The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/nfsserver/nfs_serv.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 1989, 1993
    3  *      The Regents of the University of California.  All rights reserved.
    4  *
    5  * This code is derived from software contributed to Berkeley by
    6  * Rick Macklem at The University of Guelph.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  * 4. Neither the name of the University nor the names of its contributors
   17  *    may be used to endorse or promote products derived from this software
   18  *    without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   30  * SUCH DAMAGE.
   31  *
   32  *      @(#)nfs_serv.c  8.8 (Berkeley) 7/31/95
   33  */
   34 
   35 #include <sys/cdefs.h>
   36 __FBSDID("$FreeBSD: releng/9.1/sys/nfsserver/nfs_serv.c 229617 2012-01-05 18:50:12Z jhb $");
   37 
   38 /*
   39  * nfs version 2 and 3 server calls to vnode ops
   40  * - these routines generally have 3 phases
   41  *   1 - break down and validate rpc request in mbuf list
   42  *   2 - do the vnode ops for the request
   43  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
   44  *   3 - build the rpc reply in an mbuf list
   45  *   nb:
   46  *      - do not mix the phases, since the nfsm_?? macros can return failures
   47  *        on a bad rpc or similar and do not do any vrele() or vput()'s
   48  *
   49  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
   50  *      error number iff error != 0 whereas
   51  *      returning an error from the server function implies a fatal error
   52  *      such as a badly constructed rpc request that should be dropped without
   53  *      a reply.
   54  *      For nfsm_reply(), the case where error == EBADRPC is treated
   55  *      specially; after constructing a reply, it does an immediate
   56  *      `goto nfsmout' to avoid getting any V3 post-op status appended.
   57  *
   58  * Other notes:
   59  *      Warning: always pay careful attention to resource cleanup on return
   60  *      and note that nfsm_*() macros can terminate a procedure on certain
   61  *      errors.
   62  *
   63  *      lookup() and namei()
   64  *      may return garbage in various structural fields/return elements
   65  *      if an error is returned, and may garbage up nd.ni_dvp even if no
   66  *      error is returned and you did not request LOCKPARENT or WANTPARENT.
   67  *
   68  *      We use the ni_cnd.cn_flags 'HASBUF' flag to track whether the name
   69  *      buffer has been freed or not.
   70  */
   71 
   72 #include <sys/param.h>
   73 #include <sys/systm.h>
   74 #include <sys/proc.h>
   75 #include <sys/namei.h>
   76 #include <sys/unistd.h>
   77 #include <sys/vnode.h>
   78 #include <sys/mount.h>
   79 #include <sys/socket.h>
   80 #include <sys/socketvar.h>
   81 #include <sys/malloc.h>
   82 #include <sys/mbuf.h>
   83 #include <sys/priv.h>
   84 #include <sys/dirent.h>
   85 #include <sys/stat.h>
   86 #include <sys/kernel.h>
   87 #include <sys/sysctl.h>
   88 #include <sys/bio.h>
   89 #include <sys/buf.h>
   90 
   91 #include <vm/vm.h>
   92 #include <vm/vm_extern.h>
   93 #include <vm/vm_object.h>
   94 
   95 #include <nfs/nfsproto.h>
   96 #include <nfsserver/nfs.h>
   97 #include <nfs/xdr_subs.h>
   98 #include <nfsserver/nfsm_subs.h>
   99 
  100 FEATURE(nfsserver, "NFS server");
  101 
  102 #ifdef NFSRV_DEBUG
  103 #define nfsdbprintf(info)       printf info
  104 #else
  105 #define nfsdbprintf(info)
  106 #endif
  107 
  108 #define MAX_COMMIT_COUNT        (1024 * 1024)
  109 
  110 #define MAX_REORDERED_RPC       16
  111 #define NUM_HEURISTIC           1031
  112 #define NHUSE_INIT              64
  113 #define NHUSE_INC               16
  114 #define NHUSE_MAX               2048
  115 
  116 static struct nfsheur {
  117         struct vnode *nh_vp;    /* vp to match (unreferenced pointer) */
  118         off_t nh_nextoff;       /* next offset for sequential detection */
  119         int nh_use;             /* use count for selection */
  120         int nh_seqcount;        /* heuristic */
  121 } nfsheur[NUM_HEURISTIC];
  122 
  123 /* Global vars */
  124 
  125 int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
  126 int nfsrvw_procrastinate_v3 = 0;
  127 
  128 static struct timeval   nfsver = { 0 };
  129 
  130 SYSCTL_NODE(_vfs, OID_AUTO, nfsrv, CTLFLAG_RW, 0, "NFS server");
  131 
  132 static int nfs_async;
  133 static int nfs_commit_blks;
  134 static int nfs_commit_miss;
  135 SYSCTL_INT(_vfs_nfsrv, OID_AUTO, async, CTLFLAG_RW, &nfs_async, 0,
  136     "Tell client that writes were synced even though they were not");
  137 SYSCTL_INT(_vfs_nfsrv, OID_AUTO, commit_blks, CTLFLAG_RW, &nfs_commit_blks, 0,
  138     "Number of completed commits");
  139 SYSCTL_INT(_vfs_nfsrv, OID_AUTO, commit_miss, CTLFLAG_RW, &nfs_commit_miss, 0, "");
  140 
  141 struct nfsrvstats nfsrvstats;
  142 SYSCTL_STRUCT(_vfs_nfsrv, NFS_NFSRVSTATS, nfsrvstats, CTLFLAG_RW,
  143         &nfsrvstats, nfsrvstats, "S,nfsrvstats");
  144 
  145 static int      nfsrv_access(struct vnode *, accmode_t, struct ucred *,
  146                     int, int);
  147 
  148 /*
  149  * Clear nameidata fields that are tested in nsfmout cleanup code prior
  150  * to using first nfsm macro (that might jump to the cleanup code).
  151  */
  152 
  153 static __inline void
  154 ndclear(struct nameidata *nd)
  155 {
  156 
  157         nd->ni_cnd.cn_flags = 0;
  158         nd->ni_vp = NULL;
  159         nd->ni_dvp = NULL;
  160         nd->ni_startdir = NULL;
  161         nd->ni_strictrelative = 0;
  162 }
  163 
  164 /*
  165  * Takes two vfslocked integers and returns with at most one
  166  * reference to giant.  The return value indicates whether giant
  167  * is held by either lock.  This simplifies nfsrv ops by allowing
  168  * them to track only one vfslocked var.
  169  */
  170 static __inline int
  171 nfsrv_lockedpair(int vfs1, int vfs2)
  172 {
  173 
  174         if (vfs1 && vfs2)
  175                 VFS_UNLOCK_GIANT(vfs2);
  176 
  177         return (vfs1 | vfs2);
  178 }
  179 
  180 static __inline int
  181 nfsrv_lockedpair_nd(int vfs1, struct nameidata *nd)
  182 {
  183         int vfs2;
  184 
  185         vfs2 = NDHASGIANT(nd);
  186 
  187         return nfsrv_lockedpair(vfs1, vfs2);
  188 }
  189 
  190 /*
  191  * Heuristic to detect sequential operation.
  192  */
  193 static struct nfsheur *
  194 nfsrv_sequential_heuristic(struct uio *uio, struct vnode *vp)
  195 {
  196         struct nfsheur *nh;
  197         int hi, try;
  198 
  199         /* Locate best candidate. */
  200         try = 32;
  201         hi = ((int)(vm_offset_t)vp / sizeof(struct vnode)) % NUM_HEURISTIC;
  202         nh = &nfsheur[hi];
  203         while (try--) {
  204                 if (nfsheur[hi].nh_vp == vp) {
  205                         nh = &nfsheur[hi];
  206                         break;
  207                 }
  208                 if (nfsheur[hi].nh_use > 0)
  209                         --nfsheur[hi].nh_use;
  210                 hi = (hi + 1) % NUM_HEURISTIC;
  211                 if (nfsheur[hi].nh_use < nh->nh_use)
  212                         nh = &nfsheur[hi];
  213         }
  214 
  215         /* Initialize hint if this is a new file. */
  216         if (nh->nh_vp != vp) {
  217                 nh->nh_vp = vp;
  218                 nh->nh_nextoff = uio->uio_offset;
  219                 nh->nh_use = NHUSE_INIT;
  220                 if (uio->uio_offset == 0)
  221                         nh->nh_seqcount = 4;
  222                 else
  223                         nh->nh_seqcount = 1;
  224         }
  225 
  226         /* Calculate heuristic. */
  227         if ((uio->uio_offset == 0 && nh->nh_seqcount > 0) ||
  228             uio->uio_offset == nh->nh_nextoff) {
  229                 /* See comments in vfs_vnops.c:sequential_heuristic(). */
  230                 nh->nh_seqcount += howmany(uio->uio_resid, 16384);
  231                 if (nh->nh_seqcount > IO_SEQMAX)
  232                         nh->nh_seqcount = IO_SEQMAX;
  233         } else if (qabs(uio->uio_offset - nh->nh_nextoff) <= MAX_REORDERED_RPC *
  234             imax(vp->v_mount->mnt_stat.f_iosize, uio->uio_resid)) {
  235                 /* Probably a reordered RPC, leave seqcount alone. */
  236         } else if (nh->nh_seqcount > 1) {
  237                 nh->nh_seqcount /= 2;
  238         } else {
  239                 nh->nh_seqcount = 0;
  240         }
  241         nh->nh_use += NHUSE_INC;
  242         if (nh->nh_use > NHUSE_MAX)
  243                 nh->nh_use = NHUSE_MAX;
  244         return (nh);
  245 }
  246 
  247 /*
  248  * nfs v3 access service
  249  */
  250 int
  251 nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
  252     struct mbuf **mrq)
  253 {
  254         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
  255         struct sockaddr *nam = nfsd->nd_nam;
  256         caddr_t dpos = nfsd->nd_dpos;
  257         struct ucred *cred = nfsd->nd_cr;
  258         struct vnode *vp = NULL;
  259         nfsfh_t nfh;
  260         fhandle_t *fhp;
  261         u_int32_t *tl;
  262         caddr_t bpos;
  263         int error = 0, rdonly, getret;
  264         struct mbuf *mb, *mreq;
  265         struct vattr vattr, *vap = &vattr;
  266         u_long testmode, nfsmode;
  267         int v3 = (nfsd->nd_flag & ND_NFSV3);
  268         int vfslocked;
  269 
  270         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
  271         if (!v3)
  272                 panic("nfsrv3_access: v3 proc called on a v2 connection");
  273         vfslocked = 0;
  274         fhp = &nfh.fh_generic;
  275         nfsm_srvmtofh(fhp);
  276         tl = nfsm_dissect_nonblock(u_int32_t *, NFSX_UNSIGNED);
  277         error = nfsrv_fhtovp(fhp, 0, &vp, &vfslocked, nfsd, slp, nam, &rdonly);
  278         if (error) {
  279                 nfsm_reply(NFSX_UNSIGNED);
  280                 nfsm_srvpostop_attr(1, NULL);
  281                 error = 0;
  282                 goto nfsmout;
  283         }
  284         nfsmode = fxdr_unsigned(u_int32_t, *tl);
  285         if ((nfsmode & NFSV3ACCESS_READ) &&
  286                 nfsrv_access(vp, VREAD, cred, rdonly, 0))
  287                 nfsmode &= ~NFSV3ACCESS_READ;
  288         if (vp->v_type == VDIR)
  289                 testmode = (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
  290                         NFSV3ACCESS_DELETE);
  291         else
  292                 testmode = (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
  293         if ((nfsmode & testmode) &&
  294                 nfsrv_access(vp, VWRITE, cred, rdonly, 0))
  295                 nfsmode &= ~testmode;
  296         if (vp->v_type == VDIR)
  297                 testmode = NFSV3ACCESS_LOOKUP;
  298         else
  299                 testmode = NFSV3ACCESS_EXECUTE;
  300         if ((nfsmode & testmode) &&
  301                 nfsrv_access(vp, VEXEC, cred, rdonly, 0))
  302                 nfsmode &= ~testmode;
  303         getret = VOP_GETATTR(vp, vap, cred);
  304         vput(vp);
  305         vp = NULL;
  306         nfsm_reply(NFSX_POSTOPATTR(1) + NFSX_UNSIGNED);
  307         nfsm_srvpostop_attr(getret, vap);
  308         tl = nfsm_build(u_int32_t *, NFSX_UNSIGNED);
  309         *tl = txdr_unsigned(nfsmode);
  310 nfsmout:
  311         if (vp)
  312                 vput(vp);
  313         VFS_UNLOCK_GIANT(vfslocked);
  314         return(error);
  315 }
  316 
  317 /*
  318  * nfs getattr service
  319  */
  320 int
  321 nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
  322     struct mbuf **mrq)
  323 {
  324         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
  325         struct sockaddr *nam = nfsd->nd_nam;
  326         caddr_t dpos = nfsd->nd_dpos;
  327         struct ucred *cred = nfsd->nd_cr;
  328         struct nfs_fattr *fp;
  329         struct vattr va;
  330         struct vattr *vap = &va;
  331         struct vnode *vp = NULL;
  332         nfsfh_t nfh;
  333         fhandle_t *fhp;
  334         caddr_t bpos;
  335         int error = 0, rdonly;
  336         struct mbuf *mb, *mreq;
  337         int vfslocked;
  338 
  339         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
  340         vfslocked = 0;
  341         fhp = &nfh.fh_generic;
  342         nfsm_srvmtofh(fhp);
  343         error = nfsrv_fhtovp(fhp, 0, &vp, &vfslocked, nfsd, slp, nam, &rdonly);
  344         if (error) {
  345                 nfsm_reply(0);
  346                 error = 0;
  347                 goto nfsmout;
  348         }
  349         error = VOP_GETATTR(vp, vap, cred);
  350         vput(vp);
  351         vp = NULL;
  352         nfsm_reply(NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
  353         if (error) {
  354                 error = 0;
  355                 goto nfsmout;
  356         }
  357         fp = nfsm_build(struct nfs_fattr *,
  358             NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
  359         nfsm_srvfillattr(vap, fp);
  360         /* fall through */
  361 
  362 nfsmout:
  363         if (vp)
  364                 vput(vp);
  365         VFS_UNLOCK_GIANT(vfslocked);
  366         return(error);
  367 }
  368 
  369 /*
  370  * nfs setattr service
  371  */
  372 int
  373 nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
  374     struct mbuf **mrq)
  375 {
  376         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
  377         struct sockaddr *nam = nfsd->nd_nam;
  378         caddr_t dpos = nfsd->nd_dpos;
  379         struct ucred *cred = nfsd->nd_cr;
  380         struct vattr va, preat;
  381         struct vattr *vap = &va;
  382         struct nfsv2_sattr *sp;
  383         struct nfs_fattr *fp;
  384         struct vnode *vp = NULL;
  385         nfsfh_t nfh;
  386         fhandle_t *fhp;
  387         u_int32_t *tl;
  388         caddr_t bpos;
  389         int error = 0, rdonly, preat_ret = 1, postat_ret = 1;
  390         int v3 = (nfsd->nd_flag & ND_NFSV3), gcheck = 0;
  391         struct mbuf *mb, *mreq;
  392         struct timespec guard = { 0, 0 };
  393         struct mount *mp = NULL;
  394         int tvfslocked;
  395         int vfslocked;
  396 
  397         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
  398         vfslocked = 0;
  399         fhp = &nfh.fh_generic;
  400         nfsm_srvmtofh(fhp);
  401         if ((mp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
  402                 error = ESTALE;
  403                 goto out;
  404         }
  405         vfslocked = VFS_LOCK_GIANT(mp);
  406         (void) vn_start_write(NULL, &mp, V_WAIT);
  407         vfs_rel(mp);            /* The write holds a ref. */
  408         VATTR_NULL(vap);
  409         if (v3) {
  410                 nfsm_srvsattr(vap);
  411                 tl = nfsm_dissect_nonblock(u_int32_t *, NFSX_UNSIGNED);
  412                 gcheck = fxdr_unsigned(int, *tl);
  413                 if (gcheck) {
  414                         tl = nfsm_dissect_nonblock(u_int32_t *, 2 * NFSX_UNSIGNED);
  415                         fxdr_nfsv3time(tl, &guard);
  416                 }
  417         } else {
  418                 sp = nfsm_dissect_nonblock(struct nfsv2_sattr *, NFSX_V2SATTR);
  419                 /*
  420                  * Nah nah nah nah na nah
  421                  * There is a bug in the Sun client that puts 0xffff in the mode
  422                  * field of sattr when it should put in 0xffffffff. The u_short
  423                  * doesn't sign extend.
  424                  * --> check the low order 2 bytes for 0xffff
  425                  */
  426                 if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
  427                         vap->va_mode = nfstov_mode(sp->sa_mode);
  428                 if (sp->sa_uid != nfsrv_nfs_xdrneg1)
  429                         vap->va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
  430                 if (sp->sa_gid != nfsrv_nfs_xdrneg1)
  431                         vap->va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
  432                 if (sp->sa_size != nfsrv_nfs_xdrneg1)
  433                         vap->va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
  434                 if (sp->sa_atime.nfsv2_sec != nfsrv_nfs_xdrneg1) {
  435 #ifdef notyet
  436                         fxdr_nfsv2time(&sp->sa_atime, &vap->va_atime);
  437 #else
  438                         vap->va_atime.tv_sec =
  439                                 fxdr_unsigned(int32_t, sp->sa_atime.nfsv2_sec);
  440                         vap->va_atime.tv_nsec = 0;
  441 #endif
  442                 }
  443                 if (sp->sa_mtime.nfsv2_sec != nfsrv_nfs_xdrneg1)
  444                         fxdr_nfsv2time(&sp->sa_mtime, &vap->va_mtime);
  445 
  446         }
  447 
  448         /*
  449          * Now that we have all the fields, lets do it.
  450          */
  451         error = nfsrv_fhtovp(fhp, 0, &vp, &tvfslocked, nfsd, slp, nam, &rdonly);
  452         vfslocked = nfsrv_lockedpair(vfslocked, tvfslocked);
  453         if (error) {
  454                 nfsm_reply(2 * NFSX_UNSIGNED);
  455                 if (v3)
  456                         nfsm_srvwcc_data(preat_ret, &preat, postat_ret, vap);
  457                 error = 0;
  458                 goto nfsmout;
  459         }
  460 
  461         /*
  462          * vp now an active resource, pay careful attention to cleanup
  463          */
  464         if (v3) {
  465                 error = preat_ret = VOP_GETATTR(vp, &preat, cred);
  466                 if (!error && gcheck &&
  467                         (preat.va_ctime.tv_sec != guard.tv_sec ||
  468                          preat.va_ctime.tv_nsec != guard.tv_nsec))
  469                         error = NFSERR_NOT_SYNC;
  470                 if (error) {
  471                         vput(vp);
  472                         vp = NULL;
  473                         nfsm_reply(NFSX_WCCDATA(v3));
  474                         if (v3)
  475                                 nfsm_srvwcc_data(preat_ret, &preat, postat_ret, vap);
  476                         error = 0;
  477                         goto nfsmout;
  478                 }
  479         }
  480 
  481         /*
  482          * If the size is being changed write acces is required, otherwise
  483          * just check for a read only filesystem.
  484          */
  485         if (vap->va_size == ((u_quad_t)((quad_t) -1))) {
  486                 if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
  487                         error = EROFS;
  488                         goto out;
  489                 }
  490         } else {
  491                 if (vp->v_type == VDIR) {
  492                         error = EISDIR;
  493                         goto out;
  494                 } else if ((error = nfsrv_access(vp, VWRITE, cred, rdonly,
  495                     0)) != 0)
  496                         goto out;
  497         }
  498         error = VOP_SETATTR(vp, vap, cred);
  499         postat_ret = VOP_GETATTR(vp, vap, cred);
  500         if (!error)
  501                 error = postat_ret;
  502 out:
  503         if (vp != NULL)
  504                 vput(vp);
  505 
  506         vp = NULL;
  507         nfsm_reply(NFSX_WCCORFATTR(v3));
  508         if (v3) {
  509                 nfsm_srvwcc_data(preat_ret, &preat, postat_ret, vap);
  510         } else if (!error) {
  511                 /* v2 non-error case. */
  512                 fp = nfsm_build(struct nfs_fattr *, NFSX_V2FATTR);
  513                 nfsm_srvfillattr(vap, fp);
  514         }
  515         error = 0;
  516         /* fall through */
  517 
  518 nfsmout:
  519         if (vp)
  520                 vput(vp);
  521         vn_finished_write(mp);
  522         VFS_UNLOCK_GIANT(vfslocked);
  523         return(error);
  524 }
  525 
  526 /*
  527  * nfs lookup rpc
  528  */
  529 int
  530 nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
  531     struct mbuf **mrq)
  532 {
  533         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
  534         struct sockaddr *nam = nfsd->nd_nam;
  535         caddr_t dpos = nfsd->nd_dpos;
  536         struct ucred *cred = nfsd->nd_cr;
  537         struct nfs_fattr *fp;
  538         struct nameidata nd, ind, *ndp = &nd;
  539         struct vnode *vp, *dirp = NULL;
  540         nfsfh_t nfh;
  541         fhandle_t *fhp;
  542         caddr_t bpos;
  543         int error = 0, len, dirattr_ret = 1;
  544         int v3 = (nfsd->nd_flag & ND_NFSV3), pubflag;
  545         struct mbuf *mb, *mreq;
  546         struct vattr va, dirattr, *vap = &va;
  547         int tvfslocked;
  548         int vfslocked;
  549 
  550         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
  551         ndclear(&nd);
  552         vfslocked = 0;
  553 
  554         fhp = &nfh.fh_generic;
  555         nfsm_srvmtofh(fhp);
  556         nfsm_srvnamesiz(len);
  557 
  558         pubflag = nfs_ispublicfh(fhp);
  559 
  560         nd.ni_cnd.cn_cred = cred;
  561         nd.ni_cnd.cn_nameiop = LOOKUP;
  562         nd.ni_cnd.cn_flags = LOCKLEAF | SAVESTART | MPSAFE;
  563         error = nfs_namei(&nd, nfsd, fhp, len, slp, nam, &md, &dpos,
  564                 &dirp, v3, &dirattr, &dirattr_ret, pubflag);
  565         vfslocked = NDHASGIANT(&nd);
  566 
  567         /*
  568          * namei failure, only dirp to cleanup.  Clear out garbarge from
  569          * structure in case macros jump to nfsmout.
  570          */
  571 
  572         if (error) {
  573                 if (dirp) {
  574                         vrele(dirp);
  575                         dirp = NULL;
  576                 }
  577                 nfsm_reply(NFSX_POSTOPATTR(v3));
  578                 if (v3)
  579                         nfsm_srvpostop_attr(dirattr_ret, &dirattr);
  580                 error = 0;
  581                 goto nfsmout;
  582         }
  583 
  584         /*
  585          * Locate index file for public filehandle
  586          *
  587          * error is 0 on entry and 0 on exit from this block.
  588          */
  589 
  590         if (pubflag) {
  591                 if (nd.ni_vp->v_type == VDIR && nfs_pub.np_index != NULL) {
  592                         /*
  593                          * Setup call to lookup() to see if we can find
  594                          * the index file. Arguably, this doesn't belong
  595                          * in a kernel.. Ugh.  If an error occurs, do not
  596                          * try to install an index file and then clear the
  597                          * error.
  598                          *
  599                          * When we replace nd with ind and redirect ndp,
  600                          * maintenance of ni_startdir and ni_vp shift to
  601                          * ind and we have to clean them up in the old nd.
  602                          * However, the cnd resource continues to be maintained
  603                          * via the original nd.  Confused?  You aren't alone!
  604                          */
  605                         ind = nd;
  606                         VOP_UNLOCK(nd.ni_vp, 0);
  607                         ind.ni_pathlen = strlen(nfs_pub.np_index);
  608                         ind.ni_cnd.cn_nameptr = ind.ni_cnd.cn_pnbuf =
  609                             nfs_pub.np_index;
  610                         ind.ni_startdir = nd.ni_vp;
  611                         VREF(ind.ni_startdir);
  612                         ind.ni_cnd.cn_flags &= ~GIANTHELD;
  613                         tvfslocked = VFS_LOCK_GIANT(ind.ni_startdir->v_mount);
  614                         if (tvfslocked)
  615                                 nd.ni_cnd.cn_flags |= GIANTHELD;
  616                         error = lookup(&ind);
  617                         ind.ni_dvp = NULL;
  618                         vfslocked = nfsrv_lockedpair_nd(vfslocked, &ind);
  619                         ind.ni_cnd.cn_flags &= ~GIANTHELD;
  620 
  621                         if (error == 0) {
  622                                 /*
  623                                  * Found an index file. Get rid of
  624                                  * the old references.  transfer nd.ni_vp'
  625                                  */
  626                                 if (dirp)
  627                                         vrele(dirp);
  628                                 dirp = nd.ni_vp;
  629                                 nd.ni_vp = NULL;
  630                                 vrele(nd.ni_startdir);
  631                                 nd.ni_startdir = NULL;
  632                                 ndp = &ind;
  633                         }
  634                         error = 0;
  635                 }
  636                 /*
  637                  * If the public filehandle was used, check that this lookup
  638                  * didn't result in a filehandle outside the publicly exported
  639                  * filesystem.  We clear the poor vp here to avoid lockups due
  640                  * to NFS I/O.
  641                  */
  642 
  643                 if (ndp->ni_vp->v_mount != nfs_pub.np_mount) {
  644                         vput(nd.ni_vp);
  645                         nd.ni_vp = NULL;
  646                         error = EPERM;
  647                 }
  648         }
  649 
  650         /*
  651          * Resources at this point:
  652          *      ndp->ni_vp      may not be NULL
  653          */
  654 
  655         if (error) {
  656                 nfsm_reply(NFSX_POSTOPATTR(v3));
  657                 if (v3)
  658                         nfsm_srvpostop_attr(dirattr_ret, &dirattr);
  659                 error = 0;
  660                 goto nfsmout;
  661         }
  662 
  663         /*
  664          * Get underlying attribute, then release remaining resources ( for
  665          * the same potential blocking reason ) and reply.
  666          */
  667         vp = ndp->ni_vp;
  668         bzero((caddr_t)fhp, sizeof(nfh));
  669         fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
  670         error = VOP_VPTOFH(vp, &fhp->fh_fid);
  671         if (!error)
  672                 error = VOP_GETATTR(vp, vap, cred);
  673 
  674         vput(vp);
  675         vrele(ndp->ni_startdir);
  676         vrele(dirp);
  677         ndp->ni_vp = NULL;
  678         ndp->ni_startdir = NULL;
  679         dirp = NULL;
  680         nfsm_reply(NFSX_SRVFH(v3) + NFSX_POSTOPORFATTR(v3) + NFSX_POSTOPATTR(v3));
  681         if (error) {
  682                 if (v3)
  683                         nfsm_srvpostop_attr(dirattr_ret, &dirattr);
  684                 error = 0;
  685                 goto nfsmout;
  686         }
  687         nfsm_srvfhtom(fhp, v3);
  688         if (v3) {
  689                 nfsm_srvpostop_attr(0, vap);
  690                 nfsm_srvpostop_attr(dirattr_ret, &dirattr);
  691         } else {
  692                 fp = nfsm_build(struct nfs_fattr *, NFSX_V2FATTR);
  693                 nfsm_srvfillattr(vap, fp);
  694         }
  695 
  696 nfsmout:
  697         if (ndp->ni_vp || dirp || ndp->ni_startdir) {
  698                 if (ndp->ni_vp)
  699                         vput(ndp->ni_vp);
  700                 if (dirp)
  701                         vrele(dirp);
  702                 if (ndp->ni_startdir)
  703                         vrele(ndp->ni_startdir);
  704         }
  705         NDFREE(&nd, NDF_ONLY_PNBUF);
  706         VFS_UNLOCK_GIANT(vfslocked);
  707         return (error);
  708 }
  709 
  710 /*
  711  * nfs readlink service
  712  */
  713 int
  714 nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
  715     struct mbuf **mrq)
  716 {
  717         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
  718         struct sockaddr *nam = nfsd->nd_nam;
  719         caddr_t dpos = nfsd->nd_dpos;
  720         struct ucred *cred = nfsd->nd_cr;
  721         struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
  722         struct iovec *ivp = iv;
  723         struct mbuf *mp;
  724         u_int32_t *tl;
  725         caddr_t bpos;
  726         int error = 0, rdonly, i, tlen, len, getret;
  727         int v3 = (nfsd->nd_flag & ND_NFSV3);
  728         struct mbuf *mb, *mp3, *nmp, *mreq;
  729         struct vnode *vp = NULL;
  730         struct vattr attr;
  731         nfsfh_t nfh;
  732         fhandle_t *fhp;
  733         struct uio io, *uiop = &io;
  734         int vfslocked;
  735 
  736         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
  737         vfslocked = 0;
  738 #ifndef nolint
  739         mp = NULL;
  740 #endif
  741         mp3 = NULL;
  742         fhp = &nfh.fh_generic;
  743         nfsm_srvmtofh(fhp);
  744         len = 0;
  745         i = 0;
  746         while (len < NFS_MAXPATHLEN) {
  747                 MGET(nmp, M_WAIT, MT_DATA);
  748                 MCLGET(nmp, M_WAIT);
  749                 nmp->m_len = NFSMSIZ(nmp);
  750                 if (len == 0)
  751                         mp3 = mp = nmp;
  752                 else {
  753                         mp->m_next = nmp;
  754                         mp = nmp;
  755                 }
  756                 if ((len + mp->m_len) > NFS_MAXPATHLEN) {
  757                         mp->m_len = NFS_MAXPATHLEN - len;
  758                         len = NFS_MAXPATHLEN;
  759                 } else
  760                         len += mp->m_len;
  761                 ivp->iov_base = mtod(mp, caddr_t);
  762                 ivp->iov_len = mp->m_len;
  763                 i++;
  764                 ivp++;
  765         }
  766         uiop->uio_iov = iv;
  767         uiop->uio_iovcnt = i;
  768         uiop->uio_offset = 0;
  769         uiop->uio_resid = len;
  770         uiop->uio_rw = UIO_READ;
  771         uiop->uio_segflg = UIO_SYSSPACE;
  772         uiop->uio_td = NULL;
  773         error = nfsrv_fhtovp(fhp, 0, &vp, &vfslocked, nfsd, slp, nam, &rdonly);
  774         if (error) {
  775                 nfsm_reply(2 * NFSX_UNSIGNED);
  776                 if (v3)
  777                         nfsm_srvpostop_attr(1, NULL);
  778                 error = 0;
  779                 goto nfsmout;
  780         }
  781         if (vp->v_type != VLNK) {
  782                 if (v3)
  783                         error = EINVAL;
  784                 else
  785                         error = ENXIO;
  786         } else 
  787                 error = VOP_READLINK(vp, uiop, cred);
  788         getret = VOP_GETATTR(vp, &attr, cred);
  789         vput(vp);
  790         vp = NULL;
  791         nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_UNSIGNED);
  792         if (v3)
  793                 nfsm_srvpostop_attr(getret, &attr);
  794         if (error) {
  795                 error = 0;
  796                 goto nfsmout;
  797         }
  798         if (uiop->uio_resid > 0) {
  799                 len -= uiop->uio_resid;
  800                 tlen = nfsm_rndup(len);
  801                 nfsm_adj(mp3, NFS_MAXPATHLEN-tlen, tlen-len);
  802         }
  803         tl = nfsm_build(u_int32_t *, NFSX_UNSIGNED);
  804         *tl = txdr_unsigned(len);
  805         mb->m_next = mp3;
  806         mp3 = NULL;
  807 nfsmout:
  808         if (mp3)
  809                 m_freem(mp3);
  810         if (vp)
  811                 vput(vp);
  812         VFS_UNLOCK_GIANT(vfslocked);
  813         return(error);
  814 }
  815 
  816 /*
  817  * nfs read service
  818  */
  819 int
  820 nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
  821     struct mbuf **mrq)
  822 {
  823         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
  824         struct sockaddr *nam = nfsd->nd_nam;
  825         caddr_t dpos = nfsd->nd_dpos;
  826         struct ucred *cred = nfsd->nd_cr;
  827         struct iovec *iv;
  828         struct iovec *iv2;
  829         struct mbuf *m;
  830         struct nfs_fattr *fp;
  831         u_int32_t *tl;
  832         int i;
  833         caddr_t bpos;
  834         int error = 0, rdonly, cnt, len, left, siz, tlen, getret;
  835         int v3 = (nfsd->nd_flag & ND_NFSV3), reqlen;
  836         struct mbuf *mb, *mreq;
  837         struct mbuf *m2;
  838         struct vnode *vp = NULL;
  839         nfsfh_t nfh;
  840         fhandle_t *fhp;
  841         struct uio io, *uiop = &io;
  842         struct vattr va, *vap = &va;
  843         struct nfsheur *nh;
  844         off_t off;
  845         int ioflag = 0;
  846         int vfslocked;
  847 
  848 
  849         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
  850         vfslocked = 0;
  851         fhp = &nfh.fh_generic;
  852         nfsm_srvmtofh(fhp);
  853         if (v3) {
  854                 tl = nfsm_dissect_nonblock(u_int32_t *, 2 * NFSX_UNSIGNED);
  855                 off = fxdr_hyper(tl);
  856         } else {
  857                 tl = nfsm_dissect_nonblock(u_int32_t *, NFSX_UNSIGNED);
  858                 off = (off_t)fxdr_unsigned(u_int32_t, *tl);
  859         }
  860         nfsm_srvstrsiz(reqlen, NFS_SRVMAXDATA(nfsd));
  861 
  862         /*
  863          * Reference vp.  If an error occurs, vp will be invalid, but we
  864          * have to NULL it just in case.  The macros might goto nfsmout
  865          * as well.
  866          */
  867 
  868         error = nfsrv_fhtovp(fhp, 0, &vp, &vfslocked, nfsd, slp, nam, &rdonly);
  869         if (error) {
  870                 vp = NULL;
  871                 nfsm_reply(2 * NFSX_UNSIGNED);
  872                 if (v3)
  873                         nfsm_srvpostop_attr(1, NULL);
  874                 error = 0;
  875                 goto nfsmout;
  876         }
  877 
  878         if (vp->v_type != VREG) {
  879                 if (v3)
  880                         error = EINVAL;
  881                 else
  882                         error = (vp->v_type == VDIR) ? EISDIR : EACCES;
  883         }
  884         if (!error) {
  885                 if ((error = nfsrv_access(vp, VREAD, cred, rdonly, 1)) != 0)
  886                         error = nfsrv_access(vp, VEXEC, cred, rdonly, 1);
  887         }
  888         getret = VOP_GETATTR(vp, vap, cred);
  889         if (!error)
  890                 error = getret;
  891         if (error) {
  892                 vput(vp);
  893                 vp = NULL;
  894                 nfsm_reply(NFSX_POSTOPATTR(v3));
  895                 if (v3)
  896                         nfsm_srvpostop_attr(getret, vap);
  897                 error = 0;
  898                 goto nfsmout;
  899         }
  900 
  901         /*
  902          * Calculate byte count to read
  903          */
  904         if (off >= vap->va_size)
  905                 cnt = 0;
  906         else if ((off + reqlen) > vap->va_size)
  907                 cnt = vap->va_size - off;
  908         else
  909                 cnt = reqlen;
  910 
  911         nfsm_reply(NFSX_POSTOPORFATTR(v3) + 3 * NFSX_UNSIGNED+nfsm_rndup(cnt));
  912         if (v3) {
  913                 tl = nfsm_build(u_int32_t *, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
  914                 *tl++ = nfsrv_nfs_true;
  915                 fp = (struct nfs_fattr *)tl;
  916                 tl += (NFSX_V3FATTR / sizeof (u_int32_t));
  917         } else {
  918                 tl = nfsm_build(u_int32_t *, NFSX_V2FATTR + NFSX_UNSIGNED);
  919                 fp = (struct nfs_fattr *)tl;
  920                 tl += (NFSX_V2FATTR / sizeof (u_int32_t));
  921         }
  922         len = left = nfsm_rndup(cnt);
  923         if (cnt > 0) {
  924                 /*
  925                  * Generate the mbuf list with the uio_iov ref. to it.
  926                  */
  927                 i = 0;
  928                 m = m2 = mb;
  929                 while (left > 0) {
  930                         siz = min(M_TRAILINGSPACE(m), left);
  931                         if (siz > 0) {
  932                                 left -= siz;
  933                                 i++;
  934                         }
  935                         if (left > 0) {
  936                                 MGET(m, M_WAIT, MT_DATA);
  937                                 MCLGET(m, M_WAIT);
  938                                 m->m_len = 0;
  939                                 m2->m_next = m;
  940                                 m2 = m;
  941                         }
  942                 }
  943                 iv = malloc(i * sizeof (struct iovec),
  944                        M_TEMP, M_WAITOK);
  945                 uiop->uio_iov = iv2 = iv;
  946                 m = mb;
  947                 left = len;
  948                 i = 0;
  949                 while (left > 0) {
  950                         if (m == NULL)
  951                                 panic("nfsrv_read iov");
  952                         siz = min(M_TRAILINGSPACE(m), left);
  953                         if (siz > 0) {
  954                                 iv->iov_base = mtod(m, caddr_t) + m->m_len;
  955                                 iv->iov_len = siz;
  956                                 m->m_len += siz;
  957                                 left -= siz;
  958                                 iv++;
  959                                 i++;
  960                         }
  961                         m = m->m_next;
  962                 }
  963                 uiop->uio_iovcnt = i;
  964                 uiop->uio_offset = off;
  965                 uiop->uio_resid = len;
  966                 uiop->uio_rw = UIO_READ;
  967                 uiop->uio_segflg = UIO_SYSSPACE;
  968                 nh = nfsrv_sequential_heuristic(uiop, vp);
  969                 ioflag |= nh->nh_seqcount << IO_SEQSHIFT;
  970                 error = VOP_READ(vp, uiop, IO_NODELOCKED | ioflag, cred);
  971                 if (error == 0)
  972                         nh->nh_nextoff = uiop->uio_offset;
  973                 free((caddr_t)iv2, M_TEMP);
  974                 if (error || (getret = VOP_GETATTR(vp, vap, cred))) {
  975                         if (!error)
  976                                 error = getret;
  977                         m_freem(mreq);
  978                         vput(vp);
  979                         vp = NULL;
  980                         nfsm_reply(NFSX_POSTOPATTR(v3));
  981                         if (v3)
  982                                 nfsm_srvpostop_attr(getret, vap);
  983                         error = 0;
  984                         goto nfsmout;
  985                 }
  986         } else
  987                 uiop->uio_resid = 0;
  988         vput(vp);
  989         vp = NULL;
  990         nfsm_srvfillattr(vap, fp);
  991         tlen = len - uiop->uio_resid;
  992         cnt = cnt < tlen ? cnt : tlen;
  993         tlen = nfsm_rndup(cnt);
  994         if (len != tlen || tlen != cnt)
  995                 nfsm_adj(mb, len - tlen, tlen - cnt);
  996         if (v3) {
  997                 *tl++ = txdr_unsigned(cnt);
  998                 if (cnt < reqlen)
  999                         *tl++ = nfsrv_nfs_true;
 1000                 else
 1001                         *tl++ = nfsrv_nfs_false;
 1002         }
 1003         *tl = txdr_unsigned(cnt);
 1004 nfsmout:
 1005         if (vp)
 1006                 vput(vp);
 1007         VFS_UNLOCK_GIANT(vfslocked);
 1008         return(error);
 1009 }
 1010 
 1011 /*
 1012  * nfs write service
 1013  */
 1014 int
 1015 nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 1016     struct mbuf **mrq)
 1017 {
 1018         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 1019         struct sockaddr *nam = nfsd->nd_nam;
 1020         caddr_t dpos = nfsd->nd_dpos;
 1021         struct ucred *cred = nfsd->nd_cr;
 1022         struct iovec *ivp;
 1023         int i, cnt;
 1024         struct mbuf *mp;
 1025         struct nfs_fattr *fp;
 1026         struct iovec *iv;
 1027         struct vattr va, forat;
 1028         struct vattr *vap = &va;
 1029         u_int32_t *tl;
 1030         caddr_t bpos;
 1031         int error = 0, rdonly, len, forat_ret = 1;
 1032         int ioflags, aftat_ret = 1, retlen = 0, zeroing, adjust;
 1033         int stable = NFSV3WRITE_FILESYNC;
 1034         int v3 = (nfsd->nd_flag & ND_NFSV3);
 1035         struct mbuf *mb, *mreq;
 1036         struct vnode *vp = NULL;
 1037         struct nfsheur *nh;
 1038         nfsfh_t nfh;
 1039         fhandle_t *fhp;
 1040         struct uio io, *uiop = &io;
 1041         off_t off;
 1042         struct mount *mntp = NULL;
 1043         int tvfslocked;
 1044         int vfslocked;
 1045 
 1046         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 1047         vfslocked = 0;
 1048         if (mrep == NULL) {
 1049                 *mrq = NULL;
 1050                 error = 0;
 1051                 goto nfsmout;
 1052         }
 1053         fhp = &nfh.fh_generic;
 1054         nfsm_srvmtofh(fhp);
 1055         if ((mntp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
 1056                 error = ESTALE;
 1057                 goto ereply;
 1058         }
 1059         vfslocked = VFS_LOCK_GIANT(mntp);
 1060         (void) vn_start_write(NULL, &mntp, V_WAIT);
 1061         vfs_rel(mntp);          /* The write holds a ref. */
 1062         if (v3) {
 1063                 tl = nfsm_dissect_nonblock(u_int32_t *, 5 * NFSX_UNSIGNED);
 1064                 off = fxdr_hyper(tl);
 1065                 tl += 3;
 1066                 stable = fxdr_unsigned(int, *tl++);
 1067         } else {
 1068                 tl = nfsm_dissect_nonblock(u_int32_t *, 4 * NFSX_UNSIGNED);
 1069                 off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
 1070                 tl += 2;
 1071                 if (nfs_async)
 1072                         stable = NFSV3WRITE_UNSTABLE;
 1073         }
 1074         retlen = len = fxdr_unsigned(int32_t, *tl);
 1075         cnt = i = 0;
 1076 
 1077         /*
 1078          * For NFS Version 2, it is not obvious what a write of zero length
 1079          * should do, but I might as well be consistent with Version 3,
 1080          * which is to return ok so long as there are no permission problems.
 1081          */
 1082         if (len > 0) {
 1083             zeroing = 1;
 1084             mp = mrep;
 1085             while (mp) {
 1086                 if (mp == md) {
 1087                         zeroing = 0;
 1088                         adjust = dpos - mtod(mp, caddr_t);
 1089                         mp->m_len -= adjust;
 1090                         if (mp->m_len > 0 && adjust > 0)
 1091                                 mp->m_data += adjust;
 1092                 }
 1093                 if (zeroing)
 1094                         mp->m_len = 0;
 1095                 else if (mp->m_len > 0) {
 1096                         i += mp->m_len;
 1097                         if (i > len) {
 1098                                 mp->m_len -= (i - len);
 1099                                 zeroing = 1;
 1100                         }
 1101                         if (mp->m_len > 0)
 1102                                 cnt++;
 1103                 }
 1104                 mp = mp->m_next;
 1105             }
 1106         }
 1107         if (len > NFS_MAXDATA || len < 0 || i < len) {
 1108                 error = EIO;
 1109                 nfsm_reply(2 * NFSX_UNSIGNED);
 1110                 if (v3)
 1111                         nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, vap);
 1112                 error = 0;
 1113                 goto nfsmout;
 1114         }
 1115         error = nfsrv_fhtovp(fhp, 0, &vp, &tvfslocked, nfsd, slp, nam, &rdonly);
 1116         vfslocked = nfsrv_lockedpair(vfslocked, tvfslocked);
 1117         if (error) {
 1118                 vp = NULL;
 1119                 nfsm_reply(2 * NFSX_UNSIGNED);
 1120                 if (v3)
 1121                         nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, vap);
 1122                 error = 0;
 1123                 goto nfsmout;
 1124         }
 1125         if (v3)
 1126                 forat_ret = VOP_GETATTR(vp, &forat, cred);
 1127         if (vp->v_type != VREG) {
 1128                 if (v3)
 1129                         error = EINVAL;
 1130                 else
 1131                         error = (vp->v_type == VDIR) ? EISDIR : EACCES;
 1132         }
 1133         if (!error)
 1134                 error = nfsrv_access(vp, VWRITE, cred, rdonly, 1);
 1135         if (error) {
 1136                 vput(vp);
 1137                 vp = NULL;
 1138                 nfsm_reply(NFSX_WCCDATA(v3));
 1139                 if (v3)
 1140                         nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, vap);
 1141                 error = 0;
 1142                 goto nfsmout;
 1143         }
 1144 
 1145         if (len > 0) {
 1146             ivp = malloc(cnt * sizeof (struct iovec), M_TEMP,
 1147                 M_WAITOK);
 1148             uiop->uio_iov = iv = ivp;
 1149             uiop->uio_iovcnt = cnt;
 1150             mp = mrep;
 1151             while (mp) {
 1152                 if (mp->m_len > 0) {
 1153                         ivp->iov_base = mtod(mp, caddr_t);
 1154                         ivp->iov_len = mp->m_len;
 1155                         ivp++;
 1156                 }
 1157                 mp = mp->m_next;
 1158             }
 1159 
 1160             /*
 1161              * XXX
 1162              * The IO_METASYNC flag indicates that all metadata (and not just
 1163              * enough to ensure data integrity) mus be written to stable storage
 1164              * synchronously.
 1165              * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
 1166              */
 1167             if (stable == NFSV3WRITE_UNSTABLE)
 1168                 ioflags = IO_NODELOCKED;
 1169             else if (stable == NFSV3WRITE_DATASYNC)
 1170                 ioflags = (IO_SYNC | IO_NODELOCKED);
 1171             else
 1172                 ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
 1173             uiop->uio_resid = len;
 1174             uiop->uio_rw = UIO_WRITE;
 1175             uiop->uio_segflg = UIO_SYSSPACE;
 1176             uiop->uio_td = NULL;
 1177             uiop->uio_offset = off;
 1178             nh = nfsrv_sequential_heuristic(uiop, vp);
 1179             ioflags |= nh->nh_seqcount << IO_SEQSHIFT;
 1180             error = VOP_WRITE(vp, uiop, ioflags, cred);
 1181             if (error == 0)
 1182                     nh->nh_nextoff = uiop->uio_offset;
 1183             /* Unlocked write. */
 1184             nfsrvstats.srvvop_writes++;
 1185             free((caddr_t)iv, M_TEMP);
 1186         }
 1187         aftat_ret = VOP_GETATTR(vp, vap, cred);
 1188         vput(vp);
 1189         vp = NULL;
 1190         if (!error)
 1191                 error = aftat_ret;
 1192 ereply:
 1193         nfsm_reply(NFSX_PREOPATTR(v3) + NFSX_POSTOPORFATTR(v3) +
 1194                 2 * NFSX_UNSIGNED + NFSX_WRITEVERF(v3));
 1195         if (v3) {
 1196                 nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, vap);
 1197                 if (error) {
 1198                         error = 0;
 1199                         goto nfsmout;
 1200                 }
 1201                 tl = nfsm_build(u_int32_t *, 4 * NFSX_UNSIGNED);
 1202                 *tl++ = txdr_unsigned(retlen);
 1203                 /*
 1204                  * If nfs_async is set, then pretend the write was FILESYNC.
 1205                  */
 1206                 if (stable == NFSV3WRITE_UNSTABLE && !nfs_async)
 1207                         *tl++ = txdr_unsigned(stable);
 1208                 else
 1209                         *tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
 1210                 /*
 1211                  * Actually, there is no need to txdr these fields,
 1212                  * but it may make the values more human readable,
 1213                  * for debugging purposes.
 1214                  */
 1215                 if (nfsver.tv_sec == 0)
 1216                         nfsver = boottime;
 1217                 *tl++ = txdr_unsigned(nfsver.tv_sec);
 1218                 *tl = txdr_unsigned(nfsver.tv_usec);
 1219         } else if (!error) {
 1220                 /* v2 non-error case. */
 1221                 fp = nfsm_build(struct nfs_fattr *, NFSX_V2FATTR);
 1222                 nfsm_srvfillattr(vap, fp);
 1223         }
 1224         error = 0;
 1225 nfsmout:
 1226         if (vp)
 1227                 vput(vp);
 1228         vn_finished_write(mntp);
 1229         VFS_UNLOCK_GIANT(vfslocked);
 1230         return(error);
 1231 }
 1232 
 1233 /*
 1234  * nfs create service
 1235  * now does a truncate to 0 length via. setattr if it already exists
 1236  */
 1237 int
 1238 nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 1239     struct mbuf **mrq)
 1240 {
 1241         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 1242         struct sockaddr *nam = nfsd->nd_nam;
 1243         caddr_t dpos = nfsd->nd_dpos;
 1244         struct ucred *cred = nfsd->nd_cr;
 1245         struct nfs_fattr *fp;
 1246         struct vattr va, dirfor, diraft;
 1247         struct vattr *vap = &va;
 1248         struct nfsv2_sattr *sp;
 1249         u_int32_t *tl;
 1250         struct nameidata nd;
 1251         caddr_t bpos;
 1252         int error = 0, rdev, len, tsize, dirfor_ret = 1, diraft_ret = 1;
 1253         int v3 = (nfsd->nd_flag & ND_NFSV3), how, exclusive_flag = 0;
 1254         struct mbuf *mb, *mreq;
 1255         struct vnode *dirp = NULL;
 1256         nfsfh_t nfh;
 1257         fhandle_t *fhp;
 1258         u_quad_t tempsize;
 1259         struct timespec cverf;
 1260         struct mount *mp = NULL;
 1261         int tvfslocked;
 1262         int vfslocked;
 1263 
 1264         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 1265         vfslocked = 0;
 1266 #ifndef nolint
 1267         rdev = 0;
 1268 #endif
 1269         ndclear(&nd);
 1270 
 1271         fhp = &nfh.fh_generic;
 1272         nfsm_srvmtofh(fhp);
 1273         if ((mp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
 1274                 error = ESTALE;
 1275                 goto ereply;
 1276         }
 1277         vfslocked = VFS_LOCK_GIANT(mp);
 1278         (void) vn_start_write(NULL, &mp, V_WAIT);
 1279         vfs_rel(mp);            /* The write holds a ref. */
 1280         nfsm_srvnamesiz(len);
 1281 
 1282         nd.ni_cnd.cn_cred = cred;
 1283         nd.ni_cnd.cn_nameiop = CREATE;
 1284         nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | SAVESTART | MPSAFE;
 1285 
 1286         /*
 1287          * Call namei and do initial cleanup to get a few things
 1288          * out of the way.  If we get an initial error we cleanup
 1289          * and return here to avoid special-casing the invalid nd
 1290          * structure through the rest of the case.  dirp may be
 1291          * set even if an error occurs, but the nd structure will not
 1292          * be valid at all if an error occurs so we have to invalidate it
 1293          * prior to calling nfsm_reply ( which might goto nfsmout ).
 1294          */
 1295         error = nfs_namei(&nd, nfsd, fhp, len, slp, nam, &md, &dpos,
 1296                 &dirp, v3, &dirfor, &dirfor_ret, FALSE);
 1297         vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 1298         if (dirp && !v3) {
 1299                 vrele(dirp);
 1300                 dirp = NULL;
 1301         }
 1302         if (error) {
 1303                 nfsm_reply(NFSX_WCCDATA(v3));
 1304                 if (v3)
 1305                         nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 1306                 error = 0;
 1307                 goto nfsmout;
 1308         }
 1309 
 1310         /*
 1311          * No error.  Continue.  State:
 1312          *
 1313          *      startdir        is valid ( we release this immediately )
 1314          *      dirp            may be valid
 1315          *      nd.ni_vp        may be valid
 1316          *      nd.ni_dvp       is valid
 1317          *
 1318          * The error state is set through the code and we may also do some
 1319          * opportunistic releasing of vnodes to avoid holding locks through
 1320          * NFS I/O.  The cleanup at the end is a catch-all
 1321          */
 1322 
 1323         VATTR_NULL(vap);
 1324         if (v3) {
 1325                 tl = nfsm_dissect_nonblock(u_int32_t *, NFSX_UNSIGNED);
 1326                 how = fxdr_unsigned(int, *tl);
 1327                 switch (how) {
 1328                 case NFSV3CREATE_GUARDED:
 1329                         if (nd.ni_vp) {
 1330                                 error = EEXIST;
 1331                                 break;
 1332                         }
 1333                         /* fall through */
 1334                 case NFSV3CREATE_UNCHECKED:
 1335                         nfsm_srvsattr(vap);
 1336                         break;
 1337                 case NFSV3CREATE_EXCLUSIVE:
 1338                         tl = nfsm_dissect_nonblock(u_int32_t *,
 1339                             NFSX_V3CREATEVERF);
 1340                         /* Unique bytes, endianness is not important. */
 1341                         cverf.tv_sec  = (int32_t)tl[0];
 1342                         cverf.tv_nsec = tl[1];
 1343                         exclusive_flag = 1;
 1344                         break;
 1345                 };
 1346                 vap->va_type = VREG;
 1347         } else {
 1348                 sp = nfsm_dissect_nonblock(struct nfsv2_sattr *, NFSX_V2SATTR);
 1349                 vap->va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
 1350                 if (vap->va_type == VNON)
 1351                         vap->va_type = VREG;
 1352                 vap->va_mode = nfstov_mode(sp->sa_mode);
 1353                 switch (vap->va_type) {
 1354                 case VREG:
 1355                         tsize = fxdr_unsigned(int32_t, sp->sa_size);
 1356                         if (tsize != -1)
 1357                                 vap->va_size = (u_quad_t)tsize;
 1358                         break;
 1359                 case VCHR:
 1360                 case VBLK:
 1361                 case VFIFO:
 1362                         rdev = fxdr_unsigned(long, sp->sa_size);
 1363                         break;
 1364                 default:
 1365                         break;
 1366                 };
 1367         }
 1368 
 1369         /*
 1370          * Iff doesn't exist, create it
 1371          * otherwise just truncate to 0 length
 1372          *   should I set the mode too ?
 1373          *
 1374          * The only possible error we can have at this point is EEXIST.
 1375          * nd.ni_vp will also be non-NULL in that case.
 1376          */
 1377         if (nd.ni_vp == NULL) {
 1378                 if (vap->va_mode == (mode_t)VNOVAL)
 1379                         vap->va_mode = 0;
 1380                 if (vap->va_type == VREG || vap->va_type == VSOCK) {
 1381                         error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap);
 1382                         if (error)
 1383                                 NDFREE(&nd, NDF_ONLY_PNBUF);
 1384                         else {
 1385                                 if (exclusive_flag) {
 1386                                         exclusive_flag = 0;
 1387                                         VATTR_NULL(vap);
 1388                                         vap->va_atime = cverf;
 1389                                         error = VOP_SETATTR(nd.ni_vp, vap,
 1390                                             cred);
 1391                                 }
 1392                         }
 1393                 } else if (vap->va_type == VCHR || vap->va_type == VBLK ||
 1394                     vap->va_type == VFIFO) {
 1395                         /*
 1396                          * NFSv2-specific code for creating device nodes
 1397                          * and fifos.
 1398                          *
 1399                          * Handle SysV FIFO node special cases.  All other
 1400                          * devices require super user to access.
 1401                          */
 1402                         if (vap->va_type == VCHR && rdev == 0xffffffff)
 1403                                 vap->va_type = VFIFO;
 1404                         if (vap->va_type != VFIFO &&
 1405                             (error = priv_check_cred(cred, PRIV_VFS_MKNOD_DEV,
 1406                             0))) {
 1407                                 goto ereply;
 1408                         }
 1409                         vap->va_rdev = rdev;
 1410                         error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap);
 1411                         if (error) {
 1412                                 NDFREE(&nd, NDF_ONLY_PNBUF);
 1413                                 goto ereply;
 1414                         }
 1415                         vput(nd.ni_vp);
 1416                         nd.ni_vp = NULL;
 1417 
 1418                         /*
 1419                          * release dvp prior to lookup
 1420                          */
 1421                         vput(nd.ni_dvp);
 1422                         nd.ni_dvp = NULL;
 1423                         /*
 1424                          * Setup for lookup.
 1425                          *
 1426                          * Even though LOCKPARENT was cleared, ni_dvp may
 1427                          * be garbage.
 1428                          */
 1429                         nd.ni_cnd.cn_nameiop = LOOKUP;
 1430                         nd.ni_cnd.cn_flags &= ~(LOCKPARENT);
 1431                         nd.ni_cnd.cn_thread = curthread;
 1432                         nd.ni_cnd.cn_cred = cred;
 1433                         tvfslocked = VFS_LOCK_GIANT(nd.ni_startdir->v_mount);
 1434                         if (tvfslocked)
 1435                                 nd.ni_cnd.cn_flags |= GIANTHELD;
 1436                         error = lookup(&nd);
 1437                         nd.ni_dvp = NULL;
 1438                         vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 1439                         nd.ni_cnd.cn_flags &= ~GIANTHELD;
 1440                         if (error)
 1441                                 goto ereply;
 1442 
 1443                         if (nd.ni_cnd.cn_flags & ISSYMLINK) {
 1444                                 error = EINVAL;
 1445                                 goto ereply;
 1446                         }
 1447                 } else {
 1448                         error = ENXIO;
 1449                 }
 1450         } else {
 1451                 if (vap->va_size != -1) {
 1452                         error = nfsrv_access(nd.ni_vp, VWRITE,
 1453                             cred, (nd.ni_cnd.cn_flags & RDONLY), 0);
 1454                         if (!error) {
 1455                                 tempsize = vap->va_size;
 1456                                 VATTR_NULL(vap);
 1457                                 vap->va_size = tempsize;
 1458                                 error = VOP_SETATTR(nd.ni_vp, vap, cred);
 1459                         }
 1460                 }
 1461         }
 1462 
 1463         if (!error) {
 1464                 bzero((caddr_t)fhp, sizeof(nfh));
 1465                 fhp->fh_fsid = nd.ni_vp->v_mount->mnt_stat.f_fsid;
 1466                 error = VOP_VPTOFH(nd.ni_vp, &fhp->fh_fid);
 1467                 if (!error)
 1468                         error = VOP_GETATTR(nd.ni_vp, vap, cred);
 1469         }
 1470         if (v3) {
 1471                 if (exclusive_flag && !error &&
 1472                     bcmp(&cverf, &vap->va_atime, sizeof (cverf)))
 1473                         error = EEXIST;
 1474                 if (dirp == nd.ni_dvp)
 1475                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 1476                 else {
 1477                         /* Drop the other locks to avoid deadlock. */
 1478                         if (nd.ni_dvp) {
 1479                                 if (nd.ni_dvp == nd.ni_vp)
 1480                                         vrele(nd.ni_dvp);
 1481                                 else
 1482                                         vput(nd.ni_dvp);
 1483                         }
 1484                         if (nd.ni_vp)
 1485                                 vput(nd.ni_vp);
 1486                         nd.ni_dvp = NULL;
 1487                         nd.ni_vp = NULL;
 1488 
 1489                         vn_lock(dirp, LK_EXCLUSIVE | LK_RETRY);
 1490                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 1491                         VOP_UNLOCK(dirp, 0);
 1492                 }
 1493         }
 1494 ereply:
 1495         nfsm_reply(NFSX_SRVFH(v3) + NFSX_FATTR(v3) + NFSX_WCCDATA(v3));
 1496         if (v3) {
 1497                 if (!error) {
 1498                         nfsm_srvpostop_fh(fhp);
 1499                         nfsm_srvpostop_attr(0, vap);
 1500                 }
 1501                 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 1502         } else if (!error) {
 1503                 /* v2 non-error case. */
 1504                 nfsm_srvfhtom(fhp, v3);
 1505                 fp = nfsm_build(struct nfs_fattr *, NFSX_V2FATTR);
 1506                 nfsm_srvfillattr(vap, fp);
 1507         }
 1508         error = 0;
 1509 
 1510 nfsmout:
 1511         if (nd.ni_dvp) {
 1512                 if (nd.ni_dvp == nd.ni_vp)
 1513                         vrele(nd.ni_dvp);
 1514                 else
 1515                         vput(nd.ni_dvp);
 1516         }
 1517         if (nd.ni_vp)
 1518                 vput(nd.ni_vp);
 1519         if (nd.ni_startdir) {
 1520                 vrele(nd.ni_startdir);
 1521                 nd.ni_startdir = NULL;
 1522         }
 1523         if (dirp)
 1524                 vrele(dirp);
 1525         NDFREE(&nd, NDF_ONLY_PNBUF);
 1526         vn_finished_write(mp);
 1527         VFS_UNLOCK_GIANT(vfslocked);
 1528         return (error);
 1529 }
 1530 
 1531 /*
 1532  * nfs v3 mknod service
 1533  */
 1534 int
 1535 nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 1536     struct mbuf **mrq)
 1537 {
 1538         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 1539         struct sockaddr *nam = nfsd->nd_nam;
 1540         caddr_t dpos = nfsd->nd_dpos;
 1541         struct ucred *cred = nfsd->nd_cr;
 1542         struct vattr va, dirfor, diraft;
 1543         struct vattr *vap = &va;
 1544         struct thread *td = curthread;
 1545         u_int32_t *tl;
 1546         struct nameidata nd;
 1547         caddr_t bpos;
 1548         int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
 1549         u_int32_t major, minor;
 1550         enum vtype vtyp;
 1551         struct mbuf *mb, *mreq;
 1552         struct vnode *vp, *dirp = NULL;
 1553         nfsfh_t nfh;
 1554         fhandle_t *fhp;
 1555         struct mount *mp = NULL;
 1556         int v3 = (nfsd->nd_flag & ND_NFSV3);
 1557         int tvfslocked;
 1558         int vfslocked;
 1559 
 1560         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 1561         vfslocked = 0;
 1562         if (!v3)
 1563                 panic("nfsrv_mknod: v3 proc called on a v2 connection");
 1564         ndclear(&nd);
 1565 
 1566         fhp = &nfh.fh_generic;
 1567         nfsm_srvmtofh(fhp);
 1568         if ((mp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
 1569                 error = ESTALE;
 1570                 goto ereply;
 1571         }
 1572         vfslocked = VFS_LOCK_GIANT(mp);
 1573         (void) vn_start_write(NULL, &mp, V_WAIT);
 1574         vfs_rel(mp);            /* The write holds a ref. */
 1575         nfsm_srvnamesiz(len);
 1576 
 1577         nd.ni_cnd.cn_cred = cred;
 1578         nd.ni_cnd.cn_nameiop = CREATE;
 1579         nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | SAVESTART | MPSAFE;
 1580 
 1581         /*
 1582          * Handle nfs_namei() call.  If an error occurs, the nd structure
 1583          * is not valid.  However, nfsm_*() routines may still jump to
 1584          * nfsmout.
 1585          */
 1586 
 1587         error = nfs_namei(&nd, nfsd, fhp, len, slp, nam, &md, &dpos,
 1588                 &dirp, v3, &dirfor, &dirfor_ret, FALSE);
 1589         vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 1590         if (error) {
 1591                 nfsm_reply(NFSX_WCCDATA(1));
 1592                 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 1593                 error = 0;
 1594                 goto nfsmout;
 1595         }
 1596         tl = nfsm_dissect_nonblock(u_int32_t *, NFSX_UNSIGNED);
 1597         vtyp = nfsv3tov_type(*tl);
 1598         if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
 1599                 error = NFSERR_BADTYPE;
 1600                 goto out;
 1601         }
 1602         VATTR_NULL(vap);
 1603         nfsm_srvsattr(vap);
 1604         if (vtyp == VCHR || vtyp == VBLK) {
 1605                 tl = nfsm_dissect_nonblock(u_int32_t *, 2 * NFSX_UNSIGNED);
 1606                 major = fxdr_unsigned(u_int32_t, *tl++);
 1607                 minor = fxdr_unsigned(u_int32_t, *tl);
 1608                 vap->va_rdev = makedev(major, minor);
 1609         }
 1610 
 1611         /*
 1612          * Iff doesn't exist, create it.
 1613          */
 1614         if (nd.ni_vp) {
 1615                 error = EEXIST;
 1616                 goto out;
 1617         }
 1618         vap->va_type = vtyp;
 1619         if (vap->va_mode == (mode_t)VNOVAL)
 1620                 vap->va_mode = 0;
 1621         if (vtyp == VSOCK) {
 1622                 vrele(nd.ni_startdir);
 1623                 nd.ni_startdir = NULL;
 1624                 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap);
 1625                 if (error)
 1626                         NDFREE(&nd, NDF_ONLY_PNBUF);
 1627         } else {
 1628                 if (vtyp != VFIFO && (error = priv_check_cred(cred,
 1629                     PRIV_VFS_MKNOD_DEV, 0)))
 1630                         goto out;
 1631                 error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap);
 1632                 if (error) {
 1633                         NDFREE(&nd, NDF_ONLY_PNBUF);
 1634                         goto out;
 1635                 }
 1636                 vput(nd.ni_vp);
 1637                 nd.ni_vp = NULL;
 1638 
 1639                 /*
 1640                  * Release dvp prior to lookup
 1641                  */
 1642                 vput(nd.ni_dvp);
 1643                 nd.ni_dvp = NULL;
 1644 
 1645                 nd.ni_cnd.cn_nameiop = LOOKUP;
 1646                 nd.ni_cnd.cn_flags &= ~(LOCKPARENT);
 1647                 nd.ni_cnd.cn_thread = td;
 1648                 nd.ni_cnd.cn_cred = td->td_ucred;
 1649                 tvfslocked = VFS_LOCK_GIANT(nd.ni_startdir->v_mount);
 1650                 if (tvfslocked)
 1651                         nd.ni_cnd.cn_flags |= GIANTHELD;
 1652                 error = lookup(&nd);
 1653                 nd.ni_dvp = NULL;
 1654                 vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 1655                 nd.ni_cnd.cn_flags &= ~GIANTHELD;
 1656 
 1657                 if (error)
 1658                         goto out;
 1659                 if (nd.ni_cnd.cn_flags & ISSYMLINK)
 1660                         error = EINVAL;
 1661         }
 1662 
 1663         /*
 1664          * send response, cleanup, return.
 1665          */
 1666 out:
 1667         vp = nd.ni_vp;
 1668         if (!error) {
 1669                 bzero((caddr_t)fhp, sizeof(nfh));
 1670                 fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
 1671                 error = VOP_VPTOFH(vp, &fhp->fh_fid);
 1672                 if (!error)
 1673                         error = VOP_GETATTR(vp, vap, cred);
 1674         }
 1675         if (nd.ni_dvp) {
 1676                 if (nd.ni_dvp == nd.ni_vp)
 1677                         vrele(nd.ni_dvp);
 1678                 else
 1679                         vput(nd.ni_dvp);
 1680                 nd.ni_dvp = NULL;
 1681         }
 1682         if (vp) {
 1683                 vput(vp);
 1684                 vp = NULL;
 1685                 nd.ni_vp = NULL;
 1686         }
 1687         if (nd.ni_startdir) {
 1688                 vrele(nd.ni_startdir);
 1689                 nd.ni_startdir = NULL;
 1690         }
 1691         NDFREE(&nd, NDF_ONLY_PNBUF);
 1692         if (dirp) {
 1693                 vn_lock(dirp, LK_EXCLUSIVE | LK_RETRY);
 1694                 diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 1695                 vput(dirp);
 1696         }
 1697 ereply:
 1698         nfsm_reply(NFSX_SRVFH(1) + NFSX_POSTOPATTR(1) + NFSX_WCCDATA(1));
 1699         if (v3) {
 1700                 if (!error) {
 1701                         nfsm_srvpostop_fh(fhp);
 1702                         nfsm_srvpostop_attr(0, vap);
 1703                 }
 1704                 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 1705         }
 1706         vn_finished_write(mp);
 1707         VFS_UNLOCK_GIANT(vfslocked);
 1708         return (0);
 1709 nfsmout:
 1710         if (nd.ni_dvp) {
 1711                 if (nd.ni_dvp == nd.ni_vp)
 1712                         vrele(nd.ni_dvp);
 1713                 else
 1714                         vput(nd.ni_dvp);
 1715         }
 1716         if (nd.ni_vp)
 1717                 vput(nd.ni_vp);
 1718         if (dirp)
 1719                 vrele(dirp);
 1720         if (nd.ni_startdir)
 1721                 vrele(nd.ni_startdir);
 1722         NDFREE(&nd, NDF_ONLY_PNBUF);
 1723         vn_finished_write(mp);
 1724         VFS_UNLOCK_GIANT(vfslocked);
 1725         return (error);
 1726 }
 1727 
 1728 /*
 1729  * nfs remove service
 1730  */
 1731 int
 1732 nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 1733     struct mbuf **mrq)
 1734 {
 1735         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 1736         struct sockaddr *nam = nfsd->nd_nam;
 1737         caddr_t dpos = nfsd->nd_dpos;
 1738         struct ucred *cred = nfsd->nd_cr;
 1739         struct nameidata nd;
 1740         caddr_t bpos;
 1741         int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
 1742         int v3 = (nfsd->nd_flag & ND_NFSV3);
 1743         struct mbuf *mb, *mreq;
 1744         struct vnode *dirp;
 1745         struct vattr dirfor, diraft;
 1746         nfsfh_t nfh;
 1747         fhandle_t *fhp;
 1748         struct mount *mp = NULL;
 1749         int vfslocked;
 1750 
 1751         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 1752         ndclear(&nd);
 1753         vfslocked = 0;
 1754 
 1755         fhp = &nfh.fh_generic;
 1756         nfsm_srvmtofh(fhp);
 1757         if ((mp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
 1758                 error = ESTALE;
 1759                 goto ereply;
 1760         }
 1761         vfslocked = VFS_LOCK_GIANT(mp);
 1762         (void) vn_start_write(NULL, &mp, V_WAIT);
 1763         vfs_rel(mp);            /* The write holds a ref. */
 1764         nfsm_srvnamesiz(len);
 1765 
 1766         nd.ni_cnd.cn_cred = cred;
 1767         nd.ni_cnd.cn_nameiop = DELETE;
 1768         nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | MPSAFE;
 1769         error = nfs_namei(&nd, nfsd, fhp, len, slp, nam, &md, &dpos,
 1770                 &dirp, v3,  &dirfor, &dirfor_ret, FALSE);
 1771         vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 1772         if (dirp && !v3) {
 1773                 vrele(dirp);
 1774                 dirp = NULL;
 1775         }
 1776         if (error == 0) {
 1777                 if (nd.ni_vp->v_type == VDIR) {
 1778                         error = EPERM;          /* POSIX */
 1779                         goto out;
 1780                 }
 1781                 /*
 1782                  * The root of a mounted filesystem cannot be deleted.
 1783                  */
 1784                 if (nd.ni_vp->v_vflag & VV_ROOT) {
 1785                         error = EBUSY;
 1786                         goto out;
 1787                 }
 1788 out:
 1789                 if (!error) {
 1790                         error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
 1791                         NDFREE(&nd, NDF_ONLY_PNBUF);
 1792                 }
 1793         }
 1794         if (dirp && v3) {
 1795                 if (dirp == nd.ni_dvp)
 1796                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 1797                 else {
 1798                         /* Drop the other locks to avoid deadlock. */
 1799                         if (nd.ni_dvp) {
 1800                                 if (nd.ni_dvp == nd.ni_vp)
 1801                                         vrele(nd.ni_dvp);
 1802                                 else
 1803                                         vput(nd.ni_dvp);
 1804                         }
 1805                         if (nd.ni_vp)
 1806                                 vput(nd.ni_vp);
 1807                         nd.ni_dvp = NULL;
 1808                         nd.ni_vp = NULL;
 1809 
 1810                         vn_lock(dirp, LK_EXCLUSIVE | LK_RETRY);
 1811                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 1812                         VOP_UNLOCK(dirp, 0);
 1813                 }
 1814                 vrele(dirp);
 1815                 dirp = NULL;
 1816         }
 1817 ereply:
 1818         nfsm_reply(NFSX_WCCDATA(v3));
 1819         if (v3)
 1820                 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 1821         error = 0;
 1822 nfsmout:
 1823         NDFREE(&nd, NDF_ONLY_PNBUF);
 1824         if (nd.ni_dvp) {
 1825                 if (nd.ni_dvp == nd.ni_vp)
 1826                         vrele(nd.ni_dvp);
 1827                 else
 1828                         vput(nd.ni_dvp);
 1829         }
 1830         if (nd.ni_vp)
 1831                 vput(nd.ni_vp);
 1832         vn_finished_write(mp);
 1833         VFS_UNLOCK_GIANT(vfslocked);
 1834         return(error);
 1835 }
 1836 
 1837 /*
 1838  * nfs rename service
 1839  */
 1840 int
 1841 nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 1842     struct mbuf **mrq)
 1843 {
 1844         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 1845         struct sockaddr *nam = nfsd->nd_nam;
 1846         caddr_t dpos = nfsd->nd_dpos;
 1847         struct ucred *cred = nfsd->nd_cr;
 1848         caddr_t bpos;
 1849         int error = 0, len, len2, fdirfor_ret = 1, fdiraft_ret = 1;
 1850         int tdirfor_ret = 1, tdiraft_ret = 1;
 1851         int v3 = (nfsd->nd_flag & ND_NFSV3);
 1852         struct mbuf *mb, *mreq;
 1853         struct nameidata fromnd, tond;
 1854         struct vnode *fvp, *tvp, *tdvp, *fdirp = NULL;
 1855         struct vnode *tdirp = NULL;
 1856         struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
 1857         nfsfh_t fnfh, tnfh;
 1858         fhandle_t *ffhp, *tfhp;
 1859         uid_t saved_uid;
 1860         struct mount *mp = NULL;
 1861         int vfslocked;
 1862 
 1863         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 1864         vfslocked = 0;
 1865 #ifndef nolint
 1866         fvp = NULL;
 1867 #endif
 1868         ffhp = &fnfh.fh_generic;
 1869         tfhp = &tnfh.fh_generic;
 1870 
 1871         /*
 1872          * Clear fields incase goto nfsmout occurs from macro.
 1873          */
 1874 
 1875         ndclear(&fromnd);
 1876         ndclear(&tond);
 1877 
 1878         nfsm_srvmtofh(ffhp);
 1879         if ((mp = vfs_getvfs(&ffhp->fh_fsid)) == NULL) {
 1880                 error = ESTALE;
 1881                 goto out1;
 1882         }
 1883         vfslocked = VFS_LOCK_GIANT(mp);
 1884         (void) vn_start_write(NULL, &mp, V_WAIT);
 1885         vfs_rel(mp);            /* The write holds a ref. */
 1886         nfsm_srvnamesiz(len);
 1887         /*
 1888          * Remember our original uid so that we can reset cr_uid before
 1889          * the second nfs_namei() call, in case it is remapped.
 1890          */
 1891         saved_uid = cred->cr_uid;
 1892         fromnd.ni_cnd.cn_cred = cred;
 1893         fromnd.ni_cnd.cn_nameiop = DELETE;
 1894         fromnd.ni_cnd.cn_flags = WANTPARENT | SAVESTART | MPSAFE;
 1895         error = nfs_namei(&fromnd, nfsd, ffhp, len, slp, nam, &md,
 1896                 &dpos, &fdirp, v3, &fdirfor, &fdirfor_ret, FALSE);
 1897         vfslocked = nfsrv_lockedpair_nd(vfslocked, &fromnd);
 1898         if (fdirp && !v3) {
 1899                 vrele(fdirp);
 1900                 fdirp = NULL;
 1901         }
 1902         if (error) {
 1903                 nfsm_reply(2 * NFSX_WCCDATA(v3));
 1904                 if (v3) {
 1905                         nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
 1906                         nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
 1907                 }
 1908                 error = 0;
 1909                 goto nfsmout;
 1910         }
 1911         fvp = fromnd.ni_vp;
 1912         nfsm_srvmtofh(tfhp);
 1913         nfsm_srvnamesiz(len2);
 1914         cred->cr_uid = saved_uid;
 1915         tond.ni_cnd.cn_cred = cred;
 1916         tond.ni_cnd.cn_nameiop = RENAME;
 1917         tond.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | NOCACHE | SAVESTART | MPSAFE;
 1918         error = nfs_namei(&tond, nfsd, tfhp, len2, slp, nam, &md,
 1919                 &dpos, &tdirp, v3, &tdirfor, &tdirfor_ret, FALSE);
 1920         vfslocked = nfsrv_lockedpair_nd(vfslocked, &tond);
 1921         if (tdirp && !v3) {
 1922                 vrele(tdirp);
 1923                 tdirp = NULL;
 1924         }
 1925         if (error)
 1926                 goto out1;
 1927 
 1928         tdvp = tond.ni_dvp;
 1929         tvp = tond.ni_vp;
 1930         if (tvp != NULL) {
 1931                 if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
 1932                         if (v3)
 1933                                 error = EEXIST;
 1934                         else
 1935                                 error = EISDIR;
 1936                         goto out;
 1937                 } else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
 1938                         if (v3)
 1939                                 error = EEXIST;
 1940                         else
 1941                                 error = ENOTDIR;
 1942                         goto out;
 1943                 }
 1944                 if (tvp->v_type == VDIR && tvp->v_mountedhere) {
 1945                         if (v3)
 1946                                 error = EXDEV;
 1947                         else
 1948                                 error = ENOTEMPTY;
 1949                         goto out;
 1950                 }
 1951         }
 1952         if (fvp->v_type == VDIR && fvp->v_mountedhere) {
 1953                 if (v3)
 1954                         error = EXDEV;
 1955                 else
 1956                         error = ENOTEMPTY;
 1957                 goto out;
 1958         }
 1959         if (fvp->v_mount != tdvp->v_mount) {
 1960                 if (v3)
 1961                         error = EXDEV;
 1962                 else
 1963                         error = ENOTEMPTY;
 1964                 goto out;
 1965         }
 1966         if (fvp == tdvp) {
 1967                 if (v3)
 1968                         error = EINVAL;
 1969                 else
 1970                         error = ENOTEMPTY;
 1971         }
 1972         /*
 1973          * If source is the same as the destination (that is the
 1974          * same vnode with the same name in the same directory),
 1975          * then there is nothing to do.
 1976          */
 1977         if (fvp == tvp && fromnd.ni_dvp == tdvp &&
 1978             fromnd.ni_cnd.cn_namelen == tond.ni_cnd.cn_namelen &&
 1979             !bcmp(fromnd.ni_cnd.cn_nameptr, tond.ni_cnd.cn_nameptr,
 1980               fromnd.ni_cnd.cn_namelen))
 1981                 error = -1;
 1982 out:
 1983         if (!error) {
 1984                 /*
 1985                  * The VOP_RENAME function releases all vnode references &
 1986                  * locks prior to returning so we need to clear the pointers
 1987                  * to bypass cleanup code later on.
 1988                  */
 1989                 error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
 1990                                    tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
 1991                 fromnd.ni_dvp = NULL;
 1992                 fromnd.ni_vp = NULL;
 1993                 tond.ni_dvp = NULL;
 1994                 tond.ni_vp = NULL;
 1995                 if (error) {
 1996                         NDFREE(&fromnd, NDF_ONLY_PNBUF);
 1997                         NDFREE(&tond, NDF_ONLY_PNBUF);
 1998                 }
 1999         } else {
 2000                 if (error == -1)
 2001                         error = 0;
 2002         }
 2003         /* fall through */
 2004 out1:
 2005         nfsm_reply(2 * NFSX_WCCDATA(v3));
 2006         if (v3) {
 2007                 /* Release existing locks to prevent deadlock. */
 2008                 if (tond.ni_dvp) {
 2009                         if (tond.ni_dvp == tond.ni_vp)
 2010                                 vrele(tond.ni_dvp);
 2011                         else
 2012                                 vput(tond.ni_dvp);
 2013                 }
 2014                 if (tond.ni_vp)
 2015                         vput(tond.ni_vp);
 2016                 tond.ni_dvp = NULL;
 2017                 tond.ni_vp = NULL;
 2018 
 2019                 if (fdirp) {
 2020                         vn_lock(fdirp, LK_EXCLUSIVE | LK_RETRY);
 2021                         fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred);
 2022                         VOP_UNLOCK(fdirp, 0);
 2023                 }
 2024                 if (tdirp) {
 2025                         vn_lock(tdirp, LK_EXCLUSIVE | LK_RETRY);
 2026                         tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred);
 2027                         VOP_UNLOCK(tdirp, 0);
 2028                 }
 2029                 nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
 2030                 nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
 2031         }
 2032         error = 0;
 2033         /* fall through */
 2034 
 2035 nfsmout:
 2036         /*
 2037          * Clear out tond related fields
 2038          */
 2039         if (tond.ni_dvp) {
 2040                 if (tond.ni_dvp == tond.ni_vp)
 2041                         vrele(tond.ni_dvp);
 2042                 else
 2043                         vput(tond.ni_dvp);
 2044         }
 2045         if (tond.ni_vp)
 2046                 vput(tond.ni_vp);
 2047         if (tdirp)
 2048                 vrele(tdirp);
 2049         if (tond.ni_startdir)
 2050                 vrele(tond.ni_startdir);
 2051         NDFREE(&tond, NDF_ONLY_PNBUF);
 2052         /*
 2053          * Clear out fromnd related fields
 2054          */
 2055         if (fdirp)
 2056                 vrele(fdirp);
 2057         if (fromnd.ni_startdir)
 2058                 vrele(fromnd.ni_startdir);
 2059         NDFREE(&fromnd, NDF_ONLY_PNBUF);
 2060         if (fromnd.ni_dvp)
 2061                 vrele(fromnd.ni_dvp);
 2062         if (fromnd.ni_vp)
 2063                 vrele(fromnd.ni_vp);
 2064 
 2065         vn_finished_write(mp);
 2066         VFS_UNLOCK_GIANT(vfslocked);
 2067         return (error);
 2068 }
 2069 
 2070 /*
 2071  * nfs link service
 2072  */
 2073 int
 2074 nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 2075     struct mbuf **mrq)
 2076 {
 2077         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 2078         struct sockaddr *nam = nfsd->nd_nam;
 2079         caddr_t dpos = nfsd->nd_dpos;
 2080         struct ucred *cred = nfsd->nd_cr;
 2081         struct nameidata nd;
 2082         caddr_t bpos;
 2083         int error = 0, rdonly, len, dirfor_ret = 1, diraft_ret = 1;
 2084         int getret = 1, v3 = (nfsd->nd_flag & ND_NFSV3);
 2085         struct mbuf *mb, *mreq;
 2086         struct vnode *vp = NULL, *xp, *dirp = NULL;
 2087         struct vattr dirfor, diraft, at;
 2088         nfsfh_t nfh, dnfh;
 2089         fhandle_t *fhp, *dfhp;
 2090         struct mount *mp = NULL;
 2091         int tvfslocked;
 2092         int vfslocked;
 2093 
 2094         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 2095         ndclear(&nd);
 2096         vfslocked = 0;
 2097 
 2098         fhp = &nfh.fh_generic;
 2099         dfhp = &dnfh.fh_generic;
 2100         nfsm_srvmtofh(fhp);
 2101         if ((mp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
 2102                 error = ESTALE;
 2103                 goto ereply;
 2104         }
 2105         vfslocked = VFS_LOCK_GIANT(mp);
 2106         (void) vn_start_write(NULL, &mp, V_WAIT);
 2107         vfs_rel(mp);            /* The write holds a ref. */
 2108         nfsm_srvmtofh(dfhp);
 2109         nfsm_srvnamesiz(len);
 2110 
 2111         error = nfsrv_fhtovp(fhp, 0, &vp, &tvfslocked, nfsd, slp, nam, &rdonly);
 2112         vfslocked = nfsrv_lockedpair(vfslocked, tvfslocked);
 2113         if (error) {
 2114                 nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
 2115                 if (v3) {
 2116                         nfsm_srvpostop_attr(getret, &at);
 2117                         nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 2118                 }
 2119                 vp = NULL;
 2120                 error = 0;
 2121                 goto nfsmout;
 2122         }
 2123         if (v3)
 2124                 getret = VOP_GETATTR(vp, &at, cred);
 2125         if (vp->v_type == VDIR) {
 2126                 error = EPERM;          /* POSIX */
 2127                 goto out1;
 2128         }
 2129         VOP_UNLOCK(vp, 0);
 2130         nd.ni_cnd.cn_cred = cred;
 2131         nd.ni_cnd.cn_nameiop = CREATE;
 2132         nd.ni_cnd.cn_flags = LOCKPARENT | MPSAFE | MPSAFE;
 2133         error = nfs_namei(&nd, nfsd, dfhp, len, slp, nam, &md, &dpos,
 2134                 &dirp, v3, &dirfor, &dirfor_ret, FALSE);
 2135         vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 2136         if (dirp && !v3) {
 2137                 vrele(dirp);
 2138                 dirp = NULL;
 2139         }
 2140         if (error) {
 2141                 vrele(vp);
 2142                 vp = NULL;
 2143                 goto out2;
 2144         }
 2145         xp = nd.ni_vp;
 2146         if (xp != NULL) {
 2147                 error = EEXIST;
 2148                 vrele(vp);
 2149                 vp = NULL;
 2150                 goto out2;
 2151         }
 2152         xp = nd.ni_dvp;
 2153         if (vp->v_mount != xp->v_mount) {
 2154                 error = EXDEV;
 2155                 vrele(vp);
 2156                 vp = NULL;
 2157                 goto out2;
 2158         }
 2159         vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
 2160         error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
 2161         NDFREE(&nd, NDF_ONLY_PNBUF);
 2162         /* fall through */
 2163 
 2164 out1:
 2165         if (v3)
 2166                 getret = VOP_GETATTR(vp, &at, cred);
 2167 out2:
 2168         if (dirp) {
 2169                 if (dirp == nd.ni_dvp)
 2170                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 2171                 else {
 2172                         /* Release existing locks to prevent deadlock. */
 2173                         if (nd.ni_dvp) {
 2174                                 if (nd.ni_dvp == nd.ni_vp)
 2175                                         vrele(nd.ni_dvp);
 2176                                 else
 2177                                         vput(nd.ni_dvp);
 2178                         }
 2179                         if (nd.ni_vp)
 2180                                 vrele(nd.ni_vp);
 2181                         nd.ni_dvp = NULL;
 2182                         nd.ni_vp = NULL;
 2183 
 2184                         vn_lock(dirp, LK_EXCLUSIVE | LK_RETRY);
 2185                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 2186                         VOP_UNLOCK(dirp, 0);
 2187                 }
 2188         }
 2189 ereply:
 2190         nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
 2191         if (v3) {
 2192                 nfsm_srvpostop_attr(getret, &at);
 2193                 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 2194         }
 2195         error = 0;
 2196         /* fall through */
 2197 
 2198 nfsmout:
 2199         NDFREE(&nd, NDF_ONLY_PNBUF);
 2200         if (vp)
 2201                 vput(vp);
 2202         if (nd.ni_dvp) {
 2203                 if (nd.ni_dvp == nd.ni_vp)
 2204                         vrele(nd.ni_dvp);
 2205                 else
 2206                         vput(nd.ni_dvp);
 2207         }
 2208         if (dirp)
 2209                 vrele(dirp);
 2210         if (nd.ni_vp)
 2211                 vrele(nd.ni_vp);
 2212         vn_finished_write(mp);
 2213         VFS_UNLOCK_GIANT(vfslocked);
 2214         return(error);
 2215 }
 2216 
 2217 /*
 2218  * nfs symbolic link service
 2219  */
 2220 int
 2221 nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 2222     struct mbuf **mrq)
 2223 {
 2224         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 2225         struct sockaddr *nam = nfsd->nd_nam;
 2226         caddr_t dpos = nfsd->nd_dpos;
 2227         struct ucred *cred = nfsd->nd_cr;
 2228         struct vattr va, dirfor, diraft;
 2229         struct nameidata nd;
 2230         struct vattr *vap = &va;
 2231         struct nfsv2_sattr *sp;
 2232         char *bpos, *pathcp = NULL;
 2233         struct uio io;
 2234         struct iovec iv;
 2235         int error = 0, len, len2, dirfor_ret = 1, diraft_ret = 1;
 2236         int v3 = (nfsd->nd_flag & ND_NFSV3);
 2237         struct mbuf *mb, *mreq;
 2238         struct vnode *dirp = NULL;
 2239         nfsfh_t nfh;
 2240         fhandle_t *fhp;
 2241         struct mount *mp = NULL;
 2242         int tvfslocked;
 2243         int vfslocked;
 2244 
 2245         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 2246         ndclear(&nd);
 2247         vfslocked = 0;
 2248 
 2249         fhp = &nfh.fh_generic;
 2250         nfsm_srvmtofh(fhp);
 2251         if ((mp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
 2252                 error = ESTALE;
 2253                 goto out;
 2254         }
 2255         vfslocked = VFS_LOCK_GIANT(mp);
 2256         (void) vn_start_write(NULL, &mp, V_WAIT);
 2257         vfs_rel(mp);            /* The write holds a ref. */
 2258         nfsm_srvnamesiz(len);
 2259         nd.ni_cnd.cn_cred = cred;
 2260         nd.ni_cnd.cn_nameiop = CREATE;
 2261         nd.ni_cnd.cn_flags = LOCKPARENT | SAVESTART | MPSAFE;
 2262         error = nfs_namei(&nd, nfsd, fhp, len, slp, nam, &md, &dpos,
 2263                 &dirp, v3, &dirfor, &dirfor_ret, FALSE);
 2264         vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 2265         if (error == 0) {
 2266                 VATTR_NULL(vap);
 2267                 if (v3)
 2268                         nfsm_srvsattr(vap);
 2269                 nfsm_srvpathsiz(len2);
 2270         }
 2271         if (dirp && !v3) {
 2272                 vrele(dirp);
 2273                 dirp = NULL;
 2274         }
 2275         if (error)
 2276                 goto out;
 2277         pathcp = malloc(len2 + 1, M_TEMP, M_WAITOK);
 2278         iv.iov_base = pathcp;
 2279         iv.iov_len = len2;
 2280         io.uio_resid = len2;
 2281         io.uio_offset = 0;
 2282         io.uio_iov = &iv;
 2283         io.uio_iovcnt = 1;
 2284         io.uio_segflg = UIO_SYSSPACE;
 2285         io.uio_rw = UIO_READ;
 2286         io.uio_td = NULL;
 2287         nfsm_mtouio(&io, len2);
 2288         if (!v3) {
 2289                 sp = nfsm_dissect_nonblock(struct nfsv2_sattr *, NFSX_V2SATTR);
 2290                 vap->va_mode = nfstov_mode(sp->sa_mode);
 2291         }
 2292         *(pathcp + len2) = '\0';
 2293         if (nd.ni_vp) {
 2294                 error = EEXIST;
 2295                 goto out;
 2296         }
 2297 
 2298         /*
 2299          * issue symlink op.  SAVESTART is set so the underlying path component
 2300          * is only freed by the VOP if an error occurs.
 2301          */
 2302         if (vap->va_mode == (mode_t)VNOVAL)
 2303                 vap->va_mode = 0;
 2304         error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap, pathcp);
 2305         if (error)
 2306                 NDFREE(&nd, NDF_ONLY_PNBUF);
 2307         else
 2308                 vput(nd.ni_vp);
 2309         nd.ni_vp = NULL;
 2310         /*
 2311          * releases directory prior to potential lookup op.
 2312          */
 2313         vput(nd.ni_dvp);
 2314         nd.ni_dvp = NULL;
 2315 
 2316         if (error == 0) {
 2317             if (v3) {
 2318                 /*
 2319                  * Issue lookup.  Leave SAVESTART set so we can easily free
 2320                  * the name buffer later on.
 2321                  *
 2322                  * since LOCKPARENT is not set, ni_dvp will be garbage on
 2323                  * return whether an error occurs or not.
 2324                  */
 2325                 nd.ni_cnd.cn_nameiop = LOOKUP;
 2326                 nd.ni_cnd.cn_flags &= ~(LOCKPARENT | FOLLOW);
 2327                 nd.ni_cnd.cn_flags |= (NOFOLLOW | LOCKLEAF);
 2328                 nd.ni_cnd.cn_thread = curthread;
 2329                 nd.ni_cnd.cn_cred = cred;
 2330                 tvfslocked = VFS_LOCK_GIANT(nd.ni_startdir->v_mount);
 2331                 if (tvfslocked)
 2332                         nd.ni_cnd.cn_flags |= GIANTHELD;
 2333                 error = lookup(&nd);
 2334                 nd.ni_dvp = NULL;
 2335                 vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 2336                 nd.ni_cnd.cn_flags &= ~GIANTHELD;
 2337 
 2338                 if (error == 0) {
 2339                         bzero((caddr_t)fhp, sizeof(nfh));
 2340                         fhp->fh_fsid = nd.ni_vp->v_mount->mnt_stat.f_fsid;
 2341                         error = VOP_VPTOFH(nd.ni_vp, &fhp->fh_fid);
 2342                         if (!error)
 2343                                 error = VOP_GETATTR(nd.ni_vp, vap, cred);
 2344                         vput(nd.ni_vp);
 2345                         nd.ni_vp = NULL;
 2346                 }
 2347             }
 2348         }
 2349 out:
 2350         /*
 2351          * These releases aren't strictly required, does even doing them
 2352          * make any sense? XXX can nfsm_reply() block?
 2353          */
 2354         if (pathcp) {
 2355                 free(pathcp, M_TEMP);
 2356                 pathcp = NULL;
 2357         }
 2358         if (dirp) {
 2359                 vn_lock(dirp, LK_EXCLUSIVE | LK_RETRY);
 2360                 diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 2361                 VOP_UNLOCK(dirp, 0);
 2362         }
 2363         if (nd.ni_startdir) {
 2364                 vrele(nd.ni_startdir);
 2365                 nd.ni_startdir = NULL;
 2366         }
 2367         nfsm_reply(NFSX_SRVFH(v3) + NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
 2368         if (v3) {
 2369                 if (!error) {
 2370                         nfsm_srvpostop_fh(fhp);
 2371                         nfsm_srvpostop_attr(0, vap);
 2372                 }
 2373                 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 2374         }
 2375         error = 0;
 2376         /* fall through */
 2377 
 2378 nfsmout:
 2379         NDFREE(&nd, NDF_ONLY_PNBUF);
 2380         if (nd.ni_dvp) {
 2381                 if (nd.ni_dvp == nd.ni_vp)
 2382                         vrele(nd.ni_dvp);
 2383                 else
 2384                         vput(nd.ni_dvp);
 2385         }
 2386         if (nd.ni_vp)
 2387                 vrele(nd.ni_vp);
 2388         if (nd.ni_startdir)
 2389                 vrele(nd.ni_startdir);
 2390         if (dirp)
 2391                 vrele(dirp);
 2392         if (pathcp)
 2393                 free(pathcp, M_TEMP);
 2394 
 2395         vn_finished_write(mp);
 2396         VFS_UNLOCK_GIANT(vfslocked);
 2397         return (error);
 2398 }
 2399 
 2400 /*
 2401  * nfs mkdir service
 2402  */
 2403 int
 2404 nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 2405     struct mbuf **mrq)
 2406 {
 2407         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 2408         struct sockaddr *nam = nfsd->nd_nam;
 2409         caddr_t dpos = nfsd->nd_dpos;
 2410         struct ucred *cred = nfsd->nd_cr;
 2411         struct vattr va, dirfor, diraft;
 2412         struct vattr *vap = &va;
 2413         struct nfs_fattr *fp;
 2414         struct nameidata nd;
 2415         u_int32_t *tl;
 2416         caddr_t bpos;
 2417         int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
 2418         int v3 = (nfsd->nd_flag & ND_NFSV3);
 2419         struct mbuf *mb, *mreq;
 2420         struct vnode *dirp = NULL;
 2421         int vpexcl = 0;
 2422         nfsfh_t nfh;
 2423         fhandle_t *fhp;
 2424         struct mount *mp = NULL;
 2425         int vfslocked;
 2426 
 2427         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 2428         ndclear(&nd);
 2429         vfslocked = 0;
 2430 
 2431         fhp = &nfh.fh_generic;
 2432         nfsm_srvmtofh(fhp);
 2433         if ((mp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
 2434                 error = ESTALE;
 2435                 goto out;
 2436         }
 2437         vfslocked = VFS_LOCK_GIANT(mp);
 2438         (void) vn_start_write(NULL, &mp, V_WAIT);
 2439         vfs_rel(mp);            /* The write holds a ref. */
 2440         nfsm_srvnamesiz(len);
 2441         nd.ni_cnd.cn_cred = cred;
 2442         nd.ni_cnd.cn_nameiop = CREATE;
 2443         nd.ni_cnd.cn_flags = LOCKPARENT | MPSAFE;
 2444 
 2445         error = nfs_namei(&nd, nfsd, fhp, len, slp, nam, &md, &dpos,
 2446                 &dirp, v3, &dirfor, &dirfor_ret, FALSE);
 2447         vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 2448         if (dirp && !v3) {
 2449                 vrele(dirp);
 2450                 dirp = NULL;
 2451         }
 2452         if (error) {
 2453                 nfsm_reply(NFSX_WCCDATA(v3));
 2454                 if (v3)
 2455                         nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 2456                 error = 0;
 2457                 goto nfsmout;
 2458         }
 2459         VATTR_NULL(vap);
 2460         if (v3) {
 2461                 nfsm_srvsattr(vap);
 2462         } else {
 2463                 tl = nfsm_dissect_nonblock(u_int32_t *, NFSX_UNSIGNED);
 2464                 vap->va_mode = nfstov_mode(*tl++);
 2465         }
 2466 
 2467         /*
 2468          * At this point nd.ni_dvp is referenced and exclusively locked and
 2469          * nd.ni_vp, if it exists, is referenced but not locked.
 2470          */
 2471 
 2472         vap->va_type = VDIR;
 2473         if (nd.ni_vp != NULL) {
 2474                 NDFREE(&nd, NDF_ONLY_PNBUF);
 2475                 error = EEXIST;
 2476                 goto out;
 2477         }
 2478 
 2479         /*
 2480          * Issue mkdir op.  Since SAVESTART is not set, the pathname
 2481          * component is freed by the VOP call.  This will fill-in
 2482          * nd.ni_vp, reference, and exclusively lock it.
 2483          */
 2484         if (vap->va_mode == (mode_t)VNOVAL)
 2485                 vap->va_mode = 0;
 2486         error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap);
 2487         NDFREE(&nd, NDF_ONLY_PNBUF);
 2488         vpexcl = 1;
 2489 
 2490         vput(nd.ni_dvp);
 2491         nd.ni_dvp = NULL;
 2492 
 2493         if (!error) {
 2494                 bzero((caddr_t)fhp, sizeof(nfh));
 2495                 fhp->fh_fsid = nd.ni_vp->v_mount->mnt_stat.f_fsid;
 2496                 error = VOP_VPTOFH(nd.ni_vp, &fhp->fh_fid);
 2497                 if (!error)
 2498                         error = VOP_GETATTR(nd.ni_vp, vap, cred);
 2499         }
 2500 out:
 2501         if (dirp) {
 2502                 if (dirp == nd.ni_dvp) {
 2503                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 2504                 } else {
 2505                         /* Release existing locks to prevent deadlock. */
 2506                         if (nd.ni_dvp) {
 2507                                 NDFREE(&nd, NDF_ONLY_PNBUF);
 2508                                 if (nd.ni_dvp == nd.ni_vp && vpexcl)
 2509                                         vrele(nd.ni_dvp);
 2510                                 else
 2511                                         vput(nd.ni_dvp);
 2512                         }
 2513                         if (nd.ni_vp) {
 2514                                 if (vpexcl)
 2515                                         vput(nd.ni_vp);
 2516                                 else
 2517                                         vrele(nd.ni_vp);
 2518                         }
 2519                         nd.ni_dvp = NULL;
 2520                         nd.ni_vp = NULL;
 2521                         vn_lock(dirp, LK_EXCLUSIVE | LK_RETRY);
 2522                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 2523                         VOP_UNLOCK(dirp, 0);
 2524                 }
 2525         }
 2526         nfsm_reply(NFSX_SRVFH(v3) + NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
 2527         if (v3) {
 2528                 if (!error) {
 2529                         nfsm_srvpostop_fh(fhp);
 2530                         nfsm_srvpostop_attr(0, vap);
 2531                 }
 2532                 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 2533         } else if (!error) {
 2534                 /* v2 non-error case. */
 2535                 nfsm_srvfhtom(fhp, v3);
 2536                 fp = nfsm_build(struct nfs_fattr *, NFSX_V2FATTR);
 2537                 nfsm_srvfillattr(vap, fp);
 2538         }
 2539         error = 0;
 2540         /* fall through */
 2541 
 2542 nfsmout:
 2543         if (nd.ni_dvp) {
 2544                 NDFREE(&nd, NDF_ONLY_PNBUF);
 2545                 if (nd.ni_dvp == nd.ni_vp && vpexcl)
 2546                         vrele(nd.ni_dvp);
 2547                 else
 2548                         vput(nd.ni_dvp);
 2549         }
 2550         if (nd.ni_vp) {
 2551                 if (vpexcl)
 2552                         vput(nd.ni_vp);
 2553                 else
 2554                         vrele(nd.ni_vp);
 2555         }
 2556         if (dirp)
 2557                 vrele(dirp);
 2558         vn_finished_write(mp);
 2559         VFS_UNLOCK_GIANT(vfslocked);
 2560         return (error);
 2561 }
 2562 
 2563 /*
 2564  * nfs rmdir service
 2565  */
 2566 int
 2567 nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 2568     struct mbuf **mrq)
 2569 {
 2570         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 2571         struct sockaddr *nam = nfsd->nd_nam;
 2572         caddr_t dpos = nfsd->nd_dpos;
 2573         struct ucred *cred = nfsd->nd_cr;
 2574         caddr_t bpos;
 2575         int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
 2576         int v3 = (nfsd->nd_flag & ND_NFSV3);
 2577         struct mbuf *mb, *mreq;
 2578         struct vnode *vp, *dirp = NULL;
 2579         struct vattr dirfor, diraft;
 2580         nfsfh_t nfh;
 2581         fhandle_t *fhp;
 2582         struct nameidata nd;
 2583         struct mount *mp = NULL;
 2584         int vfslocked;
 2585 
 2586         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 2587         ndclear(&nd);
 2588         vfslocked = 0;
 2589 
 2590         fhp = &nfh.fh_generic;
 2591         nfsm_srvmtofh(fhp);
 2592         if ((mp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
 2593                 error = ESTALE;
 2594                 goto out;
 2595         }
 2596         vfslocked = VFS_LOCK_GIANT(mp);
 2597         (void) vn_start_write(NULL, &mp, V_WAIT);
 2598         vfs_rel(mp);            /* The write holds a ref. */
 2599         nfsm_srvnamesiz(len);
 2600         nd.ni_cnd.cn_cred = cred;
 2601         nd.ni_cnd.cn_nameiop = DELETE;
 2602         nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | MPSAFE;
 2603         error = nfs_namei(&nd, nfsd, fhp, len, slp, nam, &md, &dpos,
 2604                 &dirp, v3, &dirfor, &dirfor_ret, FALSE);
 2605         vfslocked = nfsrv_lockedpair_nd(vfslocked, &nd);
 2606         if (dirp && !v3) {
 2607                 vrele(dirp);
 2608                 dirp = NULL;
 2609         }
 2610         if (error) {
 2611                 nfsm_reply(NFSX_WCCDATA(v3));
 2612                 if (v3)
 2613                         nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 2614                 error = 0;
 2615                 goto nfsmout;
 2616         }
 2617         vp = nd.ni_vp;
 2618         if (vp->v_type != VDIR) {
 2619                 error = ENOTDIR;
 2620                 goto out;
 2621         }
 2622         /*
 2623          * No rmdir "." please.
 2624          */
 2625         if (nd.ni_dvp == vp) {
 2626                 error = EINVAL;
 2627                 goto out;
 2628         }
 2629         /*
 2630          * The root of a mounted filesystem cannot be deleted.
 2631          */
 2632         if (vp->v_vflag & VV_ROOT)
 2633                 error = EBUSY;
 2634 out:
 2635         /*
 2636          * Issue or abort op.  Since SAVESTART is not set, path name
 2637          * component is freed by the VOP after either.
 2638          */
 2639         if (!error)
 2640                 error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
 2641         NDFREE(&nd, NDF_ONLY_PNBUF);
 2642 
 2643         if (dirp) {
 2644                 if (dirp == nd.ni_dvp)
 2645                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 2646                 else {
 2647                         /* Release existing locks to prevent deadlock. */
 2648                         if (nd.ni_dvp) {
 2649                                 if (nd.ni_dvp == nd.ni_vp)
 2650                                         vrele(nd.ni_dvp);
 2651                                 else
 2652                                         vput(nd.ni_dvp);
 2653                         }
 2654                         if (nd.ni_vp)
 2655                                 vput(nd.ni_vp);
 2656                         nd.ni_dvp = NULL;
 2657                         nd.ni_vp = NULL;
 2658                         vn_lock(dirp, LK_EXCLUSIVE | LK_RETRY);
 2659                         diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
 2660                         VOP_UNLOCK(dirp, 0);
 2661                 }
 2662         }
 2663         nfsm_reply(NFSX_WCCDATA(v3));
 2664         error = 0;
 2665         if (v3)
 2666                 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
 2667         /* fall through */
 2668 
 2669 nfsmout:
 2670         NDFREE(&nd, NDF_ONLY_PNBUF);
 2671         if (nd.ni_dvp) {
 2672                 if (nd.ni_dvp == nd.ni_vp)
 2673                         vrele(nd.ni_dvp);
 2674                 else
 2675                         vput(nd.ni_dvp);
 2676         }
 2677         if (nd.ni_vp)
 2678                 vput(nd.ni_vp);
 2679         if (dirp)
 2680                 vrele(dirp);
 2681 
 2682         vn_finished_write(mp);
 2683         VFS_UNLOCK_GIANT(vfslocked);
 2684         return(error);
 2685 }
 2686 
 2687 /*
 2688  * nfs readdir service
 2689  * - mallocs what it thinks is enough to read
 2690  *      count rounded up to a multiple of NFS_DIRBLKSIZ <= NFS_MAXREADDIR
 2691  * - calls VOP_READDIR()
 2692  * - loops around building the reply
 2693  *      if the output generated exceeds count break out of loop
 2694  *      The nfsm_clget macro is used here so that the reply will be packed
 2695  *      tightly in mbuf clusters.
 2696  * - it only knows that it has encountered eof when the VOP_READDIR()
 2697  *      reads nothing
 2698  * - as such one readdir rpc will return eof false although you are there
 2699  *      and then the next will return eof
 2700  * - it trims out records with d_fileno == 0
 2701  *      this doesn't matter for Unix clients, but they might confuse clients
 2702  *      for other os'.
 2703  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
 2704  *      than requested, but this may not apply to all filesystems. For
 2705  *      example, client NFS does not { although it is never remote mounted
 2706  *      anyhow }
 2707  *     The alternate call nfsrv_readdirplus() does lookups as well.
 2708  * PS: The NFS protocol spec. does not clarify what the "count" byte
 2709  *      argument is a count of.. just name strings and file id's or the
 2710  *      entire reply rpc or ...
 2711  *      I tried just file name and id sizes and it confused the Sun client,
 2712  *      so I am using the full rpc size now. The "paranoia.." comment refers
 2713  *      to including the status longwords that are not a part of the dir.
 2714  *      "entry" structures, but are in the rpc.
 2715  */
 2716 struct flrep {
 2717         nfsuint64       fl_off;
 2718         u_int32_t       fl_postopok;
 2719         u_int32_t       fl_fattr[NFSX_V3FATTR / sizeof (u_int32_t)];
 2720         u_int32_t       fl_fhok;
 2721         u_int32_t       fl_fhsize;
 2722         u_int32_t       fl_nfh[NFSX_V3FH / sizeof (u_int32_t)];
 2723 };
 2724 
 2725 int
 2726 nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 2727     struct mbuf **mrq)
 2728 {
 2729         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 2730         struct sockaddr *nam = nfsd->nd_nam;
 2731         caddr_t dpos = nfsd->nd_dpos;
 2732         struct ucred *cred = nfsd->nd_cr;
 2733         char *bp, *be;
 2734         struct mbuf *mp;
 2735         struct dirent *dp;
 2736         caddr_t cp;
 2737         u_int32_t *tl;
 2738         caddr_t bpos;
 2739         struct mbuf *mb, *mreq;
 2740         char *cpos, *cend, *rbuf;
 2741         struct vnode *vp = NULL;
 2742         struct vattr at;
 2743         nfsfh_t nfh;
 2744         fhandle_t *fhp;
 2745         struct uio io;
 2746         struct iovec iv;
 2747         int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
 2748         int siz, cnt, fullsiz, eofflag, rdonly, ncookies;
 2749         int v3 = (nfsd->nd_flag & ND_NFSV3);
 2750         u_quad_t off, toff, verf;
 2751         u_long *cookies = NULL, *cookiep; /* needs to be int64_t or off_t */
 2752         int vfslocked, not_zfs;
 2753 
 2754         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 2755         vfslocked = 0;
 2756         fhp = &nfh.fh_generic;
 2757         nfsm_srvmtofh(fhp);
 2758         if (v3) {
 2759                 tl = nfsm_dissect_nonblock(u_int32_t *, 5 * NFSX_UNSIGNED);
 2760                 toff = fxdr_hyper(tl);
 2761                 tl += 2;
 2762                 verf = fxdr_hyper(tl);
 2763                 tl += 2;
 2764         } else {
 2765                 tl = nfsm_dissect_nonblock(u_int32_t *, 2 * NFSX_UNSIGNED);
 2766                 toff = fxdr_unsigned(u_quad_t, *tl++);
 2767                 verf = 0;       /* shut up gcc */
 2768         }
 2769         off = toff;
 2770         cnt = fxdr_unsigned(int, *tl);
 2771         siz = ((cnt + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
 2772         xfer = NFS_SRVMAXDATA(nfsd);
 2773         if (cnt > xfer)
 2774                 cnt = xfer;
 2775         if (siz > xfer)
 2776                 siz = xfer;
 2777         fullsiz = siz;
 2778         error = nfsrv_fhtovp(fhp, 0, &vp, &vfslocked, nfsd, slp, nam, &rdonly);
 2779         if (!error && vp->v_type != VDIR) {
 2780                 error = ENOTDIR;
 2781                 vput(vp);
 2782                 vp = NULL;
 2783         }
 2784         if (error) {
 2785                 nfsm_reply(NFSX_UNSIGNED);
 2786                 if (v3)
 2787                         nfsm_srvpostop_attr(getret, &at);
 2788                 error = 0;
 2789                 goto nfsmout;
 2790         }
 2791 
 2792         /*
 2793          * Obtain lock on vnode for this section of the code
 2794          */
 2795         if (v3) {
 2796                 error = getret = VOP_GETATTR(vp, &at, cred);
 2797 #if 0
 2798                 /*
 2799                  * XXX This check may be too strict for Solaris 2.5 clients.
 2800                  */
 2801                 if (!error && toff && verf && verf != at.va_filerev)
 2802                         error = NFSERR_BAD_COOKIE;
 2803 #endif
 2804         }
 2805         if (!error)
 2806                 error = nfsrv_access(vp, VEXEC, cred, rdonly, 0);
 2807         if (error) {
 2808                 vput(vp);
 2809                 vp = NULL;
 2810                 nfsm_reply(NFSX_POSTOPATTR(v3));
 2811                 if (v3)
 2812                         nfsm_srvpostop_attr(getret, &at);
 2813                 error = 0;
 2814                 goto nfsmout;
 2815         }
 2816         not_zfs = strcmp(vp->v_mount->mnt_vfc->vfc_name, "zfs") != 0;
 2817         VOP_UNLOCK(vp, 0);
 2818 
 2819         /*
 2820          * end section.  Allocate rbuf and continue
 2821          */
 2822         rbuf = malloc(siz, M_TEMP, M_WAITOK);
 2823 again:
 2824         iv.iov_base = rbuf;
 2825         iv.iov_len = fullsiz;
 2826         io.uio_iov = &iv;
 2827         io.uio_iovcnt = 1;
 2828         io.uio_offset = (off_t)off;
 2829         io.uio_resid = fullsiz;
 2830         io.uio_segflg = UIO_SYSSPACE;
 2831         io.uio_rw = UIO_READ;
 2832         io.uio_td = NULL;
 2833         eofflag = 0;
 2834         if (cookies) {
 2835                 free((caddr_t)cookies, M_TEMP);
 2836                 cookies = NULL;
 2837         }
 2838         vn_lock(vp, LK_SHARED | LK_RETRY);
 2839         error = VOP_READDIR(vp, &io, cred, &eofflag, &ncookies, &cookies);
 2840         off = (off_t)io.uio_offset;
 2841         if (!cookies && !error)
 2842                 error = NFSERR_PERM;
 2843         if (v3) {
 2844                 getret = VOP_GETATTR(vp, &at, cred);
 2845                 if (!error)
 2846                         error = getret;
 2847         }
 2848         VOP_UNLOCK(vp, 0);
 2849         if (error) {
 2850                 vrele(vp);
 2851                 vp = NULL;
 2852                 free((caddr_t)rbuf, M_TEMP);
 2853                 if (cookies)
 2854                         free((caddr_t)cookies, M_TEMP);
 2855                 nfsm_reply(NFSX_POSTOPATTR(v3));
 2856                 if (v3)
 2857                         nfsm_srvpostop_attr(getret, &at);
 2858                 error = 0;
 2859                 goto nfsmout;
 2860         }
 2861         if (io.uio_resid) {
 2862                 siz -= io.uio_resid;
 2863 
 2864                 /*
 2865                  * If nothing read, return eof
 2866                  * rpc reply
 2867                  */
 2868                 if (siz == 0) {
 2869                         vrele(vp);
 2870                         vp = NULL;
 2871                         nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) +
 2872                                 2 * NFSX_UNSIGNED);
 2873                         if (v3) {
 2874                                 nfsm_srvpostop_attr(getret, &at);
 2875                                 tl = nfsm_build(u_int32_t *, 4 * NFSX_UNSIGNED);
 2876                                 txdr_hyper(at.va_filerev, tl);
 2877                                 tl += 2;
 2878                         } else
 2879                                 tl = nfsm_build(u_int32_t *, 2 * NFSX_UNSIGNED);
 2880                         *tl++ = nfsrv_nfs_false;
 2881                         *tl = nfsrv_nfs_true;
 2882                         free((caddr_t)rbuf, M_TEMP);
 2883                         free((caddr_t)cookies, M_TEMP);
 2884                         error = 0;
 2885                         goto nfsmout;
 2886                 }
 2887         }
 2888 
 2889         /*
 2890          * Check for degenerate cases of nothing useful read.
 2891          * If so go try again
 2892          */
 2893         cpos = rbuf;
 2894         cend = rbuf + siz;
 2895         dp = (struct dirent *)cpos;
 2896         cookiep = cookies;
 2897         /*
 2898          * For some reason FreeBSD's ufs_readdir() chooses to back the
 2899          * directory offset up to a block boundary, so it is necessary to
 2900          * skip over the records that precede the requested offset. This
 2901          * requires the assumption that file offset cookies monotonically
 2902          * increase.
 2903          * Since the offset cookies don't monotonically increase for ZFS,
 2904          * this is not done when ZFS is the file system.
 2905          */
 2906         while (cpos < cend && ncookies > 0 &&
 2907                 (dp->d_fileno == 0 || dp->d_type == DT_WHT ||
 2908                  (not_zfs != 0 && ((u_quad_t)(*cookiep)) <= toff))) {
 2909                 cpos += dp->d_reclen;
 2910                 dp = (struct dirent *)cpos;
 2911                 cookiep++;
 2912                 ncookies--;
 2913         }
 2914         if (cpos >= cend || ncookies == 0) {
 2915                 toff = off;
 2916                 siz = fullsiz;
 2917                 goto again;
 2918         }
 2919 
 2920         len = 3 * NFSX_UNSIGNED;        /* paranoia, probably can be 0 */
 2921         nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) + siz);
 2922         if (v3) {
 2923                 nfsm_srvpostop_attr(getret, &at);
 2924                 tl = nfsm_build(u_int32_t *, 2 * NFSX_UNSIGNED);
 2925                 txdr_hyper(at.va_filerev, tl);
 2926         }
 2927         mp = mb;
 2928         bp = bpos;
 2929         be = bp + M_TRAILINGSPACE(mp);
 2930 
 2931         /* Loop through the records and build reply */
 2932         while (cpos < cend && ncookies > 0) {
 2933                 if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
 2934                         nlen = dp->d_namlen;
 2935                         rem = nfsm_rndup(nlen) - nlen;
 2936                         len += (4 * NFSX_UNSIGNED + nlen + rem);
 2937                         if (v3)
 2938                                 len += 2 * NFSX_UNSIGNED;
 2939                         if (len > cnt) {
 2940                                 eofflag = 0;
 2941                                 break;
 2942                         }
 2943                         /*
 2944                          * Build the directory record xdr from
 2945                          * the dirent entry.
 2946                          */
 2947                         nfsm_clget;
 2948                         *tl = nfsrv_nfs_true;
 2949                         bp += NFSX_UNSIGNED;
 2950                         if (v3) {
 2951                                 nfsm_clget;
 2952                                 *tl = 0;
 2953                                 bp += NFSX_UNSIGNED;
 2954                         }
 2955                         nfsm_clget;
 2956                         *tl = txdr_unsigned(dp->d_fileno);
 2957                         bp += NFSX_UNSIGNED;
 2958                         nfsm_clget;
 2959                         *tl = txdr_unsigned(nlen);
 2960                         bp += NFSX_UNSIGNED;
 2961 
 2962                         /* And loop around copying the name */
 2963                         xfer = nlen;
 2964                         cp = dp->d_name;
 2965                         while (xfer > 0) {
 2966                                 nfsm_clget;
 2967                                 if ((bp+xfer) > be)
 2968                                         tsiz = be-bp;
 2969                                 else
 2970                                         tsiz = xfer;
 2971                                 bcopy(cp, bp, tsiz);
 2972                                 bp += tsiz;
 2973                                 xfer -= tsiz;
 2974                                 if (xfer > 0)
 2975                                         cp += tsiz;
 2976                         }
 2977                         /* And null pad to an int32_t boundary. */
 2978                         for (i = 0; i < rem; i++)
 2979                                 *bp++ = '\0';
 2980                         nfsm_clget;
 2981 
 2982                         /* Finish off the record */
 2983                         if (v3) {
 2984                                 *tl = 0;
 2985                                 bp += NFSX_UNSIGNED;
 2986                                 nfsm_clget;
 2987                         }
 2988                         *tl = txdr_unsigned(*cookiep);
 2989                         bp += NFSX_UNSIGNED;
 2990                 }
 2991                 cpos += dp->d_reclen;
 2992                 dp = (struct dirent *)cpos;
 2993                 cookiep++;
 2994                 ncookies--;
 2995         }
 2996         vrele(vp);
 2997         vp = NULL;
 2998         nfsm_clget;
 2999         *tl = nfsrv_nfs_false;
 3000         bp += NFSX_UNSIGNED;
 3001         nfsm_clget;
 3002         if (eofflag)
 3003                 *tl = nfsrv_nfs_true;
 3004         else
 3005                 *tl = nfsrv_nfs_false;
 3006         bp += NFSX_UNSIGNED;
 3007         if (mp != mb) {
 3008                 if (bp < be)
 3009                         mp->m_len = bp - mtod(mp, caddr_t);
 3010         } else
 3011                 mp->m_len += bp - bpos;
 3012         free((caddr_t)rbuf, M_TEMP);
 3013         free((caddr_t)cookies, M_TEMP);
 3014 
 3015 nfsmout:
 3016         if (vp)
 3017                 vrele(vp);
 3018         VFS_UNLOCK_GIANT(vfslocked);
 3019         return(error);
 3020 }
 3021 
 3022 int
 3023 nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 3024     struct mbuf **mrq)
 3025 {
 3026         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 3027         struct sockaddr *nam = nfsd->nd_nam;
 3028         caddr_t dpos = nfsd->nd_dpos;
 3029         struct ucred *cred = nfsd->nd_cr;
 3030         char *bp, *be;
 3031         struct mbuf *mp;
 3032         struct dirent *dp;
 3033         caddr_t cp;
 3034         u_int32_t *tl;
 3035         caddr_t bpos;
 3036         struct mbuf *mb, *mreq;
 3037         char *cpos, *cend, *rbuf;
 3038         struct vnode *vp = NULL, *nvp;
 3039         struct flrep fl;
 3040         nfsfh_t nfh;
 3041         fhandle_t *fhp, *nfhp = (fhandle_t *)fl.fl_nfh;
 3042         struct uio io;
 3043         struct iovec iv;
 3044         struct vattr va, at, *vap = &va;
 3045         struct nfs_fattr *fp;
 3046         int len, nlen, rem, xfer, tsiz, i, error = 0, error1, getret = 1;
 3047         int vp_locked;
 3048         int siz, cnt, fullsiz, eofflag, rdonly, dirlen, ncookies;
 3049         u_quad_t off, toff, verf;
 3050         u_long *cookies = NULL, *cookiep; /* needs to be int64_t or off_t */
 3051         int v3 = (nfsd->nd_flag & ND_NFSV3);
 3052         int usevget = 1, vfslocked;
 3053         struct componentname cn;
 3054         struct mount *mntp = NULL;
 3055         int not_zfs;
 3056 
 3057         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 3058         vfslocked = 0;
 3059         vp_locked = 0;
 3060         if (!v3)
 3061                 panic("nfsrv_readdirplus: v3 proc called on a v2 connection");
 3062         fhp = &nfh.fh_generic;
 3063         nfsm_srvmtofh(fhp);
 3064         tl = nfsm_dissect_nonblock(u_int32_t *, 6 * NFSX_UNSIGNED);
 3065         toff = fxdr_hyper(tl);
 3066         tl += 2;
 3067         verf = fxdr_hyper(tl);
 3068         tl += 2;
 3069         siz = fxdr_unsigned(int, *tl++);
 3070         cnt = fxdr_unsigned(int, *tl);
 3071         off = toff;
 3072         siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
 3073         xfer = NFS_SRVMAXDATA(nfsd);
 3074         if (cnt > xfer)
 3075                 cnt = xfer;
 3076         if (siz > xfer)
 3077                 siz = xfer;
 3078         fullsiz = siz;
 3079         error = nfsrv_fhtovp(fhp, NFSRV_FLAG_BUSY, &vp, &vfslocked, nfsd, slp,
 3080             nam, &rdonly);
 3081         if (!error) {
 3082                 vp_locked = 1;
 3083                 mntp = vp->v_mount;
 3084                 if (vp->v_type != VDIR) {
 3085                         error = ENOTDIR;
 3086                         vput(vp);
 3087                         vp = NULL;
 3088                         vp_locked = 0;
 3089                 }
 3090         }
 3091         if (error) {
 3092                 nfsm_reply(NFSX_UNSIGNED);
 3093                 nfsm_srvpostop_attr(getret, &at);
 3094                 error = 0;
 3095                 goto nfsmout;
 3096         }
 3097         error = getret = VOP_GETATTR(vp, &at, cred);
 3098 #if 0
 3099         /*
 3100          * XXX This check may be too strict for Solaris 2.5 clients.
 3101          */
 3102         if (!error && toff && verf && verf != at.va_filerev)
 3103                 error = NFSERR_BAD_COOKIE;
 3104 #endif
 3105         if (!error)
 3106                 error = nfsrv_access(vp, VEXEC, cred, rdonly, 0);
 3107         if (error) {
 3108                 vput(vp);
 3109                 vp_locked = 0;
 3110                 vp = NULL;
 3111                 nfsm_reply(NFSX_V3POSTOPATTR);
 3112                 nfsm_srvpostop_attr(getret, &at);
 3113                 error = 0;
 3114                 goto nfsmout;
 3115         }
 3116         not_zfs = strcmp(vp->v_mount->mnt_vfc->vfc_name, "zfs") != 0;
 3117         VOP_UNLOCK(vp, 0);
 3118         vp_locked = 0;
 3119         rbuf = malloc(siz, M_TEMP, M_WAITOK);
 3120 again:
 3121         iv.iov_base = rbuf;
 3122         iv.iov_len = fullsiz;
 3123         io.uio_iov = &iv;
 3124         io.uio_iovcnt = 1;
 3125         io.uio_offset = (off_t)off;
 3126         io.uio_resid = fullsiz;
 3127         io.uio_segflg = UIO_SYSSPACE;
 3128         io.uio_rw = UIO_READ;
 3129         io.uio_td = NULL;
 3130         eofflag = 0;
 3131         vp_locked = 1;
 3132         if (cookies) {
 3133                 free((caddr_t)cookies, M_TEMP);
 3134                 cookies = NULL;
 3135         }
 3136         vn_lock(vp, LK_SHARED | LK_RETRY);
 3137         error = VOP_READDIR(vp, &io, cred, &eofflag, &ncookies, &cookies);
 3138         off = (u_quad_t)io.uio_offset;
 3139         getret = VOP_GETATTR(vp, &at, cred);
 3140         VOP_UNLOCK(vp, 0);
 3141         vp_locked = 0;
 3142         if (!cookies && !error)
 3143                 error = NFSERR_PERM;
 3144         if (!error)
 3145                 error = getret;
 3146         if (error) {
 3147                 vrele(vp);
 3148                 vp = NULL;
 3149                 if (cookies)
 3150                         free((caddr_t)cookies, M_TEMP);
 3151                 free((caddr_t)rbuf, M_TEMP);
 3152                 nfsm_reply(NFSX_V3POSTOPATTR);
 3153                 nfsm_srvpostop_attr(getret, &at);
 3154                 error = 0;
 3155                 goto nfsmout;
 3156         }
 3157         if (io.uio_resid) {
 3158                 siz -= io.uio_resid;
 3159 
 3160                 /*
 3161                  * If nothing read, return eof
 3162                  * rpc reply
 3163                  */
 3164                 if (siz == 0) {
 3165                         vrele(vp);
 3166                         vp = NULL;
 3167                         nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
 3168                                 2 * NFSX_UNSIGNED);
 3169                         nfsm_srvpostop_attr(getret, &at);
 3170                         tl = nfsm_build(u_int32_t *, 4 * NFSX_UNSIGNED);
 3171                         txdr_hyper(at.va_filerev, tl);
 3172                         tl += 2;
 3173                         *tl++ = nfsrv_nfs_false;
 3174                         *tl = nfsrv_nfs_true;
 3175                         free((caddr_t)cookies, M_TEMP);
 3176                         free((caddr_t)rbuf, M_TEMP);
 3177                         error = 0;
 3178                         goto nfsmout;
 3179                 }
 3180         }
 3181 
 3182         /*
 3183          * Check for degenerate cases of nothing useful read.
 3184          * If so go try again
 3185          */
 3186         cpos = rbuf;
 3187         cend = rbuf + siz;
 3188         dp = (struct dirent *)cpos;
 3189         cookiep = cookies;
 3190         /*
 3191          * For some reason FreeBSD's ufs_readdir() chooses to back the
 3192          * directory offset up to a block boundary, so it is necessary to
 3193          * skip over the records that precede the requested offset. This
 3194          * requires the assumption that file offset cookies monotonically
 3195          * increase.
 3196          * Since the offset cookies don't monotonically increase for ZFS,
 3197          * this is not done when ZFS is the file system.
 3198          */
 3199         while (cpos < cend && ncookies > 0 &&
 3200                 (dp->d_fileno == 0 || dp->d_type == DT_WHT ||
 3201                  (not_zfs != 0 && ((u_quad_t)(*cookiep)) <= toff))) {
 3202                 cpos += dp->d_reclen;
 3203                 dp = (struct dirent *)cpos;
 3204                 cookiep++;
 3205                 ncookies--;
 3206         }
 3207         if (cpos >= cend || ncookies == 0) {
 3208                 toff = off;
 3209                 siz = fullsiz;
 3210                 goto again;
 3211         }
 3212 
 3213         dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
 3214             2 * NFSX_UNSIGNED;
 3215         nfsm_reply(cnt);
 3216         nfsm_srvpostop_attr(getret, &at);
 3217         tl = nfsm_build(u_int32_t *, 2 * NFSX_UNSIGNED);
 3218         txdr_hyper(at.va_filerev, tl);
 3219         mp = mb;
 3220         bp = bpos;
 3221         be = bp + M_TRAILINGSPACE(mp);
 3222 
 3223         /* Loop through the records and build reply */
 3224         while (cpos < cend && ncookies > 0) {
 3225                 if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
 3226                         nlen = dp->d_namlen;
 3227                         rem = nfsm_rndup(nlen)-nlen;
 3228 
 3229                         if (usevget) {
 3230                                 /*
 3231                                  * For readdir_and_lookup get the vnode using
 3232                                  * the file number.
 3233                                  */
 3234                                 error = VFS_VGET(mntp, dp->d_fileno, LK_SHARED,
 3235                                     &nvp);
 3236                                 if (error != 0 && error != EOPNOTSUPP) {
 3237                                         error = 0;
 3238                                         goto invalid;
 3239                                 } else if (error == EOPNOTSUPP) {
 3240                                         /*
 3241                                          * VFS_VGET() not supported?
 3242                                          * Let's switch to VOP_LOOKUP().
 3243                                          */
 3244                                         error = 0;
 3245                                         usevget = 0;
 3246                                         cn.cn_nameiop = LOOKUP;
 3247                                         cn.cn_flags = ISLASTCN | NOFOLLOW | \
 3248                                             LOCKSHARED | LOCKLEAF | MPSAFE;
 3249                                         cn.cn_lkflags = LK_SHARED | LK_RETRY;
 3250                                         cn.cn_cred = cred;
 3251                                         cn.cn_thread = curthread;
 3252                                 }
 3253                         }
 3254                         if (!usevget) {
 3255                                 cn.cn_nameptr = dp->d_name;
 3256                                 cn.cn_namelen = dp->d_namlen;
 3257                                 if (dp->d_namlen == 2 &&
 3258                                     dp->d_name[0] == '.' &&
 3259                                     dp->d_name[1] == '.') {
 3260                                         cn.cn_flags |= ISDOTDOT;
 3261                                 } else {
 3262                                         cn.cn_flags &= ~ISDOTDOT;
 3263                                 }
 3264                                 if (!vp_locked) {
 3265                                         vn_lock(vp, LK_SHARED | LK_RETRY);
 3266                                         vp_locked = 1;
 3267                                 }
 3268                                 if ((vp->v_vflag & VV_ROOT) != 0 &&
 3269                                     (cn.cn_flags & ISDOTDOT) != 0) {
 3270                                         vref(vp);
 3271                                         nvp = vp;
 3272                                 } else if (VOP_LOOKUP(vp, &nvp, &cn) != 0)
 3273                                         goto invalid;
 3274                         }
 3275 
 3276                         bzero((caddr_t)nfhp, NFSX_V3FH);
 3277                         nfhp->fh_fsid = nvp->v_mount->mnt_stat.f_fsid;
 3278                         if ((error1 = VOP_VPTOFH(nvp, &nfhp->fh_fid)) == 0)
 3279                                 error1 = VOP_GETATTR(nvp, vap, cred);
 3280                         if (!usevget && vp == nvp)
 3281                                 vunref(nvp);
 3282                         else
 3283                                 vput(nvp);
 3284                         nvp = NULL;
 3285                         if (error1 != 0)
 3286                                 goto invalid;
 3287 
 3288                         /*
 3289                          * If either the dircount or maxcount will be
 3290                          * exceeded, get out now. Both of these lengths
 3291                          * are calculated conservatively, including all
 3292                          * XDR overheads.
 3293                          */
 3294                         len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
 3295                                 NFSX_V3POSTOPATTR);
 3296                         dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
 3297                         if (len > cnt || dirlen > fullsiz) {
 3298                                 eofflag = 0;
 3299                                 break;
 3300                         }
 3301 
 3302                         /*
 3303                          * Build the directory record xdr from
 3304                          * the dirent entry.
 3305                          */
 3306                         fp = (struct nfs_fattr *)&fl.fl_fattr;
 3307                         nfsm_srvfillattr(vap, fp);
 3308                         fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
 3309                         fl.fl_fhok = nfsrv_nfs_true;
 3310                         fl.fl_postopok = nfsrv_nfs_true;
 3311                         fl.fl_off.nfsuquad[0] = 0;
 3312                         fl.fl_off.nfsuquad[1] = txdr_unsigned(*cookiep);
 3313 
 3314                         nfsm_clget;
 3315                         *tl = nfsrv_nfs_true;
 3316                         bp += NFSX_UNSIGNED;
 3317                         nfsm_clget;
 3318                         *tl = 0;
 3319                         bp += NFSX_UNSIGNED;
 3320                         nfsm_clget;
 3321                         *tl = txdr_unsigned(dp->d_fileno);
 3322                         bp += NFSX_UNSIGNED;
 3323                         nfsm_clget;
 3324                         *tl = txdr_unsigned(nlen);
 3325                         bp += NFSX_UNSIGNED;
 3326 
 3327                         /* And loop around copying the name */
 3328                         xfer = nlen;
 3329                         cp = dp->d_name;
 3330                         while (xfer > 0) {
 3331                                 nfsm_clget;
 3332                                 if ((bp + xfer) > be)
 3333                                         tsiz = be - bp;
 3334                                 else
 3335                                         tsiz = xfer;
 3336                                 bcopy(cp, bp, tsiz);
 3337                                 bp += tsiz;
 3338                                 xfer -= tsiz;
 3339                                 if (xfer > 0)
 3340                                         cp += tsiz;
 3341                         }
 3342                         /* And null pad to an int32_t boundary. */
 3343                         for (i = 0; i < rem; i++)
 3344                                 *bp++ = '\0';
 3345 
 3346                         /*
 3347                          * Now copy the flrep structure out.
 3348                          */
 3349                         xfer = sizeof (struct flrep);
 3350                         cp = (caddr_t)&fl;
 3351                         while (xfer > 0) {
 3352                                 nfsm_clget;
 3353                                 if ((bp + xfer) > be)
 3354                                         tsiz = be - bp;
 3355                                 else
 3356                                         tsiz = xfer;
 3357                                 bcopy(cp, bp, tsiz);
 3358                                 bp += tsiz;
 3359                                 xfer -= tsiz;
 3360                                 if (xfer > 0)
 3361                                         cp += tsiz;
 3362                         }
 3363                 }
 3364 invalid:
 3365                 cpos += dp->d_reclen;
 3366                 dp = (struct dirent *)cpos;
 3367                 cookiep++;
 3368                 ncookies--;
 3369         }
 3370         if (!usevget && vp_locked)
 3371                 vput(vp);
 3372         else
 3373                 vrele(vp);
 3374         vp = NULL;
 3375         nfsm_clget;
 3376         *tl = nfsrv_nfs_false;
 3377         bp += NFSX_UNSIGNED;
 3378         nfsm_clget;
 3379         if (eofflag)
 3380                 *tl = nfsrv_nfs_true;
 3381         else
 3382                 *tl = nfsrv_nfs_false;
 3383         bp += NFSX_UNSIGNED;
 3384         if (mp != mb) {
 3385                 if (bp < be)
 3386                         mp->m_len = bp - mtod(mp, caddr_t);
 3387         } else
 3388                 mp->m_len += bp - bpos;
 3389         free((caddr_t)cookies, M_TEMP);
 3390         free((caddr_t)rbuf, M_TEMP);
 3391 nfsmout:
 3392         if (vp)
 3393                 vrele(vp);
 3394         if (mntp)
 3395                 vfs_unbusy(mntp);
 3396         VFS_UNLOCK_GIANT(vfslocked);
 3397         return(error);
 3398 }
 3399 
 3400 /*
 3401  * nfs commit service
 3402  */
 3403 int
 3404 nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 3405     struct mbuf **mrq)
 3406 {
 3407         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 3408         struct sockaddr *nam = nfsd->nd_nam;
 3409         caddr_t dpos = nfsd->nd_dpos;
 3410         struct ucred *cred = nfsd->nd_cr;
 3411         struct vattr bfor, aft;
 3412         struct vnode *vp = NULL;
 3413         nfsfh_t nfh;
 3414         fhandle_t *fhp;
 3415         u_int32_t *tl;
 3416         caddr_t bpos;
 3417         int error = 0, rdonly, for_ret = 1, aft_ret = 1, cnt;
 3418         struct mbuf *mb, *mreq;
 3419         u_quad_t off;
 3420         struct mount *mp = NULL;
 3421         int v3 = (nfsd->nd_flag & ND_NFSV3);
 3422         int tvfslocked;
 3423         int vfslocked;
 3424 
 3425         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 3426         vfslocked = 0;
 3427         if (!v3)
 3428                 panic("nfsrv_commit: v3 proc called on a v2 connection");
 3429         fhp = &nfh.fh_generic;
 3430         nfsm_srvmtofh(fhp);
 3431         if ((mp = vfs_getvfs(&fhp->fh_fsid)) == NULL) {
 3432                 error = ESTALE;
 3433                 goto ereply;
 3434         }
 3435         vfslocked = VFS_LOCK_GIANT(mp);
 3436         (void) vn_start_write(NULL, &mp, V_WAIT);
 3437         vfs_rel(mp);            /* The write holds a ref. */
 3438         tl = nfsm_dissect_nonblock(u_int32_t *, 3 * NFSX_UNSIGNED);
 3439 
 3440         /*
 3441          * XXX At this time VOP_FSYNC() does not accept offset and byte
 3442          * count parameters, so these arguments are useless (someday maybe).
 3443          */
 3444         off = fxdr_hyper(tl);
 3445         tl += 2;
 3446         cnt = fxdr_unsigned(int, *tl);
 3447         error = nfsrv_fhtovp(fhp, 0, &vp, &tvfslocked, nfsd, slp, nam, &rdonly);
 3448         vfslocked = nfsrv_lockedpair(vfslocked, tvfslocked);
 3449         if (error) {
 3450                 nfsm_reply(2 * NFSX_UNSIGNED);
 3451                 nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
 3452                 error = 0;
 3453                 goto nfsmout;
 3454         }
 3455         for_ret = VOP_GETATTR(vp, &bfor, cred);
 3456 
 3457         if (cnt > MAX_COMMIT_COUNT) {
 3458                 /*
 3459                  * Give up and do the whole thing
 3460                  */
 3461                 if (vp->v_object &&
 3462                    (vp->v_object->flags & OBJ_MIGHTBEDIRTY)) {
 3463                         VM_OBJECT_LOCK(vp->v_object);
 3464                         vm_object_page_clean(vp->v_object, 0, 0, OBJPC_SYNC);
 3465                         VM_OBJECT_UNLOCK(vp->v_object);
 3466                 }
 3467                 error = VOP_FSYNC(vp, MNT_WAIT, curthread);
 3468         } else {
 3469                 /*
 3470                  * Locate and synchronously write any buffers that fall
 3471                  * into the requested range.  Note:  we are assuming that
 3472                  * f_iosize is a power of 2.
 3473                  */
 3474                 int iosize = vp->v_mount->mnt_stat.f_iosize;
 3475                 int iomask = iosize - 1;
 3476                 struct bufobj *bo;
 3477                 daddr_t lblkno;
 3478 
 3479                 /*
 3480                  * Align to iosize boundry, super-align to page boundry.
 3481                  */
 3482                 if (off & iomask) {
 3483                         cnt += off & iomask;
 3484                         off &= ~(u_quad_t)iomask;
 3485                 }
 3486                 if (off & PAGE_MASK) {
 3487                         cnt += off & PAGE_MASK;
 3488                         off &= ~(u_quad_t)PAGE_MASK;
 3489                 }
 3490                 lblkno = off / iosize;
 3491 
 3492                 if (vp->v_object &&
 3493                    (vp->v_object->flags & OBJ_MIGHTBEDIRTY)) {
 3494                         VM_OBJECT_LOCK(vp->v_object);
 3495                         vm_object_page_clean(vp->v_object, off, off + cnt,
 3496                             OBJPC_SYNC);
 3497                         VM_OBJECT_UNLOCK(vp->v_object);
 3498                 }
 3499 
 3500                 bo = &vp->v_bufobj;
 3501                 BO_LOCK(bo);
 3502                 while (cnt > 0) {
 3503                         struct buf *bp;
 3504 
 3505                         /*
 3506                          * If we have a buffer and it is marked B_DELWRI we
 3507                          * have to lock and write it.  Otherwise the prior
 3508                          * write is assumed to have already been committed.
 3509                          *
 3510                          * gbincore() can return invalid buffers now so we
 3511                          * have to check that bit as well (though B_DELWRI
 3512                          * should not be set if B_INVAL is set there could be
 3513                          * a race here since we haven't locked the buffer).
 3514                          */
 3515                         if ((bp = gbincore(&vp->v_bufobj, lblkno)) != NULL) {
 3516                                 if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_SLEEPFAIL |
 3517                                     LK_INTERLOCK, BO_MTX(bo)) == ENOLCK) {
 3518                                         BO_LOCK(bo);
 3519                                         continue; /* retry */
 3520                                 }
 3521                                 if ((bp->b_flags & (B_DELWRI|B_INVAL)) ==
 3522                                     B_DELWRI) {
 3523                                         bremfree(bp);
 3524                                         bp->b_flags &= ~B_ASYNC;
 3525                                         bwrite(bp);
 3526                                         ++nfs_commit_miss;
 3527                                 } else
 3528                                         BUF_UNLOCK(bp);
 3529                                 BO_LOCK(bo);
 3530                         }
 3531                         ++nfs_commit_blks;
 3532                         if (cnt < iosize)
 3533                                 break;
 3534                         cnt -= iosize;
 3535                         ++lblkno;
 3536                 }
 3537                 BO_UNLOCK(bo);
 3538         }
 3539 
 3540         aft_ret = VOP_GETATTR(vp, &aft, cred);
 3541         vput(vp);
 3542         vp = NULL;
 3543 ereply:
 3544         nfsm_reply(NFSX_V3WCCDATA + NFSX_V3WRITEVERF);
 3545         nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
 3546         if (!error) {
 3547                 tl = nfsm_build(u_int32_t *, NFSX_V3WRITEVERF);
 3548                 if (nfsver.tv_sec == 0)
 3549                         nfsver = boottime;
 3550                 *tl++ = txdr_unsigned(nfsver.tv_sec);
 3551                 *tl = txdr_unsigned(nfsver.tv_usec);
 3552         } else {
 3553                 error = 0;
 3554         }
 3555 nfsmout:
 3556         if (vp)
 3557                 vput(vp);
 3558         vn_finished_write(mp);
 3559         VFS_UNLOCK_GIANT(vfslocked);
 3560         return(error);
 3561 }
 3562 
 3563 /*
 3564  * nfs statfs service
 3565  */
 3566 int
 3567 nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 3568     struct mbuf **mrq)
 3569 {
 3570         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 3571         struct sockaddr *nam = nfsd->nd_nam;
 3572         caddr_t dpos = nfsd->nd_dpos;
 3573         struct ucred *cred = nfsd->nd_cr;
 3574         struct statfs *sf;
 3575         struct nfs_statfs *sfp;
 3576         caddr_t bpos;
 3577         int error = 0, rdonly, getret = 1;
 3578         int v3 = (nfsd->nd_flag & ND_NFSV3);
 3579         struct mbuf *mb, *mreq;
 3580         struct vnode *vp = NULL;
 3581         struct vattr at;
 3582         nfsfh_t nfh;
 3583         fhandle_t *fhp;
 3584         struct statfs statfs;
 3585         u_quad_t tval;
 3586         int vfslocked;
 3587 
 3588         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 3589         vfslocked = 0;
 3590         fhp = &nfh.fh_generic;
 3591         nfsm_srvmtofh(fhp);
 3592         error = nfsrv_fhtovp(fhp, 0, &vp, &vfslocked, nfsd, slp, nam, &rdonly);
 3593         if (error) {
 3594                 nfsm_reply(NFSX_UNSIGNED);
 3595                 if (v3)
 3596                         nfsm_srvpostop_attr(getret, &at);
 3597                 error = 0;
 3598                 goto nfsmout;
 3599         }
 3600         sf = &statfs;
 3601         error = VFS_STATFS(vp->v_mount, sf);
 3602         getret = VOP_GETATTR(vp, &at, cred);
 3603         vput(vp);
 3604         vp = NULL;
 3605         nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_STATFS(v3));
 3606         if (v3)
 3607                 nfsm_srvpostop_attr(getret, &at);
 3608         if (error) {
 3609                 error = 0;
 3610                 goto nfsmout;
 3611         }
 3612         sfp = nfsm_build(struct nfs_statfs *, NFSX_STATFS(v3));
 3613         if (v3) {
 3614                 tval = (u_quad_t)sf->f_blocks;
 3615                 tval *= (u_quad_t)sf->f_bsize;
 3616                 txdr_hyper(tval, &sfp->sf_tbytes);
 3617                 tval = (u_quad_t)sf->f_bfree;
 3618                 tval *= (u_quad_t)sf->f_bsize;
 3619                 txdr_hyper(tval, &sfp->sf_fbytes);
 3620                 /*
 3621                  * Don't send negative values for available space,
 3622                  * since this field is unsigned in the NFS protocol.
 3623                  * Otherwise, the client would see absurdly high
 3624                  * numbers for free space.
 3625                  */
 3626                 if (sf->f_bavail < 0)
 3627                         tval = 0;
 3628                 else
 3629                         tval = (u_quad_t)sf->f_bavail;
 3630                 tval *= (u_quad_t)sf->f_bsize;
 3631                 txdr_hyper(tval, &sfp->sf_abytes);
 3632                 sfp->sf_tfiles.nfsuquad[0] = 0;
 3633                 sfp->sf_tfiles.nfsuquad[1] = txdr_unsigned(sf->f_files);
 3634                 sfp->sf_ffiles.nfsuquad[0] = 0;
 3635                 sfp->sf_ffiles.nfsuquad[1] = txdr_unsigned(sf->f_ffree);
 3636                 sfp->sf_afiles.nfsuquad[0] = 0;
 3637                 sfp->sf_afiles.nfsuquad[1] = txdr_unsigned(sf->f_ffree);
 3638                 sfp->sf_invarsec = 0;
 3639         } else {
 3640                 sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
 3641                 sfp->sf_bsize = txdr_unsigned(sf->f_bsize);
 3642                 sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
 3643                 sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
 3644                 if (sf->f_bavail < 0)
 3645                         sfp->sf_bavail = 0;
 3646                 else
 3647                         sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
 3648         }
 3649 nfsmout:
 3650         if (vp)
 3651                 vput(vp);
 3652         VFS_UNLOCK_GIANT(vfslocked);
 3653         return(error);
 3654 }
 3655 
 3656 /*
 3657  * nfs fsinfo service
 3658  */
 3659 int
 3660 nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 3661     struct mbuf **mrq)
 3662 {
 3663         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 3664         struct sockaddr *nam = nfsd->nd_nam;
 3665         caddr_t dpos = nfsd->nd_dpos;
 3666         struct ucred *cred = nfsd->nd_cr;
 3667         struct nfsv3_fsinfo *sip;
 3668         caddr_t bpos;
 3669         int error = 0, rdonly, getret = 1, pref;
 3670         struct mbuf *mb, *mreq;
 3671         struct vnode *vp = NULL;
 3672         struct vattr at;
 3673         nfsfh_t nfh;
 3674         fhandle_t *fhp;
 3675         u_quad_t maxfsize;
 3676         struct statfs sb;
 3677         int v3 = (nfsd->nd_flag & ND_NFSV3);
 3678         int vfslocked;
 3679 
 3680         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 3681         if (!v3)
 3682                 panic("nfsrv_fsinfo: v3 proc called on a v2 connection");
 3683         fhp = &nfh.fh_generic;
 3684         vfslocked = 0;
 3685         nfsm_srvmtofh(fhp);
 3686         error = nfsrv_fhtovp(fhp, 0, &vp, &vfslocked, nfsd, slp, nam, &rdonly);
 3687         if (error) {
 3688                 nfsm_reply(NFSX_UNSIGNED);
 3689                 nfsm_srvpostop_attr(getret, &at);
 3690                 error = 0;
 3691                 goto nfsmout;
 3692         }
 3693 
 3694         /* XXX Try to make a guess on the max file size. */
 3695         VFS_STATFS(vp->v_mount, &sb);
 3696         maxfsize = (u_quad_t)0x80000000 * sb.f_bsize - 1;
 3697 
 3698         getret = VOP_GETATTR(vp, &at, cred);
 3699         vput(vp);
 3700         vp = NULL;
 3701         nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3FSINFO);
 3702         nfsm_srvpostop_attr(getret, &at);
 3703         sip = nfsm_build(struct nfsv3_fsinfo *, NFSX_V3FSINFO);
 3704 
 3705         /*
 3706          * XXX
 3707          * There should be filesystem VFS OP(s) to get this information.
 3708          * For now, assume ufs.
 3709          */
 3710         pref = NFS_SRVMAXDATA(nfsd);
 3711         sip->fs_rtmax = txdr_unsigned(pref);
 3712         sip->fs_rtpref = txdr_unsigned(pref);
 3713         sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
 3714         sip->fs_wtmax = txdr_unsigned(pref);
 3715         sip->fs_wtpref = txdr_unsigned(pref);
 3716         sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
 3717         sip->fs_dtpref = txdr_unsigned(pref);
 3718         txdr_hyper(maxfsize, &sip->fs_maxfilesize);
 3719         sip->fs_timedelta.nfsv3_sec = 0;
 3720         sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
 3721         sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
 3722                 NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
 3723                 NFSV3FSINFO_CANSETTIME);
 3724 nfsmout:
 3725         if (vp)
 3726                 vput(vp);
 3727         VFS_UNLOCK_GIANT(vfslocked);
 3728         return(error);
 3729 }
 3730 
 3731 /*
 3732  * nfs pathconf service
 3733  */
 3734 int
 3735 nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 3736     struct mbuf **mrq)
 3737 {
 3738         struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
 3739         struct sockaddr *nam = nfsd->nd_nam;
 3740         caddr_t dpos = nfsd->nd_dpos;
 3741         struct ucred *cred = nfsd->nd_cr;
 3742         struct nfsv3_pathconf *pc;
 3743         caddr_t bpos;
 3744         int error = 0, rdonly, getret = 1;
 3745         register_t linkmax, namemax, chownres, notrunc;
 3746         struct mbuf *mb, *mreq;
 3747         struct vnode *vp = NULL;
 3748         struct vattr at;
 3749         nfsfh_t nfh;
 3750         fhandle_t *fhp;
 3751         int v3 = (nfsd->nd_flag & ND_NFSV3);
 3752         int vfslocked;
 3753 
 3754         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 3755         if (!v3)
 3756                 panic("nfsrv_pathconf: v3 proc called on a v2 connection");
 3757         vfslocked = 0;
 3758         fhp = &nfh.fh_generic;
 3759         nfsm_srvmtofh(fhp);
 3760         error = nfsrv_fhtovp(fhp, 0, &vp, &vfslocked, nfsd, slp, nam, &rdonly);
 3761         if (error) {
 3762                 nfsm_reply(NFSX_UNSIGNED);
 3763                 nfsm_srvpostop_attr(getret, &at);
 3764                 error = 0;
 3765                 goto nfsmout;
 3766         }
 3767         error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
 3768         if (!error)
 3769                 error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
 3770         if (!error)
 3771                 error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
 3772         if (!error)
 3773                 error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
 3774         getret = VOP_GETATTR(vp, &at, cred);
 3775         vput(vp);
 3776         vp = NULL;
 3777         nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3PATHCONF);
 3778         nfsm_srvpostop_attr(getret, &at);
 3779         if (error) {
 3780                 error = 0;
 3781                 goto nfsmout;
 3782         }
 3783         pc = nfsm_build(struct nfsv3_pathconf *, NFSX_V3PATHCONF);
 3784 
 3785         pc->pc_linkmax = txdr_unsigned(linkmax);
 3786         pc->pc_namemax = txdr_unsigned(namemax);
 3787         pc->pc_notrunc = txdr_unsigned(notrunc);
 3788         pc->pc_chownrestricted = txdr_unsigned(chownres);
 3789 
 3790         /*
 3791          * These should probably be supported by VOP_PATHCONF(), but
 3792          * until msdosfs is exportable (why would you want to?), the
 3793          * Unix defaults should be ok.
 3794          */
 3795         pc->pc_caseinsensitive = nfsrv_nfs_false;
 3796         pc->pc_casepreserving = nfsrv_nfs_true;
 3797 nfsmout:
 3798         if (vp)
 3799                 vput(vp);
 3800         VFS_UNLOCK_GIANT(vfslocked);
 3801         return(error);
 3802 }
 3803 
 3804 /*
 3805  * Null operation, used by clients to ping server
 3806  */
 3807 /* ARGSUSED */
 3808 int
 3809 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 3810     struct mbuf **mrq)
 3811 {
 3812         struct mbuf *mrep = nfsd->nd_mrep;
 3813         caddr_t bpos;
 3814         int error = NFSERR_RETVOID;
 3815         struct mbuf *mb, *mreq;
 3816 
 3817         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 3818         nfsm_reply(0);
 3819 nfsmout:
 3820         return (error);
 3821 }
 3822 
 3823 /*
 3824  * No operation, used for obsolete procedures
 3825  */
 3826 /* ARGSUSED */
 3827 int
 3828 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 3829     struct mbuf **mrq)
 3830 {
 3831         struct mbuf *mrep = nfsd->nd_mrep;
 3832         caddr_t bpos;
 3833         int error;
 3834         struct mbuf *mb, *mreq;
 3835 
 3836         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 3837         if (nfsd->nd_repstat)
 3838                 error = nfsd->nd_repstat;
 3839         else
 3840                 error = EPROCUNAVAIL;
 3841         nfsm_reply(0);
 3842         error = 0;
 3843 nfsmout:
 3844         return (error);
 3845 }
 3846 
 3847 /*
 3848  * Perform access checking for vnodes obtained from file handles that would
 3849  * refer to files already opened by a Unix client. You cannot just use
 3850  * vn_writechk() and VOP_ACCESS() for two reasons.
 3851  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write
 3852  *     case.
 3853  * 2 - The owner is to be given access irrespective of mode bits for some
 3854  *     operations, so that processes that chmod after opening a file don't
 3855  *     break. I don't like this because it opens a security hole, but since
 3856  *     the nfs server opens a security hole the size of a barn door anyhow,
 3857  *     what the heck.
 3858  *
 3859  * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
 3860  * will return EPERM instead of EACCES. EPERM is always an error.
 3861  */
 3862 static int
 3863 nfsrv_access(struct vnode *vp, accmode_t accmode, struct ucred *cred,
 3864     int rdonly, int override)
 3865 {
 3866         struct vattr vattr;
 3867         int error;
 3868 
 3869         VFS_ASSERT_GIANT(vp->v_mount);
 3870 
 3871         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 3872 
 3873         if (accmode & VWRITE) {
 3874                 /* Just vn_writechk() changed to check rdonly */
 3875                 /*
 3876                  * Disallow write attempts on read-only filesystems;
 3877                  * unless the file is a socket or a block or character
 3878                  * device resident on the filesystem.
 3879                  */
 3880                 if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
 3881                         switch (vp->v_type) {
 3882                         case VREG:
 3883                         case VDIR:
 3884                         case VLNK:
 3885                                 return (EROFS);
 3886                         default:
 3887                                 break;
 3888                         }
 3889                 }
 3890                 /*
 3891                  * If there's shared text associated with
 3892                  * the inode, we can't allow writing.
 3893                  */
 3894                 if (vp->v_vflag & VV_TEXT)
 3895                         return (ETXTBSY);
 3896         }
 3897 
 3898         error = VOP_GETATTR(vp, &vattr, cred);
 3899         if (error)
 3900                 return (error);
 3901         error = VOP_ACCESS(vp, accmode, cred, curthread);
 3902         /*
 3903          * Allow certain operations for the owner (reads and writes
 3904          * on files that are already open).
 3905          */
 3906         if (override && error == EACCES && cred->cr_uid == vattr.va_uid)
 3907                 error = 0;
 3908         return (error);
 3909 }

Cache object: 3d053d4762e01f31bddc485e6b48cb01


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.