem(m);
 6415                         m = m2 = NULL;
 6416                 } else if (alen != tlen || tlen != len)
 6417                         m2 = nfsrv_adj(m, alen - tlen, tlen - len);
 6418         }
 6419         *lenp = len;
 6420         *mpp = m;
 6421         *mpendp = m2;
 6422 
 6423 out:
 6424         if (error != 0) {
 6425                 if (m != NULL)
 6426                         m_freem(m);
 6427                 *lenp = 0;
 6428         }
 6429         free(iv, M_TEMP);
 6430         NFSEXITCODE(error);
 6431         return (error);
 6432 }
 6433 
 6434 /*
 6435  * Set Extended attribute vnode op from an mbuf list.
 6436  */
 6437 int
 6438 nfsvno_setxattr(struct vnode *vp, char *name, int len, struct mbuf *m,
 6439     char *cp, struct ucred *cred, struct thread *p)
 6440 {
 6441         struct iovec *iv;
 6442         struct uio uio, *uiop = &uio;
 6443         int cnt, error;
 6444 
 6445         error = 0;
 6446 #ifdef MAC
 6447         error = mac_vnode_check_setextattr(cred, vp, EXTATTR_NAMESPACE_USER,
 6448             name);
 6449 #endif
 6450         if (error != 0)
 6451                 goto out;
 6452 
 6453         uiop->uio_rw = UIO_WRITE;
 6454         uiop->uio_segflg = UIO_SYSSPACE;
 6455         uiop->uio_td = p;
 6456         uiop->uio_offset = 0;
 6457         uiop->uio_resid = len;
 6458         if (len > 0) {
 6459                 error = nfsrv_createiovecw(len, m, cp, &iv, &cnt);
 6460                 uiop->uio_iov = iv;
 6461                 uiop->uio_iovcnt = cnt;
 6462         } else {
 6463                 uiop->uio_iov = iv = NULL;
 6464                 uiop->uio_iovcnt = 0;
 6465         }
 6466         if (error == 0) {
 6467                 error = VOP_SETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, uiop,
 6468                     cred, p);
 6469                 free(iv, M_TEMP);
 6470         }
 6471 
 6472 out:
 6473         NFSEXITCODE(error);
 6474         return (error);
 6475 }
 6476 
 6477 /*
 6478  * Remove Extended attribute vnode op.
 6479  */
 6480 int
 6481 nfsvno_rmxattr(struct nfsrv_descript *nd, struct vnode *vp, char *name,
 6482     struct ucred *cred, struct thread *p)
 6483 {
 6484         int error;
 6485 
 6486         /*
 6487          * Get rid of any delegations.  I am not sure why this is required,
 6488          * but RFC-8276 says so.
 6489          */
 6490         error = nfsrv_checkremove(vp, 0, nd, nd->nd_clientid, p);
 6491         if (error != 0)
 6492                 goto out;
 6493 #ifdef MAC
 6494         error = mac_vnode_check_deleteextattr(cred, vp, EXTATTR_NAMESPACE_USER,
 6495             name);
 6496         if (error != 0)
 6497                 goto out;
 6498 #endif
 6499 
 6500         error = VOP_DELETEEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, cred, p);
 6501         if (error == EOPNOTSUPP)
 6502                 error = VOP_SETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
 6503                     cred, p);
 6504 out:
 6505         NFSEXITCODE(error);
 6506         return (error);
 6507 }
 6508 
 6509 /*
 6510  * List Extended Atribute vnode op into an mbuf list.
 6511  */
 6512 int
 6513 nfsvno_listxattr(struct vnode *vp, uint64_t cookie, struct ucred *cred,
 6514     struct thread *p, u_char **bufp, uint32_t *lenp, bool *eofp)
 6515 {
 6516         struct iovec iv;
 6517         struct uio io;
 6518         int error;
 6519         size_t siz;
 6520 
 6521         *bufp = NULL;
 6522         /* First, find out the size of the extended attribute. */
 6523         error = VOP_LISTEXTATTR(vp, EXTATTR_NAMESPACE_USER, NULL, &siz, cred,
 6524             p);
 6525         if (error != 0)
 6526                 return (NFSERR_NOXATTR);
 6527         if (siz <= cookie) {
 6528                 *lenp = 0;
 6529                 *eofp = true;
 6530                 goto out;
 6531         }
 6532         if (siz > cookie + *lenp) {
 6533                 siz = cookie + *lenp;
 6534                 *eofp = false;
 6535         } else
 6536                 *eofp = true;
 6537         /* Just choose a sanity limit of 10Mbytes for malloc(M_TEMP). */
 6538         if (siz > 10 * 1024 * 1024) {
 6539                 error = NFSERR_XATTR2BIG;
 6540                 goto out;
 6541         }
 6542         *bufp = malloc(siz, M_TEMP, M_WAITOK);
 6543         iv.iov_base = *bufp;
 6544         iv.iov_len = siz;
 6545         io.uio_iovcnt = 1;
 6546         io.uio_iov = &iv;
 6547         io.uio_offset = 0;
 6548         io.uio_resid = siz;
 6549         io.uio_rw = UIO_READ;
 6550         io.uio_segflg = UIO_SYSSPACE;
 6551         io.uio_td = p;
 6552 #ifdef MAC
 6553         error = mac_vnode_check_listextattr(cred, vp, EXTATTR_NAMESPACE_USER);
 6554         if (error != 0)
 6555                 goto out;
 6556 #endif
 6557 
 6558         error = VOP_LISTEXTATTR(vp, EXTATTR_NAMESPACE_USER, &io, NULL, cred,
 6559             p);
 6560         if (error != 0)
 6561                 goto out;
 6562         if (io.uio_resid > 0)
 6563                 siz -= io.uio_resid;
 6564         *lenp = siz;
 6565 
 6566 out:
 6567         if (error != 0) {
 6568                 free(*bufp, M_TEMP);
 6569                 *bufp = NULL;
 6570         }
 6571         NFSEXITCODE(error);
 6572         return (error);
 6573 }
 6574 
 6575 /*
 6576  * Trim trailing data off the mbuf list being built.
 6577  */
 6578 void
 6579 nfsm_trimtrailing(struct nfsrv_descript *nd, struct mbuf *mb, char *bpos,
 6580     int bextpg, int bextpgsiz)
 6581 {
 6582         vm_page_t pg;
 6583         int fullpgsiz, i;
 6584 
 6585         if (mb->m_next != NULL) {
 6586                 m_freem(mb->m_next);
 6587                 mb->m_next = NULL;
 6588         }
 6589         if ((mb->m_flags & M_EXTPG) != 0) {
 6590                 KASSERT(bextpg >= 0 && bextpg < mb->m_epg_npgs,
 6591                     ("nfsm_trimtrailing: bextpg out of range"));
 6592                 KASSERT(bpos == (char *)(void *)
 6593                     PHYS_TO_DMAP(mb->m_epg_pa[bextpg]) + PAGE_SIZE - bextpgsiz,
 6594                     ("nfsm_trimtrailing: bextpgsiz bad!"));
 6595 
 6596                 /* First, get rid of any pages after this position. */
 6597                 for (i = mb->m_epg_npgs - 1; i > bextpg; i--) {
 6598                         pg = PHYS_TO_VM_PAGE(mb->m_epg_pa[i]);
 6599                         vm_page_unwire_noq(pg);
 6600                         vm_page_free(pg);
 6601                 }
 6602                 mb->m_epg_npgs = bextpg + 1;
 6603                 if (bextpg == 0)
 6604                         fullpgsiz = PAGE_SIZE - mb->m_epg_1st_off;
 6605                 else
 6606                         fullpgsiz = PAGE_SIZE;
 6607                 mb->m_epg_last_len = fullpgsiz - bextpgsiz;
 6608                 mb->m_len = m_epg_pagelen(mb, 0, mb->m_epg_1st_off);
 6609                 for (i = 1; i < mb->m_epg_npgs; i++)
 6610                         mb->m_len += m_epg_pagelen(mb, i, 0);
 6611                 nd->nd_bextpgsiz = bextpgsiz;
 6612                 nd->nd_bextpg = bextpg;
 6613         } else
 6614                 mb->m_len = bpos - mtod(mb, char *);
 6615         nd->nd_mb = mb;
 6616         nd->nd_bpos = bpos;
 6617 }
 6618 
 6619 extern int (*nfsd_call_nfsd)(struct thread *, struct nfssvc_args *);
 6620 
 6621 /*
 6622  * Called once to initialize data structures...
 6623  */
 6624 static int
 6625 nfsd_modevent(module_t mod, int type, void *data)
 6626 {
 6627         int error = 0, i;
 6628         static int loaded = 0;
 6629 
 6630         switch (type) {
 6631         case MOD_LOAD:
 6632                 if (loaded)
 6633                         goto out;
 6634                 newnfs_portinit();
 6635                 for (i = 0; i < NFSRVCACHE_HASHSIZE; i++) {
 6636                         mtx_init(&nfsrchash_table[i].mtx, "nfsrtc", NULL,
 6637                             MTX_DEF);
 6638                         mtx_init(&nfsrcahash_table[i].mtx, "nfsrtca", NULL,
 6639                             MTX_DEF);
 6640                 }
 6641                 mtx_init(&nfsrc_udpmtx, "nfsuc", NULL, MTX_DEF);
 6642                 mtx_init(&nfs_v4root_mutex, "nfs4rt", NULL, MTX_DEF);
 6643                 mtx_init(&nfsv4root_mnt.mnt_mtx, "nfs4mnt", NULL, MTX_DEF);
 6644                 mtx_init(&nfsrv_dontlistlock_mtx, "nfs4dnl", NULL, MTX_DEF);
 6645                 mtx_init(&nfsrv_recalllock_mtx, "nfs4rec", NULL, MTX_DEF);
 6646                 lockinit(&nfsv4root_mnt.mnt_explock, PVFS, "explock", 0, 0);
 6647                 nfsrvd_initcache();
 6648                 nfsd_init();
 6649                 NFSD_LOCK();
 6650                 nfsrvd_init(0);
 6651                 NFSD_UNLOCK();
 6652                 nfsd_mntinit();
 6653 #ifdef VV_DISABLEDELEG
 6654                 vn_deleg_ops.vndeleg_recall = nfsd_recalldelegation;
 6655                 vn_deleg_ops.vndeleg_disable = nfsd_disabledelegation;
 6656 #endif
 6657                 nfsd_call_servertimer = nfsrv_servertimer;
 6658                 nfsd_call_nfsd = nfssvc_nfsd;
 6659                 loaded = 1;
 6660                 break;
 6661 
 6662         case MOD_UNLOAD:
 6663                 if (newnfs_numnfsd != 0) {
 6664                         error = EBUSY;
 6665                         break;
 6666                 }
 6667 
 6668 #ifdef VV_DISABLEDELEG
 6669                 vn_deleg_ops.vndeleg_recall = NULL;
 6670                 vn_deleg_ops.vndeleg_disable = NULL;
 6671 #endif
 6672                 nfsd_call_servertimer = NULL;
 6673                 nfsd_call_nfsd = NULL;
 6674 
 6675                 /* Clean out all NFSv4 state. */
 6676                 nfsrv_throwawayallstate(curthread);
 6677 
 6678                 /* Clean the NFS server reply cache */
 6679                 nfsrvd_cleancache();
 6680 
 6681                 /* Free up the krpc server pool. */
 6682                 if (nfsrvd_pool != NULL)
 6683                         svcpool_destroy(nfsrvd_pool);
 6684 
 6685                 /* and get rid of the locks */
 6686                 for (i = 0; i < NFSRVCACHE_HASHSIZE; i++) {
 6687                         mtx_destroy(&nfsrchash_table[i].mtx);
 6688                         mtx_destroy(&nfsrcahash_table[i].mtx);
 6689                 }
 6690                 mtx_destroy(&nfsrc_udpmtx);
 6691                 mtx_destroy(&nfs_v4root_mutex);
 6692                 mtx_destroy(&nfsv4root_mnt.mnt_mtx);
 6693                 mtx_destroy(&nfsrv_dontlistlock_mtx);
 6694                 mtx_destroy(&nfsrv_recalllock_mtx);
 6695                 for (i = 0; i < nfsrv_sessionhashsize; i++)
 6696                         mtx_destroy(&nfssessionhash[i].mtx);
 6697                 if (nfslayouthash != NULL) {
 6698                         for (i = 0; i < nfsrv_layouthashsize; i++)
 6699                                 mtx_destroy(&nfslayouthash[i].mtx);
 6700                         free(nfslayouthash, M_NFSDSESSION);
 6701                 }
 6702                 lockdestroy(&nfsv4root_mnt.mnt_explock);
 6703                 free(nfsclienthash, M_NFSDCLIENT);
 6704                 free(nfslockhash, M_NFSDLOCKFILE);
 6705                 free(nfssessionhash, M_NFSDSESSION);
 6706                 loaded = 0;
 6707                 break;
 6708         default:
 6709                 error = EOPNOTSUPP;
 6710                 break;
 6711         }
 6712 
 6713 out:
 6714         NFSEXITCODE(error);
 6715         return (error);
 6716 }
 6717 static moduledata_t nfsd_mod = {
 6718         "nfsd",
 6719         nfsd_modevent,
 6720         NULL,
 6721 };
 6722 DECLARE_MODULE(nfsd, nfsd_mod, SI_SUB_VFS, SI_ORDER_ANY);
 6723 
 6724 /* So that loader and kldload(2) can find us, wherever we are.. */
 6725 MODULE_VERSION(nfsd, 1);
 6726 MODULE_DEPEND(nfsd, nfscommon, 1, 1, 1);
 6727 MODULE_DEPEND(nfsd, nfslockd, 1, 1, 1);
 6728 MODULE_DEPEND(nfsd, krpc, 1, 1, 1);
 6729 MODULE_DEPEND(nfsd, nfssvc, 1, 1, 1);

Cache object: 90bcf92800c6ef37fb38c717ef75a952


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.