sys/vfs/nfs/nfs_socket.c

   1 /*
   2  * Copyright (c) 1989, 1991, 1993, 1995
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * This code is derived from software contributed to Berkeley by
   6  * Rick Macklem at The University of Guelph.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. All advertising materials mentioning features or use of this software
  17  *    must display the following acknowledgement:
  18  *      This product includes software developed by the University of
  19  *      California, Berkeley and its contributors.
  20  * 4. Neither the name of the University nor the names of its contributors
  21  *    may be used to endorse or promote products derived from this software
  22  *    without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  *
  36  *      @(#)nfs_socket.c        8.5 (Berkeley) 3/30/95
  37  * $FreeBSD: src/sys/nfs/nfs_socket.c,v 1.60.2.6 2003/03/26 01:44:46 alfred Exp $
  38  * $DragonFly: src/sys/vfs/nfs/nfs_socket.c,v 1.45 2007/05/18 17:05:13 dillon Exp $
  39  */
  40
  41 /*
  42  * Socket operations for use by nfs
  43  */
  44
  45 #include <sys/param.h>
  46 #include <sys/systm.h>
  47 #include <sys/proc.h>
  48 #include <sys/malloc.h>
  49 #include <sys/mount.h>
  50 #include <sys/kernel.h>
  51 #include <sys/mbuf.h>
  52 #include <sys/vnode.h>
  53 #include <sys/fcntl.h>
  54 #include <sys/protosw.h>
  55 #include <sys/resourcevar.h>
  56 #include <sys/socket.h>
  57 #include <sys/socketvar.h>
  58 #include <sys/socketops.h>
  59 #include <sys/syslog.h>
  60 #include <sys/thread.h>
  61 #include <sys/tprintf.h>
  62 #include <sys/sysctl.h>
  63 #include <sys/signalvar.h>
  64 #include <sys/mutex.h>
  65
  66 #include <sys/signal2.h>
  67 #include <sys/mutex2.h>
  68
  69 #include <netinet/in.h>
  70 #include <netinet/tcp.h>
  71 #include <sys/thread2.h>
  72
  73 #include "rpcv2.h"
  74 #include "nfsproto.h"
  75 #include "nfs.h"
  76 #include "xdr_subs.h"
  77 #include "nfsm_subs.h"
  78 #include "nfsmount.h"
  79 #include "nfsnode.h"
  80 #include "nfsrtt.h"
  81
  82 #define TRUE    1
  83 #define FALSE   0
  84
  85 /*
  86  * RTT calculations are scaled by 256 (8 bits).  A proper fractional
  87  * RTT will still be calculated even with a slow NFS timer.
  88  */
  89 #define NFS_SRTT(r)     (r)->r_nmp->nm_srtt[proct[(r)->r_procnum]]
  90 #define NFS_SDRTT(r)    (r)->r_nmp->nm_sdrtt[proct[(r)->r_procnum]]
  91 #define NFS_RTT_SCALE_BITS      8       /* bits */
  92 #define NFS_RTT_SCALE           256     /* value */
  93
  94 /*
  95  * Defines which timer to use for the procnum.
  96  * 0 - default
  97  * 1 - getattr
  98  * 2 - lookup
  99  * 3 - read
 100  * 4 - write
 101  */
 102 static int proct[NFS_NPROCS] = {
 103         0, 1, 0, 2, 1, 3, 3, 4, 0, 0, 0, 0, 0, 0, 0, 0, 3, 3, 0, 0, 0, 0, 0,
 104         0, 0, 0,
 105 };
 106
 107 static int nfs_backoff[8] = { 2, 3, 5, 8, 13, 21, 34, 55 };
 108 static int nfs_realign_test;
 109 static int nfs_realign_count;
 110 static int nfs_bufpackets = 4;
 111 static int nfs_showrtt;
 112 static int nfs_showrexmit;
 113
 114 SYSCTL_DECL(_vfs_nfs);
 115
 116 SYSCTL_INT(_vfs_nfs, OID_AUTO, realign_test, CTLFLAG_RW, &nfs_realign_test, 0, "");
 117 SYSCTL_INT(_vfs_nfs, OID_AUTO, realign_count, CTLFLAG_RW, &nfs_realign_count, 0, "");
 118 SYSCTL_INT(_vfs_nfs, OID_AUTO, bufpackets, CTLFLAG_RW, &nfs_bufpackets, 0, "");
 119 SYSCTL_INT(_vfs_nfs, OID_AUTO, showrtt, CTLFLAG_RW, &nfs_showrtt, 0, "");
 120 SYSCTL_INT(_vfs_nfs, OID_AUTO, showrexmit, CTLFLAG_RW, &nfs_showrexmit, 0, "");
 121
 122 static int nfs_request_setup(nfsm_info_t info);
 123 static int nfs_request_auth(struct nfsreq *rep);
 124 static int nfs_request_try(struct nfsreq *rep);
 125 static int nfs_request_waitreply(struct nfsreq *rep);
 126 static int nfs_request_processreply(nfsm_info_t info, int);
 127
 128 int nfsrtton = 0;
 129 struct nfsrtt nfsrtt;
 130 struct callout  nfs_timer_handle;
 131
 132 static int      nfs_msg (struct thread *,char *,char *);
 133 static int      nfs_rcvlock (struct nfsmount *nmp, struct nfsreq *myreq);
 134 static void     nfs_rcvunlock (struct nfsmount *nmp);
 135 static void     nfs_realign (struct mbuf **pm, int hsiz);
 136 static int      nfs_receive (struct nfsmount *nmp, struct nfsreq *rep,
 137                                 struct sockaddr **aname, struct mbuf **mp);
 138 static void     nfs_softterm (struct nfsreq *rep, int islocked);
 139 static void     nfs_hardterm (struct nfsreq *rep, int islocked);
 140 static int      nfs_reconnect (struct nfsmount *nmp, struct nfsreq *rep);
 141 #ifndef NFS_NOSERVER
 142 static int      nfsrv_getstream (struct nfssvc_sock *, int, int *);
 143 static void     nfs_timer_req(struct nfsreq *req);
 144
 145 int (*nfsrv3_procs[NFS_NPROCS]) (struct nfsrv_descript *nd,
 146                                     struct nfssvc_sock *slp,
 147                                     struct thread *td,
 148                                     struct mbuf **mreqp) = {
 149         nfsrv_null,
 150         nfsrv_getattr,
 151         nfsrv_setattr,
 152         nfsrv_lookup,
 153         nfsrv3_access,
 154         nfsrv_readlink,
 155         nfsrv_read,
 156         nfsrv_write,
 157         nfsrv_create,
 158         nfsrv_mkdir,
 159         nfsrv_symlink,
 160         nfsrv_mknod,
 161         nfsrv_remove,
 162         nfsrv_rmdir,
 163         nfsrv_rename,
 164         nfsrv_link,
 165         nfsrv_readdir,
 166         nfsrv_readdirplus,
 167         nfsrv_statfs,
 168         nfsrv_fsinfo,
 169         nfsrv_pathconf,
 170         nfsrv_commit,
 171         nfsrv_noop,
 172         nfsrv_noop,
 173         nfsrv_noop,
 174         nfsrv_noop
 175 };
 176 #endif /* NFS_NOSERVER */
 177
 178 /*
 179  * Initialize sockets and congestion for a new NFS connection.
 180  * We do not free the sockaddr if error.
 181  */
 182 int
 183 nfs_connect(struct nfsmount *nmp, struct nfsreq *rep)
 184 {
 185         struct socket *so;
 186         int error, rcvreserve, sndreserve;
 187         int pktscale;
 188         struct sockaddr *saddr;
 189         struct sockaddr_in *sin;
 190         struct thread *td = &thread0; /* only used for socreate and sobind */
 191
 192         nmp->nm_so = NULL;
 193         saddr = nmp->nm_nam;
 194         error = socreate(saddr->sa_family, &nmp->nm_so, nmp->nm_sotype,
 195                 nmp->nm_soproto, td);
 196         if (error)
 197                 goto bad;
 198         so = nmp->nm_so;
 199         nmp->nm_soflags = so->so_proto->pr_flags;
 200
 201         /*
 202          * Some servers require that the client port be a reserved port number.
 203          */
 204         if (saddr->sa_family == AF_INET && (nmp->nm_flag & NFSMNT_RESVPORT)) {
 205                 struct sockopt sopt;
 206                 int ip;
 207                 struct sockaddr_in ssin;
 208
 209                 bzero(&sopt, sizeof sopt);
 210                 ip = IP_PORTRANGE_LOW;
 211                 sopt.sopt_level = IPPROTO_IP;
 212                 sopt.sopt_name = IP_PORTRANGE;
 213                 sopt.sopt_val = (void *)&ip;
 214                 sopt.sopt_valsize = sizeof(ip);
 215                 sopt.sopt_td = NULL;
 216                 error = sosetopt(so, &sopt);
 217                 if (error)
 218                         goto bad;
 219                 bzero(&ssin, sizeof ssin);
 220                 sin = &ssin;
 221                 sin->sin_len = sizeof (struct sockaddr_in);
 222                 sin->sin_family = AF_INET;
 223                 sin->sin_addr.s_addr = INADDR_ANY;
 224                 sin->sin_port = htons(0);
 225                 error = sobind(so, (struct sockaddr *)sin, td);
 226                 if (error)
 227                         goto bad;
 228                 bzero(&sopt, sizeof sopt);
 229                 ip = IP_PORTRANGE_DEFAULT;
 230                 sopt.sopt_level = IPPROTO_IP;
 231                 sopt.sopt_name = IP_PORTRANGE;
 232                 sopt.sopt_val = (void *)&ip;
 233                 sopt.sopt_valsize = sizeof(ip);
 234                 sopt.sopt_td = NULL;
 235                 error = sosetopt(so, &sopt);
 236                 if (error)
 237                         goto bad;
 238         }
 239
 240         /*
 241          * Protocols that do not require connections may be optionally left
 242          * unconnected for servers that reply from a port other than NFS_PORT.
 243          */
 244         if (nmp->nm_flag & NFSMNT_NOCONN) {
 245                 if (nmp->nm_soflags & PR_CONNREQUIRED) {
 246                         error = ENOTCONN;
 247                         goto bad;
 248                 }
 249         } else {
 250                 error = soconnect(so, nmp->nm_nam, td);
 251                 if (error)
 252                         goto bad;
 253
 254                 /*
 255                  * Wait for the connection to complete. Cribbed from the
 256                  * connect system call but with the wait timing out so
 257                  * that interruptible mounts don't hang here for a long time.
 258                  */
 259                 crit_enter();
 260                 while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) {
 261                         (void) tsleep((caddr_t)&so->so_timeo, 0,
 262                                 "nfscon", 2 * hz);
 263                         if ((so->so_state & SS_ISCONNECTING) &&
 264                             so->so_error == 0 && rep &&
 265                             (error = nfs_sigintr(nmp, rep, rep->r_td)) != 0){
 266                                 so->so_state &= ~SS_ISCONNECTING;
 267                                 crit_exit();
 268                                 goto bad;
 269                         }
 270                 }
 271                 if (so->so_error) {
 272                         error = so->so_error;
 273                         so->so_error = 0;
 274                         crit_exit();
 275                         goto bad;
 276                 }
 277                 crit_exit();
 278         }
 279         so->so_rcv.ssb_timeo = (5 * hz);
 280         so->so_snd.ssb_timeo = (5 * hz);
 281
 282         /*
 283          * Get buffer reservation size from sysctl, but impose reasonable
 284          * limits.
 285          */
 286         pktscale = nfs_bufpackets;
 287         if (pktscale < 2)
 288                 pktscale = 2;
 289         if (pktscale > 64)
 290                 pktscale = 64;
 291
 292         if (nmp->nm_sotype == SOCK_DGRAM) {
 293                 sndreserve = (nmp->nm_wsize + NFS_MAXPKTHDR) * pktscale;
 294                 rcvreserve = (max(nmp->nm_rsize, nmp->nm_readdirsize) +
 295                     NFS_MAXPKTHDR) * pktscale;
 296         } else if (nmp->nm_sotype == SOCK_SEQPACKET) {
 297                 sndreserve = (nmp->nm_wsize + NFS_MAXPKTHDR) * pktscale;
 298                 rcvreserve = (max(nmp->nm_rsize, nmp->nm_readdirsize) +
 299                     NFS_MAXPKTHDR) * pktscale;
 300         } else {
 301                 if (nmp->nm_sotype != SOCK_STREAM)
 302                         panic("nfscon sotype");
 303                 if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
 304                         struct sockopt sopt;
 305                         int val;
 306
 307                         bzero(&sopt, sizeof sopt);
 308                         sopt.sopt_level = SOL_SOCKET;
 309                         sopt.sopt_name = SO_KEEPALIVE;
 310                         sopt.sopt_val = &val;
 311                         sopt.sopt_valsize = sizeof val;
 312                         val = 1;
 313                         sosetopt(so, &sopt);
 314                 }
 315                 if (so->so_proto->pr_protocol == IPPROTO_TCP) {
 316                         struct sockopt sopt;
 317                         int val;
 318
 319                         bzero(&sopt, sizeof sopt);
 320                         sopt.sopt_level = IPPROTO_TCP;
 321                         sopt.sopt_name = TCP_NODELAY;
 322                         sopt.sopt_val = &val;
 323                         sopt.sopt_valsize = sizeof val;
 324                         val = 1;
 325                         sosetopt(so, &sopt);
 326                 }
 327                 sndreserve = (nmp->nm_wsize + NFS_MAXPKTHDR +
 328                     sizeof (u_int32_t)) * pktscale;
 329                 rcvreserve = (nmp->nm_rsize + NFS_MAXPKTHDR +
 330                     sizeof (u_int32_t)) * pktscale;
 331         }
 332         error = soreserve(so, sndreserve, rcvreserve,
 333                           &td->td_proc->p_rlimit[RLIMIT_SBSIZE]);
 334         if (error)
 335                 goto bad;
 336         so->so_rcv.ssb_flags |= SSB_NOINTR;
 337         so->so_snd.ssb_flags |= SSB_NOINTR;
 338
 339         /* Initialize other non-zero congestion variables */
 340         nmp->nm_srtt[0] = nmp->nm_srtt[1] = nmp->nm_srtt[2] =
 341                 nmp->nm_srtt[3] = (NFS_TIMEO << NFS_RTT_SCALE_BITS);
 342         nmp->nm_sdrtt[0] = nmp->nm_sdrtt[1] = nmp->nm_sdrtt[2] =
 343                 nmp->nm_sdrtt[3] = 0;
 344         nmp->nm_maxasync_scaled = NFS_MINASYNC_SCALED;
 345         nmp->nm_timeouts = 0;
 346         return (0);
 347
 348 bad:
 349         nfs_disconnect(nmp);
 350         return (error);
 351 }
 352
 353 /*
 354  * Reconnect routine:
 355  * Called when a connection is broken on a reliable protocol.
 356  * - clean up the old socket
 357  * - nfs_connect() again
 358  * - set R_NEEDSXMIT for all outstanding requests on mount point
 359  * If this fails the mount point is DEAD!
 360  * nb: Must be called with the nfs_sndlock() set on the mount point.
 361  */
 362 static int
 363 nfs_reconnect(struct nfsmount *nmp, struct nfsreq *rep)
 364 {
 365         struct nfsreq *req;
 366         int error;
 367
 368         nfs_disconnect(nmp);
 369         while ((error = nfs_connect(nmp, rep)) != 0) {
 370                 if (error == EINTR || error == ERESTART)
 371                         return (EINTR);
 372                 (void) tsleep((caddr_t)&lbolt, 0, "nfscon", 0);
 373         }
 374
 375         /*
 376          * Loop through outstanding request list and fix up all requests
 377          * on old socket.
 378          */
 379         crit_enter();
 380         TAILQ_FOREACH(req, &nmp->nm_reqq, r_chain) {
 381                 KKASSERT(req->r_nmp == nmp);
 382                 req->r_flags |= R_NEEDSXMIT;
 383         }
 384         crit_exit();
 385         return (0);
 386 }
 387
 388 /*
 389  * NFS disconnect. Clean up and unlink.
 390  */
 391 void
 392 nfs_disconnect(struct nfsmount *nmp)
 393 {
 394         struct socket *so;
 395
 396         if (nmp->nm_so) {
 397                 so = nmp->nm_so;
 398                 nmp->nm_so = NULL;
 399                 soshutdown(so, SHUT_RDWR);
 400                 soclose(so, FNONBLOCK);
 401         }
 402 }
 403
 404 void
 405 nfs_safedisconnect(struct nfsmount *nmp)
 406 {
 407         nfs_rcvlock(nmp, NULL);
 408         nfs_disconnect(nmp);
 409         nfs_rcvunlock(nmp);
 410 }
 411
 412 /*
 413  * This is the nfs send routine. For connection based socket types, it
 414  * must be called with an nfs_sndlock() on the socket.
 415  * "rep == NULL" indicates that it has been called from a server.
 416  * For the client side:
 417  * - return EINTR if the RPC is terminated, 0 otherwise
 418  * - set R_NEEDSXMIT if the send fails for any reason
 419  * - do any cleanup required by recoverable socket errors (?)
 420  * For the server side:
 421  * - return EINTR or ERESTART if interrupted by a signal
 422  * - return EPIPE if a connection is lost for connection based sockets (TCP...)
 423  * - do any cleanup required by recoverable socket errors (?)
 424  */
 425 int
 426 nfs_send(struct socket *so, struct sockaddr *nam, struct mbuf *top,
 427          struct nfsreq *rep)
 428 {
 429         struct sockaddr *sendnam;
 430         int error, soflags, flags;
 431
 432         if (rep) {
 433                 if (rep->r_flags & R_SOFTTERM) {
 434                         m_freem(top);
 435                         return (EINTR);
 436                 }
 437                 if ((so = rep->r_nmp->nm_so) == NULL) {
 438                         rep->r_flags |= R_NEEDSXMIT;
 439                         m_freem(top);
 440                         return (0);
 441                 }
 442                 rep->r_flags &= ~R_NEEDSXMIT;
 443                 soflags = rep->r_nmp->nm_soflags;
 444         } else {
 445                 soflags = so->so_proto->pr_flags;
 446         }
 447         if ((soflags & PR_CONNREQUIRED) || (so->so_state & SS_ISCONNECTED))
 448                 sendnam = NULL;
 449         else
 450                 sendnam = nam;
 451         if (so->so_type == SOCK_SEQPACKET)
 452                 flags = MSG_EOR;
 453         else
 454                 flags = 0;
 455
 456         error = so_pru_sosend(so, sendnam, NULL, top, NULL, flags,
 457             curthread /*XXX*/);
 458         /*
 459          * ENOBUFS for dgram sockets is transient and non fatal.
 460          * No need to log, and no need to break a soft mount.
 461          */
 462         if (error == ENOBUFS && so->so_type == SOCK_DGRAM) {
 463                 error = 0;
 464                 /*
 465                  * do backoff retransmit on client
 466                  */
 467                 if (rep)
 468                         rep->r_flags |= R_NEEDSXMIT;
 469         }
 470
 471         if (error) {
 472                 if (rep) {
 473                         log(LOG_INFO, "nfs send error %d for server %s\n",error,
 474                             rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname);
 475                         /*
 476                          * Deal with errors for the client side.
 477                          */
 478                         if (rep->r_flags & R_SOFTTERM)
 479                                 error = EINTR;
 480                         else
 481                                 rep->r_flags |= R_NEEDSXMIT;
 482                 } else {
 483                         log(LOG_INFO, "nfsd send error %d\n", error);
 484                 }
 485
 486                 /*
 487                  * Handle any recoverable (soft) socket errors here. (?)
 488                  */
 489                 if (error != EINTR && error != ERESTART &&
 490                         error != EWOULDBLOCK && error != EPIPE)
 491                         error = 0;
 492         }
 493         return (error);
 494 }
 495
 496 /*
 497  * Receive a Sun RPC Request/Reply. For SOCK_DGRAM, the work is all
 498  * done by soreceive(), but for SOCK_STREAM we must deal with the Record
 499  * Mark and consolidate the data into a new mbuf list.
 500  * nb: Sometimes TCP passes the data up to soreceive() in long lists of
 501  *     small mbufs.
 502  * For SOCK_STREAM we must be very careful to read an entire record once
 503  * we have read any of it, even if the system call has been interrupted.
 504  */
 505 static int
 506 nfs_receive(struct nfsmount *nmp, struct nfsreq *rep,
 507             struct sockaddr **aname, struct mbuf **mp)
 508 {
 509         struct socket *so;
 510         struct sockbuf sio;
 511         struct uio auio;
 512         struct iovec aio;
 513         struct mbuf *m;
 514         struct mbuf *control;
 515         u_int32_t len;
 516         struct sockaddr **getnam;
 517         int error, sotype, rcvflg;
 518         struct thread *td = curthread;  /* XXX */
 519
 520         /*
 521          * Set up arguments for soreceive()
 522          */
 523         *mp = NULL;
 524         *aname = NULL;
 525         sotype = nmp->nm_sotype;
 526
 527         /*
 528          * For reliable protocols, lock against other senders/receivers
 529          * in case a reconnect is necessary.
 530          * For SOCK_STREAM, first get the Record Mark to find out how much
 531          * more there is to get.
 532          * We must lock the socket against other receivers
 533          * until we have an entire rpc request/reply.
 534          */
 535         if (sotype != SOCK_DGRAM) {
 536                 error = nfs_sndlock(nmp, rep);
 537                 if (error)
 538                         return (error);
 539 tryagain:
 540                 /*
 541                  * Check for fatal errors and resending request.
 542                  */
 543                 /*
 544                  * Ugh: If a reconnect attempt just happened, nm_so
 545                  * would have changed. NULL indicates a failed
 546                  * attempt that has essentially shut down this
 547                  * mount point.
 548                  */
 549                 if (rep && (rep->r_mrep || (rep->r_flags & R_SOFTTERM))) {
 550                         nfs_sndunlock(nmp);
 551                         return (EINTR);
 552                 }
 553                 so = nmp->nm_so;
 554                 if (so == NULL) {
 555                         error = nfs_reconnect(nmp, rep);
 556                         if (error) {
 557                                 nfs_sndunlock(nmp);
 558                                 return (error);
 559                         }
 560                         goto tryagain;
 561                 }
 562                 while (rep && (rep->r_flags & R_NEEDSXMIT)) {
 563                         m = m_copym(rep->r_mreq, 0, M_COPYALL, MB_WAIT);
 564                         nfsstats.rpcretries++;
 565                         error = nfs_send(so, rep->r_nmp->nm_nam, m, rep);
 566                         if (error) {
 567                                 if (error == EINTR || error == ERESTART ||
 568                                     (error = nfs_reconnect(nmp, rep)) != 0) {
 569                                         nfs_sndunlock(nmp);
 570                                         return (error);
 571                                 }
 572                                 goto tryagain;
 573                         }
 574                 }
 575                 nfs_sndunlock(nmp);
 576                 if (sotype == SOCK_STREAM) {
 577                         /*
 578                          * Get the length marker from the stream
 579                          */
 580                         aio.iov_base = (caddr_t)&len;
 581                         aio.iov_len = sizeof(u_int32_t);
 582                         auio.uio_iov = &aio;
 583                         auio.uio_iovcnt = 1;
 584                         auio.uio_segflg = UIO_SYSSPACE;
 585                         auio.uio_rw = UIO_READ;
 586                         auio.uio_offset = 0;
 587                         auio.uio_resid = sizeof(u_int32_t);
 588                         auio.uio_td = td;
 589                         do {
 590                            rcvflg = MSG_WAITALL;
 591                            error = so_pru_soreceive(so, NULL, &auio, NULL,
 592                                                     NULL, &rcvflg);
 593                            if (error == EWOULDBLOCK && rep) {
 594                                 if (rep->r_flags & R_SOFTTERM)
 595                                         return (EINTR);
 596                            }
 597                         } while (error == EWOULDBLOCK);
 598
 599                         if (error == 0 && auio.uio_resid > 0) {
 600                             /*
 601                              * Only log short packets if not EOF
 602                              */
 603                             if (auio.uio_resid != sizeof(u_int32_t))
 604                             log(LOG_INFO,
 605                                  "short receive (%d/%d) from nfs server %s\n",
 606                                  (int)(sizeof(u_int32_t) - auio.uio_resid),
 607                                  (int)sizeof(u_int32_t),
 608                                  nmp->nm_mountp->mnt_stat.f_mntfromname);
 609                             error = EPIPE;
 610                         }
 611                         if (error)
 612                                 goto errout;
 613                         len = ntohl(len) & ~0x80000000;
 614                         /*
 615                          * This is SERIOUS! We are out of sync with the sender
 616                          * and forcing a disconnect/reconnect is all I can do.
 617                          */
 618                         if (len > NFS_MAXPACKET) {
 619                             log(LOG_ERR, "%s (%d) from nfs server %s\n",
 620                                 "impossible packet length",
 621                                 len,
 622                                 nmp->nm_mountp->mnt_stat.f_mntfromname);
 623                             error = EFBIG;
 624                             goto errout;
 625                         }
 626
 627                         /*
 628                          * Get the rest of the packet as an mbuf chain
 629                          */
 630                         sbinit(&sio, len);
 631                         do {
 632                             rcvflg = MSG_WAITALL;
 633                             error = so_pru_soreceive(so, NULL, NULL, &sio,
 634                                                      NULL, &rcvflg);
 635                         } while (error == EWOULDBLOCK || error == EINTR ||
 636                                  error == ERESTART);
 637                         if (error == 0 && sio.sb_cc != len) {
 638                             if (sio.sb_cc != 0)
 639                             log(LOG_INFO,
 640                                 "short receive (%d/%d) from nfs server %s\n",
 641                                 len - auio.uio_resid, len,
 642                                 nmp->nm_mountp->mnt_stat.f_mntfromname);
 643                             error = EPIPE;
 644                         }
 645                         *mp = sio.sb_mb;
 646                 } else {
 647                         /*
 648                          * Non-stream, so get the whole packet by not
 649                          * specifying MSG_WAITALL and by specifying a large
 650                          * length.
 651                          *
 652                          * We have no use for control msg., but must grab them
 653                          * and then throw them away so we know what is going
 654                          * on.
 655                          */
 656                         sbinit(&sio, 100000000);
 657                         do {
 658                             rcvflg = 0;
 659                             error =  so_pru_soreceive(so, NULL, NULL, &sio,
 660                                                       &control, &rcvflg);
 661                             if (control)
 662                                 m_freem(control);
 663                             if (error == EWOULDBLOCK && rep) {
 664                                 if (rep->r_flags & R_SOFTTERM) {
 665                                         m_freem(sio.sb_mb);
 666                                         return (EINTR);
 667                                 }
 668                             }
 669                         } while (error == EWOULDBLOCK ||
 670                                  (error == 0 && sio.sb_mb == NULL && control));
 671                         if ((rcvflg & MSG_EOR) == 0)
 672                                 kprintf("Egad!!\n");
 673                         if (error == 0 && sio.sb_mb == NULL)
 674                                 error = EPIPE;
 675                         len = sio.sb_cc;
 676                         *mp = sio.sb_mb;
 677                 }
 678 errout:
 679                 if (error && error != EINTR && error != ERESTART) {
 680                         m_freem(*mp);
 681                         *mp = NULL;
 682                         if (error != EPIPE) {
 683                                 log(LOG_INFO,
 684                                     "receive error %d from nfs server %s\n",
 685                                     error,
 686                                  nmp->nm_mountp->mnt_stat.f_mntfromname);
 687                         }
 688                         error = nfs_sndlock(nmp, rep);
 689                         if (!error) {
 690                                 error = nfs_reconnect(nmp, rep);
 691                                 if (!error)
 692                                         goto tryagain;
 693                                 else
 694                                         nfs_sndunlock(nmp);
 695                         }
 696                 }
 697         } else {
 698                 if ((so = nmp->nm_so) == NULL)
 699                         return (EACCES);
 700                 if (so->so_state & SS_ISCONNECTED)
 701                         getnam = NULL;
 702                 else
 703                         getnam = aname;
 704                 sbinit(&sio, 100000000);
 705                 do {
 706                         rcvflg = 0;
 707                         error =  so_pru_soreceive(so, getnam, NULL, &sio,
 708                                                   NULL, &rcvflg);
 709                         if (error == EWOULDBLOCK && rep &&
 710                             (rep->r_flags & R_SOFTTERM)) {
 711                                 m_freem(sio.sb_mb);
 712                                 return (EINTR);
 713                         }
 714                 } while (error == EWOULDBLOCK);
 715
 716                 len = sio.sb_cc;
 717                 *mp = sio.sb_mb;
 718
 719                 /*
 720                  * A shutdown may result in no error and no mbuf.
 721                  * Convert to EPIPE.
 722                  */
 723                 if (*mp == NULL && error == 0)
 724                         error = EPIPE;
 725         }
 726         if (error) {
 727                 m_freem(*mp);
 728                 *mp = NULL;
 729         }
 730
 731         /*
 732          * Search for any mbufs that are not a multiple of 4 bytes long
 733          * or with m_data not longword aligned.
 734          * These could cause pointer alignment problems, so copy them to
 735          * well aligned mbufs.
 736          */
 737         nfs_realign(mp, 5 * NFSX_UNSIGNED);
 738         return (error);
 739 }
 740
 741 /*
 742  * Implement receipt of reply on a socket.
 743  *
 744  * We must search through the list of received datagrams matching them
 745  * with outstanding requests using the xid, until ours is found.
 746  *
 747  * If myrep is NULL we process packets on the socket until
 748  * interrupted or until nm_reqrxq is non-empty.
 749  */
 750 /* ARGSUSED */
 751 int
 752 nfs_reply(struct nfsmount *nmp, struct nfsreq *myrep)
 753 {
 754         struct nfsreq *rep;
 755         struct sockaddr *nam;
 756         u_int32_t rxid;
 757         u_int32_t *tl;
 758         int error;
 759         struct nfsm_info info;
 760
 761         /*
 762          * Loop around until we get our own reply
 763          */
 764         for (;;) {
 765                 /*
 766                  * Lock against other receivers so that I don't get stuck in
 767                  * sbwait() after someone else has received my reply for me.
 768                  * Also necessary for connection based protocols to avoid
 769                  * race conditions during a reconnect.
 770                  *
 771                  * If nfs_rcvlock() returns EALREADY, that means that
 772                  * the reply has already been recieved by another
 773                  * process and we can return immediately.  In this
 774                  * case, the lock is not taken to avoid races with
 775                  * other processes.
 776                  */
 777                 info.mrep = NULL;
 778
 779                 error = nfs_rcvlock(nmp, myrep);
 780                 if (error == EALREADY)
 781                         return (0);
 782                 if (error)
 783                         return (error);
 784
 785                 /*
 786                  * If myrep is NULL we are the receiver helper thread.
 787                  * Stop waiting for incoming replies if there are
 788                  * messages sitting on reqrxq that we need to process,
 789                  * or if a shutdown request is pending.
 790                  */
 791                 if (myrep == NULL && (TAILQ_FIRST(&nmp->nm_reqrxq) ||
 792                     nmp->nm_rxstate > NFSSVC_PENDING)) {
 793                         nfs_rcvunlock(nmp);
 794                         return(EWOULDBLOCK);
 795                 }
 796
 797                 /*
 798                  * Get the next Rpc reply off the socket
 799                  *
 800                  * We cannot release the receive lock until we've
 801                  * filled in rep->r_mrep, otherwise a waiting
 802                  * thread may deadlock in soreceive with no incoming
 803                  * packets expected.
 804                  */
 805                 error = nfs_receive(nmp, myrep, &nam, &info.mrep);
 806                 if (error) {
 807                         /*
 808                          * Ignore routing errors on connectionless protocols??
 809                          */
 810                         nfs_rcvunlock(nmp);
 811                         if (NFSIGNORE_SOERROR(nmp->nm_soflags, error)) {
 812                                 if (nmp->nm_so == NULL)
 813                                         return (error);
 814                                 nmp->nm_so->so_error = 0;
 815                                 continue;
 816                         }
 817                         return (error);
 818                 }
 819                 if (nam)
 820                         FREE(nam, M_SONAME);
 821
 822                 /*
 823                  * Get the xid and check that it is an rpc reply
 824                  */
 825                 info.md = info.mrep;
 826                 info.dpos = mtod(info.md, caddr_t);
 827                 NULLOUT(tl = nfsm_dissect(&info, 2*NFSX_UNSIGNED));
 828                 rxid = *tl++;
 829                 if (*tl != rpc_reply) {
 830                         nfsstats.rpcinvalid++;
 831                         m_freem(info.mrep);
 832                         info.mrep = NULL;
 833 nfsmout:
 834                         nfs_rcvunlock(nmp);
 835                         continue;
 836                 }
 837
 838                 /*
 839                  * Loop through the request list to match up the reply
 840                  * Iff no match, just drop the datagram.  On match, set
 841                  * r_mrep atomically to prevent the timer from messing
 842                  * around with the request after we have exited the critical
 843                  * section.
 844                  */
 845                 crit_enter();
 846                 TAILQ_FOREACH(rep, &nmp->nm_reqq, r_chain) {
 847                         if (rep->r_mrep == NULL && rxid == rep->r_xid)
 848                                 break;
 849                 }
 850
 851                 /*
 852                  * Fill in the rest of the reply if we found a match.
 853                  */
 854                 if (rep) {
 855                         rep->r_md = info.md;
 856                         rep->r_dpos = info.dpos;
 857                         if (nfsrtton) {
 858                                 struct rttl *rt;
 859
 860                                 rt = &nfsrtt.rttl[nfsrtt.pos];
 861                                 rt->proc = rep->r_procnum;
 862                                 rt->rto = 0;
 863                                 rt->sent = 0;
 864                                 rt->cwnd = nmp->nm_maxasync_scaled;
 865                                 rt->srtt = nmp->nm_srtt[proct[rep->r_procnum] - 1];
 866                                 rt->sdrtt = nmp->nm_sdrtt[proct[rep->r_procnum] - 1];
 867                                 rt->fsid = nmp->nm_mountp->mnt_stat.f_fsid;
 868                                 getmicrotime(&rt->tstamp);
 869                                 if (rep->r_flags & R_TIMING)
 870                                         rt->rtt = rep->r_rtt;
 871                                 else
 872                                         rt->rtt = 1000000;
 873                                 nfsrtt.pos = (nfsrtt.pos + 1) % NFSRTTLOGSIZ;
 874                         }
 875
 876                         /*
 877                          * New congestion control is based only on async
 878                          * requests.
 879                          */
 880                         if (nmp->nm_maxasync_scaled < NFS_MAXASYNC_SCALED)
 881                                 ++nmp->nm_maxasync_scaled;
 882                         if (rep->r_flags & R_SENT) {
 883                                 rep->r_flags &= ~R_SENT;
 884                         }
 885                         /*
 886                          * Update rtt using a gain of 0.125 on the mean
 887                          * and a gain of 0.25 on the deviation.
 888                          *
 889                          * NOTE SRTT/SDRTT are only good if R_TIMING is set.
 890                          */
 891                         if (rep->r_flags & R_TIMING) {
 892                                 /*
 893                                  * Since the timer resolution of
 894                                  * NFS_HZ is so course, it can often
 895                                  * result in r_rtt == 0. Since
 896                                  * r_rtt == N means that the actual
 897                                  * rtt is between N+dt and N+2-dt ticks,
 898                                  * add 1.
 899                                  */
 900                                 int n;
 901                                 int d;
 902
 903 #define NFSRSB  NFS_RTT_SCALE_BITS
 904                                 n = ((NFS_SRTT(rep) * 7) +
 905                                      (rep->r_rtt << NFSRSB)) >> 3;
 906                                 d = n - NFS_SRTT(rep);
 907                                 NFS_SRTT(rep) = n;
 908
 909                                 /*
 910                                  * Don't let the jitter calculation decay
 911                                  * too quickly, but we want a fast rampup.
 912                                  */
 913                                 if (d < 0)
 914                                         d = -d;
 915                                 d <<= NFSRSB;
 916                                 if (d < NFS_SDRTT(rep))
 917                                         n = ((NFS_SDRTT(rep) * 15) + d) >> 4;
 918                                 else
 919                                         n = ((NFS_SDRTT(rep) * 3) + d) >> 2;
 920                                 NFS_SDRTT(rep) = n;
 921 #undef NFSRSB
 922                         }
 923                         nmp->nm_timeouts = 0;
 924                         rep->r_mrep = info.mrep;
 925                         nfs_hardterm(rep, 0);
 926                 }
 927                 nfs_rcvunlock(nmp);
 928                 crit_exit();
 929
 930                 /*
 931                  * If not matched to a request, drop it.
 932                  * If it's mine, get out.
 933                  */
 934                 if (rep == NULL) {
 935                         nfsstats.rpcunexpected++;
 936                         m_freem(info.mrep);
 937                         info.mrep = NULL;
 938                 } else if (rep == myrep) {
 939                         if (rep->r_mrep == NULL)
 940                                 panic("nfsreply nil");
 941                         return (0);
 942                 }
 943         }
 944 }
 945
 946 /*
 947  * Run the request state machine until the target state is reached
 948  * or a fatal error occurs.  The target state is not run.  Specifying
 949  * a target of NFSM_STATE_DONE runs the state machine until the rpc
 950  * is complete.
 951  *
 952  * EINPROGRESS is returned for all states other then the DONE state,
 953  * indicating that the rpc is still in progress.
 954  */
 955 int
 956 nfs_request(struct nfsm_info *info, nfsm_state_t bstate, nfsm_state_t estate)
 957 {
 958         struct nfsreq *req;
 959
 960         while (info->state >= bstate && info->state < estate) {
 961                 switch(info->state) {
 962                 case NFSM_STATE_SETUP:
 963                         /*
 964                          * Setup the nfsreq.  Any error which occurs during
 965                          * this state is fatal.
 966                          */
 967                         info->error = nfs_request_setup(info);
 968                         if (info->error) {
 969                                 info->state = NFSM_STATE_DONE;
 970                                 return (info->error);
 971                         } else {
 972                                 req = info->req;
 973                                 req->r_mrp = &info->mrep;
 974                                 req->r_mdp = &info->md;
 975                                 req->r_dposp = &info->dpos;
 976                                 info->state = NFSM_STATE_AUTH;
 977                         }
 978                         break;
 979                 case NFSM_STATE_AUTH:
 980                         /*
 981                          * Authenticate the nfsreq.  Any error which occurs
 982                          * during this state is fatal.
 983                          */
 984                         info->error = nfs_request_auth(info->req);
 985                         if (info->error) {
 986                                 info->state = NFSM_STATE_DONE;
 987                                 return (info->error);
 988                         } else {
 989                                 info->state = NFSM_STATE_TRY;
 990                         }
 991                         break;
 992                 case NFSM_STATE_TRY:
 993                         /*
 994                          * Transmit or retransmit attempt.  An error in this
 995                          * state is ignored and we always move on to the
 996                          * next state.
 997                          *
 998                          * This can trivially race the receiver if the
 999                          * request is asynchronous.  nfs_request_try()
1000                          * will thus set the state for us and we
1001                          * must also return immediately if we are
1002                          * running an async state machine, because
1003                          * info can become invalid due to races after
1004                          * try() returns.
1005                          */
1006                         if (info->req->r_flags & R_ASYNC) {
1007                                 nfs_request_try(info->req);
1008                                 if (estate == NFSM_STATE_WAITREPLY)
1009                                         return (EINPROGRESS);
1010                         } else {
1011                                 nfs_request_try(info->req);
1012                                 info->state = NFSM_STATE_WAITREPLY;
1013                         }
1014                         break;
1015                 case NFSM_STATE_WAITREPLY:
1016                         /*
1017                          * Wait for a reply or timeout and move on to the
1018                          * next state.  The error returned by this state
1019                          * is passed to the processing code in the next
1020                          * state.
1021                          */
1022                         info->error = nfs_request_waitreply(info->req);
1023                         info->state = NFSM_STATE_PROCESSREPLY;
1024                         break;
1025                 case NFSM_STATE_PROCESSREPLY:
1026                         /*
1027                          * Process the reply or timeout.  Errors which occur
1028                          * in this state may cause the state machine to
1029                          * go back to an earlier state, and are fatal
1030                          * otherwise.
1031                          */
1032                         info->error = nfs_request_processreply(info,
1033                                                                info->error);
1034                         switch(info->error) {
1035                         case ENEEDAUTH:
1036                                 info->state = NFSM_STATE_AUTH;
1037                                 break;
1038                         case EAGAIN:
1039                                 info->state = NFSM_STATE_TRY;
1040                                 break;
1041                         default:
1042                                 /*
1043                                  * Operation complete, with or without an
1044                                  * error.  We are done.
1045                                  */
1046                                 info->req = NULL;
1047                                 info->state = NFSM_STATE_DONE;
1048                                 return (info->error);
1049                         }
1050                         break;
1051                 case NFSM_STATE_DONE:
1052                         /*
1053                          * Shouldn't be reached
1054                          */
1055                         return (info->error);
1056                         /* NOT REACHED */
1057                 }
1058         }
1059
1060         /*
1061          * If we are done return the error code (if any).
1062          * Otherwise return EINPROGRESS.
1063          */
1064         if (info->state == NFSM_STATE_DONE)
1065                 return (info->error);
1066         return (EINPROGRESS);
1067 }
1068
1069 /*
1070  * nfs_request - goes something like this
1071  *      - fill in request struct
1072  *      - links it into list
1073  *      - calls nfs_send() for first transmit
1074  *      - calls nfs_receive() to get reply
1075  *      - break down rpc header and return with nfs reply pointed to
1076  *        by mrep or error
1077  * nb: always frees up mreq mbuf list
1078  */
1079 static int
1080 nfs_request_setup(nfsm_info_t info)
1081 {
1082         struct nfsreq *req;
1083         struct nfsmount *nmp;
1084         struct mbuf *m;
1085         int i;
1086
1087         /*
1088          * Reject requests while attempting a forced unmount.
1089          */
1090         if (info->vp->v_mount->mnt_kern_flag & MNTK_UNMOUNTF) {
1091                 m_freem(info->mreq);
1092                 info->mreq = NULL;
1093                 return (ESTALE);
1094         }
1095         nmp = VFSTONFS(info->vp->v_mount);
1096         req = kmalloc(sizeof(struct nfsreq), M_NFSREQ, M_WAITOK);
1097         req->r_nmp = nmp;
1098         req->r_vp = info->vp;
1099         req->r_td = info->td;
1100         req->r_procnum = info->procnum;
1101         req->r_mreq = NULL;
1102         req->r_cred = info->cred;
1103
1104         i = 0;
1105         m = info->mreq;
1106         while (m) {
1107                 i += m->m_len;
1108                 m = m->m_next;
1109         }
1110         req->r_mrest = info->mreq;
1111         req->r_mrest_len = i;
1112
1113         /*
1114          * The presence of a non-NULL r_info in req indicates
1115          * async completion via our helper threads.  See the receiver
1116          * code.
1117          */
1118         if (info->bio) {
1119                 req->r_info = info;
1120                 req->r_flags = R_ASYNC;
1121         } else {
1122                 req->r_info = NULL;
1123                 req->r_flags = 0;
1124         }
1125         info->req = req;
1126         return(0);
1127 }
1128
1129 static int
1130 nfs_request_auth(struct nfsreq *rep)
1131 {
1132         struct nfsmount *nmp = rep->r_nmp;
1133         struct mbuf *m;
1134         char nickv[RPCX_NICKVERF];
1135         int error = 0, auth_len, auth_type;
1136         int verf_len;
1137         u_int32_t xid;
1138         char *auth_str, *verf_str;
1139         struct ucred *cred;
1140
1141         cred = rep->r_cred;
1142         rep->r_failed_auth = 0;
1143
1144         /*
1145          * Get the RPC header with authorization.
1146          */
1147         verf_str = auth_str = NULL;
1148         if (nmp->nm_flag & NFSMNT_KERB) {
1149                 verf_str = nickv;
1150                 verf_len = sizeof (nickv);
1151                 auth_type = RPCAUTH_KERB4;
1152                 bzero((caddr_t)rep->r_key, sizeof(rep->r_key));
1153                 if (rep->r_failed_auth ||
1154                     nfs_getnickauth(nmp, cred, &auth_str, &auth_len,
1155                                     verf_str, verf_len)) {
1156                         error = nfs_getauth(nmp, rep, cred, &auth_str,
1157                                 &auth_len, verf_str, &verf_len, rep->r_key);
1158                         if (error) {
1159                                 m_freem(rep->r_mrest);
1160                                 rep->r_mrest = NULL;
1161                                 kfree((caddr_t)rep, M_NFSREQ);
1162                                 return (error);
1163                         }
1164                 }
1165         } else {
1166                 auth_type = RPCAUTH_UNIX;
1167                 if (cred->cr_ngroups < 1)
1168                         panic("nfsreq nogrps");
1169                 auth_len = ((((cred->cr_ngroups - 1) > nmp->nm_numgrps) ?
1170                         nmp->nm_numgrps : (cred->cr_ngroups - 1)) << 2) +
1171                         5 * NFSX_UNSIGNED;
1172         }
1173         m = nfsm_rpchead(cred, nmp->nm_flag, rep->r_procnum, auth_type,
1174                         auth_len, auth_str, verf_len, verf_str,
1175                         rep->r_mrest, rep->r_mrest_len, &rep->r_mheadend, &xid);
1176         rep->r_mrest = NULL;
1177         if (auth_str)
1178                 kfree(auth_str, M_TEMP);
1179
1180         /*
1181          * For stream protocols, insert a Sun RPC Record Mark.
1182          */
1183         if (nmp->nm_sotype == SOCK_STREAM) {
1184                 M_PREPEND(m, NFSX_UNSIGNED, MB_WAIT);
1185                 if (m == NULL) {
1186                         kfree(rep, M_NFSREQ);
1187                         return (ENOBUFS);
1188                 }
1189                 *mtod(m, u_int32_t *) = htonl(0x80000000 |
1190                          (m->m_pkthdr.len - NFSX_UNSIGNED));
1191         }
1192         rep->r_mreq = m;
1193         rep->r_xid = xid;
1194         return (0);
1195 }
1196
1197 static int
1198 nfs_request_try(struct nfsreq *rep)
1199 {
1200         struct nfsmount *nmp = rep->r_nmp;
1201         struct mbuf *m2;
1202         int error;
1203
1204         /*
1205          * Request is not on any queue, only the owner has access to it
1206          * so it should not be locked by anyone atm.
1207          *
1208          * Interlock to prevent races.  While locked the only remote
1209          * action possible is for r_mrep to be set (once we enqueue it).
1210          */
1211         if (rep->r_flags == 0xdeadc0de) {
1212                 print_backtrace();
1213                 panic("flags nbad\n");
1214         }
1215         KKASSERT((rep->r_flags & (R_LOCKED | R_ONREQQ)) == 0);
1216         if (nmp->nm_flag & NFSMNT_SOFT)
1217                 rep->r_retry = nmp->nm_retry;
1218         else
1219                 rep->r_retry = NFS_MAXREXMIT + 1;       /* past clip limit */
1220         rep->r_rtt = rep->r_rexmit = 0;
1221         if (proct[rep->r_procnum] > 0)
1222                 rep->r_flags |= R_TIMING | R_LOCKED;
1223         else
1224                 rep->r_flags |= R_LOCKED;
1225         rep->r_mrep = NULL;
1226
1227         /*
1228          * Do the client side RPC.
1229          */
1230         nfsstats.rpcrequests++;
1231
1232         /*
1233          * Chain request into list of outstanding requests. Be sure
1234          * to put it LAST so timer finds oldest requests first.  Note
1235          * that our control of R_LOCKED prevents the request from
1236          * getting ripped out from under us or transmitted by the
1237          * timer code.
1238          *
1239          * For requests with info structures we must atomically set the
1240          * info's state because the structure could become invalid upon
1241          * return due to races (i.e., if async)
1242          */
1243         crit_enter();
1244         mtx_link_init(&rep->r_link);
1245         TAILQ_INSERT_TAIL(&nmp->nm_reqq, rep, r_chain);
1246         rep->r_flags |= R_ONREQQ;
1247         ++nmp->nm_reqqlen;
1248         if (rep->r_flags & R_ASYNC)
1249                 rep->r_info->state = NFSM_STATE_WAITREPLY;
1250         crit_exit();
1251
1252         error = 0;
1253
1254         /*
1255          * Send if we can.  Congestion control is not handled here any more
1256          * becausing trying to defer the initial send based on the nfs_timer
1257          * requires having a very fast nfs_timer, which is silly.
1258          */
1259         if (nmp->nm_so) {
1260                 if (nmp->nm_soflags & PR_CONNREQUIRED)
1261                         error = nfs_sndlock(nmp, rep);
1262                 if (error == 0) {
1263                         m2 = m_copym(rep->r_mreq, 0, M_COPYALL, MB_WAIT);
1264                         error = nfs_send(nmp->nm_so, nmp->nm_nam, m2, rep);
1265                         if (nmp->nm_soflags & PR_CONNREQUIRED)
1266                                 nfs_sndunlock(nmp);
1267                         rep->r_flags &= ~R_NEEDSXMIT;
1268                         if ((rep->r_flags & R_SENT) == 0) {
1269                                 rep->r_flags |= R_SENT;
1270                         }
1271                 } else {
1272                         rep->r_flags |= R_NEEDSXMIT;
1273                 }
1274         } else {
1275                 rep->r_flags |= R_NEEDSXMIT;
1276                 rep->r_rtt = -1;
1277         }
1278         if (error == EPIPE)
1279                 error = 0;
1280
1281         /*
1282          * Release the lock.  The only remote action that may have occurred
1283          * would have been the setting of rep->r_mrep.  If this occured
1284          * and the request was async we have to move it to the reader
1285          * thread's queue for action.
1286          *
1287          * For async requests also make sure the reader is woken up so
1288          * it gets on the socket to read responses.
1289          */
1290         crit_enter();
1291         if (rep->r_flags & R_ASYNC) {
1292                 if (rep->r_mrep)
1293                         nfs_hardterm(rep, 1);
1294                 rep->r_flags &= ~R_LOCKED;
1295                 nfssvc_iod_reader_wakeup(nmp);
1296         } else {
1297                 rep->r_flags &= ~R_LOCKED;
1298         }
1299         if (rep->r_flags & R_WANTED) {
1300                 rep->r_flags &= ~R_WANTED;
1301                 wakeup(rep);
1302         }
1303         crit_exit();
1304         return (error);
1305 }
1306
1307 /*
1308  * This code is only called for synchronous requests.  Completed synchronous
1309  * requests are left on reqq and we remove them before moving on to the
1310  * processing state.
1311  */
1312 static int
1313 nfs_request_waitreply(struct nfsreq *rep)
1314 {
1315         struct nfsmount *nmp = rep->r_nmp;
1316         int error;
1317
1318         KKASSERT((rep->r_flags & R_ASYNC) == 0);
1319
1320         /*
1321          * Wait until the request is finished.
1322          */
1323         error = nfs_reply(nmp, rep);
1324
1325         /*
1326          * RPC done, unlink the request, but don't rip it out from under
1327          * the callout timer.
1328          *
1329          * Once unlinked no other receiver or the timer will have
1330          * visibility, so we do not have to set R_LOCKED.
1331          */
1332         crit_enter();
1333         while (rep->r_flags & R_LOCKED) {
1334                 rep->r_flags |= R_WANTED;
1335                 tsleep(rep, 0, "nfstrac", 0);
1336         }
1337         KKASSERT(rep->r_flags & R_ONREQQ);
1338         TAILQ_REMOVE(&nmp->nm_reqq, rep, r_chain);
1339         rep->r_flags &= ~R_ONREQQ;
1340         --nmp->nm_reqqlen;
1341         crit_exit();
1342
1343         /*
1344          * Decrement the outstanding request count.
1345          */
1346         if (rep->r_flags & R_SENT) {
1347                 rep->r_flags &= ~R_SENT;
1348         }
1349         return (error);
1350 }
1351
1352 /*
1353  * Process reply with error returned from nfs_requet_waitreply().
1354  *
1355  * Returns EAGAIN if it wants us to loop up to nfs_request_try() again.
1356  * Returns ENEEDAUTH if it wants us to loop up to nfs_request_auth() again.
1357  */
1358 static int
1359 nfs_request_processreply(nfsm_info_t info, int error)
1360 {
1361         struct nfsreq *req = info->req;
1362         struct nfsmount *nmp = req->r_nmp;
1363         u_int32_t *tl;
1364         int verf_type;
1365         int i;
1366
1367         /*
1368          * If there was a successful reply and a tprintf msg.
1369          * tprintf a response.
1370          */
1371         if (error == 0 && (req->r_flags & R_TPRINTFMSG)) {
1372                 nfs_msg(req->r_td, nmp->nm_mountp->mnt_stat.f_mntfromname,
1373                     "is alive again");
1374         }
1375         info->mrep = req->r_mrep;
1376         info->md = req->r_md;
1377         info->dpos = req->r_dpos;
1378         if (error) {
1379                 m_freem(req->r_mreq);
1380                 req->r_mreq = NULL;
1381                 kfree(req, M_NFSREQ);
1382                 info->req = NULL;
1383                 return (error);
1384         }
1385
1386         /*
1387          * break down the rpc header and check if ok
1388          */
1389         NULLOUT(tl = nfsm_dissect(info, 3 * NFSX_UNSIGNED));
1390         if (*tl++ == rpc_msgdenied) {
1391                 if (*tl == rpc_mismatch) {
1392                         error = EOPNOTSUPP;
1393                 } else if ((nmp->nm_flag & NFSMNT_KERB) &&
1394                            *tl++ == rpc_autherr) {
1395                         if (req->r_failed_auth == 0) {
1396                                 req->r_failed_auth++;
1397                                 req->r_mheadend->m_next = NULL;
1398                                 m_freem(info->mrep);
1399                                 info->mrep = NULL;
1400                                 m_freem(req->r_mreq);
1401                                 return (ENEEDAUTH);
1402                         } else {
1403                                 error = EAUTH;
1404                         }
1405                 } else {
1406                         error = EACCES;
1407                 }
1408                 m_freem(info->mrep);
1409                 info->mrep = NULL;
1410                 m_freem(req->r_mreq);
1411                 req->r_mreq = NULL;
1412                 kfree(req, M_NFSREQ);
1413                 info->req = NULL;
1414                 return (error);
1415         }
1416
1417         /*
1418          * Grab any Kerberos verifier, otherwise just throw it away.
1419          */
1420         verf_type = fxdr_unsigned(int, *tl++);
1421         i = fxdr_unsigned(int32_t, *tl);
1422         if ((nmp->nm_flag & NFSMNT_KERB) && verf_type == RPCAUTH_KERB4) {
1423                 error = nfs_savenickauth(nmp, req->r_cred, i, req->r_key,
1424                                          &info->md, &info->dpos, info->mrep);
1425                 if (error)
1426                         goto nfsmout;
1427         } else if (i > 0) {
1428                 ERROROUT(nfsm_adv(info, nfsm_rndup(i)));
1429         }
1430         NULLOUT(tl = nfsm_dissect(info, NFSX_UNSIGNED));
1431         /* 0 == ok */
1432         if (*tl == 0) {
1433                 NULLOUT(tl = nfsm_dissect(info, NFSX_UNSIGNED));
1434                 if (*tl != 0) {
1435                         error = fxdr_unsigned(int, *tl);
1436
1437                         /*
1438                          * Does anyone even implement this?  Just impose
1439                          * a 1-second delay.
1440                          */
1441                         if ((nmp->nm_flag & NFSMNT_NFSV3) &&
1442                                 error == NFSERR_TRYLATER) {
1443                                 m_freem(info->mrep);
1444                                 info->mrep = NULL;
1445                                 error = 0;
1446
1447                                 tsleep((caddr_t)&lbolt, 0, "nqnfstry", 0);
1448                                 return (EAGAIN);        /* goto tryagain */
1449                         }
1450
1451                         /*
1452                          * If the File Handle was stale, invalidate the
1453                          * lookup cache, just in case.
1454                          *
1455                          * To avoid namecache<->vnode deadlocks we must
1456                          * release the vnode lock if we hold it.
1457                          */
1458                         if (error == ESTALE) {
1459                                 struct vnode *vp = req->r_vp;
1460                                 int ltype;
1461
1462                                 ltype = lockstatus(&vp->v_lock, curthread);
1463                                 if (ltype == LK_EXCLUSIVE || ltype == LK_SHARED)
1464                                         lockmgr(&vp->v_lock, LK_RELEASE);
1465                                 cache_inval_vp(vp, CINV_CHILDREN);
1466                                 if (ltype == LK_EXCLUSIVE || ltype == LK_SHARED)
1467                                         lockmgr(&vp->v_lock, ltype);
1468                         }
1469                         if (nmp->nm_flag & NFSMNT_NFSV3) {
1470                                 KKASSERT(*req->r_mrp == info->mrep);
1471                                 KKASSERT(*req->r_mdp == info->md);
1472                                 KKASSERT(*req->r_dposp == info->dpos);
1473                                 error |= NFSERR_RETERR;
1474                         } else {
1475                                 m_freem(info->mrep);
1476                                 info->mrep = NULL;
1477                         }
1478                         m_freem(req->r_mreq);
1479                         req->r_mreq = NULL;
1480                         kfree(req, M_NFSREQ);
1481                         info->req = NULL;
1482                         return (error);
1483                 }
1484
1485                 KKASSERT(*req->r_mrp == info->mrep);
1486                 KKASSERT(*req->r_mdp == info->md);
1487                 KKASSERT(*req->r_dposp == info->dpos);
1488                 m_freem(req->r_mreq);
1489                 req->r_mreq = NULL;
1490                 FREE(req, M_NFSREQ);
1491                 return (0);
1492         }
1493         m_freem(info->mrep);
1494         info->mrep = NULL;
1495         error = EPROTONOSUPPORT;
1496 nfsmout:
1497         m_freem(req->r_mreq);
1498         req->r_mreq = NULL;
1499         kfree(req, M_NFSREQ);
1500         info->req = NULL;
1501         return (error);
1502 }
1503
1504 #ifndef NFS_NOSERVER
1505 /*
1506  * Generate the rpc reply header
1507  * siz arg. is used to decide if adding a cluster is worthwhile
1508  */
1509 int
1510 nfs_rephead(int siz, struct nfsrv_descript *nd, struct nfssvc_sock *slp,
1511             int err, struct mbuf **mrq, struct mbuf **mbp, caddr_t *bposp)
1512 {
1513         u_int32_t *tl;
1514         struct nfsm_info info;
1515
1516         siz += RPC_REPLYSIZ;
1517         info.mb = m_getl(max_hdr + siz, MB_WAIT, MT_DATA, M_PKTHDR, NULL);
1518         info.mreq = info.mb;
1519         info.mreq->m_pkthdr.len = 0;
1520         /*
1521          * If this is not a cluster, try and leave leading space
1522          * for the lower level headers.
1523          */
1524         if ((max_hdr + siz) < MINCLSIZE)
1525                 info.mreq->m_data += max_hdr;
1526         tl = mtod(info.mreq, u_int32_t *);
1527         info.mreq->m_len = 6 * NFSX_UNSIGNED;
1528         info.bpos = ((caddr_t)tl) + info.mreq->m_len;
1529         *tl++ = txdr_unsigned(nd->nd_retxid);
1530         *tl++ = rpc_reply;
1531         if (err == ERPCMISMATCH || (err & NFSERR_AUTHERR)) {
1532                 *tl++ = rpc_msgdenied;
1533                 if (err & NFSERR_AUTHERR) {
1534                         *tl++ = rpc_autherr;
1535                         *tl = txdr_unsigned(err & ~NFSERR_AUTHERR);
1536                         info.mreq->m_len -= NFSX_UNSIGNED;
1537                         info.bpos -= NFSX_UNSIGNED;
1538                 } else {
1539                         *tl++ = rpc_mismatch;
1540                         *tl++ = txdr_unsigned(RPC_VER2);
1541                         *tl = txdr_unsigned(RPC_VER2);
1542                 }
1543         } else {
1544                 *tl++ = rpc_msgaccepted;
1545
1546                 /*
1547                  * For Kerberos authentication, we must send the nickname
1548                  * verifier back, otherwise just RPCAUTH_NULL.
1549                  */
1550                 if (nd->nd_flag & ND_KERBFULL) {
1551                     struct nfsuid *nuidp;
1552                     struct timeval ktvin, ktvout;
1553
1554                     for (nuidp = NUIDHASH(slp, nd->nd_cr.cr_uid)->lh_first;
1555                         nuidp != 0; nuidp = nuidp->nu_hash.le_next) {
1556                         if (nuidp->nu_cr.cr_uid == nd->nd_cr.cr_uid &&
1557                             (!nd->nd_nam2 || netaddr_match(NU_NETFAM(nuidp),
1558                              &nuidp->nu_haddr, nd->nd_nam2)))
1559                             break;
1560                     }
1561                     if (nuidp) {
1562                         ktvin.tv_sec =
1563                             txdr_unsigned(nuidp->nu_timestamp.tv_sec - 1);
1564                         ktvin.tv_usec =
1565                             txdr_unsigned(nuidp->nu_timestamp.tv_usec);
1566
1567                         /*
1568                          * Encrypt the timestamp in ecb mode using the
1569                          * session key.
1570                          */
1571 #ifdef NFSKERB
1572                         XXX
1573 #endif
1574
1575                         *tl++ = rpc_auth_kerb;
1576                         *tl++ = txdr_unsigned(3 * NFSX_UNSIGNED);
1577                         *tl = ktvout.tv_sec;
1578                         tl = nfsm_build(&info, 3 * NFSX_UNSIGNED);
1579                         *tl++ = ktvout.tv_usec;
1580                         *tl++ = txdr_unsigned(nuidp->nu_cr.cr_uid);
1581                     } else {
1582                         *tl++ = 0;
1583                         *tl++ = 0;
1584                     }
1585                 } else {
1586                         *tl++ = 0;
1587                         *tl++ = 0;
1588                 }
1589                 switch (err) {
1590                 case EPROGUNAVAIL:
1591                         *tl = txdr_unsigned(RPC_PROGUNAVAIL);
1592                         break;
1593                 case EPROGMISMATCH:
1594                         *tl = txdr_unsigned(RPC_PROGMISMATCH);
1595                         tl = nfsm_build(&info, 2 * NFSX_UNSIGNED);
1596                         *tl++ = txdr_unsigned(2);
1597                         *tl = txdr_unsigned(3);
1598                         break;
1599                 case EPROCUNAVAIL:
1600                         *tl = txdr_unsigned(RPC_PROCUNAVAIL);
1601                         break;
1602                 case EBADRPC:
1603                         *tl = txdr_unsigned(RPC_GARBAGE);
1604                         break;
1605                 default:
1606                         *tl = 0;
1607                         if (err != NFSERR_RETVOID) {
1608                                 tl = nfsm_build(&info, NFSX_UNSIGNED);
1609                                 if (err)
1610                                     *tl = txdr_unsigned(nfsrv_errmap(nd, err));
1611                                 else
1612                                     *tl = 0;
1613                         }
1614                         break;
1615                 };
1616         }
1617
1618         if (mrq != NULL)
1619             *mrq = info.mreq;
1620         *mbp = info.mb;
1621         *bposp = info.bpos;
1622         if (err != 0 && err != NFSERR_RETVOID)
1623                 nfsstats.srvrpc_errs++;
1624         return (0);
1625 }
1626
1627
1628 #endif /* NFS_NOSERVER */
1629
1630 /*
1631  * Nfs timer routine.
1632  *
1633  * Scan the nfsreq list and retranmit any requests that have timed out
1634  * To avoid retransmission attempts on STREAM sockets (in the future) make
1635  * sure to set the r_retry field to 0 (implies nm_retry == 0).
1636  *
1637  * Requests with attached responses, terminated requests, and
1638  * locked requests are ignored.  Locked requests will be picked up
1639  * in a later timer call.
1640  */
1641 void
1642 nfs_timer(void *arg /* never used */)
1643 {
1644         struct nfsmount *nmp;
1645         struct nfsreq *req;
1646 #ifndef NFS_NOSERVER
1647         struct nfssvc_sock *slp;
1648         u_quad_t cur_usec;
1649 #endif /* NFS_NOSERVER */
1650
1651         crit_enter();
1652         TAILQ_FOREACH(nmp, &nfs_mountq, nm_entry) {
1653                 TAILQ_FOREACH(req, &nmp->nm_reqq, r_chain) {
1654                         KKASSERT(nmp == req->r_nmp);
1655                         if (req->r_mrep)
1656                                 continue;
1657                         if (req->r_flags & (R_SOFTTERM | R_LOCKED))
1658                                 continue;
1659                         req->r_flags |= R_LOCKED;
1660                         if (nfs_sigintr(nmp, req, req->r_td)) {
1661                                 nfs_softterm(req, 1);
1662                         } else {
1663                                 nfs_timer_req(req);
1664                         }
1665                         req->r_flags &= ~R_LOCKED;
1666                         if (req->r_flags & R_WANTED) {
1667                                 req->r_flags &= ~R_WANTED;
1668                                 wakeup(req);
1669                         }
1670                 }
1671         }
1672 #ifndef NFS_NOSERVER
1673
1674         /*
1675          * Scan the write gathering queues for writes that need to be
1676          * completed now.
1677          */
1678         cur_usec = nfs_curusec();
1679         TAILQ_FOREACH(slp, &nfssvc_sockhead, ns_chain) {
1680             if (slp->ns_tq.lh_first && slp->ns_tq.lh_first->nd_time<=cur_usec)
1681                 nfsrv_wakenfsd(slp, 1);
1682         }
1683 #endif /* NFS_NOSERVER */
1684         crit_exit();
1685         callout_reset(&nfs_timer_handle, nfs_ticks, nfs_timer, NULL);
1686 }
1687
1688 static
1689 void
1690 nfs_timer_req(struct nfsreq *req)
1691 {
1692         struct thread *td = &thread0; /* XXX for creds, will break if sleep */
1693         struct nfsmount *nmp = req->r_nmp;
1694         struct mbuf *m;
1695         struct socket *so;
1696         int timeo;
1697         int error;
1698
1699         /*
1700          * rtt ticks and timeout calculation.  Return if the timeout
1701          * has not been reached yet, unless the packet is flagged
1702          * for an immediate send.
1703          *
1704          * The mean rtt doesn't help when we get random I/Os, we have
1705          * to multiply by fairly large numbers.
1706          */
1707         if (req->r_rtt >= 0) {
1708                 req->r_rtt++;
1709                 if (nmp->nm_flag & NFSMNT_DUMBTIMR) {
1710                         timeo = nmp->nm_timeo << NFS_RTT_SCALE_BITS;
1711                 } else if (req->r_flags & R_TIMING) {
1712                         timeo = NFS_SRTT(req) + NFS_SDRTT(req);
1713                 } else {
1714                         timeo = nmp->nm_timeo << NFS_RTT_SCALE_BITS;
1715                 }
1716                 /* timeo is still scaled by SCALE_BITS */
1717
1718 #define NFSFS   (NFS_RTT_SCALE * NFS_HZ)
1719                 if (req->r_flags & R_TIMING) {
1720                         static long last_time;
1721                         if (nfs_showrtt && last_time != time_second) {
1722                                 kprintf("rpccmd %d NFS SRTT %d SDRTT %d "
1723                                         "timeo %d.%03d\n",
1724                                         proct[req->r_procnum],
1725                                         NFS_SRTT(req), NFS_SDRTT(req),
1726                                         timeo / NFSFS,
1727                                         timeo % NFSFS * 1000 /  NFSFS);
1728                                 last_time = time_second;
1729                         }
1730                 }
1731 #undef NFSFS
1732
1733                 /*
1734                  * deal with nfs_timer jitter.
1735                  */
1736                 timeo = (timeo >> NFS_RTT_SCALE_BITS) + 1;
1737                 if (timeo < 2)
1738                         timeo = 2;
1739
1740                 if (nmp->nm_timeouts > 0)
1741                         timeo *= nfs_backoff[nmp->nm_timeouts - 1];
1742                 if (timeo > NFS_MAXTIMEO)
1743                         timeo = NFS_MAXTIMEO;
1744                 if (req->r_rtt <= timeo) {
1745                         if ((req->r_flags & R_NEEDSXMIT) == 0)
1746                                 return;
1747                 } else if (nmp->nm_timeouts < 8) {
1748                         nmp->nm_timeouts++;
1749                 }
1750         }
1751
1752         /*
1753          * Check for server not responding
1754          */
1755         if ((req->r_flags & R_TPRINTFMSG) == 0 &&
1756              req->r_rexmit > nmp->nm_deadthresh) {
1757                 nfs_msg(req->r_td, nmp->nm_mountp->mnt_stat.f_mntfromname,
1758                         "not responding");
1759                 req->r_flags |= R_TPRINTFMSG;
1760         }
1761         if (req->r_rexmit >= req->r_retry) {    /* too many */
1762                 nfsstats.rpctimeouts++;
1763                 nfs_softterm(req, 1);
1764                 return;
1765         }
1766
1767         /*
1768          * Generally disable retransmission on reliable sockets,
1769          * unless the request is flagged for immediate send.
1770          */
1771         if (nmp->nm_sotype != SOCK_DGRAM) {
1772                 if (++req->r_rexmit > NFS_MAXREXMIT)
1773                         req->r_rexmit = NFS_MAXREXMIT;
1774                 if ((req->r_flags & R_NEEDSXMIT) == 0)
1775                         return;
1776         }
1777
1778         /*
1779          * Stop here if we do not have a socket!
1780          */
1781         if ((so = nmp->nm_so) == NULL)
1782                 return;
1783
1784         /*
1785          * If there is enough space and the window allows.. resend it.
1786          *
1787          * Set r_rtt to -1 in case we fail to send it now.
1788          */
1789         req->r_rtt = -1;
1790         if (ssb_space(&so->so_snd) >= req->r_mreq->m_pkthdr.len &&
1791             (req->r_flags & (R_SENT | R_NEEDSXMIT)) &&
1792            (m = m_copym(req->r_mreq, 0, M_COPYALL, MB_DONTWAIT))){
1793                 req->r_flags &= ~R_NEEDSXMIT;
1794                 if ((nmp->nm_flag & NFSMNT_NOCONN) == 0)
1795                     error = so_pru_send(so, 0, m, NULL, NULL, td);
1796                 else
1797                     error = so_pru_send(so, 0, m, nmp->nm_nam,
1798                         NULL, td);
1799                 if (error) {
1800                         if (NFSIGNORE_SOERROR(nmp->nm_soflags, error))
1801                                 so->so_error = 0;
1802                         req->r_flags |= R_NEEDSXMIT;
1803                 } else if (req->r_mrep == NULL) {
1804                         /*
1805                          * Iff first send, start timing
1806                          * else turn timing off, backoff timer
1807                          * and divide congestion window by 2.
1808                          *
1809                          * It is possible for the so_pru_send() to
1810                          * block and for us to race a reply so we
1811                          * only do this if the reply field has not
1812                          * been filled in.  R_LOCKED will prevent
1813                          * the request from being ripped out from under
1814                          * us entirely.
1815                          */
1816                         if (req->r_flags & R_SENT) {
1817                                 if (nfs_showrexmit)
1818                                         kprintf("X");
1819                                 req->r_flags &= ~R_TIMING;
1820                                 if (++req->r_rexmit > NFS_MAXREXMIT)
1821                                         req->r_rexmit = NFS_MAXREXMIT;
1822                                 nmp->nm_maxasync_scaled >>= 1;
1823                                 if (nmp->nm_maxasync_scaled < NFS_MINASYNC_SCALED)
1824                                         nmp->nm_maxasync_scaled = NFS_MINASYNC_SCALED;
1825                                 nfsstats.rpcretries++;
1826                         } else {
1827                                 req->r_flags |= R_SENT;
1828                         }
1829                         req->r_rtt = 0;
1830                 }
1831         }
1832 }
1833
1834 /*
1835  * Mark all of an nfs mount's outstanding requests with R_SOFTTERM and
1836  * wait for all requests to complete. This is used by forced unmounts
1837  * to terminate any outstanding RPCs.
1838  *
1839  * Locked requests cannot be canceled but will be marked for
1840  * soft-termination.
1841  */
1842 int
1843 nfs_nmcancelreqs(struct nfsmount *nmp)
1844 {
1845         struct nfsreq *req;
1846         int i;
1847
1848         crit_enter();
1849         TAILQ_FOREACH(req, &nmp->nm_reqq, r_chain) {
1850                 if (req->r_mrep != NULL || (req->r_flags & R_SOFTTERM))
1851                         continue;
1852                 nfs_softterm(req, 0);
1853         }
1854         /* XXX  the other two queues as well */
1855         crit_exit();
1856
1857         for (i = 0; i < 30; i++) {
1858                 crit_enter();
1859                 TAILQ_FOREACH(req, &nmp->nm_reqq, r_chain) {
1860                         if (nmp == req->r_nmp)
1861                                 break;
1862                 }
1863                 crit_exit();
1864                 if (req == NULL)
1865                         return (0);
1866                 tsleep(&lbolt, 0, "nfscancel", 0);
1867         }
1868         return (EBUSY);
1869 }
1870
1871 /*
1872  * Soft-terminate a request, effectively marking it as failed.
1873  *
1874  * Must be called from within a critical section.
1875  */
1876 static void
1877 nfs_softterm(struct nfsreq *rep, int islocked)
1878 {
1879         rep->r_flags |= R_SOFTTERM;
1880         nfs_hardterm(rep, islocked);
1881 }
1882
1883 /*
1884  * Hard-terminate a request, typically after getting a response.
1885  *
1886  * The state machine can still decide to re-issue it later if necessary.
1887  *
1888  * Must be called from within a critical section.
1889  */
1890 static void
1891 nfs_hardterm(struct nfsreq *rep, int islocked)
1892 {
1893         struct nfsmount *nmp = rep->r_nmp;
1894
1895         /*
1896          * The nm_send count is decremented now to avoid deadlocks
1897          * when the process in soreceive() hasn't yet managed to send
1898          * its own request.
1899          */
1900         if (rep->r_flags & R_SENT) {
1901                 rep->r_flags &= ~R_SENT;
1902         }
1903
1904         /*
1905          * If we locked the request or nobody else has locked the request,
1906          * and the request is async, we can move it to the reader thread's
1907          * queue now and fix up the state.
1908          *
1909          * If we locked the request or nobody else has locked the request,
1910          * we can wake up anyone blocked waiting for a response on the
1911          * request.
1912          */
1913         if (islocked || (rep->r_flags & R_LOCKED) == 0) {
1914                 if ((rep->r_flags & (R_ONREQQ | R_ASYNC)) ==
1915                     (R_ONREQQ | R_ASYNC)) {
1916                         rep->r_flags &= ~R_ONREQQ;
1917                         TAILQ_REMOVE(&nmp->nm_reqq, rep, r_chain);
1918                         --nmp->nm_reqqlen;
1919                         TAILQ_INSERT_TAIL(&nmp->nm_reqrxq, rep, r_chain);
1920                         KKASSERT(rep->r_info->state == NFSM_STATE_TRY ||
1921                                  rep->r_info->state == NFSM_STATE_WAITREPLY);
1922                         rep->r_info->state = NFSM_STATE_PROCESSREPLY;
1923                         nfssvc_iod_reader_wakeup(nmp);
1924                 }
1925                 mtx_abort_ex_link(&nmp->nm_rxlock, &rep->r_link);
1926         }
1927 }
1928
1929 /*
1930  * Test for a termination condition pending on the process.
1931  * This is used for NFSMNT_INT mounts.
1932  */
1933 int
1934 nfs_sigintr(struct nfsmount *nmp, struct nfsreq *rep, struct thread *td)
1935 {
1936         sigset_t tmpset;
1937         struct proc *p;
1938         struct lwp *lp;
1939
1940         if (rep && (rep->r_flags & R_SOFTTERM))
1941                 return (EINTR);
1942         /* Terminate all requests while attempting a forced unmount. */
1943         if (nmp->nm_mountp->mnt_kern_flag & MNTK_UNMOUNTF)
1944                 return (EINTR);
1945         if (!(nmp->nm_flag & NFSMNT_INT))
1946                 return (0);
1947         /* td might be NULL YYY */
1948         if (td == NULL || (p = td->td_proc) == NULL)
1949                 return (0);
1950
1951         lp = td->td_lwp;
1952         tmpset = lwp_sigpend(lp);
1953         SIGSETNAND(tmpset, lp->lwp_sigmask);
1954         SIGSETNAND(tmpset, p->p_sigignore);
1955         if (SIGNOTEMPTY(tmpset) && NFSINT_SIGMASK(tmpset))
1956                 return (EINTR);
1957
1958         return (0);
1959 }
1960
1961 /*
1962  * Lock a socket against others.
1963  * Necessary for STREAM sockets to ensure you get an entire rpc request/reply
1964  * and also to avoid race conditions between the processes with nfs requests
1965  * in progress when a reconnect is necessary.
1966  */
1967 int
1968 nfs_sndlock(struct nfsmount *nmp, struct nfsreq *rep)
1969 {
1970         mtx_t mtx = &nmp->nm_txlock;
1971         struct thread *td;
1972         int slptimeo;
1973         int slpflag;
1974         int error;
1975
1976         slpflag = 0;
1977         slptimeo = 0;
1978         td = rep ? rep->r_td : NULL;
1979         if (nmp->nm_flag & NFSMNT_INT)
1980                 slpflag = PCATCH;
1981
1982         while ((error = mtx_lock_ex_try(mtx)) != 0) {
1983                 if (nfs_sigintr(nmp, rep, td)) {
1984                         error = EINTR;
1985                         break;
1986                 }
1987                 error = mtx_lock_ex(mtx, "nfsndlck", slpflag, slptimeo);
1988                 if (error == 0)
1989                         break;
1990                 if (slpflag == PCATCH) {
1991                         slpflag = 0;
1992                         slptimeo = 2 * hz;
1993                 }
1994         }
1995         /* Always fail if our request has been cancelled. */
1996         if (rep && (rep->r_flags & R_SOFTTERM)) {
1997                 if (error == 0)
1998                         mtx_unlock(mtx);
1999                 error = EINTR;
2000         }
2001         return (error);
2002 }
2003
2004 /*
2005  * Unlock the stream socket for others.
2006  */
2007 void
2008 nfs_sndunlock(struct nfsmount *nmp)
2009 {
2010         mtx_unlock(&nmp->nm_txlock);
2011 }
2012
2013 /*
2014  * Lock the receiver side of the socket.
2015  *
2016  * rep may be NULL.
2017  */
2018 static int
2019 nfs_rcvlock(struct nfsmount *nmp, struct nfsreq *rep)
2020 {
2021         mtx_t mtx = &nmp->nm_rxlock;
2022         int slpflag;
2023         int slptimeo;
2024         int error;
2025
2026         /*
2027          * Unconditionally check for completion in case another nfsiod
2028          * get the packet while the caller was blocked, before the caller
2029          * called us.  Packet reception is handled by mainline code which
2030          * is protected by the BGL at the moment.
2031          *
2032          * We do not strictly need the second check just before the
2033          * tsleep(), but it's good defensive programming.
2034          */
2035         if (rep && rep->r_mrep != NULL)
2036                 return (EALREADY);
2037
2038         if (nmp->nm_flag & NFSMNT_INT)
2039                 slpflag = PCATCH;
2040         else
2041                 slpflag = 0;
2042         slptimeo = 0;
2043
2044         while ((error = mtx_lock_ex_try(mtx)) != 0) {
2045                 if (nfs_sigintr(nmp, rep, (rep ? rep->r_td : NULL))) {
2046                         error = EINTR;
2047                         break;
2048                 }
2049                 if (rep && rep->r_mrep != NULL) {
2050                         error = EALREADY;
2051                         break;
2052                 }
2053
2054                 /*
2055                  * NOTE: can return ENOLCK, but in that case rep->r_mrep
2056                  *       will already be set.
2057                  */
2058                 if (rep) {
2059                         error = mtx_lock_ex_link(mtx, &rep->r_link,
2060                                                  "nfsrcvlk",
2061                                                  slpflag, slptimeo);
2062                 } else {
2063                         error = mtx_lock_ex(mtx, "nfsrcvlk", slpflag, slptimeo);
2064                 }
2065                 if (error == 0)
2066                         break;
2067
2068                 /*
2069                  * If our reply was recieved while we were sleeping,
2070                  * then just return without taking the lock to avoid a
2071                  * situation where a single iod could 'capture' the
2072                  * recieve lock.
2073                  */
2074                 if (rep && rep->r_mrep != NULL) {
2075                         error = EALREADY;
2076                         break;
2077                 }
2078                 if (slpflag == PCATCH) {
2079                         slpflag = 0;
2080                         slptimeo = 2 * hz;
2081                 }
2082         }
2083         if (error == 0) {
2084                 if (rep && rep->r_mrep != NULL) {
2085                         error = EALREADY;
2086                         mtx_unlock(mtx);
2087                 }
2088         }
2089         return (error);
2090 }
2091
2092 /*
2093  * Unlock the stream socket for others.
2094  */
2095 static void
2096 nfs_rcvunlock(struct nfsmount *nmp)
2097 {
2098         mtx_unlock(&nmp->nm_rxlock);
2099 }
2100
2101 /*
2102  *      nfs_realign:
2103  *
2104  *      Check for badly aligned mbuf data and realign by copying the unaligned
2105  *      portion of the data into a new mbuf chain and freeing the portions
2106  *      of the old chain that were replaced.
2107  *
2108  *      We cannot simply realign the data within the existing mbuf chain
2109  *      because the underlying buffers may contain other rpc commands and
2110  *      we cannot afford to overwrite them.
2111  *
2112  *      We would prefer to avoid this situation entirely.  The situation does
2113  *      not occur with NFS/UDP and is supposed to only occassionally occur
2114  *      with TCP.  Use vfs.nfs.realign_count and realign_test to check this.
2115  */
2116 static void
2117 nfs_realign(struct mbuf **pm, int hsiz)
2118 {
2119         struct mbuf *m;
2120         struct mbuf *n = NULL;
2121         int off = 0;
2122
2123         ++nfs_realign_test;
2124
2125         while ((m = *pm) != NULL) {
2126                 if ((m->m_len & 0x3) || (mtod(m, intptr_t) & 0x3)) {
2127                         n = m_getl(m->m_len, MB_WAIT, MT_DATA, 0, NULL);
2128                         n->m_len = 0;
2129                         break;
2130                 }
2131                 pm = &m->m_next;
2132         }
2133
2134         /*
2135          * If n is non-NULL, loop on m copying data, then replace the
2136          * portion of the chain that had to be realigned.
2137          */
2138         if (n != NULL) {
2139                 ++nfs_realign_count;
2140                 while (m) {
2141                         m_copyback(n, off, m->m_len, mtod(m, caddr_t));
2142                         off += m->m_len;
2143                         m = m->m_next;
2144                 }
2145                 m_freem(*pm);
2146                 *pm = n;
2147         }
2148 }
2149
2150 #ifndef NFS_NOSERVER
2151
2152 /*
2153  * Parse an RPC request
2154  * - verify it
2155  * - fill in the cred struct.
2156  */
2157 int
2158 nfs_getreq(struct nfsrv_descript *nd, struct nfsd *nfsd, int has_header)
2159 {
2160         int len, i;
2161         u_int32_t *tl;
2162         struct uio uio;
2163         struct iovec iov;
2164         caddr_t cp;
2165         u_int32_t nfsvers, auth_type;
2166         uid_t nickuid;
2167         int error = 0, ticklen;
2168         struct nfsuid *nuidp;
2169         struct timeval tvin, tvout;
2170         struct nfsm_info info;
2171 #if 0                           /* until encrypted keys are implemented */
2172         NFSKERBKEYSCHED_T keys; /* stores key schedule */
2173 #endif
2174
2175         info.mrep = nd->nd_mrep;
2176         info.md = nd->nd_md;
2177         info.dpos = nd->nd_dpos;
2178
2179         if (has_header) {
2180                 NULLOUT(tl = nfsm_dissect(&info, 10 * NFSX_UNSIGNED));
2181                 nd->nd_retxid = fxdr_unsigned(u_int32_t, *tl++);
2182                 if (*tl++ != rpc_call) {
2183                         m_freem(info.mrep);
2184                         return (EBADRPC);
2185                 }
2186         } else {
2187                 NULLOUT(tl = nfsm_dissect(&info, 8 * NFSX_UNSIGNED));
2188         }
2189         nd->nd_repstat = 0;
2190         nd->nd_flag = 0;
2191         if (*tl++ != rpc_vers) {
2192                 nd->nd_repstat = ERPCMISMATCH;
2193                 nd->nd_procnum = NFSPROC_NOOP;
2194                 return (0);
2195         }
2196         if (*tl != nfs_prog) {
2197                 nd->nd_repstat = EPROGUNAVAIL;
2198                 nd->nd_procnum = NFSPROC_NOOP;
2199                 return (0);
2200         }
2201         tl++;
2202         nfsvers = fxdr_unsigned(u_int32_t, *tl++);
2203         if (nfsvers < NFS_VER2 || nfsvers > NFS_VER3) {
2204                 nd->nd_repstat = EPROGMISMATCH;
2205                 nd->nd_procnum = NFSPROC_NOOP;
2206                 return (0);
2207         }
2208         if (nfsvers == NFS_VER3)
2209                 nd->nd_flag = ND_NFSV3;
2210         nd->nd_procnum = fxdr_unsigned(u_int32_t, *tl++);
2211         if (nd->nd_procnum == NFSPROC_NULL)
2212                 return (0);
2213         if (nd->nd_procnum >= NFS_NPROCS ||
2214                 (nd->nd_procnum >= NQNFSPROC_GETLEASE) ||
2215                 (!nd->nd_flag && nd->nd_procnum > NFSV2PROC_STATFS)) {
2216                 nd->nd_repstat = EPROCUNAVAIL;
2217                 nd->nd_procnum = NFSPROC_NOOP;
2218                 return (0);
2219         }
2220         if ((nd->nd_flag & ND_NFSV3) == 0)
2221                 nd->nd_procnum = nfsv3_procid[nd->nd_procnum];
2222         auth_type = *tl++;
2223         len = fxdr_unsigned(int, *tl++);
2224         if (len < 0 || len > RPCAUTH_MAXSIZ) {
2225                 m_freem(info.mrep);
2226                 return (EBADRPC);
2227         }
2228
2229         nd->nd_flag &= ~ND_KERBAUTH;
2230         /*
2231          * Handle auth_unix or auth_kerb.
2232          */
2233         if (auth_type == rpc_auth_unix) {
2234                 len = fxdr_unsigned(int, *++tl);
2235                 if (len < 0 || len > NFS_MAXNAMLEN) {
2236                         m_freem(info.mrep);
2237                         return (EBADRPC);
2238                 }
2239                 ERROROUT(nfsm_adv(&info, nfsm_rndup(len)));
2240                 NULLOUT(tl = nfsm_dissect(&info, 3 * NFSX_UNSIGNED));
2241                 bzero((caddr_t)&nd->nd_cr, sizeof (struct ucred));
2242                 nd->nd_cr.cr_ref = 1;
2243                 nd->nd_cr.cr_uid = fxdr_unsigned(uid_t, *tl++);
2244                 nd->nd_cr.cr_gid = fxdr_unsigned(gid_t, *tl++);
2245                 len = fxdr_unsigned(int, *tl);
2246                 if (len < 0 || len > RPCAUTH_UNIXGIDS) {
2247                         m_freem(info.mrep);
2248                         return (EBADRPC);
2249                 }
2250                 NULLOUT(tl = nfsm_dissect(&info, (len + 2) * NFSX_UNSIGNED));
2251                 for (i = 1; i <= len; i++)
2252                     if (i < NGROUPS)
2253                         nd->nd_cr.cr_groups[i] = fxdr_unsigned(gid_t, *tl++);
2254                     else
2255                         tl++;
2256                 nd->nd_cr.cr_ngroups = (len >= NGROUPS) ? NGROUPS : (len + 1);
2257                 if (nd->nd_cr.cr_ngroups > 1)
2258                     nfsrvw_sort(nd->nd_cr.cr_groups, nd->nd_cr.cr_ngroups);
2259                 len = fxdr_unsigned(int, *++tl);
2260                 if (len < 0 || len > RPCAUTH_MAXSIZ) {
2261                         m_freem(info.mrep);
2262                         return (EBADRPC);
2263                 }
2264                 if (len > 0) {
2265                         ERROROUT(nfsm_adv(&info, nfsm_rndup(len)));
2266                 }
2267         } else if (auth_type == rpc_auth_kerb) {
2268                 switch (fxdr_unsigned(int, *tl++)) {
2269                 case RPCAKN_FULLNAME:
2270                         ticklen = fxdr_unsigned(int, *tl);
2271                         *((u_int32_t *)nfsd->nfsd_authstr) = *tl;
2272                         uio.uio_resid = nfsm_rndup(ticklen) + NFSX_UNSIGNED;
2273                         nfsd->nfsd_authlen = uio.uio_resid + NFSX_UNSIGNED;
2274                         if (uio.uio_resid > (len - 2 * NFSX_UNSIGNED)) {
2275                                 m_freem(info.mrep);
2276                                 return (EBADRPC);
2277                         }
2278                         uio.uio_offset = 0;
2279                         uio.uio_iov = &iov;
2280                         uio.uio_iovcnt = 1;
2281                         uio.uio_segflg = UIO_SYSSPACE;
2282                         iov.iov_base = (caddr_t)&nfsd->nfsd_authstr[4];
2283                         iov.iov_len = RPCAUTH_MAXSIZ - 4;
2284                         ERROROUT(nfsm_mtouio(&info, &uio, uio.uio_resid));
2285                         NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
2286                         if (*tl++ != rpc_auth_kerb ||
2287                                 fxdr_unsigned(int, *tl) != 4 * NFSX_UNSIGNED) {
2288                                 kprintf("Bad kerb verifier\n");
2289                                 nd->nd_repstat = (NFSERR_AUTHERR|AUTH_BADVERF);
2290                                 nd->nd_procnum = NFSPROC_NOOP;
2291                                 return (0);
2292                         }
2293                         NULLOUT(cp = nfsm_dissect(&info, 4 * NFSX_UNSIGNED));
2294                         tl = (u_int32_t *)cp;
2295                         if (fxdr_unsigned(int, *tl) != RPCAKN_FULLNAME) {
2296                                 kprintf("Not fullname kerb verifier\n");
2297                                 nd->nd_repstat = (NFSERR_AUTHERR|AUTH_BADVERF);
2298                                 nd->nd_procnum = NFSPROC_NOOP;
2299                                 return (0);
2300                         }
2301                         cp += NFSX_UNSIGNED;
2302                         bcopy(cp, nfsd->nfsd_verfstr, 3 * NFSX_UNSIGNED);
2303                         nfsd->nfsd_verflen = 3 * NFSX_UNSIGNED;
2304                         nd->nd_flag |= ND_KERBFULL;
2305                         nfsd->nfsd_flag |= NFSD_NEEDAUTH;
2306                         break;
2307                 case RPCAKN_NICKNAME:
2308                         if (len != 2 * NFSX_UNSIGNED) {
2309                                 kprintf("Kerb nickname short\n");
2310                                 nd->nd_repstat = (NFSERR_AUTHERR|AUTH_BADCRED);
2311                                 nd->nd_procnum = NFSPROC_NOOP;
2312                                 return (0);
2313                         }
2314                         nickuid = fxdr_unsigned(uid_t, *tl);
2315                         NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
2316                         if (*tl++ != rpc_auth_kerb ||
2317                                 fxdr_unsigned(int, *tl) != 3 * NFSX_UNSIGNED) {
2318                                 kprintf("Kerb nick verifier bad\n");
2319                                 nd->nd_repstat = (NFSERR_AUTHERR|AUTH_BADVERF);
2320                                 nd->nd_procnum = NFSPROC_NOOP;
2321                                 return (0);
2322                         }
2323                         NULLOUT(tl = nfsm_dissect(&info, 3 * NFSX_UNSIGNED));
2324                         tvin.tv_sec = *tl++;
2325                         tvin.tv_usec = *tl;
2326
2327                         for (nuidp = NUIDHASH(nfsd->nfsd_slp,nickuid)->lh_first;
2328                             nuidp != 0; nuidp = nuidp->nu_hash.le_next) {
2329                                 if (nuidp->nu_cr.cr_uid == nickuid &&
2330                                     (!nd->nd_nam2 ||
2331                                      netaddr_match(NU_NETFAM(nuidp),
2332                                       &nuidp->nu_haddr, nd->nd_nam2)))
2333                                         break;
2334                         }
2335                         if (!nuidp) {
2336                                 nd->nd_repstat =
2337                                         (NFSERR_AUTHERR|AUTH_REJECTCRED);
2338                                 nd->nd_procnum = NFSPROC_NOOP;
2339                                 return (0);
2340                         }
2341
2342                         /*
2343                          * Now, decrypt the timestamp using the session key
2344                          * and validate it.
2345                          */
2346 #ifdef NFSKERB
2347                         XXX
2348 #endif
2349
2350                         tvout.tv_sec = fxdr_unsigned(long, tvout.tv_sec);
2351                         tvout.tv_usec = fxdr_unsigned(long, tvout.tv_usec);
2352                         if (nuidp->nu_expire < time_second ||
2353                             nuidp->nu_timestamp.tv_sec > tvout.tv_sec ||
2354                             (nuidp->nu_timestamp.tv_sec == tvout.tv_sec &&
2355                              nuidp->nu_timestamp.tv_usec > tvout.tv_usec)) {
2356                                 nuidp->nu_expire = 0;
2357                                 nd->nd_repstat =
2358                                     (NFSERR_AUTHERR|AUTH_REJECTVERF);
2359                                 nd->nd_procnum = NFSPROC_NOOP;
2360                                 return (0);
2361                         }
2362                         nfsrv_setcred(&nuidp->nu_cr, &nd->nd_cr);
2363                         nd->nd_flag |= ND_KERBNICK;
2364                 };
2365         } else {
2366                 nd->nd_repstat = (NFSERR_AUTHERR | AUTH_REJECTCRED);
2367                 nd->nd_procnum = NFSPROC_NOOP;
2368                 return (0);
2369         }
2370
2371         nd->nd_md = info.md;
2372         nd->nd_dpos = info.dpos;
2373         return (0);
2374 nfsmout:
2375         return (error);
2376 }
2377
2378 #endif
2379
2380 /*
2381  * Send a message to the originating process's terminal.  The thread and/or
2382  * process may be NULL.  YYY the thread should not be NULL but there may
2383  * still be some uio_td's that are still being passed as NULL through to
2384  * nfsm_request().
2385  */
2386 static int
2387 nfs_msg(struct thread *td, char *server, char *msg)
2388 {
2389         tpr_t tpr;
2390
2391         if (td && td->td_proc)
2392                 tpr = tprintf_open(td->td_proc);
2393         else
2394                 tpr = NULL;
2395         tprintf(tpr, "nfs server %s: %s\n", server, msg);
2396         tprintf_close(tpr);
2397         return (0);
2398 }
2399
2400 #ifndef NFS_NOSERVER
2401 /*
2402  * Socket upcall routine for the nfsd sockets.
2403  * The caddr_t arg is a pointer to the "struct nfssvc_sock".
2404  * Essentially do as much as possible non-blocking, else punt and it will
2405  * be called with MB_WAIT from an nfsd.
2406  */
2407 void
2408 nfsrv_rcv(struct socket *so, void *arg, int waitflag)
2409 {
2410         struct nfssvc_sock *slp = (struct nfssvc_sock *)arg;
2411         struct mbuf *m;
2412         struct sockaddr *nam;
2413         struct sockbuf sio;
2414         int flags, error;
2415         int nparallel_wakeup = 0;
2416
2417         if ((slp->ns_flag & SLP_VALID) == 0)
2418                 return;
2419
2420         /*
2421          * Do not allow an infinite number of completed RPC records to build
2422          * up before we stop reading data from the socket.  Otherwise we could
2423          * end up holding onto an unreasonable number of mbufs for requests
2424          * waiting for service.
2425          *
2426          * This should give pretty good feedback to the TCP
2427          * layer and prevents a memory crunch for other protocols.
2428          *
2429          * Note that the same service socket can be dispatched to several
2430          * nfs servers simultaniously.
2431          *
2432          * the tcp protocol callback calls us with MB_DONTWAIT.
2433          * nfsd calls us with MB_WAIT (typically).
2434          */
2435         if (waitflag == MB_DONTWAIT && slp->ns_numrec >= nfsd_waiting / 2 + 1) {
2436                 slp->ns_flag |= SLP_NEEDQ;
2437                 goto dorecs;
2438         }
2439
2440         /*
2441          * Handle protocol specifics to parse an RPC request.  We always
2442          * pull from the socket using non-blocking I/O.
2443          */
2444         if (so->so_type == SOCK_STREAM) {
2445                 /*
2446                  * The data has to be read in an orderly fashion from a TCP
2447                  * stream, unlike a UDP socket.  It is possible for soreceive
2448                  * and/or nfsrv_getstream() to block, so make sure only one
2449                  * entity is messing around with the TCP stream at any given
2450                  * moment.  The receive sockbuf's lock in soreceive is not
2451                  * sufficient.
2452                  *
2453                  * Note that this procedure can be called from any number of
2454                  * NFS severs *OR* can be upcalled directly from a TCP
2455                  * protocol thread.
2456                  */
2457                 if (slp->ns_flag & SLP_GETSTREAM) {
2458                         slp->ns_flag |= SLP_NEEDQ;
2459                         goto dorecs;
2460                 }
2461                 slp->ns_flag |= SLP_GETSTREAM;
2462
2463                 /*
2464                  * Do soreceive().  Pull out as much data as possible without
2465                  * blocking.
2466                  */
2467                 sbinit(&sio, 1000000000);
2468                 flags = MSG_DONTWAIT;
2469                 error = so_pru_soreceive(so, &nam, NULL, &sio, NULL, &flags);
2470                 if (error || sio.sb_mb == NULL) {
2471                         if (error == EWOULDBLOCK)
2472                                 slp->ns_flag |= SLP_NEEDQ;
2473                         else
2474                                 slp->ns_flag |= SLP_DISCONN;
2475                         slp->ns_flag &= ~SLP_GETSTREAM;
2476                         goto dorecs;
2477                 }
2478                 m = sio.sb_mb;
2479                 if (slp->ns_rawend) {
2480                         slp->ns_rawend->m_next = m;
2481                         slp->ns_cc += sio.sb_cc;
2482                 } else {
2483                         slp->ns_raw = m;
2484                         slp->ns_cc = sio.sb_cc;
2485                 }
2486                 while (m->m_next)
2487                         m = m->m_next;
2488                 slp->ns_rawend = m;
2489
2490                 /*
2491                  * Now try and parse as many record(s) as we can out of the
2492                  * raw stream data.
2493                  */
2494                 error = nfsrv_getstream(slp, waitflag, &nparallel_wakeup);
2495                 if (error) {
2496                         if (error == EPERM)
2497                                 slp->ns_flag |= SLP_DISCONN;
2498                         else
2499                                 slp->ns_flag |= SLP_NEEDQ;
2500                 }
2501                 slp->ns_flag &= ~SLP_GETSTREAM;
2502         } else {
2503                 /*
2504                  * For UDP soreceive typically pulls just one packet, loop
2505                  * to get the whole batch.
2506                  */
2507                 do {
2508                         sbinit(&sio, 1000000000);
2509                         flags = MSG_DONTWAIT;
2510                         error = so_pru_soreceive(so, &nam, NULL, &sio,
2511                                                  NULL, &flags);
2512                         if (sio.sb_mb) {
2513                                 struct nfsrv_rec *rec;
2514                                 int mf = (waitflag & MB_DONTWAIT) ?
2515                                             M_NOWAIT : M_WAITOK;
2516                                 rec = kmalloc(sizeof(struct nfsrv_rec),
2517                                              M_NFSRVDESC, mf);
2518                                 if (!rec) {
2519                                         if (nam)
2520                                                 FREE(nam, M_SONAME);
2521                                         m_freem(sio.sb_mb);
2522                                         continue;
2523                                 }
2524                                 nfs_realign(&sio.sb_mb, 10 * NFSX_UNSIGNED);
2525                                 rec->nr_address = nam;
2526                                 rec->nr_packet = sio.sb_mb;
2527                                 STAILQ_INSERT_TAIL(&slp->ns_rec, rec, nr_link);
2528                                 ++slp->ns_numrec;
2529                                 ++nparallel_wakeup;
2530                         }
2531                         if (error) {
2532                                 if ((so->so_proto->pr_flags & PR_CONNREQUIRED)
2533                                         && error != EWOULDBLOCK) {
2534                                         slp->ns_flag |= SLP_DISCONN;
2535                                         goto dorecs;
2536                                 }
2537                         }
2538                 } while (sio.sb_mb);
2539         }
2540
2541         /*
2542          * If we were upcalled from the tcp protocol layer and we have
2543          * fully parsed records ready to go, or there is new data pending,
2544          * or something went wrong, try to wake up an nfsd thread to deal
2545          * with it.
2546          */
2547 dorecs:
2548         if (waitflag == MB_DONTWAIT && (slp->ns_numrec > 0
2549              || (slp->ns_flag & (SLP_NEEDQ | SLP_DISCONN)))) {
2550                 nfsrv_wakenfsd(slp, nparallel_wakeup);
2551         }
2552 }
2553
2554 /*
2555  * Try and extract an RPC request from the mbuf data list received on a
2556  * stream socket. The "waitflag" argument indicates whether or not it
2557  * can sleep.
2558  */
2559 static int
2560 nfsrv_getstream(struct nfssvc_sock *slp, int waitflag, int *countp)
2561 {
2562         struct mbuf *m, **mpp;
2563         char *cp1, *cp2;
2564         int len;
2565         struct mbuf *om, *m2, *recm;
2566         u_int32_t recmark;
2567
2568         for (;;) {
2569             if (slp->ns_reclen == 0) {
2570                 if (slp->ns_cc < NFSX_UNSIGNED)
2571                         return (0);
2572                 m = slp->ns_raw;
2573                 if (m->m_len >= NFSX_UNSIGNED) {
2574                         bcopy(mtod(m, caddr_t), (caddr_t)&recmark, NFSX_UNSIGNED);
2575                         m->m_data += NFSX_UNSIGNED;
2576                         m->m_len -= NFSX_UNSIGNED;
2577                 } else {
2578                         cp1 = (caddr_t)&recmark;
2579                         cp2 = mtod(m, caddr_t);
2580                         while (cp1 < ((caddr_t)&recmark) + NFSX_UNSIGNED) {
2581                                 while (m->m_len == 0) {
2582                                         m = m->m_next;
2583                                         cp2 = mtod(m, caddr_t);
2584                                 }
2585                                 *cp1++ = *cp2++;
2586                                 m->m_data++;
2587                                 m->m_len--;
2588                         }
2589                 }
2590                 slp->ns_cc -= NFSX_UNSIGNED;
2591                 recmark = ntohl(recmark);
2592                 slp->ns_reclen = recmark & ~0x80000000;
2593                 if (recmark & 0x80000000)
2594                         slp->ns_flag |= SLP_LASTFRAG;
2595                 else
2596                         slp->ns_flag &= ~SLP_LASTFRAG;
2597                 if (slp->ns_reclen > NFS_MAXPACKET || slp->ns_reclen <= 0) {
2598                         log(LOG_ERR, "%s (%d) from nfs client\n",
2599                             "impossible packet length",
2600                             slp->ns_reclen);
2601                         return (EPERM);
2602                 }
2603             }
2604
2605             /*
2606              * Now get the record part.
2607              *
2608              * Note that slp->ns_reclen may be 0.  Linux sometimes
2609              * generates 0-length RPCs
2610              */
2611             recm = NULL;
2612             if (slp->ns_cc == slp->ns_reclen) {
2613                 recm = slp->ns_raw;
2614                 slp->ns_raw = slp->ns_rawend = NULL;
2615                 slp->ns_cc = slp->ns_reclen = 0;
2616             } else if (slp->ns_cc > slp->ns_reclen) {
2617                 len = 0;
2618                 m = slp->ns_raw;
2619                 om = NULL;
2620
2621                 while (len < slp->ns_reclen) {
2622                         if ((len + m->m_len) > slp->ns_reclen) {
2623                                 m2 = m_copym(m, 0, slp->ns_reclen - len,
2624                                         waitflag);
2625                                 if (m2) {
2626                                         if (om) {
2627                                                 om->m_next = m2;
2628                                                 recm = slp->ns_raw;
2629                                         } else
2630                                                 recm = m2;
2631                                         m->m_data += slp->ns_reclen - len;
2632                                         m->m_len -= slp->ns_reclen - len;
2633                                         len = slp->ns_reclen;
2634                                 } else {
2635                                         return (EWOULDBLOCK);
2636                                 }
2637                         } else if ((len + m->m_len) == slp->ns_reclen) {
2638                                 om = m;
2639                                 len += m->m_len;
2640                                 m = m->m_next;
2641                                 recm = slp->ns_raw;
2642                                 om->m_next = NULL;
2643                         } else {
2644                                 om = m;
2645                                 len += m->m_len;
2646                                 m = m->m_next;
2647                         }
2648                 }
2649                 slp->ns_raw = m;
2650                 slp->ns_cc -= len;
2651                 slp->ns_reclen = 0;
2652             } else {
2653                 return (0);
2654             }
2655
2656             /*
2657              * Accumulate the fragments into a record.
2658              */
2659             mpp = &slp->ns_frag;
2660             while (*mpp)
2661                 mpp = &((*mpp)->m_next);
2662             *mpp = recm;
2663             if (slp->ns_flag & SLP_LASTFRAG) {
2664                 struct nfsrv_rec *rec;
2665                 int mf = (waitflag & MB_DONTWAIT) ? M_NOWAIT : M_WAITOK;
2666                 rec = kmalloc(sizeof(struct nfsrv_rec), M_NFSRVDESC, mf);
2667                 if (!rec) {
2668                     m_freem(slp->ns_frag);
2669                 } else {
2670                     nfs_realign(&slp->ns_frag, 10 * NFSX_UNSIGNED);
2671                     rec->nr_address = NULL;
2672                     rec->nr_packet = slp->ns_frag;
2673                     STAILQ_INSERT_TAIL(&slp->ns_rec, rec, nr_link);
2674                     ++slp->ns_numrec;
2675                     ++*countp;
2676                 }
2677                 slp->ns_frag = NULL;
2678             }
2679         }
2680 }
2681
2682 /*
2683  * Parse an RPC header.
2684  */
2685 int
2686 nfsrv_dorec(struct nfssvc_sock *slp, struct nfsd *nfsd,
2687             struct nfsrv_descript **ndp)
2688 {
2689         struct nfsrv_rec *rec;
2690         struct mbuf *m;
2691         struct sockaddr *nam;
2692         struct nfsrv_descript *nd;
2693         int error;
2694
2695         *ndp = NULL;
2696         if ((slp->ns_flag & SLP_VALID) == 0 || !STAILQ_FIRST(&slp->ns_rec))
2697                 return (ENOBUFS);
2698         rec = STAILQ_FIRST(&slp->ns_rec);
2699         STAILQ_REMOVE_HEAD(&slp->ns_rec, nr_link);
2700         KKASSERT(slp->ns_numrec > 0);
2701         --slp->ns_numrec;
2702         nam = rec->nr_address;
2703         m = rec->nr_packet;
2704         kfree(rec, M_NFSRVDESC);
2705         MALLOC(nd, struct nfsrv_descript *, sizeof (struct nfsrv_descript),
2706                 M_NFSRVDESC, M_WAITOK);
2707         nd->nd_md = nd->nd_mrep = m;
2708         nd->nd_nam2 = nam;
2709         nd->nd_dpos = mtod(m, caddr_t);
2710         error = nfs_getreq(nd, nfsd, TRUE);
2711         if (error) {
2712                 if (nam) {
2713                         FREE(nam, M_SONAME);
2714                 }
2715                 kfree((caddr_t)nd, M_NFSRVDESC);
2716                 return (error);
2717         }
2718         *ndp = nd;
2719         nfsd->nfsd_nd = nd;
2720         return (0);
2721 }
2722
2723 /*
2724  * Try to assign service sockets to nfsd threads based on the number
2725  * of new rpc requests that have been queued on the service socket.
2726  *
2727  * If no nfsd's are available or additonal requests are pending, set the
2728  * NFSD_CHECKSLP flag so that one of the running nfsds will go look for
2729  * the work in the nfssvc_sock list when it is finished processing its
2730  * current work.  This flag is only cleared when an nfsd can not find
2731  * any new work to perform.
2732  */
2733 void
2734 nfsrv_wakenfsd(struct nfssvc_sock *slp, int nparallel)
2735 {
2736         struct nfsd *nd;
2737
2738         if ((slp->ns_flag & SLP_VALID) == 0)
2739                 return;
2740         if (nparallel <= 1)
2741                 nparallel = 1;
2742         TAILQ_FOREACH(nd, &nfsd_head, nfsd_chain) {
2743                 if (nd->nfsd_flag & NFSD_WAITING) {
2744                         nd->nfsd_flag &= ~NFSD_WAITING;
2745                         if (nd->nfsd_slp)
2746                                 panic("nfsd wakeup");
2747                         slp->ns_sref++;
2748                         nd->nfsd_slp = slp;
2749                         wakeup((caddr_t)nd);
2750                         if (--nparallel == 0)
2751                                 break;
2752                 }
2753         }
2754         if (nparallel) {
2755                 slp->ns_flag |= SLP_DOREC;
2756                 nfsd_head_flag |= NFSD_CHECKSLP;
2757         }
2758 }
2759 #endif /* NFS_NOSERVER */