sys/vfs/nfs/nfs_serv.c

   1 /*
   2  * Copyright (c) 1989, 1993
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * This code is derived from software contributed to Berkeley by
   6  * Rick Macklem at The University of Guelph.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. All advertising materials mentioning features or use of this software
  17  *    must display the following acknowledgement:
  18  *      This product includes software developed by the University of
  19  *      California, Berkeley and its contributors.
  20  * 4. Neither the name of the University nor the names of its contributors
  21  *    may be used to endorse or promote products derived from this software
  22  *    without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  *
  36  *      @(#)nfs_serv.c  8.8 (Berkeley) 7/31/95
  37  * $FreeBSD: src/sys/nfs/nfs_serv.c,v 1.93.2.6 2002/12/29 18:19:53 dillon Exp $
  38  * $DragonFly: src/sys/vfs/nfs/nfs_serv.c,v 1.48 2008/09/17 21:44:24 dillon Exp $
  39  */
  40
  41 /*
  42  * nfs version 2 and 3 server calls to vnode ops
  43  * - these routines generally have 3 phases
  44  *   1 - break down and validate rpc request in mbuf list
  45  *   2 - do the vnode ops for the request
  46  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
  47  *   3 - build the rpc reply in an mbuf list
  48  *   nb:
  49  *      - do not mix the phases, since the nfsm_?? macros can return failures
  50  *        on a bad rpc or similar and do not do any vrele() or vput()'s
  51  *
  52  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
  53  *      error number iff error != 0 whereas
  54  *      returning an error from the server function implies a fatal error
  55  *      such as a badly constructed rpc request that should be dropped without
  56  *      a reply.
  57  *      For Version 3, nfsm_reply() does not return for the error case, since
  58  *      most version 3 rpcs return more than the status for error cases.
  59  *
  60  * Other notes:
  61  *      Warning: always pay careful attention to resource cleanup on return
  62  *      and note that nfsm_*() macros can terminate a procedure on certain
  63  *      errors.
  64  */
  65
  66 #include <sys/param.h>
  67 #include <sys/systm.h>
  68 #include <sys/proc.h>
  69 #include <sys/priv.h>
  70 #include <sys/nlookup.h>
  71 #include <sys/namei.h>
  72 #include <sys/unistd.h>
  73 #include <sys/vnode.h>
  74 #include <sys/mount.h>
  75 #include <sys/socket.h>
  76 #include <sys/socketvar.h>
  77 #include <sys/malloc.h>
  78 #include <sys/mbuf.h>
  79 #include <sys/dirent.h>
  80 #include <sys/stat.h>
  81 #include <sys/kernel.h>
  82 #include <sys/sysctl.h>
  83 #include <sys/buf.h>
  84
  85 #include <vm/vm.h>
  86 #include <vm/vm_extern.h>
  87 #include <vm/vm_zone.h>
  88 #include <vm/vm_object.h>
  89
  90 #include <sys/buf2.h>
  91
  92 #include <sys/thread2.h>
  93
  94 #include "nfsproto.h"
  95 #include "rpcv2.h"
  96 #include "nfs.h"
  97 #include "xdr_subs.h"
  98 #include "nfsm_subs.h"
  99
 100 #ifdef NFSRV_DEBUG
 101 #define nfsdbprintf(info)       kprintf info
 102 #else
 103 #define nfsdbprintf(info)
 104 #endif
 105
 106 #define MAX_COMMIT_COUNT        (1024 * 1024)
 107
 108 #define NUM_HEURISTIC           1017
 109 #define NHUSE_INIT              64
 110 #define NHUSE_INC               16
 111 #define NHUSE_MAX               2048
 112
 113 static struct nfsheur {
 114     struct vnode *nh_vp;        /* vp to match (unreferenced pointer) */
 115     off_t nh_nextr;             /* next offset for sequential detection */
 116     int nh_use;                 /* use count for selection */
 117     int nh_seqcount;            /* heuristic */
 118 } nfsheur[NUM_HEURISTIC];
 119
 120 nfstype nfsv3_type[9] = { NFNON, NFREG, NFDIR, NFBLK, NFCHR, NFLNK, NFSOCK,
 121                       NFFIFO, NFNON };
 122 #ifndef NFS_NOSERVER
 123 nfstype nfsv2_type[9] = { NFNON, NFREG, NFDIR, NFBLK, NFCHR, NFLNK, NFNON,
 124                       NFCHR, NFNON };
 125
 126 int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
 127 int nfsrvw_procrastinate_v3 = 0;
 128
 129 static struct timespec  nfsver;
 130
 131 SYSCTL_DECL(_vfs_nfs);
 132
 133 int nfs_async;
 134 SYSCTL_INT(_vfs_nfs, OID_AUTO, async, CTLFLAG_RW, &nfs_async, 0, "");
 135 static int nfs_commit_blks;
 136 static int nfs_commit_miss;
 137 SYSCTL_INT(_vfs_nfs, OID_AUTO, commit_blks, CTLFLAG_RW, &nfs_commit_blks, 0, "");
 138 SYSCTL_INT(_vfs_nfs, OID_AUTO, commit_miss, CTLFLAG_RW, &nfs_commit_miss, 0, "");
 139
 140 static int nfsrv_access (struct mount *, struct vnode *, int,
 141                         struct ucred *, int, struct thread *, int);
 142 static void nfsrvw_coalesce (struct nfsrv_descript *,
 143                 struct nfsrv_descript *);
 144
 145 /*
 146  * nfs v3 access service
 147  */
 148 int
 149 nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 150               struct thread *td, struct mbuf **mrq)
 151 {
 152         struct sockaddr *nam = nfsd->nd_nam;
 153         struct ucred *cred = &nfsd->nd_cr;
 154         struct vnode *vp = NULL;
 155         struct mount *mp = NULL;
 156         nfsfh_t nfh;
 157         fhandle_t *fhp;
 158         int error = 0, rdonly, getret;
 159         struct vattr vattr, *vap = &vattr;
 160         u_long testmode, nfsmode;
 161         struct nfsm_info info;
 162         u_int32_t *tl;
 163
 164         info.dpos = nfsd->nd_dpos;
 165         info.md = nfsd->nd_md;
 166         info.mrep = nfsd->nd_mrep;
 167         info.mreq = NULL;
 168
 169         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 170         fhp = &nfh.fh_generic;
 171         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
 172         NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
 173         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam, &rdonly,
 174             (nfsd->nd_flag & ND_KERBAUTH), TRUE);
 175         if (error) {
 176                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
 177                 nfsm_srvpostop_attr(&info, nfsd, 1, NULL);
 178                 error = 0;
 179                 goto nfsmout;
 180         }
 181         nfsmode = fxdr_unsigned(u_int32_t, *tl);
 182         if ((nfsmode & NFSV3ACCESS_READ) &&
 183                 nfsrv_access(mp, vp, VREAD, cred, rdonly, td, 0))
 184                 nfsmode &= ~NFSV3ACCESS_READ;
 185         if (vp->v_type == VDIR)
 186                 testmode = (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
 187                         NFSV3ACCESS_DELETE);
 188         else
 189                 testmode = (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
 190         if ((nfsmode & testmode) &&
 191                 nfsrv_access(mp, vp, VWRITE, cred, rdonly, td, 0))
 192                 nfsmode &= ~testmode;
 193         if (vp->v_type == VDIR)
 194                 testmode = NFSV3ACCESS_LOOKUP;
 195         else
 196                 testmode = NFSV3ACCESS_EXECUTE;
 197         if ((nfsmode & testmode) &&
 198                 nfsrv_access(mp, vp, VEXEC, cred, rdonly, td, 0))
 199                 nfsmode &= ~testmode;
 200         getret = VOP_GETATTR(vp, vap);
 201         vput(vp);
 202         vp = NULL;
 203         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 204                               NFSX_POSTOPATTR(1) + NFSX_UNSIGNED, &error));
 205         nfsm_srvpostop_attr(&info, nfsd, getret, vap);
 206         tl = nfsm_build(&info, NFSX_UNSIGNED);
 207         *tl = txdr_unsigned(nfsmode);
 208 nfsmout:
 209         *mrq = info.mreq;
 210         if (vp)
 211                 vput(vp);
 212         return(error);
 213 }
 214
 215 /*
 216  * nfs getattr service
 217  */
 218 int
 219 nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 220               struct thread *td, struct mbuf **mrq)
 221 {
 222         struct sockaddr *nam = nfsd->nd_nam;
 223         struct ucred *cred = &nfsd->nd_cr;
 224         struct nfs_fattr *fp;
 225         struct vattr va;
 226         struct vattr *vap = &va;
 227         struct vnode *vp = NULL;
 228         struct mount *mp = NULL;
 229         nfsfh_t nfh;
 230         fhandle_t *fhp;
 231         int error = 0, rdonly;
 232         struct nfsm_info info;
 233
 234         info.mrep = nfsd->nd_mrep;
 235         info.md = nfsd->nd_md;
 236         info.dpos = nfsd->nd_dpos;
 237         info.mreq = NULL;
 238
 239         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 240         fhp = &nfh.fh_generic;
 241         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
 242         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
 243                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
 244         if (error) {
 245                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, 0, &error));
 246                 error = 0;
 247                 goto nfsmout;
 248         }
 249         error = VOP_GETATTR(vp, vap);
 250         vput(vp);
 251         vp = NULL;
 252         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 253                               NFSX_FATTR(nfsd->nd_flag & ND_NFSV3), &error));
 254         if (error) {
 255                 error = 0;
 256                 goto nfsmout;
 257         }
 258         fp = nfsm_build(&info, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
 259         nfsm_srvfattr(nfsd, vap, fp);
 260         /* fall through */
 261
 262 nfsmout:
 263         *mrq = info.mreq;
 264         if (vp)
 265                 vput(vp);
 266         return(error);
 267 }
 268
 269 /*
 270  * nfs setattr service
 271  */
 272 int
 273 nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 274               struct thread *td, struct mbuf **mrq)
 275 {
 276         struct sockaddr *nam = nfsd->nd_nam;
 277         struct ucred *cred = &nfsd->nd_cr;
 278         struct vattr va, preat;
 279         struct vattr *vap = &va;
 280         struct nfsv2_sattr *sp;
 281         struct nfs_fattr *fp;
 282         struct vnode *vp = NULL;
 283         struct mount *mp = NULL;
 284         nfsfh_t nfh;
 285         fhandle_t *fhp;
 286         u_int32_t *tl;
 287         int error = 0, rdonly, preat_ret = 1, postat_ret = 1;
 288         int gcheck = 0;
 289         struct timespec guard;
 290         struct nfsm_info info;
 291
 292         info.mrep = nfsd->nd_mrep;
 293         info.mreq = NULL;
 294         info.md = nfsd->nd_md;
 295         info.dpos = nfsd->nd_dpos;
 296         info.v3 = (nfsd->nd_flag & ND_NFSV3);
 297
 298         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 299         fhp = &nfh.fh_generic;
 300         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
 301         VATTR_NULL(vap);
 302         if (info.v3) {
 303                 ERROROUT(nfsm_srvsattr(&info, vap));
 304                 NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
 305                 gcheck = fxdr_unsigned(int, *tl);
 306                 if (gcheck) {
 307                         NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
 308                         fxdr_nfsv3time(tl, &guard);
 309                 }
 310         } else {
 311                 NULLOUT(sp = nfsm_dissect(&info, NFSX_V2SATTR));
 312                 /*
 313                  * Nah nah nah nah na nah
 314                  * There is a bug in the Sun client that puts 0xffff in the mode
 315                  * field of sattr when it should put in 0xffffffff. The u_short
 316                  * doesn't sign extend.
 317                  * --> check the low order 2 bytes for 0xffff
 318                  */
 319                 if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
 320                         vap->va_mode = nfstov_mode(sp->sa_mode);
 321                 if (sp->sa_uid != nfs_xdrneg1)
 322                         vap->va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
 323                 if (sp->sa_gid != nfs_xdrneg1)
 324                         vap->va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
 325                 if (sp->sa_size != nfs_xdrneg1)
 326                         vap->va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
 327                 if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
 328 #ifdef notyet
 329                         fxdr_nfsv2time(&sp->sa_atime, &vap->va_atime);
 330 #else
 331                         vap->va_atime.tv_sec =
 332                                 fxdr_unsigned(int32_t, sp->sa_atime.nfsv2_sec);
 333                         vap->va_atime.tv_nsec = 0;
 334 #endif
 335                 }
 336                 if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
 337                         fxdr_nfsv2time(&sp->sa_mtime, &vap->va_mtime);
 338
 339         }
 340
 341         /*
 342          * Now that we have all the fields, lets do it.
 343          */
 344         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam, &rdonly,
 345                 (nfsd->nd_flag & ND_KERBAUTH), TRUE);
 346         if (error) {
 347                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 348                                       2 * NFSX_UNSIGNED, &error));
 349                 nfsm_srvwcc_data(&info, nfsd, preat_ret, &preat,
 350                                  postat_ret, vap);
 351                 error = 0;
 352                 goto nfsmout;
 353         }
 354
 355         /*
 356          * vp now an active resource, pay careful attention to cleanup
 357          */
 358
 359         if (info.v3) {
 360                 error = preat_ret = VOP_GETATTR(vp, &preat);
 361                 if (!error && gcheck &&
 362                         (preat.va_ctime.tv_sec != guard.tv_sec ||
 363                          preat.va_ctime.tv_nsec != guard.tv_nsec))
 364                         error = NFSERR_NOT_SYNC;
 365                 if (error) {
 366                         vput(vp);
 367                         vp = NULL;
 368                         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 369                                               NFSX_WCCDATA(info.v3), &error));
 370                         nfsm_srvwcc_data(&info, nfsd, preat_ret, &preat,
 371                                          postat_ret, vap);
 372                         error = 0;
 373                         goto nfsmout;
 374                 }
 375         }
 376
 377         /*
 378          * If the size is being changed write acces is required, otherwise
 379          * just check for a read only file system.
 380          */
 381         if (vap->va_size == ((u_quad_t)((quad_t) -1))) {
 382                 if (rdonly || (mp->mnt_flag & MNT_RDONLY)) {
 383                         error = EROFS;
 384                         goto out;
 385                 }
 386         } else {
 387                 if (vp->v_type == VDIR) {
 388                         error = EISDIR;
 389                         goto out;
 390                 } else if ((error = nfsrv_access(mp, vp, VWRITE, cred, rdonly,
 391                             td, 0)) != 0){
 392                         goto out;
 393                 }
 394         }
 395         error = VOP_SETATTR(vp, vap, cred);
 396         postat_ret = VOP_GETATTR(vp, vap);
 397         if (!error)
 398                 error = postat_ret;
 399 out:
 400         vput(vp);
 401         vp = NULL;
 402         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 403                    NFSX_WCCORFATTR(info.v3), &error));
 404         if (info.v3) {
 405                 nfsm_srvwcc_data(&info, nfsd, preat_ret, &preat,
 406                                  postat_ret, vap);
 407                 error = 0;
 408                 goto nfsmout;
 409         } else {
 410                 fp = nfsm_build(&info, NFSX_V2FATTR);
 411                 nfsm_srvfattr(nfsd, vap, fp);
 412         }
 413         /* fall through */
 414
 415 nfsmout:
 416         *mrq = info.mreq;
 417         if (vp)
 418                 vput(vp);
 419         return(error);
 420 }
 421
 422 /*
 423  * nfs lookup rpc
 424  */
 425 int
 426 nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 427              struct thread *td, struct mbuf **mrq)
 428 {
 429         struct sockaddr *nam = nfsd->nd_nam;
 430         struct ucred *cred = &nfsd->nd_cr;
 431         struct nfs_fattr *fp;
 432         struct nlookupdata nd;
 433         struct vnode *vp;
 434         struct vnode *dirp;
 435         struct nchandle nch;
 436         nfsfh_t nfh;
 437         fhandle_t *fhp;
 438         int error = 0, len, dirattr_ret = 1;
 439         int pubflag;
 440         struct vattr va, dirattr, *vap = &va;
 441         struct nfsm_info info;
 442
 443         info.mrep = nfsd->nd_mrep;
 444         info.mreq = NULL;
 445         info.md = nfsd->nd_md;
 446         info.dpos = nfsd->nd_dpos;
 447         info.v3 = (nfsd->nd_flag & ND_NFSV3);
 448
 449         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 450         nlookup_zero(&nd);
 451         dirp = NULL;
 452         vp = NULL;
 453
 454         fhp = &nfh.fh_generic;
 455         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
 456         NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
 457
 458         pubflag = nfs_ispublicfh(fhp);
 459
 460         error = nfs_namei(&nd, cred, 0, NULL, &vp,
 461                 fhp, len, slp, nam, &info.md, &info.dpos,
 462                 &dirp, td, (nfsd->nd_flag & ND_KERBAUTH), pubflag);
 463
 464         /*
 465          * namei failure, only dirp to cleanup.  Clear out garbarge from
 466          * structure in case macros jump to nfsmout.
 467          */
 468
 469         if (error) {
 470                 if (dirp) {
 471                         if (info.v3)
 472                                 dirattr_ret = VOP_GETATTR(dirp, &dirattr);
 473                         vrele(dirp);
 474                         dirp = NULL;
 475                 }
 476                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 477                                       NFSX_POSTOPATTR(info.v3), &error));
 478                 nfsm_srvpostop_attr(&info, nfsd, dirattr_ret, &dirattr);
 479                 error = 0;
 480                 goto nfsmout;
 481         }
 482
 483         /*
 484          * Locate index file for public filehandle
 485          *
 486          * error is 0 on entry and 0 on exit from this block.
 487          */
 488
 489         if (pubflag) {
 490                 if (vp->v_type == VDIR && nfs_pub.np_index != NULL) {
 491                         /*
 492                          * Setup call to lookup() to see if we can find
 493                          * the index file. Arguably, this doesn't belong
 494                          * in a kernel.. Ugh.  If an error occurs, do not
 495                          * try to install an index file and then clear the
 496                          * error.
 497                          *
 498                          * When we replace nd with ind and redirect ndp,
 499                          * maintenance of ni_startdir and ni_vp shift to
 500                          * ind and we have to clean them up in the old nd.
 501                          * However, the cnd resource continues to be maintained
 502                          * via the original nd.  Confused?  You aren't alone!
 503                          */
 504                         vn_unlock(vp);
 505                         cache_copy(&nd.nl_nch, &nch);
 506                         nlookup_done(&nd);
 507                         error = nlookup_init_raw(&nd, nfs_pub.np_index,
 508                                                 UIO_SYSSPACE, 0, cred, &nch);
 509                         cache_drop(&nch);
 510                         if (error == 0)
 511                                 error = nlookup(&nd);
 512
 513                         if (error == 0) {
 514                                 /*
 515                                  * Found an index file. Get rid of
 516                                  * the old references.  transfer vp and
 517                                  * load up the new vp.  Fortunately we do
 518                                  * not have to deal with dvp, that would be
 519                                  * a huge mess.
 520                                  */
 521                                 if (dirp)
 522                                         vrele(dirp);
 523                                 dirp = vp;
 524                                 vp = NULL;
 525                                 error = cache_vget(&nd.nl_nch, nd.nl_cred,
 526                                                         LK_EXCLUSIVE, &vp);
 527                                 KKASSERT(error == 0);
 528                         }
 529                         error = 0;
 530                 }
 531                 /*
 532                  * If the public filehandle was used, check that this lookup
 533                  * didn't result in a filehandle outside the publicly exported
 534                  * filesystem.  We clear the poor vp here to avoid lockups due
 535                  * to NFS I/O.
 536                  */
 537
 538                 if (vp->v_mount != nfs_pub.np_mount) {
 539                         vput(vp);
 540                         vp = NULL;
 541                         error = EPERM;
 542                 }
 543         }
 544
 545         if (dirp) {
 546                 if (info.v3)
 547                         dirattr_ret = VOP_GETATTR(dirp, &dirattr);
 548                 vrele(dirp);
 549                 dirp = NULL;
 550         }
 551
 552         /*
 553          * Resources at this point:
 554          *      ndp->ni_vp      may not be NULL
 555          *
 556          */
 557
 558         if (error) {
 559                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 560                                       NFSX_POSTOPATTR(info.v3), &error));
 561                 nfsm_srvpostop_attr(&info, nfsd, dirattr_ret, &dirattr);
 562                 error = 0;
 563                 goto nfsmout;
 564         }
 565
 566         /*
 567          * Clear out some resources prior to potentially blocking.  This
 568          * is not as critical as ni_dvp resources in other routines, but
 569          * it helps.
 570          */
 571         nlookup_done(&nd);
 572
 573         /*
 574          * Get underlying attribute, then release remaining resources ( for
 575          * the same potential blocking reason ) and reply.
 576          */
 577         bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
 578         error = VFS_VPTOFH(vp, &fhp->fh_fid);
 579         if (!error)
 580                 error = VOP_GETATTR(vp, vap);
 581
 582         vput(vp);
 583         vp = NULL;
 584         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 585                               NFSX_SRVFH(info.v3) +
 586                               NFSX_POSTOPORFATTR(info.v3) +
 587                               NFSX_POSTOPATTR(info.v3),
 588                               &error));
 589         if (error) {
 590                 nfsm_srvpostop_attr(&info, nfsd, dirattr_ret, &dirattr);
 591                 error = 0;
 592                 goto nfsmout;
 593         }
 594         nfsm_srvfhtom(&info, fhp);
 595         if (info.v3) {
 596                 nfsm_srvpostop_attr(&info, nfsd, 0, vap);
 597                 nfsm_srvpostop_attr(&info, nfsd, dirattr_ret, &dirattr);
 598         } else {
 599                 fp = nfsm_build(&info, NFSX_V2FATTR);
 600                 nfsm_srvfattr(nfsd, vap, fp);
 601         }
 602
 603 nfsmout:
 604         *mrq = info.mreq;
 605         if (dirp)
 606                 vrele(dirp);
 607         nlookup_done(&nd);              /* may be called twice */
 608         if (vp)
 609                 vput(vp);
 610         return (error);
 611 }
 612
 613 /*
 614  * nfs readlink service
 615  */
 616 int
 617 nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 618                struct thread *td, struct mbuf **mrq)
 619 {
 620         struct sockaddr *nam = nfsd->nd_nam;
 621         struct ucred *cred = &nfsd->nd_cr;
 622         struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
 623         struct iovec *ivp = iv;
 624         u_int32_t *tl;
 625         int error = 0, rdonly, i, tlen, len, getret;
 626         struct mbuf *mp1, *mp2, *mp3;
 627         struct vnode *vp = NULL;
 628         struct mount *mp = NULL;
 629         struct vattr attr;
 630         nfsfh_t nfh;
 631         fhandle_t *fhp;
 632         struct uio io, *uiop = &io;
 633         struct nfsm_info info;
 634
 635         info.mrep = nfsd->nd_mrep;
 636         info.mreq = NULL;
 637         info.md = nfsd->nd_md;
 638         info.dpos = nfsd->nd_dpos;
 639         info.v3 = (nfsd->nd_flag & ND_NFSV3);
 640
 641         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 642 #ifndef nolint
 643         mp2 = NULL;
 644 #endif
 645         mp3 = NULL;
 646         fhp = &nfh.fh_generic;
 647         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
 648         len = 0;
 649         i = 0;
 650         while (len < NFS_MAXPATHLEN) {
 651                 mp1 = m_getcl(MB_WAIT, MT_DATA, 0);
 652                 mp1->m_len = MCLBYTES;
 653                 if (len == 0)
 654                         mp3 = mp2 = mp1;
 655                 else {
 656                         mp2->m_next = mp1;
 657                         mp2 = mp1;
 658                 }
 659                 if ((len + mp1->m_len) > NFS_MAXPATHLEN) {
 660                         mp1->m_len = NFS_MAXPATHLEN-len;
 661                         len = NFS_MAXPATHLEN;
 662                 } else
 663                         len += mp1->m_len;
 664                 ivp->iov_base = mtod(mp1, caddr_t);
 665                 ivp->iov_len = mp1->m_len;
 666                 i++;
 667                 ivp++;
 668         }
 669         uiop->uio_iov = iv;
 670         uiop->uio_iovcnt = i;
 671         uiop->uio_offset = 0;
 672         uiop->uio_resid = len;
 673         uiop->uio_rw = UIO_READ;
 674         uiop->uio_segflg = UIO_SYSSPACE;
 675         uiop->uio_td = NULL;
 676         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
 677                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
 678         if (error) {
 679                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 680                                       2 * NFSX_UNSIGNED, &error));
 681                 nfsm_srvpostop_attr(&info, nfsd, 1, NULL);
 682                 error = 0;
 683                 goto nfsmout;
 684         }
 685         if (vp->v_type != VLNK) {
 686                 if (info.v3)
 687                         error = EINVAL;
 688                 else
 689                         error = ENXIO;
 690                 goto out;
 691         }
 692         error = VOP_READLINK(vp, uiop, cred);
 693 out:
 694         getret = VOP_GETATTR(vp, &attr);
 695         vput(vp);
 696         vp = NULL;
 697         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 698                              NFSX_POSTOPATTR(info.v3) + NFSX_UNSIGNED,
 699                              &error));
 700         if (info.v3) {
 701                 nfsm_srvpostop_attr(&info, nfsd, getret, &attr);
 702                 if (error) {
 703                         error = 0;
 704                         goto nfsmout;
 705                 }
 706         }
 707         if (uiop->uio_resid > 0) {
 708                 len -= uiop->uio_resid;
 709                 tlen = nfsm_rndup(len);
 710                 nfsm_adj(mp3, NFS_MAXPATHLEN-tlen, tlen-len);
 711         }
 712         tl = nfsm_build(&info, NFSX_UNSIGNED);
 713         *tl = txdr_unsigned(len);
 714         info.mb->m_next = mp3;
 715         mp3 = NULL;
 716 nfsmout:
 717         *mrq = info.mreq;
 718         if (mp3)
 719                 m_freem(mp3);
 720         if (vp)
 721                 vput(vp);
 722         return(error);
 723 }
 724
 725 /*
 726  * nfs read service
 727  */
 728 int
 729 nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 730            struct thread *td, struct mbuf **mrq)
 731 {
 732         struct nfsm_info info;
 733         struct sockaddr *nam = nfsd->nd_nam;
 734         struct ucred *cred = &nfsd->nd_cr;
 735         struct iovec *iv;
 736         struct iovec *iv2;
 737         struct mbuf *m;
 738         struct nfs_fattr *fp;
 739         u_int32_t *tl;
 740         int i;
 741         int reqlen;
 742         int error = 0, rdonly, cnt, len, left, siz, tlen, getret;
 743         struct mbuf *m2;
 744         struct vnode *vp = NULL;
 745         struct mount *mp = NULL;
 746         nfsfh_t nfh;
 747         fhandle_t *fhp;
 748         struct uio io, *uiop = &io;
 749         struct vattr va, *vap = &va;
 750         struct nfsheur *nh;
 751         off_t off;
 752         int ioflag = 0;
 753
 754         info.mrep = nfsd->nd_mrep;
 755         info.mreq = NULL;
 756         info.md = nfsd->nd_md;
 757         info.dpos = nfsd->nd_dpos;
 758         info.v3 = (nfsd->nd_flag & ND_NFSV3);
 759
 760         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
 761         fhp = &nfh.fh_generic;
 762         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
 763         if (info.v3) {
 764                 NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
 765                 off = fxdr_hyper(tl);
 766         } else {
 767                 NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
 768                 off = (off_t)fxdr_unsigned(u_int32_t, *tl);
 769         }
 770         NEGREPLYOUT(reqlen = nfsm_srvstrsiz(&info,
 771                                             NFS_SRVMAXDATA(nfsd), &error));
 772
 773         /*
 774          * Reference vp.  If an error occurs, vp will be invalid, but we
 775          * have to NULL it just in case.  The macros might goto nfsmout
 776          * as well.
 777          */
 778
 779         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
 780                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
 781         if (error) {
 782                 vp = NULL;
 783                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 784                                       2 * NFSX_UNSIGNED, &error));
 785                 nfsm_srvpostop_attr(&info, nfsd, 1, NULL);
 786                 error = 0;
 787                 goto nfsmout;
 788         }
 789
 790         if (vp->v_type != VREG) {
 791                 if (info.v3)
 792                         error = EINVAL;
 793                 else
 794                         error = (vp->v_type == VDIR) ? EISDIR : EACCES;
 795         }
 796         if (!error) {
 797             if ((error = nfsrv_access(mp, vp, VREAD, cred, rdonly, td, 1)) != 0)
 798                 error = nfsrv_access(mp, vp, VEXEC, cred, rdonly, td, 1);
 799         }
 800         getret = VOP_GETATTR(vp, vap);
 801         if (!error)
 802                 error = getret;
 803         if (error) {
 804                 vput(vp);
 805                 vp = NULL;
 806                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 807                                       NFSX_POSTOPATTR(info.v3), &error));
 808                 nfsm_srvpostop_attr(&info, nfsd, getret, vap);
 809                 error = 0;
 810                 goto nfsmout;
 811         }
 812
 813         /*
 814          * Calculate byte count to read
 815          */
 816
 817         if (off >= vap->va_size)
 818                 cnt = 0;
 819         else if ((off + reqlen) > vap->va_size)
 820                 cnt = vap->va_size - off;
 821         else
 822                 cnt = reqlen;
 823
 824         /*
 825          * Calculate seqcount for heuristic
 826          */
 827
 828         {
 829                 int hi;
 830                 int try = 32;
 831
 832                 /*
 833                  * Locate best candidate
 834                  */
 835
 836                 hi = ((int)(vm_offset_t)vp / sizeof(struct vnode)) % NUM_HEURISTIC;
 837                 nh = &nfsheur[hi];
 838
 839                 while (try--) {
 840                         if (nfsheur[hi].nh_vp == vp) {
 841                                 nh = &nfsheur[hi];
 842                                 break;
 843                         }
 844                         if (nfsheur[hi].nh_use > 0)
 845                                 --nfsheur[hi].nh_use;
 846                         hi = (hi + 1) % NUM_HEURISTIC;
 847                         if (nfsheur[hi].nh_use < nh->nh_use)
 848                                 nh = &nfsheur[hi];
 849                 }
 850
 851                 if (nh->nh_vp != vp) {
 852                         nh->nh_vp = vp;
 853                         nh->nh_nextr = off;
 854                         nh->nh_use = NHUSE_INIT;
 855                         if (off == 0)
 856                                 nh->nh_seqcount = 4;
 857                         else
 858                                 nh->nh_seqcount = 1;
 859                 }
 860
 861                 /*
 862                  * Calculate heuristic
 863                  */
 864
 865                 if ((off == 0 && nh->nh_seqcount > 0) || off == nh->nh_nextr) {
 866                         if (++nh->nh_seqcount > IO_SEQMAX)
 867                                 nh->nh_seqcount = IO_SEQMAX;
 868                 } else if (nh->nh_seqcount > 1) {
 869                         nh->nh_seqcount = 1;
 870                 } else {
 871                         nh->nh_seqcount = 0;
 872                 }
 873                 nh->nh_use += NHUSE_INC;
 874                 if (nh->nh_use > NHUSE_MAX)
 875                         nh->nh_use = NHUSE_MAX;
 876                 ioflag |= nh->nh_seqcount << IO_SEQSHIFT;
 877         }
 878
 879         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 880                               NFSX_POSTOPORFATTR(info.v3) +
 881                               3 * NFSX_UNSIGNED + nfsm_rndup(cnt),
 882                               &error));
 883         if (info.v3) {
 884                 tl = nfsm_build(&info, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
 885                 *tl++ = nfs_true;
 886                 fp = (struct nfs_fattr *)tl;
 887                 tl += (NFSX_V3FATTR / sizeof (u_int32_t));
 888         } else {
 889                 tl = nfsm_build(&info, NFSX_V2FATTR + NFSX_UNSIGNED);
 890                 fp = (struct nfs_fattr *)tl;
 891                 tl += (NFSX_V2FATTR / sizeof (u_int32_t));
 892         }
 893         len = left = nfsm_rndup(cnt);
 894         if (cnt > 0) {
 895                 /*
 896                  * Generate the mbuf list with the uio_iov ref. to it.
 897                  */
 898                 i = 0;
 899                 m = m2 = info.mb;
 900                 while (left > 0) {
 901                         siz = min(M_TRAILINGSPACE(m), left);
 902                         if (siz > 0) {
 903                                 left -= siz;
 904                                 i++;
 905                         }
 906                         if (left > 0) {
 907                                 m = m_getcl(MB_WAIT, MT_DATA, 0);
 908                                 m->m_len = 0;
 909                                 m2->m_next = m;
 910                                 m2 = m;
 911                         }
 912                 }
 913                 MALLOC(iv, struct iovec *, i * sizeof (struct iovec),
 914                        M_TEMP, M_WAITOK);
 915                 uiop->uio_iov = iv2 = iv;
 916                 m = info.mb;
 917                 left = len;
 918                 i = 0;
 919                 while (left > 0) {
 920                         if (m == NULL)
 921                                 panic("nfsrv_read iov");
 922                         siz = min(M_TRAILINGSPACE(m), left);
 923                         if (siz > 0) {
 924                                 iv->iov_base = mtod(m, caddr_t) + m->m_len;
 925                                 iv->iov_len = siz;
 926                                 m->m_len += siz;
 927                                 left -= siz;
 928                                 iv++;
 929                                 i++;
 930                         }
 931                         m = m->m_next;
 932                 }
 933                 uiop->uio_iovcnt = i;
 934                 uiop->uio_offset = off;
 935                 uiop->uio_resid = len;
 936                 uiop->uio_rw = UIO_READ;
 937                 uiop->uio_segflg = UIO_SYSSPACE;
 938                 error = VOP_READ(vp, uiop, IO_NODELOCKED | ioflag, cred);
 939                 off = uiop->uio_offset;
 940                 nh->nh_nextr = off;
 941                 FREE((caddr_t)iv2, M_TEMP);
 942                 if (error || (getret = VOP_GETATTR(vp, vap))) {
 943                         if (!error)
 944                                 error = getret;
 945                         m_freem(info.mreq);
 946                         info.mreq = NULL;
 947                         vput(vp);
 948                         vp = NULL;
 949                         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
 950                                               NFSX_POSTOPATTR(info.v3),
 951                                               &error));
 952                         nfsm_srvpostop_attr(&info, nfsd, getret, vap);
 953                         error = 0;
 954                         goto nfsmout;
 955                 }
 956         } else {
 957                 uiop->uio_resid = 0;
 958         }
 959         vput(vp);
 960         vp = NULL;
 961         nfsm_srvfattr(nfsd, vap, fp);
 962         tlen = len - uiop->uio_resid;
 963         cnt = cnt < tlen ? cnt : tlen;
 964         tlen = nfsm_rndup(cnt);
 965         if (len != tlen || tlen != cnt)
 966                 nfsm_adj(info.mb, len - tlen, tlen - cnt);
 967         if (info.v3) {
 968                 *tl++ = txdr_unsigned(cnt);
 969                 if (len < reqlen)
 970                         *tl++ = nfs_true;
 971                 else
 972                         *tl++ = nfs_false;
 973         }
 974         *tl = txdr_unsigned(cnt);
 975 nfsmout:
 976         *mrq = info.mreq;
 977         if (vp)
 978                 vput(vp);
 979         return(error);
 980 }
 981
 982 /*
 983  * nfs write service
 984  */
 985 int
 986 nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
 987             struct thread *td, struct mbuf **mrq)
 988 {
 989         struct sockaddr *nam = nfsd->nd_nam;
 990         struct ucred *cred = &nfsd->nd_cr;
 991         struct iovec *ivp;
 992         int i, cnt;
 993         struct mbuf *mp1;
 994         struct nfs_fattr *fp;
 995         struct iovec *iv;
 996         struct vattr va, forat;
 997         struct vattr *vap = &va;
 998         u_int32_t *tl;
 999         int error = 0, rdonly, len, forat_ret = 1;
1000         int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
1001         int stable = NFSV3WRITE_FILESYNC;
1002         struct vnode *vp = NULL;
1003         struct mount *mp = NULL;
1004         nfsfh_t nfh;
1005         fhandle_t *fhp;
1006         struct uio io, *uiop = &io;
1007         struct nfsm_info info;
1008         off_t off;
1009
1010         info.mrep = nfsd->nd_mrep;
1011         info.mreq = NULL;
1012         info.md = nfsd->nd_md;
1013         info.dpos = nfsd->nd_dpos;
1014         info.v3 = (nfsd->nd_flag & ND_NFSV3);
1015
1016         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
1017         if (info.mrep == NULL) {
1018                 error = 0;
1019                 goto nfsmout;
1020         }
1021         fhp = &nfh.fh_generic;
1022         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
1023         if (info.v3) {
1024                 NULLOUT(tl = nfsm_dissect(&info, 5 * NFSX_UNSIGNED));
1025                 off = fxdr_hyper(tl);
1026                 tl += 3;
1027                 stable = fxdr_unsigned(int, *tl++);
1028         } else {
1029                 NULLOUT(tl = nfsm_dissect(&info, 4 * NFSX_UNSIGNED));
1030                 off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1031                 tl += 2;
1032                 if (nfs_async)
1033                         stable = NFSV3WRITE_UNSTABLE;
1034         }
1035         retlen = len = fxdr_unsigned(int32_t, *tl);
1036         cnt = i = 0;
1037
1038         /*
1039          * For NFS Version 2, it is not obvious what a write of zero length
1040          * should do, but I might as well be consistent with Version 3,
1041          * which is to return ok so long as there are no permission problems.
1042          */
1043         if (len > 0) {
1044             zeroing = 1;
1045             mp1 = info.mrep;
1046             while (mp1) {
1047                 if (mp1 == info.md) {
1048                         zeroing = 0;
1049                         adjust = info.dpos - mtod(mp1, caddr_t);
1050                         mp1->m_len -= adjust;
1051                         if (mp1->m_len > 0 && adjust > 0)
1052                                 mp1->m_data += adjust;
1053                 }
1054                 if (zeroing)
1055                         mp1->m_len = 0;
1056                 else if (mp1->m_len > 0) {
1057                         i += mp1->m_len;
1058                         if (i > len) {
1059                                 mp1->m_len -= (i - len);
1060                                 zeroing = 1;
1061                         }
1062                         if (mp1->m_len > 0)
1063                                 cnt++;
1064                 }
1065                 mp1 = mp1->m_next;
1066             }
1067         }
1068         if (len > NFS_MAXDATA || len < 0 || i < len) {
1069                 error = EIO;
1070                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1071                                       2 * NFSX_UNSIGNED, &error));
1072                 nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1073                                  aftat_ret, vap);
1074                 error = 0;
1075                 goto nfsmout;
1076         }
1077         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
1078                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
1079         if (error) {
1080                 vp = NULL;
1081                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1082                                       2 * NFSX_UNSIGNED, &error));
1083                 nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1084                                  aftat_ret, vap);
1085                 error = 0;
1086                 goto nfsmout;
1087         }
1088         if (info.v3)
1089                 forat_ret = VOP_GETATTR(vp, &forat);
1090         if (vp->v_type != VREG) {
1091                 if (info.v3)
1092                         error = EINVAL;
1093                 else
1094                         error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1095         }
1096         if (!error) {
1097                 error = nfsrv_access(mp, vp, VWRITE, cred, rdonly, td, 1);
1098         }
1099         if (error) {
1100                 vput(vp);
1101                 vp = NULL;
1102                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1103                                       NFSX_WCCDATA(info.v3), &error));
1104                 nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1105                                  aftat_ret, vap);
1106                 error = 0;
1107                 goto nfsmout;
1108         }
1109
1110         if (len > 0) {
1111             MALLOC(ivp, struct iovec *, cnt * sizeof (struct iovec), M_TEMP,
1112                 M_WAITOK);
1113             uiop->uio_iov = iv = ivp;
1114             uiop->uio_iovcnt = cnt;
1115             mp1 = info.mrep;
1116             while (mp1) {
1117                 if (mp1->m_len > 0) {
1118                         ivp->iov_base = mtod(mp1, caddr_t);
1119                         ivp->iov_len = mp1->m_len;
1120                         ivp++;
1121                 }
1122                 mp1 = mp1->m_next;
1123             }
1124
1125             /*
1126              * XXX
1127              * The IO_METASYNC flag indicates that all metadata (and not just
1128              * enough to ensure data integrity) mus be written to stable storage
1129              * synchronously.
1130              * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
1131              */
1132             if (stable == NFSV3WRITE_UNSTABLE)
1133                 ioflags = IO_NODELOCKED;
1134             else if (stable == NFSV3WRITE_DATASYNC)
1135                 ioflags = (IO_SYNC | IO_NODELOCKED);
1136             else
1137                 ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1138             uiop->uio_resid = len;
1139             uiop->uio_rw = UIO_WRITE;
1140             uiop->uio_segflg = UIO_SYSSPACE;
1141             uiop->uio_td = NULL;
1142             uiop->uio_offset = off;
1143             error = VOP_WRITE(vp, uiop, ioflags, cred);
1144             nfsstats.srvvop_writes++;
1145             FREE((caddr_t)iv, M_TEMP);
1146         }
1147         aftat_ret = VOP_GETATTR(vp, vap);
1148         vput(vp);
1149         vp = NULL;
1150         if (!error)
1151                 error = aftat_ret;
1152         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1153                               NFSX_PREOPATTR(info.v3) +
1154                               NFSX_POSTOPORFATTR(info.v3) +
1155                               2 * NFSX_UNSIGNED + NFSX_WRITEVERF(info.v3),
1156                               &error));
1157         if (info.v3) {
1158                 nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1159                                  aftat_ret, vap);
1160                 if (error) {
1161                         error = 0;
1162                         goto nfsmout;
1163                 }
1164                 tl = nfsm_build(&info, 4 * NFSX_UNSIGNED);
1165                 *tl++ = txdr_unsigned(retlen);
1166                 /*
1167                  * If nfs_async is set, then pretend the write was FILESYNC.
1168                  */
1169                 if (stable == NFSV3WRITE_UNSTABLE && !nfs_async)
1170                         *tl++ = txdr_unsigned(stable);
1171                 else
1172                         *tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
1173                 /*
1174                  * Actually, there is no need to txdr these fields,
1175                  * but it may make the values more human readable,
1176                  * for debugging purposes.
1177                  */
1178                 if (nfsver.tv_sec == 0)
1179                         nfsver = boottime;
1180                 *tl++ = txdr_unsigned(nfsver.tv_sec);
1181                 *tl = txdr_unsigned(nfsver.tv_nsec / 1000);
1182         } else {
1183                 fp = nfsm_build(&info, NFSX_V2FATTR);
1184                 nfsm_srvfattr(nfsd, vap, fp);
1185         }
1186 nfsmout:
1187         *mrq = info.mreq;
1188         if (vp)
1189                 vput(vp);
1190         return(error);
1191 }
1192
1193 /*
1194  * NFS write service with write gathering support. Called when
1195  * nfsrvw_procrastinate > 0.
1196  * See: Chet Juszczak, "Improving the Write Performance of an NFS Server",
1197  * in Proc. of the Winter 1994 Usenix Conference, pg. 247-259, San Franscisco,
1198  * Jan. 1994.
1199  */
1200 int
1201 nfsrv_writegather(struct nfsrv_descript **ndp, struct nfssvc_sock *slp,
1202                   struct thread *td, struct mbuf **mrq)
1203 {
1204         struct iovec *ivp;
1205         struct nfsrv_descript *wp, *nfsd, *owp, *swp;
1206         struct nfs_fattr *fp;
1207         int i;
1208         struct iovec *iov;
1209         struct nfsrvw_delayhash *wpp;
1210         struct ucred *cred;
1211         struct vattr va, forat;
1212         u_int32_t *tl;
1213         int error = 0, rdonly, len, forat_ret = 1;
1214         int ioflags, aftat_ret = 1, adjust, zeroing;
1215         struct mbuf *mp1;
1216         struct vnode *vp = NULL;
1217         struct mount *mp = NULL;
1218         struct uio io, *uiop = &io;
1219         u_quad_t cur_usec;
1220         struct nfsm_info info;
1221
1222         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
1223 #ifndef nolint
1224         i = 0;
1225         len = 0;
1226 #endif
1227         *mrq = NULL;
1228         if (*ndp) {
1229             nfsd = *ndp;
1230             *ndp = NULL;
1231             info.mrep = nfsd->nd_mrep;
1232             info.mreq = NULL;
1233             info.md = nfsd->nd_md;
1234             info.dpos = nfsd->nd_dpos;
1235             info.v3 = (nfsd->nd_flag & ND_NFSV3);
1236             cred = &nfsd->nd_cr;
1237             LIST_INIT(&nfsd->nd_coalesce);
1238             nfsd->nd_mreq = NULL;
1239             nfsd->nd_stable = NFSV3WRITE_FILESYNC;
1240             cur_usec = nfs_curusec();
1241             nfsd->nd_time = cur_usec +
1242                 (info.v3 ? nfsrvw_procrastinate_v3 : nfsrvw_procrastinate);
1243
1244             /*
1245              * Now, get the write header..
1246              */
1247             NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, &nfsd->nd_fh, &error));
1248             if (info.v3) {
1249                 NULLOUT(tl = nfsm_dissect(&info, 5 * NFSX_UNSIGNED));
1250                 nfsd->nd_off = fxdr_hyper(tl);
1251                 tl += 3;
1252                 nfsd->nd_stable = fxdr_unsigned(int, *tl++);
1253             } else {
1254                 NULLOUT(tl = nfsm_dissect(&info, 4 * NFSX_UNSIGNED));
1255                 nfsd->nd_off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1256                 tl += 2;
1257                 if (nfs_async)
1258                         nfsd->nd_stable = NFSV3WRITE_UNSTABLE;
1259             }
1260             len = fxdr_unsigned(int32_t, *tl);
1261             nfsd->nd_len = len;
1262             nfsd->nd_eoff = nfsd->nd_off + len;
1263
1264             /*
1265              * Trim the header out of the mbuf list and trim off any trailing
1266              * junk so that the mbuf list has only the write data.
1267              */
1268             zeroing = 1;
1269             i = 0;
1270             mp1 = info.mrep;
1271             while (mp1) {
1272                 if (mp1 == info.md) {
1273                     zeroing = 0;
1274                     adjust = info.dpos - mtod(mp1, caddr_t);
1275                     mp1->m_len -= adjust;
1276                     if (mp1->m_len > 0 && adjust > 0)
1277                         mp1->m_data += adjust;
1278                 }
1279                 if (zeroing)
1280                     mp1->m_len = 0;
1281                 else {
1282                     i += mp1->m_len;
1283                     if (i > len) {
1284                         mp1->m_len -= (i - len);
1285                         zeroing = 1;
1286                     }
1287                 }
1288                 mp1 = mp1->m_next;
1289             }
1290             if (len > NFS_MAXDATA || len < 0  || i < len) {
1291 nfsmout:
1292                 m_freem(info.mrep);
1293                 info.mrep = NULL;
1294                 error = EIO;
1295                 nfsm_writereply(&info, nfsd, slp, error, 2 * NFSX_UNSIGNED);
1296                 if (info.v3) {
1297                     nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1298                                      aftat_ret, &va);
1299                 }
1300                 nfsd->nd_mreq = info.mreq;
1301                 nfsd->nd_mrep = NULL;
1302                 nfsd->nd_time = 0;
1303             }
1304
1305             /*
1306              * Add this entry to the hash and time queues.
1307              */
1308             crit_enter();
1309             owp = NULL;
1310             wp = slp->ns_tq.lh_first;
1311             while (wp && wp->nd_time < nfsd->nd_time) {
1312                 owp = wp;
1313                 wp = wp->nd_tq.le_next;
1314             }
1315             NFS_DPF(WG, ("Q%03x", nfsd->nd_retxid & 0xfff));
1316             if (owp) {
1317                 LIST_INSERT_AFTER(owp, nfsd, nd_tq);
1318             } else {
1319                 LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1320             }
1321             if (nfsd->nd_mrep) {
1322                 wpp = NWDELAYHASH(slp, nfsd->nd_fh.fh_fid.fid_data);
1323                 owp = NULL;
1324                 wp = wpp->lh_first;
1325                 while (wp &&
1326                     bcmp((caddr_t)&nfsd->nd_fh,(caddr_t)&wp->nd_fh,NFSX_V3FH)) {
1327                     owp = wp;
1328                     wp = wp->nd_hash.le_next;
1329                 }
1330                 while (wp && wp->nd_off < nfsd->nd_off &&
1331                     !bcmp((caddr_t)&nfsd->nd_fh,(caddr_t)&wp->nd_fh,NFSX_V3FH)) {
1332                     owp = wp;
1333                     wp = wp->nd_hash.le_next;
1334                 }
1335                 if (owp) {
1336                     LIST_INSERT_AFTER(owp, nfsd, nd_hash);
1337
1338                     /*
1339                      * Search the hash list for overlapping entries and
1340                      * coalesce.
1341                      */
1342                     for(; nfsd && NFSW_CONTIG(owp, nfsd); nfsd = wp) {
1343                         wp = nfsd->nd_hash.le_next;
1344                         if (NFSW_SAMECRED(owp, nfsd))
1345                             nfsrvw_coalesce(owp, nfsd);
1346                     }
1347                 } else {
1348                     LIST_INSERT_HEAD(wpp, nfsd, nd_hash);
1349                 }
1350             }
1351             crit_exit();
1352         }
1353
1354         /*
1355          * Now, do VOP_WRITE()s for any one(s) that need to be done now
1356          * and generate the associated reply mbuf list(s).
1357          */
1358 loop1:
1359         cur_usec = nfs_curusec();
1360         crit_enter();
1361         for (nfsd = slp->ns_tq.lh_first; nfsd; nfsd = owp) {
1362                 owp = nfsd->nd_tq.le_next;
1363                 if (nfsd->nd_time > cur_usec)
1364                     break;
1365                 if (nfsd->nd_mreq)
1366                     continue;
1367                 NFS_DPF(WG, ("P%03x", nfsd->nd_retxid & 0xfff));
1368                 LIST_REMOVE(nfsd, nd_tq);
1369                 LIST_REMOVE(nfsd, nd_hash);
1370                 crit_exit();
1371                 info.mrep = nfsd->nd_mrep;
1372                 info.v3 = (nfsd->nd_flag & ND_NFSV3);
1373                 nfsd->nd_mrep = NULL;
1374                 cred = &nfsd->nd_cr;
1375                 forat_ret = aftat_ret = 1;
1376                 error = nfsrv_fhtovp(&nfsd->nd_fh, 1, &mp, &vp, cred, slp,
1377                     nfsd->nd_nam, &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
1378                 if (!error) {
1379                     if (info.v3)
1380                         forat_ret = VOP_GETATTR(vp, &forat);
1381                     if (vp->v_type != VREG) {
1382                         if (info.v3)
1383                             error = EINVAL;
1384                         else
1385                             error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1386                     }
1387                 } else {
1388                     vp = NULL;
1389                 }
1390                 if (!error) {
1391                     error = nfsrv_access(mp, vp, VWRITE, cred, rdonly, td, 1);
1392                 }
1393
1394                 if (nfsd->nd_stable == NFSV3WRITE_UNSTABLE)
1395                     ioflags = IO_NODELOCKED;
1396                 else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC)
1397                     ioflags = (IO_SYNC | IO_NODELOCKED);
1398                 else
1399                     ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1400                 uiop->uio_rw = UIO_WRITE;
1401                 uiop->uio_segflg = UIO_SYSSPACE;
1402                 uiop->uio_td = NULL;
1403                 uiop->uio_offset = nfsd->nd_off;
1404                 uiop->uio_resid = nfsd->nd_eoff - nfsd->nd_off;
1405                 if (uiop->uio_resid > 0) {
1406                     mp1 = info.mrep;
1407                     i = 0;
1408                     while (mp1) {
1409                         if (mp1->m_len > 0)
1410                             i++;
1411                         mp1 = mp1->m_next;
1412                     }
1413                     uiop->uio_iovcnt = i;
1414                     MALLOC(iov, struct iovec *, i * sizeof (struct iovec),
1415                         M_TEMP, M_WAITOK);
1416                     uiop->uio_iov = ivp = iov;
1417                     mp1 = info.mrep;
1418                     while (mp1) {
1419                         if (mp1->m_len > 0) {
1420                             ivp->iov_base = mtod(mp1, caddr_t);
1421                             ivp->iov_len = mp1->m_len;
1422                             ivp++;
1423                         }
1424                         mp1 = mp1->m_next;
1425                     }
1426                     if (!error) {
1427                         error = VOP_WRITE(vp, uiop, ioflags, cred);
1428                         nfsstats.srvvop_writes++;
1429                     }
1430                     FREE((caddr_t)iov, M_TEMP);
1431                 }
1432                 m_freem(info.mrep);
1433                 info.mrep = NULL;
1434                 if (vp) {
1435                     aftat_ret = VOP_GETATTR(vp, &va);
1436                     vput(vp);
1437                     vp = NULL;
1438                 }
1439
1440                 /*
1441                  * Loop around generating replies for all write rpcs that have
1442                  * now been completed.
1443                  */
1444                 swp = nfsd;
1445                 do {
1446                     NFS_DPF(WG, ("R%03x", nfsd->nd_retxid & 0xfff));
1447                     if (error) {
1448                         nfsm_writereply(&info, nfsd, slp, error,
1449                                         NFSX_WCCDATA(info.v3));
1450                         if (info.v3) {
1451                             nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1452                                              aftat_ret, &va);
1453                         }
1454                     } else {
1455                         nfsm_writereply(&info, nfsd, slp, error,
1456                                         NFSX_PREOPATTR(info.v3) +
1457                                         NFSX_POSTOPORFATTR(info.v3) +
1458                                         2 * NFSX_UNSIGNED +
1459                                         NFSX_WRITEVERF(info.v3));
1460                         if (info.v3) {
1461                             nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1462                                              aftat_ret, &va);
1463                             tl = nfsm_build(&info, 4 * NFSX_UNSIGNED);
1464                             *tl++ = txdr_unsigned(nfsd->nd_len);
1465                             *tl++ = txdr_unsigned(swp->nd_stable);
1466                             /*
1467                              * Actually, there is no need to txdr these fields,
1468                              * but it may make the values more human readable,
1469                              * for debugging purposes.
1470                              */
1471                             if (nfsver.tv_sec == 0)
1472                                     nfsver = boottime;
1473                             *tl++ = txdr_unsigned(nfsver.tv_sec);
1474                             *tl = txdr_unsigned(nfsver.tv_nsec / 1000);
1475                         } else {
1476                             fp = nfsm_build(&info, NFSX_V2FATTR);
1477                             nfsm_srvfattr(nfsd, &va, fp);
1478                         }
1479                     }
1480                     nfsd->nd_mreq = info.mreq;
1481                     if (nfsd->nd_mrep)
1482                         panic("nfsrv_write: nd_mrep not free");
1483
1484                     /*
1485                      * Done. Put it at the head of the timer queue so that
1486                      * the final phase can return the reply.
1487                      */
1488                     crit_enter();
1489                     if (nfsd != swp) {
1490                         nfsd->nd_time = 0;
1491                         LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1492                     }
1493                     nfsd = swp->nd_coalesce.lh_first;
1494                     if (nfsd) {
1495                         LIST_REMOVE(nfsd, nd_tq);
1496                     }
1497                     crit_exit();
1498                 } while (nfsd);
1499                 crit_enter();
1500                 swp->nd_time = 0;
1501                 LIST_INSERT_HEAD(&slp->ns_tq, swp, nd_tq);
1502                 crit_exit();
1503                 goto loop1;
1504         }
1505         crit_exit();
1506
1507         /*
1508          * Search for a reply to return.
1509          */
1510         crit_enter();
1511         for (nfsd = slp->ns_tq.lh_first; nfsd; nfsd = nfsd->nd_tq.le_next)
1512                 if (nfsd->nd_mreq) {
1513                     NFS_DPF(WG, ("X%03x", nfsd->nd_retxid & 0xfff));
1514                     LIST_REMOVE(nfsd, nd_tq);
1515                     *mrq = nfsd->nd_mreq;
1516                     *ndp = nfsd;
1517                     break;
1518                 }
1519         crit_exit();
1520         return (0);
1521 }
1522
1523 /*
1524  * Coalesce the write request nfsd into owp. To do this we must:
1525  * - remove nfsd from the queues
1526  * - merge nfsd->nd_mrep into owp->nd_mrep
1527  * - update the nd_eoff and nd_stable for owp
1528  * - put nfsd on owp's nd_coalesce list
1529  * NB: Must be called at splsoftclock().
1530  */
1531 static void
1532 nfsrvw_coalesce(struct nfsrv_descript *owp, struct nfsrv_descript *nfsd)
1533 {
1534         int overlap;
1535         struct mbuf *mp1;
1536         struct nfsrv_descript *p;
1537
1538         NFS_DPF(WG, ("C%03x-%03x",
1539                      nfsd->nd_retxid & 0xfff, owp->nd_retxid & 0xfff));
1540         LIST_REMOVE(nfsd, nd_hash);
1541         LIST_REMOVE(nfsd, nd_tq);
1542         if (owp->nd_eoff < nfsd->nd_eoff) {
1543             overlap = owp->nd_eoff - nfsd->nd_off;
1544             if (overlap < 0)
1545                 panic("nfsrv_coalesce: bad off");
1546             if (overlap > 0)
1547                 m_adj(nfsd->nd_mrep, overlap);
1548             mp1 = owp->nd_mrep;
1549             while (mp1->m_next)
1550                 mp1 = mp1->m_next;
1551             mp1->m_next = nfsd->nd_mrep;
1552             owp->nd_eoff = nfsd->nd_eoff;
1553         } else
1554             m_freem(nfsd->nd_mrep);
1555         nfsd->nd_mrep = NULL;
1556         if (nfsd->nd_stable == NFSV3WRITE_FILESYNC)
1557             owp->nd_stable = NFSV3WRITE_FILESYNC;
1558         else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC &&
1559             owp->nd_stable == NFSV3WRITE_UNSTABLE)
1560             owp->nd_stable = NFSV3WRITE_DATASYNC;
1561         LIST_INSERT_HEAD(&owp->nd_coalesce, nfsd, nd_tq);
1562
1563         /*
1564          * If nfsd had anything else coalesced into it, transfer them
1565          * to owp, otherwise their replies will never get sent.
1566          */
1567         for (p = nfsd->nd_coalesce.lh_first; p;
1568              p = nfsd->nd_coalesce.lh_first) {
1569             LIST_REMOVE(p, nd_tq);
1570             LIST_INSERT_HEAD(&owp->nd_coalesce, p, nd_tq);
1571         }
1572 }
1573
1574 /*
1575  * nfs create service
1576  * now does a truncate to 0 length via. setattr if it already exists
1577  */
1578 int
1579 nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1580              struct thread *td, struct mbuf **mrq)
1581 {
1582         struct sockaddr *nam = nfsd->nd_nam;
1583         struct ucred *cred = &nfsd->nd_cr;
1584         struct nfs_fattr *fp;
1585         struct vattr va, dirfor, diraft;
1586         struct vattr *vap = &va;
1587         struct nfsv2_sattr *sp;
1588         u_int32_t *tl;
1589         struct nlookupdata nd;
1590         int error = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
1591         udev_t rdev = NOUDEV;
1592         caddr_t cp;
1593         int how, exclusive_flag = 0;
1594         struct vnode *dirp;
1595         struct vnode *dvp;
1596         struct vnode *vp;
1597         struct mount *mp;
1598         nfsfh_t nfh;
1599         fhandle_t *fhp;
1600         u_quad_t tempsize;
1601         u_char cverf[NFSX_V3CREATEVERF];
1602         struct nfsm_info info;
1603
1604         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
1605         nlookup_zero(&nd);
1606         dirp = NULL;
1607         dvp = NULL;
1608         vp = NULL;
1609
1610         info.mrep = nfsd->nd_mrep;
1611         info.mreq = NULL;
1612         info.md = nfsd->nd_md;
1613         info.dpos = nfsd->nd_dpos;
1614         info.v3 = (nfsd->nd_flag & ND_NFSV3);
1615
1616         fhp = &nfh.fh_generic;
1617         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
1618         NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
1619
1620         /*
1621          * Call namei and do initial cleanup to get a few things
1622          * out of the way.  If we get an initial error we cleanup
1623          * and return here to avoid special-casing the invalid nd
1624          * structure through the rest of the case.  dirp may be
1625          * set even if an error occurs, but the nd structure will not
1626          * be valid at all if an error occurs so we have to invalidate it
1627          * prior to calling nfsm_reply ( which might goto nfsmout ).
1628          */
1629         error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
1630                           fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
1631                           td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
1632         mp = vfs_getvfs(&fhp->fh_fsid);
1633
1634         if (dirp) {
1635                 if (info.v3) {
1636                         dirfor_ret = VOP_GETATTR(dirp, &dirfor);
1637                 } else {
1638                         vrele(dirp);
1639                         dirp = NULL;
1640                 }
1641         }
1642         if (error) {
1643                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1644                                       NFSX_WCCDATA(info.v3), &error));
1645                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
1646                                  diraft_ret, &diraft);
1647                 error = 0;
1648                 goto nfsmout;
1649         }
1650
1651         /*
1652          * No error.  Continue.  State:
1653          *
1654          *      dirp            may be valid
1655          *      vp              may be valid or NULL if the target does not
1656          *                      exist.
1657          *      dvp             is valid
1658          *
1659          * The error state is set through the code and we may also do some
1660          * opportunistic releasing of vnodes to avoid holding locks through
1661          * NFS I/O.  The cleanup at the end is a catch-all
1662          */
1663
1664         VATTR_NULL(vap);
1665         if (info.v3) {
1666                 NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
1667                 how = fxdr_unsigned(int, *tl);
1668                 switch (how) {
1669                 case NFSV3CREATE_GUARDED:
1670                         if (vp) {
1671                                 error = EEXIST;
1672                                 break;
1673                         }
1674                         /* fall through */
1675                 case NFSV3CREATE_UNCHECKED:
1676                         ERROROUT(nfsm_srvsattr(&info, vap));
1677                         break;
1678                 case NFSV3CREATE_EXCLUSIVE:
1679                         NULLOUT(cp = nfsm_dissect(&info, NFSX_V3CREATEVERF));
1680                         bcopy(cp, cverf, NFSX_V3CREATEVERF);
1681                         exclusive_flag = 1;
1682                         break;
1683                 };
1684                 vap->va_type = VREG;
1685         } else {
1686                 NULLOUT(sp = nfsm_dissect(&info, NFSX_V2SATTR));
1687                 vap->va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1688                 if (vap->va_type == VNON)
1689                         vap->va_type = VREG;
1690                 vap->va_mode = nfstov_mode(sp->sa_mode);
1691                 switch (vap->va_type) {
1692                 case VREG:
1693                         tsize = fxdr_unsigned(int32_t, sp->sa_size);
1694                         if (tsize != -1)
1695                                 vap->va_size = (u_quad_t)tsize;
1696                         break;
1697                 case VCHR:
1698                 case VBLK:
1699                 case VFIFO:
1700                         rdev = fxdr_unsigned(long, sp->sa_size);
1701                         break;
1702                 default:
1703                         break;
1704                 };
1705         }
1706
1707         /*
1708          * Iff doesn't exist, create it
1709          * otherwise just truncate to 0 length
1710          *   should I set the mode too ?
1711          *
1712          * The only possible error we can have at this point is EEXIST.
1713          * nd.ni_vp will also be non-NULL in that case.
1714          */
1715         if (vp == NULL) {
1716                 if (vap->va_mode == (mode_t)VNOVAL)
1717                         vap->va_mode = 0;
1718                 if (vap->va_type == VREG || vap->va_type == VSOCK) {
1719                         vn_unlock(dvp);
1720                         error = VOP_NCREATE(&nd.nl_nch, dvp, &vp,
1721                                             nd.nl_cred, vap);
1722                         vrele(dvp);
1723                         dvp = NULL;
1724                         if (error == 0) {
1725                                 if (exclusive_flag) {
1726                                         exclusive_flag = 0;
1727                                         VATTR_NULL(vap);
1728                                         bcopy(cverf, (caddr_t)&vap->va_atime,
1729                                                 NFSX_V3CREATEVERF);
1730                                         error = VOP_SETATTR(vp, vap, cred);
1731                                 }
1732                         }
1733                 } else if (
1734                         vap->va_type == VCHR ||
1735                         vap->va_type == VBLK ||
1736                         vap->va_type == VFIFO
1737                 ) {
1738                         /*
1739                          * Handle SysV FIFO node special cases.  All other
1740                          * devices require super user to access.
1741                          */
1742                         if (vap->va_type == VCHR && rdev == 0xffffffff)
1743                                 vap->va_type = VFIFO;
1744                         if (vap->va_type != VFIFO &&
1745                             (error = priv_check_cred(cred, PRIV_ROOT, 0))) {
1746                                 goto nfsmreply0;
1747                         }
1748                         vap->va_rmajor = umajor(rdev);
1749                         vap->va_rminor = uminor(rdev);
1750
1751                         vn_unlock(dvp);
1752                         error = VOP_NMKNOD(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap);
1753                         vrele(dvp);
1754                         dvp = NULL;
1755                         if (error)
1756                                 goto nfsmreply0;
1757 #if 0
1758                         /*
1759                          * XXX what is this junk supposed to do ?
1760                          */
1761
1762                         vput(vp);
1763                         vp = NULL;
1764
1765                         /*
1766                          * release dvp prior to lookup
1767                          */
1768                         vput(dvp);
1769                         dvp = NULL;
1770
1771                         /*
1772                          * Setup for lookup.
1773                          *
1774                          * Even though LOCKPARENT was cleared, ni_dvp may
1775                          * be garbage.
1776                          */
1777                         nd.ni_cnd.cn_nameiop = NAMEI_LOOKUP;
1778                         nd.ni_cnd.cn_flags &= ~(CNP_LOCKPARENT);
1779                         nd.ni_cnd.cn_td = td;
1780                         nd.ni_cnd.cn_cred = cred;
1781
1782                         error = lookup(&nd);
1783                         nd.ni_dvp = NULL;
1784
1785                         if (error != 0) {
1786                                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1787                                                       0, &error));
1788                                 /* fall through on certain errors */
1789                         }
1790                         nfsrv_object_create(nd.ni_vp);
1791                         if (nd.ni_cnd.cn_flags & CNP_ISSYMLINK) {
1792                                 error = EINVAL;
1793                                 goto nfsmreply0;
1794                         }
1795 #endif
1796                 } else {
1797                         error = ENXIO;
1798                 }
1799         } else {
1800                 if (vap->va_size != -1) {
1801                         error = nfsrv_access(mp, vp, VWRITE, cred,
1802                             (nd.nl_flags & NLC_NFS_RDONLY), td, 0);
1803                         if (!error) {
1804                                 tempsize = vap->va_size;
1805                                 VATTR_NULL(vap);
1806                                 vap->va_size = tempsize;
1807                                 error = VOP_SETATTR(vp, vap, cred);
1808                         }
1809                 }
1810         }
1811
1812         if (!error) {
1813                 bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
1814                 error = VFS_VPTOFH(vp, &fhp->fh_fid);
1815                 if (!error)
1816                         error = VOP_GETATTR(vp, vap);
1817         }
1818         if (info.v3) {
1819                 if (exclusive_flag && !error &&
1820                         bcmp(cverf, (caddr_t)&vap->va_atime, NFSX_V3CREATEVERF))
1821                         error = EEXIST;
1822                 diraft_ret = VOP_GETATTR(dirp, &diraft);
1823                 vrele(dirp);
1824                 dirp = NULL;
1825         }
1826         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1827                               NFSX_SRVFH(info.v3) + NFSX_FATTR(info.v3) +
1828                               NFSX_WCCDATA(info.v3),
1829                               &error));
1830         if (info.v3) {
1831                 if (!error) {
1832                         nfsm_srvpostop_fh(&info, fhp);
1833                         nfsm_srvpostop_attr(&info, nfsd, 0, vap);
1834                 }
1835                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
1836                                  diraft_ret, &diraft);
1837                 error = 0;
1838         } else {
1839                 nfsm_srvfhtom(&info, fhp);
1840                 fp = nfsm_build(&info, NFSX_V2FATTR);
1841                 nfsm_srvfattr(nfsd, vap, fp);
1842         }
1843         goto nfsmout;
1844
1845 nfsmreply0:
1846         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, 0, &error));
1847         error = 0;
1848         /* fall through */
1849
1850 nfsmout:
1851         info.mreq = NULL;
1852         if (dirp)
1853                 vrele(dirp);
1854         nlookup_done(&nd);
1855         if (dvp) {
1856                 if (dvp == vp)
1857                         vrele(dvp);
1858                 else
1859                         vput(dvp);
1860         }
1861         if (vp)
1862                 vput(vp);
1863         return (error);
1864 }
1865
1866 /*
1867  * nfs v3 mknod service
1868  */
1869 int
1870 nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1871             struct thread *td, struct mbuf **mrq)
1872 {
1873         struct sockaddr *nam = nfsd->nd_nam;
1874         struct ucred *cred = &nfsd->nd_cr;
1875         struct vattr va, dirfor, diraft;
1876         struct vattr *vap = &va;
1877         u_int32_t *tl;
1878         struct nlookupdata nd;
1879         int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
1880         enum vtype vtyp;
1881         struct vnode *dirp;
1882         struct vnode *dvp;
1883         struct vnode *vp;
1884         nfsfh_t nfh;
1885         fhandle_t *fhp;
1886         struct nfsm_info info;
1887
1888         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
1889         nlookup_zero(&nd);
1890         dirp = NULL;
1891         dvp = NULL;
1892         vp = NULL;
1893
1894         info.mrep = nfsd->nd_mrep;
1895         info.mreq = NULL;
1896         info.md = nfsd->nd_md;
1897         info.dpos = nfsd->nd_dpos;
1898
1899         fhp = &nfh.fh_generic;
1900         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
1901         NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
1902
1903         /*
1904          * Handle nfs_namei() call.  If an error occurs, the nd structure
1905          * is not valid.  However, nfsm_*() routines may still jump to
1906          * nfsmout.
1907          */
1908
1909         error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
1910                           fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
1911                           td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
1912         if (dirp)
1913                 dirfor_ret = VOP_GETATTR(dirp, &dirfor);
1914         if (error) {
1915                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1916                            NFSX_WCCDATA(1), &error));
1917                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
1918                                  diraft_ret, &diraft);
1919                 error = 0;
1920                 goto nfsmout;
1921         }
1922         NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
1923         vtyp = nfsv3tov_type(*tl);
1924         if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1925                 error = NFSERR_BADTYPE;
1926                 goto out;
1927         }
1928         VATTR_NULL(vap);
1929         ERROROUT(nfsm_srvsattr(&info, vap));
1930         if (vtyp == VCHR || vtyp == VBLK) {
1931                 NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
1932                 vap->va_rmajor = fxdr_unsigned(u_int32_t, *tl++);
1933                 vap->va_rminor = fxdr_unsigned(u_int32_t, *tl);
1934         }
1935
1936         /*
1937          * Iff doesn't exist, create it.
1938          */
1939         if (vp) {
1940                 error = EEXIST;
1941                 goto out;
1942         }
1943         vap->va_type = vtyp;
1944         if (vap->va_mode == (mode_t)VNOVAL)
1945                 vap->va_mode = 0;
1946         if (vtyp == VSOCK) {
1947                 vn_unlock(dvp);
1948                 error = VOP_NCREATE(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap);
1949                 vrele(dvp);
1950                 dvp = NULL;
1951         } else {
1952                 if (vtyp != VFIFO && (error = priv_check_cred(cred, PRIV_ROOT, 0)))
1953                         goto out;
1954
1955                 vn_unlock(dvp);
1956                 error = VOP_NMKNOD(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap);
1957                 vrele(dvp);
1958                 dvp = NULL;
1959                 if (error)
1960                         goto out;
1961         }
1962
1963         /*
1964          * send response, cleanup, return.
1965          */
1966 out:
1967         nlookup_done(&nd);
1968         if (dvp) {
1969                 if (dvp == vp)
1970                         vrele(dvp);
1971                 else
1972                         vput(dvp);
1973                 dvp = NULL;
1974         }
1975         if (!error) {
1976                 bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
1977                 error = VFS_VPTOFH(vp, &fhp->fh_fid);
1978                 if (!error)
1979                         error = VOP_GETATTR(vp, vap);
1980         }
1981         if (vp) {
1982                 vput(vp);
1983                 vp = NULL;
1984         }
1985         diraft_ret = VOP_GETATTR(dirp, &diraft);
1986         if (dirp) {
1987                 vrele(dirp);
1988                 dirp = NULL;
1989         }
1990         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1991                               NFSX_SRVFH(1) + NFSX_POSTOPATTR(1) +
1992                               NFSX_WCCDATA(1), &error));
1993         if (!error) {
1994                 nfsm_srvpostop_fh(&info, fhp);
1995                 nfsm_srvpostop_attr(&info, nfsd, 0, vap);
1996         }
1997         nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
1998                          diraft_ret, &diraft);
1999         return (0);
2000 nfsmout:
2001         *mrq = info.mreq;
2002         if (dirp)
2003                 vrele(dirp);
2004         nlookup_done(&nd);
2005         if (dvp) {
2006                 if (dvp == vp)
2007                         vrele(dvp);
2008                 else
2009                         vput(dvp);
2010         }
2011         if (vp)
2012                 vput(vp);
2013         return (error);
2014 }
2015
2016 /*
2017  * nfs remove service
2018  */
2019 int
2020 nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2021              struct thread *td, struct mbuf **mrq)
2022 {
2023         struct sockaddr *nam = nfsd->nd_nam;
2024         struct ucred *cred = &nfsd->nd_cr;
2025         struct nlookupdata nd;
2026         int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
2027         struct vnode *dirp;
2028         struct vnode *dvp;
2029         struct vnode *vp;
2030         struct vattr dirfor, diraft;
2031         nfsfh_t nfh;
2032         fhandle_t *fhp;
2033         struct nfsm_info info;
2034
2035         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2036         nlookup_zero(&nd);
2037         dirp = NULL;
2038         dvp = NULL;
2039         vp = NULL;
2040
2041         info.mrep = nfsd->nd_mrep;
2042         info.mreq = NULL;
2043         info.md = nfsd->nd_md;
2044         info.dpos = nfsd->nd_dpos;
2045         info.v3 = (nfsd->nd_flag & ND_NFSV3);
2046
2047         fhp = &nfh.fh_generic;
2048         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2049         NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2050
2051         error = nfs_namei(&nd, cred, NLC_DELETE, &dvp, &vp,
2052                           fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2053                           td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2054         if (dirp) {
2055                 if (info.v3)
2056                         dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2057         }
2058         if (error == 0) {
2059                 if (vp->v_type == VDIR) {
2060                         error = EPERM;          /* POSIX */
2061                         goto out;
2062                 }
2063                 /*
2064                  * The root of a mounted filesystem cannot be deleted.
2065                  */
2066                 if (vp->v_flag & VROOT) {
2067                         error = EBUSY;
2068                         goto out;
2069                 }
2070 out:
2071                 if (!error) {
2072                         if (dvp != vp)
2073                                 vn_unlock(dvp);
2074                         if (vp) {
2075                                 vput(vp);
2076                                 vp = NULL;
2077                         }
2078                         error = VOP_NREMOVE(&nd.nl_nch, dvp, nd.nl_cred);
2079                         vrele(dvp);
2080                         dvp = NULL;
2081                 }
2082         }
2083         if (dirp && info.v3)
2084                 diraft_ret = VOP_GETATTR(dirp, &diraft);
2085         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_WCCDATA(info.v3), &error));
2086         if (info.v3) {
2087                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2088                                  diraft_ret, &diraft);
2089                 error = 0;
2090         }
2091 nfsmout:
2092         *mrq = info.mreq;
2093         nlookup_done(&nd);
2094         if (dirp)
2095                 vrele(dirp);
2096         if (dvp) {
2097                 if (dvp == vp)
2098                         vrele(dvp);
2099                 else
2100                         vput(dvp);
2101         }
2102         if (vp)
2103                 vput(vp);
2104         return(error);
2105 }
2106
2107 /*
2108  * nfs rename service
2109  */
2110 int
2111 nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2112              struct thread *td, struct mbuf **mrq)
2113 {
2114         struct sockaddr *nam = nfsd->nd_nam;
2115         struct ucred *cred = &nfsd->nd_cr;
2116         int error = 0, len, len2, fdirfor_ret = 1, fdiraft_ret = 1;
2117         int tdirfor_ret = 1, tdiraft_ret = 1;
2118         struct nlookupdata fromnd, tond;
2119         struct vnode *fvp, *fdirp, *fdvp;
2120         struct vnode *tvp, *tdirp, *tdvp;
2121         struct namecache *ncp;
2122         struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
2123         nfsfh_t fnfh, tnfh;
2124         fhandle_t *ffhp, *tfhp;
2125         uid_t saved_uid;
2126         struct nfsm_info info;
2127
2128         info.mrep = nfsd->nd_mrep;
2129         info.mreq = NULL;
2130         info.md = nfsd->nd_md;
2131         info.dpos = nfsd->nd_dpos;
2132         info.v3 = (nfsd->nd_flag & ND_NFSV3);
2133
2134         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2135 #ifndef nolint
2136         fvp = NULL;
2137 #endif
2138         ffhp = &fnfh.fh_generic;
2139         tfhp = &tnfh.fh_generic;
2140
2141         /*
2142          * Clear fields incase goto nfsmout occurs from macro.
2143          */
2144
2145         nlookup_zero(&fromnd);
2146         nlookup_zero(&tond);
2147         fdirp = NULL;
2148         tdirp = NULL;
2149
2150         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, ffhp, &error));
2151         NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2152
2153         /*
2154          * Remember our original uid so that we can reset cr_uid before
2155          * the second nfs_namei() call, in case it is remapped.
2156          */
2157         saved_uid = cred->cr_uid;
2158         error = nfs_namei(&fromnd, cred, NLC_RENAME_SRC,
2159                           NULL, NULL,
2160                           ffhp, len, slp, nam, &info.md, &info.dpos, &fdirp,
2161                           td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2162         if (fdirp) {
2163                 if (info.v3)
2164                         fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor);
2165         }
2166         if (error) {
2167                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2168                                       2 * NFSX_WCCDATA(info.v3), &error));
2169                 nfsm_srvwcc_data(&info, nfsd, fdirfor_ret, &fdirfor,
2170                                  fdiraft_ret, &fdiraft);
2171                 nfsm_srvwcc_data(&info, nfsd, tdirfor_ret, &tdirfor,
2172                                  tdiraft_ret, &tdiraft);
2173                 error = 0;
2174                 goto nfsmout;
2175         }
2176
2177         /*
2178          * We have to unlock the from ncp before we can safely lookup
2179          * the target ncp.
2180          */
2181         KKASSERT(fromnd.nl_flags & NLC_NCPISLOCKED);
2182         cache_unlock(&fromnd.nl_nch);
2183         fromnd.nl_flags &= ~NLC_NCPISLOCKED;
2184         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, tfhp, &error));
2185         NEGATIVEOUT(len2 = nfsm_strsiz(&info, NFS_MAXNAMLEN));
2186         cred->cr_uid = saved_uid;
2187
2188         error = nfs_namei(&tond, cred, NLC_RENAME_DST, NULL, NULL,
2189                           tfhp, len2, slp, nam, &info.md, &info.dpos, &tdirp,
2190                           td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2191         if (tdirp) {
2192                 if (info.v3)
2193                         tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor);
2194         }
2195         if (error)
2196                 goto out1;
2197
2198         /*
2199          * relock the source
2200          */
2201         if (cache_lock_nonblock(&fromnd.nl_nch) == 0) {
2202                 cache_resolve(&fromnd.nl_nch, fromnd.nl_cred);
2203         } else if (fromnd.nl_nch.ncp > tond.nl_nch.ncp) {
2204                 cache_lock(&fromnd.nl_nch);
2205                 cache_resolve(&fromnd.nl_nch, fromnd.nl_cred);
2206         } else {
2207                 cache_unlock(&tond.nl_nch);
2208                 cache_lock(&fromnd.nl_nch);
2209                 cache_resolve(&fromnd.nl_nch, fromnd.nl_cred);
2210                 cache_lock(&tond.nl_nch);
2211                 cache_resolve(&tond.nl_nch, tond.nl_cred);
2212         }
2213         fromnd.nl_flags |= NLC_NCPISLOCKED;
2214
2215         fvp = fromnd.nl_nch.ncp->nc_vp;
2216         tvp = tond.nl_nch.ncp->nc_vp;
2217
2218         /*
2219          * Set fdvp and tdvp.  We haven't done all the topology checks
2220          * so these can wind up NULL (e.g. if either fvp or tvp is a mount
2221          * point).  If we get through the checks these will be guarenteed
2222          * to be non-NULL.
2223          *
2224          * Holding the children ncp's should be sufficient to prevent
2225          * fdvp and tdvp ripouts.
2226          */
2227         if (fromnd.nl_nch.ncp->nc_parent)
2228                 fdvp = fromnd.nl_nch.ncp->nc_parent->nc_vp;
2229         else
2230                 fdvp = NULL;
2231         if (tond.nl_nch.ncp->nc_parent)
2232                 tdvp = tond.nl_nch.ncp->nc_parent->nc_vp;
2233         else
2234                 tdvp = NULL;
2235
2236         if (tvp != NULL) {
2237                 if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
2238                         if (info.v3)
2239                                 error = EEXIST;
2240                         else
2241                                 error = EISDIR;
2242                         goto out;
2243                 } else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
2244                         if (info.v3)
2245                                 error = EEXIST;
2246                         else
2247                                 error = ENOTDIR;
2248                         goto out;
2249                 }
2250                 if (tvp->v_type == VDIR && (tond.nl_nch.ncp->nc_flag & NCF_ISMOUNTPT)) {
2251                         if (info.v3)
2252                                 error = EXDEV;
2253                         else
2254                                 error = ENOTEMPTY;
2255                         goto out;
2256                 }
2257         }
2258         if (fvp->v_type == VDIR && (fromnd.nl_nch.ncp->nc_flag & NCF_ISMOUNTPT)) {
2259                 if (info.v3)
2260                         error = EXDEV;
2261                 else
2262                         error = ENOTEMPTY;
2263                 goto out;
2264         }
2265         if (fromnd.nl_nch.mount != tond.nl_nch.mount) {
2266                 if (info.v3)
2267                         error = EXDEV;
2268                 else
2269                         error = ENOTEMPTY;
2270                 goto out;
2271         }
2272         if (fromnd.nl_nch.ncp == tond.nl_nch.ncp->nc_parent) {
2273                 if (info.v3)
2274                         error = EINVAL;
2275                 else
2276                         error = ENOTEMPTY;
2277         }
2278
2279         /*
2280          * You cannot rename a source into itself or a subdirectory of itself.
2281          * We check this by travsering the target directory upwards looking
2282          * for a match against the source.
2283          */
2284         if (error == 0) {
2285                 for (ncp = tond.nl_nch.ncp; ncp; ncp = ncp->nc_parent) {
2286                         if (fromnd.nl_nch.ncp == ncp) {
2287                                 error = EINVAL;
2288                                 break;
2289                         }
2290                 }
2291         }
2292
2293         /*
2294          * If source is the same as the destination (that is the
2295          * same vnode with the same name in the same directory),
2296          * then there is nothing to do.
2297          */
2298         if (fromnd.nl_nch.ncp == tond.nl_nch.ncp)
2299                 error = -1;
2300 out:
2301         if (!error) {
2302                 /*
2303                  * The VOP_NRENAME function releases all vnode references &
2304                  * locks prior to returning so we need to clear the pointers
2305                  * to bypass cleanup code later on.
2306                  */
2307                 error = VOP_NRENAME(&fromnd.nl_nch, &tond.nl_nch,
2308                                     fdvp, tdvp, tond.nl_cred);
2309         } else {
2310                 if (error == -1)
2311                         error = 0;
2312         }
2313         /* fall through */
2314
2315 out1:
2316         if (fdirp)
2317                 fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft);
2318         if (tdirp)
2319                 tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft);
2320         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2321                               2 * NFSX_WCCDATA(info.v3), &error));
2322         if (info.v3) {
2323                 nfsm_srvwcc_data(&info, nfsd, fdirfor_ret, &fdirfor,
2324                                  fdiraft_ret, &fdiraft);
2325                 nfsm_srvwcc_data(&info, nfsd, tdirfor_ret, &tdirfor,
2326                                  tdiraft_ret, &tdiraft);
2327         }
2328         error = 0;
2329         /* fall through */
2330
2331 nfsmout:
2332         *mrq = info.mreq;
2333         if (tdirp)
2334                 vrele(tdirp);
2335         nlookup_done(&tond);
2336         if (fdirp)
2337                 vrele(fdirp);
2338         nlookup_done(&fromnd);
2339         return (error);
2340 }
2341
2342 /*
2343  * nfs link service
2344  */
2345 int
2346 nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2347            struct thread *td, struct mbuf **mrq)
2348 {
2349         struct sockaddr *nam = nfsd->nd_nam;
2350         struct ucred *cred = &nfsd->nd_cr;
2351         struct nlookupdata nd;
2352         int error = 0, rdonly, len, dirfor_ret = 1, diraft_ret = 1;
2353         int getret = 1;
2354         struct vnode *dirp;
2355         struct vnode *dvp;
2356         struct vnode *vp;
2357         struct vnode *xp;
2358         struct mount *mp;
2359         struct mount *xmp;
2360         struct vattr dirfor, diraft, at;
2361         nfsfh_t nfh, dnfh;
2362         fhandle_t *fhp, *dfhp;
2363         struct nfsm_info info;
2364
2365         info.mrep = nfsd->nd_mrep;
2366         info.mreq = NULL;
2367         info.md = nfsd->nd_md;
2368         info.dpos = nfsd->nd_dpos;
2369         info.v3 = (nfsd->nd_flag & ND_NFSV3);
2370
2371         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2372         nlookup_zero(&nd);
2373         dirp = dvp = vp = xp = NULL;
2374         mp = xmp = NULL;
2375
2376         fhp = &nfh.fh_generic;
2377         dfhp = &dnfh.fh_generic;
2378         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2379         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, dfhp, &error));
2380         NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2381
2382         error = nfsrv_fhtovp(fhp, FALSE, &xmp, &xp, cred, slp, nam,
2383                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
2384         if (error) {
2385                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2386                                       NFSX_POSTOPATTR(info.v3) +
2387                                       NFSX_WCCDATA(info.v3),
2388                                       &error));
2389                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
2390                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2391                                  diraft_ret, &diraft);
2392                 xp = NULL;
2393                 error = 0;
2394                 goto nfsmout;
2395         }
2396         if (xp->v_type == VDIR) {
2397                 error = EPERM;          /* POSIX */
2398                 goto out1;
2399         }
2400
2401         error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
2402                           dfhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2403                           td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2404         if (dirp) {
2405                 if (info.v3)
2406                         dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2407         }
2408         if (error)
2409                 goto out1;
2410
2411         if (vp != NULL) {
2412                 error = EEXIST;
2413                 goto out;
2414         }
2415         if (xp->v_mount != dvp->v_mount)
2416                 error = EXDEV;
2417 out:
2418         if (!error) {
2419                 vn_unlock(dvp);
2420                 error = VOP_NLINK(&nd.nl_nch, dvp, xp, nd.nl_cred);
2421                 vrele(dvp);
2422                 dvp = NULL;
2423         }
2424         /* fall through */
2425
2426 out1:
2427         if (info.v3)
2428                 getret = VOP_GETATTR(xp, &at);
2429         if (dirp)
2430                 diraft_ret = VOP_GETATTR(dirp, &diraft);
2431         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2432                               NFSX_POSTOPATTR(info.v3) + NFSX_WCCDATA(info.v3),
2433                               &error));
2434         if (info.v3) {
2435                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
2436                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2437                                  diraft_ret, &diraft);
2438                 error = 0;
2439         }
2440         /* fall through */
2441
2442 nfsmout:
2443         *mrq = info.mreq;
2444         nlookup_done(&nd);
2445         if (dirp)
2446                 vrele(dirp);
2447         if (xp)
2448                 vrele(xp);
2449         if (dvp) {
2450                 if (dvp == vp)
2451                         vrele(dvp);
2452                 else
2453                         vput(dvp);
2454         }
2455         if (vp)
2456                 vput(vp);
2457         return(error);
2458 }
2459
2460 /*
2461  * nfs symbolic link service
2462  */
2463 int
2464 nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2465               struct thread *td, struct mbuf **mrq)
2466 {
2467         struct sockaddr *nam = nfsd->nd_nam;
2468         struct ucred *cred = &nfsd->nd_cr;
2469         struct vattr va, dirfor, diraft;
2470         struct nlookupdata nd;
2471         struct vattr *vap = &va;
2472         struct nfsv2_sattr *sp;
2473         char *pathcp = NULL;
2474         struct uio io;
2475         struct iovec iv;
2476         int error = 0, len, len2, dirfor_ret = 1, diraft_ret = 1;
2477         struct vnode *dirp;
2478         struct vnode *vp;
2479         struct vnode *dvp;
2480         nfsfh_t nfh;
2481         fhandle_t *fhp;
2482         struct nfsm_info info;
2483
2484         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2485         nlookup_zero(&nd);
2486         dirp = NULL;
2487         dvp = NULL;
2488         vp = NULL;
2489
2490         info.mrep = nfsd->nd_mrep;
2491         info.mreq =  NULL;
2492         info.md = nfsd->nd_md;
2493         info.dpos = nfsd->nd_dpos;
2494         info.v3 = (nfsd->nd_flag & ND_NFSV3);
2495
2496         fhp = &nfh.fh_generic;
2497         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2498         NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2499
2500         error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
2501                         fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2502                         td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2503         if (dirp) {
2504                 if (info.v3)
2505                         dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2506         }
2507         if (error)
2508                 goto out;
2509
2510         VATTR_NULL(vap);
2511         if (info.v3) {
2512                 ERROROUT(nfsm_srvsattr(&info, vap));
2513         }
2514         NEGATIVEOUT(len2 = nfsm_strsiz(&info, NFS_MAXPATHLEN));
2515         MALLOC(pathcp, caddr_t, len2 + 1, M_TEMP, M_WAITOK);
2516         iv.iov_base = pathcp;
2517         iv.iov_len = len2;
2518         io.uio_resid = len2;
2519         io.uio_offset = 0;
2520         io.uio_iov = &iv;
2521         io.uio_iovcnt = 1;
2522         io.uio_segflg = UIO_SYSSPACE;
2523         io.uio_rw = UIO_READ;
2524         io.uio_td = NULL;
2525         ERROROUT(nfsm_mtouio(&info, &io, len2));
2526         if (info.v3 == 0) {
2527                 NULLOUT(sp = nfsm_dissect(&info, NFSX_V2SATTR));
2528                 vap->va_mode = nfstov_mode(sp->sa_mode);
2529         }
2530         *(pathcp + len2) = '\0';
2531         if (vp) {
2532                 error = EEXIST;
2533                 goto out;
2534         }
2535
2536         if (vap->va_mode == (mode_t)VNOVAL)
2537                 vap->va_mode = 0;
2538         if (dvp != vp)
2539                 vn_unlock(dvp);
2540         error = VOP_NSYMLINK(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap, pathcp);
2541         vrele(dvp);
2542         dvp = NULL;
2543         if (error == 0) {
2544                 bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
2545                 error = VFS_VPTOFH(vp, &fhp->fh_fid);
2546                 if (!error)
2547                         error = VOP_GETATTR(vp, vap);
2548         }
2549
2550 out:
2551         if (dvp) {
2552                 if (dvp == vp)
2553                         vrele(dvp);
2554                 else
2555                         vput(dvp);
2556         }
2557         if (vp) {
2558                 vput(vp);
2559                 vp = NULL;
2560         }
2561         if (pathcp) {
2562                 FREE(pathcp, M_TEMP);
2563                 pathcp = NULL;
2564         }
2565         if (dirp) {
2566                 diraft_ret = VOP_GETATTR(dirp, &diraft);
2567                 vrele(dirp);
2568                 dirp = NULL;
2569         }
2570         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2571                               NFSX_SRVFH(info.v3) + NFSX_POSTOPATTR(info.v3) +
2572                               NFSX_WCCDATA(info.v3),
2573                               &error));
2574         if (info.v3) {
2575                 if (!error) {
2576                         nfsm_srvpostop_fh(&info, fhp);
2577                         nfsm_srvpostop_attr(&info, nfsd, 0, vap);
2578                 }
2579                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2580                                  diraft_ret, &diraft);
2581         }
2582         error = 0;
2583         /* fall through */
2584
2585 nfsmout:
2586         *mrq = info.mreq;
2587         nlookup_done(&nd);
2588         if (vp)
2589                 vput(vp);
2590         if (dirp)
2591                 vrele(dirp);
2592         if (pathcp)
2593                 FREE(pathcp, M_TEMP);
2594         return (error);
2595 }
2596
2597 /*
2598  * nfs mkdir service
2599  */
2600 int
2601 nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2602             struct thread *td, struct mbuf **mrq)
2603 {
2604         struct sockaddr *nam = nfsd->nd_nam;
2605         struct ucred *cred = &nfsd->nd_cr;
2606         struct vattr va, dirfor, diraft;
2607         struct vattr *vap = &va;
2608         struct nfs_fattr *fp;
2609         struct nlookupdata nd;
2610         u_int32_t *tl;
2611         int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
2612         struct vnode *dirp;
2613         struct vnode *dvp;
2614         struct vnode *vp;
2615         nfsfh_t nfh;
2616         fhandle_t *fhp;
2617         struct nfsm_info info;
2618
2619         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2620         nlookup_zero(&nd);
2621         dirp = NULL;
2622         dvp = NULL;
2623         vp = NULL;
2624
2625         info.dpos = nfsd->nd_dpos;
2626         info.mrep = nfsd->nd_mrep;
2627         info.mreq =  NULL;
2628         info.md = nfsd->nd_md;
2629         info.v3 = (nfsd->nd_flag & ND_NFSV3);
2630
2631         fhp = &nfh.fh_generic;
2632         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2633         NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2634
2635         error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
2636                           fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2637                           td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2638         if (dirp) {
2639                 if (info.v3)
2640                         dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2641         }
2642         if (error) {
2643                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2644                                       NFSX_WCCDATA(info.v3), &error));
2645                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2646                                  diraft_ret, &diraft);
2647                 error = 0;
2648                 goto nfsmout;
2649         }
2650         VATTR_NULL(vap);
2651         if (info.v3) {
2652                 ERROROUT(nfsm_srvsattr(&info, vap));
2653         } else {
2654                 NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
2655                 vap->va_mode = nfstov_mode(*tl++);
2656         }
2657
2658         /*
2659          * At this point nd.ni_dvp is referenced and exclusively locked and
2660          * nd.ni_vp, if it exists, is referenced but not locked.
2661          */
2662
2663         vap->va_type = VDIR;
2664         if (vp != NULL) {
2665                 error = EEXIST;
2666                 goto out;
2667         }
2668
2669         /*
2670          * Issue mkdir op.  Since SAVESTART is not set, the pathname
2671          * component is freed by the VOP call.  This will fill-in
2672          * nd.ni_vp, reference, and exclusively lock it.
2673          */
2674         if (vap->va_mode == (mode_t)VNOVAL)
2675                 vap->va_mode = 0;
2676         vn_unlock(dvp);
2677         error = VOP_NMKDIR(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap);
2678         vrele(dvp);
2679         dvp = NULL;
2680
2681         if (error == 0) {
2682                 bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
2683                 error = VFS_VPTOFH(vp, &fhp->fh_fid);
2684                 if (error == 0)
2685                         error = VOP_GETATTR(vp, vap);
2686         }
2687 out:
2688         if (dirp)
2689                 diraft_ret = VOP_GETATTR(dirp, &diraft);
2690         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2691                               NFSX_SRVFH(info.v3) + NFSX_POSTOPATTR(info.v3) +
2692                               NFSX_WCCDATA(info.v3),
2693                               &error));
2694         if (info.v3) {
2695                 if (!error) {
2696                         nfsm_srvpostop_fh(&info, fhp);
2697                         nfsm_srvpostop_attr(&info, nfsd, 0, vap);
2698                 }
2699                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2700                                  diraft_ret, &diraft);
2701         } else {
2702                 nfsm_srvfhtom(&info, fhp);
2703                 fp = nfsm_build(&info, NFSX_V2FATTR);
2704                 nfsm_srvfattr(nfsd, vap, fp);
2705         }
2706         error = 0;
2707         /* fall through */
2708
2709 nfsmout:
2710         *mrq = info.mreq;
2711         nlookup_done(&nd);
2712         if (dirp)
2713                 vrele(dirp);
2714         if (dvp) {
2715                 if (dvp == vp)
2716                         vrele(dvp);
2717                 else
2718                         vput(dvp);
2719         }
2720         if (vp)
2721                 vput(vp);
2722         return (error);
2723 }
2724
2725 /*
2726  * nfs rmdir service
2727  */
2728 int
2729 nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2730             struct thread *td, struct mbuf **mrq)
2731 {
2732         struct sockaddr *nam = nfsd->nd_nam;
2733         struct ucred *cred = &nfsd->nd_cr;
2734         int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
2735         struct vnode *dirp;
2736         struct vnode *dvp;
2737         struct vnode *vp;
2738         struct vattr dirfor, diraft;
2739         nfsfh_t nfh;
2740         fhandle_t *fhp;
2741         struct nlookupdata nd;
2742         struct nfsm_info info;
2743
2744         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2745         nlookup_zero(&nd);
2746         dirp = NULL;
2747         dvp = NULL;
2748         vp = NULL;
2749
2750         info.mrep = nfsd->nd_mrep;
2751         info.mreq = NULL;
2752         info.md = nfsd->nd_md;
2753         info.dpos = nfsd->nd_dpos;
2754         info.v3 = (nfsd->nd_flag & ND_NFSV3);
2755
2756         fhp = &nfh.fh_generic;
2757         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2758         NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2759
2760         error = nfs_namei(&nd, cred, NLC_DELETE, &dvp, &vp,
2761                           fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2762                           td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2763         if (dirp) {
2764                 if (info.v3)
2765                         dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2766         }
2767         if (error) {
2768                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2769                                       NFSX_WCCDATA(info.v3), &error));
2770                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2771                                  diraft_ret, &diraft);
2772                 error = 0;
2773                 goto nfsmout;
2774         }
2775         if (vp->v_type != VDIR) {
2776                 error = ENOTDIR;
2777                 goto out;
2778         }
2779
2780         /*
2781          * The root of a mounted filesystem cannot be deleted.
2782          */
2783         if (vp->v_flag & VROOT)
2784                 error = EBUSY;
2785 out:
2786         /*
2787          * Issue or abort op.  Since SAVESTART is not set, path name
2788          * component is freed by the VOP after either.
2789          */
2790         if (!error) {
2791                 if (dvp != vp)
2792                         vn_unlock(dvp);
2793                 vput(vp);
2794                 vp = NULL;
2795                 error = VOP_NRMDIR(&nd.nl_nch, dvp, nd.nl_cred);
2796                 vrele(dvp);
2797                 dvp = NULL;
2798         }
2799         nlookup_done(&nd);
2800
2801         if (dirp)
2802                 diraft_ret = VOP_GETATTR(dirp, &diraft);
2803         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_WCCDATA(info.v3), &error));
2804         if (info.v3) {
2805                 nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2806                                  diraft_ret, &diraft);
2807                 error = 0;
2808         }
2809         /* fall through */
2810
2811 nfsmout:
2812         *mrq = info.mreq;
2813         if (dvp) {
2814                 if (dvp == vp)
2815                         vrele(dvp);
2816                 else
2817                         vput(dvp);
2818         }
2819         nlookup_done(&nd);
2820         if (dirp)
2821                 vrele(dirp);
2822         if (vp)
2823                 vput(vp);
2824         return(error);
2825 }
2826
2827 /*
2828  * nfs readdir service
2829  * - mallocs what it thinks is enough to read
2830  *      count rounded up to a multiple of NFS_DIRBLKSIZ <= NFS_MAXREADDIR
2831  * - calls VOP_READDIR()
2832  * - loops around building the reply
2833  *      if the output generated exceeds count break out of loop
2834  *      The nfsm_clget macro is used here so that the reply will be packed
2835  *      tightly in mbuf clusters.
2836  * - it only knows that it has encountered eof when the VOP_READDIR()
2837  *      reads nothing
2838  * - as such one readdir rpc will return eof false although you are there
2839  *      and then the next will return eof
2840  * - it trims out records with d_fileno == 0
2841  *      this doesn't matter for Unix clients, but they might confuse clients
2842  *      for other os'.
2843  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2844  *      than requested, but this may not apply to all filesystems. For
2845  *      example, client NFS does not { although it is never remote mounted
2846  *      anyhow }
2847  *     The alternate call nfsrv_readdirplus() does lookups as well.
2848  * PS: The NFS protocol spec. does not clarify what the "count" byte
2849  *      argument is a count of.. just name strings and file id's or the
2850  *      entire reply rpc or ...
2851  *      I tried just file name and id sizes and it confused the Sun client,
2852  *      so I am using the full rpc size now. The "paranoia.." comment refers
2853  *      to including the status longwords that are not a part of the dir.
2854  *      "entry" structures, but are in the rpc.
2855  */
2856 struct flrep {
2857         nfsuint64       fl_off;
2858         u_int32_t       fl_postopok;
2859         u_int32_t       fl_fattr[NFSX_V3FATTR / sizeof (u_int32_t)];
2860         u_int32_t       fl_fhok;
2861         u_int32_t       fl_fhsize;
2862         u_int32_t       fl_nfh[NFSX_V3FH / sizeof (u_int32_t)];
2863 };
2864
2865 int
2866 nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2867               struct thread *td, struct mbuf **mrq)
2868 {
2869         struct sockaddr *nam = nfsd->nd_nam;
2870         struct ucred *cred = &nfsd->nd_cr;
2871         char *bp, *be;
2872         struct dirent *dp;
2873         caddr_t cp;
2874         u_int32_t *tl;
2875         struct mbuf *mp1, *mp2;
2876         char *cpos, *cend, *rbuf;
2877         struct vnode *vp = NULL;
2878         struct mount *mp = NULL;
2879         struct vattr at;
2880         nfsfh_t nfh;
2881         fhandle_t *fhp;
2882         struct uio io;
2883         struct iovec iv;
2884         int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2885         int siz, cnt, fullsiz, eofflag, rdonly, ncookies;
2886         u_quad_t off, toff, verf;
2887         off_t *cookies = NULL, *cookiep;
2888         struct nfsm_info info;
2889
2890         info.mrep = nfsd->nd_mrep;
2891         info.mreq = NULL;
2892         info.md = nfsd->nd_md;
2893         info.dpos = nfsd->nd_dpos;
2894         info.v3 = (nfsd->nd_flag & ND_NFSV3);
2895
2896         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2897         fhp = &nfh.fh_generic;
2898         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2899         if (info.v3) {
2900                 NULLOUT(tl = nfsm_dissect(&info, 5 * NFSX_UNSIGNED));
2901                 toff = fxdr_hyper(tl);
2902                 tl += 2;
2903                 verf = fxdr_hyper(tl);
2904                 tl += 2;
2905         } else {
2906                 NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
2907                 toff = fxdr_unsigned(u_quad_t, *tl++);
2908                 verf = 0;       /* shut up gcc */
2909         }
2910         off = toff;
2911         cnt = fxdr_unsigned(int, *tl);
2912         siz = ((cnt + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
2913         xfer = NFS_SRVMAXDATA(nfsd);
2914         if (cnt > xfer)
2915                 cnt = xfer;
2916         if (siz > xfer)
2917                 siz = xfer;
2918         fullsiz = siz;
2919         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
2920                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
2921         if (!error && vp->v_type != VDIR) {
2922                 error = ENOTDIR;
2923                 vput(vp);
2924                 vp = NULL;
2925         }
2926         if (error) {
2927                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
2928                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
2929                 error = 0;
2930                 goto nfsmout;
2931         }
2932
2933         /*
2934          * Obtain lock on vnode for this section of the code
2935          */
2936
2937         if (info.v3) {
2938                 error = getret = VOP_GETATTR(vp, &at);
2939 #if 0
2940                 /*
2941                  * XXX This check may be too strict for Solaris 2.5 clients.
2942                  */
2943                 if (!error && toff && verf && verf != at.va_filerev)
2944                         error = NFSERR_BAD_COOKIE;
2945 #endif
2946         }
2947         if (!error)
2948                 error = nfsrv_access(mp, vp, VEXEC, cred, rdonly, td, 0);
2949         if (error) {
2950                 vput(vp);
2951                 vp = NULL;
2952                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2953                                       NFSX_POSTOPATTR(info.v3), &error));
2954                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
2955                 error = 0;
2956                 goto nfsmout;
2957         }
2958         vn_unlock(vp);
2959
2960         /*
2961          * end section.  Allocate rbuf and continue
2962          */
2963         MALLOC(rbuf, caddr_t, siz, M_TEMP, M_WAITOK);
2964 again:
2965         iv.iov_base = rbuf;
2966         iv.iov_len = fullsiz;
2967         io.uio_iov = &iv;
2968         io.uio_iovcnt = 1;
2969         io.uio_offset = (off_t)off;
2970         io.uio_resid = fullsiz;
2971         io.uio_segflg = UIO_SYSSPACE;
2972         io.uio_rw = UIO_READ;
2973         io.uio_td = NULL;
2974         eofflag = 0;
2975         if (cookies) {
2976                 kfree((caddr_t)cookies, M_TEMP);
2977                 cookies = NULL;
2978         }
2979         error = VOP_READDIR(vp, &io, cred, &eofflag, &ncookies, &cookies);
2980         off = (off_t)io.uio_offset;
2981         if (!cookies && !error)
2982                 error = NFSERR_PERM;
2983         if (info.v3) {
2984                 getret = VOP_GETATTR(vp, &at);
2985                 if (!error)
2986                         error = getret;
2987         }
2988         if (error) {
2989                 vrele(vp);
2990                 vp = NULL;
2991                 kfree((caddr_t)rbuf, M_TEMP);
2992                 if (cookies)
2993                         kfree((caddr_t)cookies, M_TEMP);
2994                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2995                                       NFSX_POSTOPATTR(info.v3), &error));
2996                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
2997                 error = 0;
2998                 goto nfsmout;
2999         }
3000         if (io.uio_resid) {
3001                 siz -= io.uio_resid;
3002
3003                 /*
3004                  * If nothing read, return eof
3005                  * rpc reply
3006                  */
3007                 if (siz == 0) {
3008                         vrele(vp);
3009                         vp = NULL;
3010                         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3011                                               NFSX_POSTOPATTR(info.v3) +
3012                                               NFSX_COOKIEVERF(info.v3) +
3013                                               2 * NFSX_UNSIGNED,
3014                                               &error));
3015                         if (info.v3) {
3016                                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3017                                 tl = nfsm_build(&info, 4 * NFSX_UNSIGNED);
3018                                 txdr_hyper(at.va_filerev, tl);
3019                                 tl += 2;
3020                         } else
3021                                 tl = nfsm_build(&info, 2 * NFSX_UNSIGNED);
3022                         *tl++ = nfs_false;
3023                         *tl = nfs_true;
3024                         FREE((caddr_t)rbuf, M_TEMP);
3025                         FREE((caddr_t)cookies, M_TEMP);
3026                         error = 0;
3027                         goto nfsmout;
3028                 }
3029         }
3030
3031         /*
3032          * Check for degenerate cases of nothing useful read.
3033          * If so go try again
3034          */
3035         cpos = rbuf;
3036         cend = rbuf + siz;
3037         dp = (struct dirent *)cpos;
3038         cookiep = cookies;
3039         /*
3040          * For some reason FreeBSD's ufs_readdir() chooses to back the
3041          * directory offset up to a block boundary, so it is necessary to
3042          * skip over the records that preceed the requested offset. This
3043          * requires the assumption that file offset cookies monotonically
3044          * increase.
3045          */
3046         while (cpos < cend && ncookies > 0 &&
3047                 (dp->d_ino == 0 || dp->d_type == DT_WHT ||
3048                  ((u_quad_t)(*cookiep)) <= toff)) {
3049                 dp = _DIRENT_NEXT(dp);
3050                 cpos = (char *)dp;
3051                 cookiep++;
3052                 ncookies--;
3053         }
3054         if (cpos >= cend || ncookies == 0) {
3055                 toff = off;
3056                 siz = fullsiz;
3057                 goto again;
3058         }
3059
3060         len = 3 * NFSX_UNSIGNED;        /* paranoia, probably can be 0 */
3061         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3062                               NFSX_POSTOPATTR(info.v3) +
3063                               NFSX_COOKIEVERF(info.v3) + siz,
3064                               &error));
3065         if (info.v3) {
3066                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3067                 tl = nfsm_build(&info, 2 * NFSX_UNSIGNED);
3068                 txdr_hyper(at.va_filerev, tl);
3069         }
3070         mp1 = mp2 = info.mb;
3071         bp = info.bpos;
3072         be = bp + M_TRAILINGSPACE(mp1);
3073
3074         /* Loop through the records and build reply */
3075         while (cpos < cend && ncookies > 0) {
3076                 if (dp->d_ino != 0 && dp->d_type != DT_WHT) {
3077                         nlen = dp->d_namlen;
3078                         rem = nfsm_rndup(nlen) - nlen;
3079                         len += (4 * NFSX_UNSIGNED + nlen + rem);
3080                         if (info.v3)
3081                                 len += 2 * NFSX_UNSIGNED;
3082                         if (len > cnt) {
3083                                 eofflag = 0;
3084                                 break;
3085                         }
3086                         /*
3087                          * Build the directory record xdr from
3088                          * the dirent entry.
3089                          */
3090                         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3091                         *tl = nfs_true;
3092                         bp += NFSX_UNSIGNED;
3093                         if (info.v3) {
3094                                 tl = nfsm_clget(&info, mp1, mp2, bp, be);
3095                                 *tl = 0;
3096                                 bp += NFSX_UNSIGNED;
3097                         }
3098                         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3099                         *tl = txdr_unsigned(dp->d_ino);
3100                         bp += NFSX_UNSIGNED;
3101                         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3102                         *tl = txdr_unsigned(nlen);
3103                         bp += NFSX_UNSIGNED;
3104
3105                         /* And loop around copying the name */
3106                         xfer = nlen;
3107                         cp = dp->d_name;
3108                         while (xfer > 0) {
3109                                 tl = nfsm_clget(&info, mp1, mp2, bp, be);
3110                                 if ((bp+xfer) > be)
3111                                         tsiz = be-bp;
3112                                 else
3113                                         tsiz = xfer;
3114                                 bcopy(cp, bp, tsiz);
3115                                 bp += tsiz;
3116                                 xfer -= tsiz;
3117                                 if (xfer > 0)
3118                                         cp += tsiz;
3119                         }
3120                         /* And null pad to a int32_t boundary */
3121                         for (i = 0; i < rem; i++)
3122                                 *bp++ = '\0';
3123                         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3124
3125                         /* Finish off the record */
3126                         if (info.v3) {
3127                                 *tl = txdr_unsigned(*cookiep >> 32);
3128                                 bp += NFSX_UNSIGNED;
3129                                 tl = nfsm_clget(&info, mp1, mp2, bp, be);
3130                         }
3131                         *tl = txdr_unsigned(*cookiep);
3132                         bp += NFSX_UNSIGNED;
3133                 }
3134                 dp = _DIRENT_NEXT(dp);
3135                 cpos = (char *)dp;
3136                 cookiep++;
3137                 ncookies--;
3138         }
3139         vrele(vp);
3140         vp = NULL;
3141         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3142         *tl = nfs_false;
3143         bp += NFSX_UNSIGNED;
3144         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3145         if (eofflag)
3146                 *tl = nfs_true;
3147         else
3148                 *tl = nfs_false;
3149         bp += NFSX_UNSIGNED;
3150         if (mp1 != info.mb) {
3151                 if (bp < be)
3152                         mp1->m_len = bp - mtod(mp1, caddr_t);
3153         } else
3154                 mp1->m_len += bp - info.bpos;
3155         FREE((caddr_t)rbuf, M_TEMP);
3156         FREE((caddr_t)cookies, M_TEMP);
3157
3158 nfsmout:
3159         *mrq = info.mreq;
3160         if (vp)
3161                 vrele(vp);
3162         return(error);
3163 }
3164
3165 int
3166 nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3167                   struct thread *td, struct mbuf **mrq)
3168 {
3169         struct sockaddr *nam = nfsd->nd_nam;
3170         struct ucred *cred = &nfsd->nd_cr;
3171         char *bp, *be;
3172         struct dirent *dp;
3173         caddr_t cp;
3174         u_int32_t *tl;
3175         struct mbuf *mp1, *mp2;
3176         char *cpos, *cend, *rbuf;
3177         struct vnode *vp = NULL, *nvp;
3178         struct mount *mp = NULL;
3179         struct flrep fl;
3180         nfsfh_t nfh;
3181         fhandle_t *fhp, *nfhp = (fhandle_t *)fl.fl_nfh;
3182         struct uio io;
3183         struct iovec iv;
3184         struct vattr va, at, *vap = &va;
3185         struct nfs_fattr *fp;
3186         int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
3187         int siz, cnt, fullsiz, eofflag, rdonly, dirlen, ncookies;
3188         u_quad_t off, toff, verf;
3189         off_t *cookies = NULL, *cookiep; /* needs to be int64_t or off_t */
3190         struct nfsm_info info;
3191
3192         info.mrep = nfsd->nd_mrep;
3193         info.mreq = NULL;
3194         info.md = nfsd->nd_md;
3195         info.dpos = nfsd->nd_dpos;
3196
3197         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3198         fhp = &nfh.fh_generic;
3199         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3200         NULLOUT(tl = nfsm_dissect(&info, 6 * NFSX_UNSIGNED));
3201         toff = fxdr_hyper(tl);
3202         tl += 2;
3203         verf = fxdr_hyper(tl);
3204         tl += 2;
3205         siz = fxdr_unsigned(int, *tl++);
3206         cnt = fxdr_unsigned(int, *tl);
3207         off = toff;
3208         siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
3209         xfer = NFS_SRVMAXDATA(nfsd);
3210         if (cnt > xfer)
3211                 cnt = xfer;
3212         if (siz > xfer)
3213                 siz = xfer;
3214         fullsiz = siz;
3215         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3216                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3217         if (!error && vp->v_type != VDIR) {
3218                 error = ENOTDIR;
3219                 vput(vp);
3220                 vp = NULL;
3221         }
3222         if (error) {
3223                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
3224                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3225                 error = 0;
3226                 goto nfsmout;
3227         }
3228         error = getret = VOP_GETATTR(vp, &at);
3229 #if 0
3230         /*
3231          * XXX This check may be too strict for Solaris 2.5 clients.
3232          */
3233         if (!error && toff && verf && verf != at.va_filerev)
3234                 error = NFSERR_BAD_COOKIE;
3235 #endif
3236         if (!error) {
3237                 error = nfsrv_access(mp, vp, VEXEC, cred, rdonly, td, 0);
3238         }
3239         if (error) {
3240                 vput(vp);
3241                 vp = NULL;
3242                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3243                                       NFSX_V3POSTOPATTR, &error));
3244                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3245                 error = 0;
3246                 goto nfsmout;
3247         }
3248         vn_unlock(vp);
3249         MALLOC(rbuf, caddr_t, siz, M_TEMP, M_WAITOK);
3250 again:
3251         iv.iov_base = rbuf;
3252         iv.iov_len = fullsiz;
3253         io.uio_iov = &iv;
3254         io.uio_iovcnt = 1;
3255         io.uio_offset = (off_t)off;
3256         io.uio_resid = fullsiz;
3257         io.uio_segflg = UIO_SYSSPACE;
3258         io.uio_rw = UIO_READ;
3259         io.uio_td = NULL;
3260         eofflag = 0;
3261         if (cookies) {
3262                 kfree((caddr_t)cookies, M_TEMP);
3263                 cookies = NULL;
3264         }
3265         error = VOP_READDIR(vp, &io, cred, &eofflag, &ncookies, &cookies);
3266         off = (u_quad_t)io.uio_offset;
3267         getret = VOP_GETATTR(vp, &at);
3268         if (!cookies && !error)
3269                 error = NFSERR_PERM;
3270         if (!error)
3271                 error = getret;
3272         if (error) {
3273                 vrele(vp);
3274                 vp = NULL;
3275                 if (cookies)
3276                         kfree((caddr_t)cookies, M_TEMP);
3277                 kfree((caddr_t)rbuf, M_TEMP);
3278                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3279                                       NFSX_V3POSTOPATTR, &error));
3280                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3281                 error = 0;
3282                 goto nfsmout;
3283         }
3284         if (io.uio_resid) {
3285                 siz -= io.uio_resid;
3286
3287                 /*
3288                  * If nothing read, return eof
3289                  * rpc reply
3290                  */
3291                 if (siz == 0) {
3292                         vrele(vp);
3293                         vp = NULL;
3294                         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3295                                               NFSX_V3POSTOPATTR +
3296                                               NFSX_V3COOKIEVERF +
3297                                               2 * NFSX_UNSIGNED,
3298                                               &error));
3299                         nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3300                         tl = nfsm_build(&info, 4 * NFSX_UNSIGNED);
3301                         txdr_hyper(at.va_filerev, tl);
3302                         tl += 2;
3303                         *tl++ = nfs_false;
3304                         *tl = nfs_true;
3305                         FREE((caddr_t)cookies, M_TEMP);
3306                         FREE((caddr_t)rbuf, M_TEMP);
3307                         error = 0;
3308                         goto nfsmout;
3309                 }
3310         }
3311
3312         /*
3313          * Check for degenerate cases of nothing useful read.
3314          * If so go try again
3315          */
3316         cpos = rbuf;
3317         cend = rbuf + siz;
3318         dp = (struct dirent *)cpos;
3319         cookiep = cookies;
3320         /*
3321          * For some reason FreeBSD's ufs_readdir() chooses to back the
3322          * directory offset up to a block boundary, so it is necessary to
3323          * skip over the records that preceed the requested offset. This
3324          * requires the assumption that file offset cookies monotonically
3325          * increase.
3326          */
3327         while (cpos < cend && ncookies > 0 &&
3328                 (dp->d_ino == 0 || dp->d_type == DT_WHT ||
3329                  ((u_quad_t)(*cookiep)) <= toff)) {
3330                 dp = _DIRENT_NEXT(dp);
3331                 cpos = (char *)dp;
3332                 cookiep++;
3333                 ncookies--;
3334         }
3335         if (cpos >= cend || ncookies == 0) {
3336                 toff = off;
3337                 siz = fullsiz;
3338                 goto again;
3339         }
3340
3341         /*
3342          * Probe one of the directory entries to see if the filesystem
3343          * supports VGET.
3344          */
3345         if (VFS_VGET(vp->v_mount, dp->d_ino, &nvp) == EOPNOTSUPP) {
3346                 error = NFSERR_NOTSUPP;
3347                 vrele(vp);
3348                 vp = NULL;
3349                 kfree((caddr_t)cookies, M_TEMP);
3350                 kfree((caddr_t)rbuf, M_TEMP);
3351                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3352                                       NFSX_V3POSTOPATTR, &error));
3353                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3354                 error = 0;
3355                 goto nfsmout;
3356         }
3357         if (nvp) {
3358                 vput(nvp);
3359                 nvp = NULL;
3360         }
3361
3362         dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
3363                         2 * NFSX_UNSIGNED;
3364         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, cnt, &error));
3365         nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3366         tl = nfsm_build(&info, 2 * NFSX_UNSIGNED);
3367         txdr_hyper(at.va_filerev, tl);
3368         mp1 = mp2 = info.mb;
3369         bp = info.bpos;
3370         be = bp + M_TRAILINGSPACE(mp1);
3371
3372         /* Loop through the records and build reply */
3373         while (cpos < cend && ncookies > 0) {
3374                 if (dp->d_ino != 0 && dp->d_type != DT_WHT) {
3375                         nlen = dp->d_namlen;
3376                         rem = nfsm_rndup(nlen)-nlen;
3377
3378                         /*
3379                          * For readdir_and_lookup get the vnode using
3380                          * the file number.
3381                          */
3382                         if (VFS_VGET(vp->v_mount, dp->d_ino, &nvp))
3383                                 goto invalid;
3384                         bzero((caddr_t)nfhp, NFSX_V3FH);
3385                         nfhp->fh_fsid = fhp->fh_fsid;
3386                         if (VFS_VPTOFH(nvp, &nfhp->fh_fid)) {
3387                                 vput(nvp);
3388                                 nvp = NULL;
3389                                 goto invalid;
3390                         }
3391                         if (VOP_GETATTR(nvp, vap)) {
3392                                 vput(nvp);
3393                                 nvp = NULL;
3394                                 goto invalid;
3395                         }
3396                         vput(nvp);
3397                         nvp = NULL;
3398
3399                         /*
3400                          * If either the dircount or maxcount will be
3401                          * exceeded, get out now. Both of these lengths
3402                          * are calculated conservatively, including all
3403                          * XDR overheads.
3404                          */
3405                         len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
3406                                 NFSX_V3POSTOPATTR);
3407                         dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
3408                         if (len > cnt || dirlen > fullsiz) {
3409                                 eofflag = 0;
3410                                 break;
3411                         }
3412
3413                         /*
3414                          * Build the directory record xdr from
3415                          * the dirent entry.
3416                          */
3417                         fp = (struct nfs_fattr *)&fl.fl_fattr;
3418                         nfsm_srvfattr(nfsd, vap, fp);
3419                         fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
3420                         fl.fl_fhok = nfs_true;
3421                         fl.fl_postopok = nfs_true;
3422                         fl.fl_off.nfsuquad[0] = txdr_unsigned(*cookiep >> 32);
3423                         fl.fl_off.nfsuquad[1] = txdr_unsigned(*cookiep);
3424
3425                         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3426                         *tl = nfs_true;
3427                         bp += NFSX_UNSIGNED;
3428                         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3429                         *tl = 0;
3430                         bp += NFSX_UNSIGNED;
3431                         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3432                         *tl = txdr_unsigned(dp->d_ino);
3433                         bp += NFSX_UNSIGNED;
3434                         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3435                         *tl = txdr_unsigned(nlen);
3436                         bp += NFSX_UNSIGNED;
3437
3438                         /* And loop around copying the name */
3439                         xfer = nlen;
3440                         cp = dp->d_name;
3441                         while (xfer > 0) {
3442                                 tl = nfsm_clget(&info, mp1, mp2, bp, be);
3443                                 if ((bp + xfer) > be)
3444                                         tsiz = be - bp;
3445                                 else
3446                                         tsiz = xfer;
3447                                 bcopy(cp, bp, tsiz);
3448                                 bp += tsiz;
3449                                 xfer -= tsiz;
3450                                 if (xfer > 0)
3451                                         cp += tsiz;
3452                         }
3453                         /* And null pad to a int32_t boundary */
3454                         for (i = 0; i < rem; i++)
3455                                 *bp++ = '\0';
3456
3457                         /*
3458                          * Now copy the flrep structure out.
3459                          */
3460                         xfer = sizeof (struct flrep);
3461                         cp = (caddr_t)&fl;
3462                         while (xfer > 0) {
3463                                 tl = nfsm_clget(&info, mp1, mp2, bp, be);
3464                                 if ((bp + xfer) > be)
3465                                         tsiz = be - bp;
3466                                 else
3467                                         tsiz = xfer;
3468                                 bcopy(cp, bp, tsiz);
3469                                 bp += tsiz;
3470                                 xfer -= tsiz;
3471                                 if (xfer > 0)
3472                                         cp += tsiz;
3473                         }
3474                 }
3475 invalid:
3476                 dp = _DIRENT_NEXT(dp);
3477                 cpos = (char *)dp;
3478                 cookiep++;
3479                 ncookies--;
3480         }
3481         vrele(vp);
3482         vp = NULL;
3483         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3484         *tl = nfs_false;
3485         bp += NFSX_UNSIGNED;
3486         tl = nfsm_clget(&info, mp1, mp2, bp, be);
3487         if (eofflag)
3488                 *tl = nfs_true;
3489         else
3490                 *tl = nfs_false;
3491         bp += NFSX_UNSIGNED;
3492         if (mp1 != info.mb) {
3493                 if (bp < be)
3494                         mp1->m_len = bp - mtod(mp1, caddr_t);
3495         } else
3496                 mp1->m_len += bp - info.bpos;
3497         FREE((caddr_t)cookies, M_TEMP);
3498         FREE((caddr_t)rbuf, M_TEMP);
3499 nfsmout:
3500         *mrq = info.mreq;
3501         if (vp)
3502                 vrele(vp);
3503         return(error);
3504 }
3505
3506 /*
3507  * nfs commit service
3508  */
3509 int
3510 nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3511              struct thread *td, struct mbuf **mrq)
3512 {
3513         struct sockaddr *nam = nfsd->nd_nam;
3514         struct ucred *cred = &nfsd->nd_cr;
3515         struct vattr bfor, aft;
3516         struct vnode *vp = NULL;
3517         struct mount *mp = NULL;
3518         nfsfh_t nfh;
3519         fhandle_t *fhp;
3520         u_int32_t *tl;
3521         int error = 0, rdonly, for_ret = 1, aft_ret = 1, cnt;
3522         u_quad_t off;
3523         struct nfsm_info info;
3524
3525         info.mrep = nfsd->nd_mrep;
3526         info.mreq = NULL;
3527         info.md = nfsd->nd_md;
3528         info.dpos = nfsd->nd_dpos;
3529
3530         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3531         fhp = &nfh.fh_generic;
3532         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3533         NULLOUT(tl = nfsm_dissect(&info, 3 * NFSX_UNSIGNED));
3534
3535         /*
3536          * XXX At this time VOP_FSYNC() does not accept offset and byte
3537          * count parameters, so these arguments are useless (someday maybe).
3538          */
3539         off = fxdr_hyper(tl);
3540         tl += 2;
3541         cnt = fxdr_unsigned(int, *tl);
3542         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3543                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3544         if (error) {
3545                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3546                                       2 * NFSX_UNSIGNED, &error));
3547                 nfsm_srvwcc_data(&info, nfsd, for_ret, &bfor,
3548                                  aft_ret, &aft);
3549                 error = 0;
3550                 goto nfsmout;
3551         }
3552         for_ret = VOP_GETATTR(vp, &bfor);
3553
3554         if (cnt > MAX_COMMIT_COUNT) {
3555                 /*
3556                  * Give up and do the whole thing
3557                  */
3558                 if (vp->v_object &&
3559                    (vp->v_object->flags & OBJ_MIGHTBEDIRTY)) {
3560                         vm_object_page_clean(vp->v_object, 0, 0, OBJPC_SYNC);
3561                 }
3562                 error = VOP_FSYNC(vp, MNT_WAIT);
3563         } else {
3564                 /*
3565                  * Locate and synchronously write any buffers that fall
3566                  * into the requested range.  Note:  we are assuming that
3567                  * f_iosize is a power of 2.
3568                  */
3569                 int iosize = vp->v_mount->mnt_stat.f_iosize;
3570                 int iomask = iosize - 1;
3571                 off_t loffset;
3572
3573                 /*
3574                  * Align to iosize boundry, super-align to page boundry.
3575                  */
3576                 if (off & iomask) {
3577                         cnt += off & iomask;
3578                         off &= ~(u_quad_t)iomask;
3579                 }
3580                 if (off & PAGE_MASK) {
3581                         cnt += off & PAGE_MASK;
3582                         off &= ~(u_quad_t)PAGE_MASK;
3583                 }
3584                 loffset = off;
3585
3586                 if (vp->v_object &&
3587                    (vp->v_object->flags & OBJ_MIGHTBEDIRTY)) {
3588                         vm_object_page_clean(vp->v_object, off / PAGE_SIZE, (cnt + PAGE_MASK) / PAGE_SIZE, OBJPC_SYNC);
3589                 }
3590
3591                 crit_enter();
3592                 while (cnt > 0) {
3593                         struct buf *bp;
3594
3595                         /*
3596                          * If we have a buffer and it is marked B_DELWRI we
3597                          * have to lock and write it.  Otherwise the prior
3598                          * write is assumed to have already been committed.
3599                          */
3600                         if ((bp = findblk(vp, loffset, FINDBLK_TEST)) != NULL) {
3601                                 if (bp->b_flags & B_DELWRI)
3602                                         bp = findblk(vp, loffset, 0);
3603                                 else
3604                                         bp = NULL;
3605                         }
3606                         if (bp) {
3607                                 if (bp->b_flags & B_DELWRI) {
3608                                         bremfree(bp);
3609                                         bwrite(bp);
3610                                         ++nfs_commit_miss;
3611                                 } else {
3612                                         BUF_UNLOCK(bp);
3613                                 }
3614                         }
3615                         ++nfs_commit_blks;
3616                         if (cnt < iosize)
3617                                 break;
3618                         cnt -= iosize;
3619                         loffset += iosize;
3620                 }
3621                 crit_exit();
3622         }
3623
3624         aft_ret = VOP_GETATTR(vp, &aft);
3625         vput(vp);
3626         vp = NULL;
3627         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3628                               NFSX_V3WCCDATA + NFSX_V3WRITEVERF,
3629                               &error));
3630         nfsm_srvwcc_data(&info, nfsd, for_ret, &bfor,
3631                          aft_ret, &aft);
3632         if (!error) {
3633                 tl = nfsm_build(&info, NFSX_V3WRITEVERF);
3634                 if (nfsver.tv_sec == 0)
3635                         nfsver = boottime;
3636                 *tl++ = txdr_unsigned(nfsver.tv_sec);
3637                 *tl = txdr_unsigned(nfsver.tv_nsec / 1000);
3638         } else {
3639                 error = 0;
3640         }
3641 nfsmout:
3642         *mrq = info.mreq;
3643         if (vp)
3644                 vput(vp);
3645         return(error);
3646 }
3647
3648 /*
3649  * nfs statfs service
3650  */
3651 int
3652 nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3653              struct thread *td, struct mbuf **mrq)
3654 {
3655         struct sockaddr *nam = nfsd->nd_nam;
3656         struct ucred *cred = &nfsd->nd_cr;
3657         struct statfs *sf;
3658         struct nfs_statfs *sfp;
3659         int error = 0, rdonly, getret = 1;
3660         struct vnode *vp = NULL;
3661         struct mount *mp = NULL;
3662         struct vattr at;
3663         nfsfh_t nfh;
3664         fhandle_t *fhp;
3665         struct statfs statfs;
3666         u_quad_t tval;
3667         struct nfsm_info info;
3668
3669         info.mrep = nfsd->nd_mrep;
3670         info.mreq = NULL;
3671         info.md = nfsd->nd_md;
3672         info.dpos = nfsd->nd_dpos;
3673         info.v3 = (nfsd->nd_flag & ND_NFSV3);
3674
3675         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3676         fhp = &nfh.fh_generic;
3677         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3678         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3679                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3680         if (error) {
3681                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
3682                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3683                 error = 0;
3684                 goto nfsmout;
3685         }
3686         sf = &statfs;
3687         error = VFS_STATFS(vp->v_mount, sf, proc0.p_ucred);
3688         getret = VOP_GETATTR(vp, &at);
3689         vput(vp);
3690         vp = NULL;
3691         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3692                               NFSX_POSTOPATTR(info.v3) + NFSX_STATFS(info.v3),
3693                               &error));
3694         if (info.v3)
3695                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3696         if (error) {
3697                 error = 0;
3698                 goto nfsmout;
3699         }
3700         sfp = nfsm_build(&info, NFSX_STATFS(info.v3));
3701         if (info.v3) {
3702                 tval = (u_quad_t)sf->f_blocks;
3703                 tval *= (u_quad_t)sf->f_bsize;
3704                 txdr_hyper(tval, &sfp->sf_tbytes);
3705                 tval = (u_quad_t)sf->f_bfree;
3706                 tval *= (u_quad_t)sf->f_bsize;
3707                 txdr_hyper(tval, &sfp->sf_fbytes);
3708                 tval = (u_quad_t)sf->f_bavail;
3709                 tval *= (u_quad_t)sf->f_bsize;
3710                 txdr_hyper(tval, &sfp->sf_abytes);
3711                 sfp->sf_tfiles.nfsuquad[0] = 0;
3712                 sfp->sf_tfiles.nfsuquad[1] = txdr_unsigned(sf->f_files);
3713                 sfp->sf_ffiles.nfsuquad[0] = 0;
3714                 sfp->sf_ffiles.nfsuquad[1] = txdr_unsigned(sf->f_ffree);
3715                 sfp->sf_afiles.nfsuquad[0] = 0;
3716                 sfp->sf_afiles.nfsuquad[1] = txdr_unsigned(sf->f_ffree);
3717                 sfp->sf_invarsec = 0;
3718         } else {
3719                 sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
3720                 sfp->sf_bsize = txdr_unsigned(sf->f_bsize);
3721                 sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
3722                 sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
3723                 sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
3724         }
3725 nfsmout:
3726         *mrq = info.mreq;
3727         if (vp)
3728                 vput(vp);
3729         return(error);
3730 }
3731
3732 /*
3733  * nfs fsinfo service
3734  */
3735 int
3736 nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3737              struct thread *td, struct mbuf **mrq)
3738 {
3739         struct sockaddr *nam = nfsd->nd_nam;
3740         struct ucred *cred = &nfsd->nd_cr;
3741         struct nfsv3_fsinfo *sip;
3742         int error = 0, rdonly, getret = 1, pref;
3743         struct vnode *vp = NULL;
3744         struct mount *mp = NULL;
3745         struct vattr at;
3746         nfsfh_t nfh;
3747         fhandle_t *fhp;
3748         u_quad_t maxfsize;
3749         struct statfs sb;
3750         struct nfsm_info info;
3751
3752         info.mrep = nfsd->nd_mrep;
3753         info.mreq = NULL;
3754         info.md = nfsd->nd_md;
3755         info.dpos = nfsd->nd_dpos;
3756
3757         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3758         fhp = &nfh.fh_generic;
3759         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3760         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3761                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3762         if (error) {
3763                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
3764                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3765                 error = 0;
3766                 goto nfsmout;
3767         }
3768
3769         /* XXX Try to make a guess on the max file size. */
3770         VFS_STATFS(vp->v_mount, &sb, proc0.p_ucred);
3771         maxfsize = (u_quad_t)0x80000000 * sb.f_bsize - 1;
3772
3773         getret = VOP_GETATTR(vp, &at);
3774         vput(vp);
3775         vp = NULL;
3776         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3777                               NFSX_V3POSTOPATTR + NFSX_V3FSINFO, &error));
3778         nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3779         sip = nfsm_build(&info, NFSX_V3FSINFO);
3780
3781         /*
3782          * XXX
3783          * There should be file system VFS OP(s) to get this information.
3784          * For now, assume ufs.
3785          */
3786         if (slp->ns_so->so_type == SOCK_DGRAM)
3787                 pref = NFS_MAXDGRAMDATA;
3788         else
3789                 pref = NFS_MAXDATA;
3790         sip->fs_rtmax = txdr_unsigned(NFS_MAXDATA);
3791         sip->fs_rtpref = txdr_unsigned(pref);
3792         sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
3793         sip->fs_wtmax = txdr_unsigned(NFS_MAXDATA);
3794         sip->fs_wtpref = txdr_unsigned(pref);
3795         sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
3796         sip->fs_dtpref = txdr_unsigned(pref);
3797         txdr_hyper(maxfsize, &sip->fs_maxfilesize);
3798         sip->fs_timedelta.nfsv3_sec = 0;
3799         sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
3800         sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
3801                 NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
3802                 NFSV3FSINFO_CANSETTIME);
3803 nfsmout:
3804         *mrq = info.mreq;
3805         if (vp)
3806                 vput(vp);
3807         return(error);
3808 }
3809
3810 /*
3811  * nfs pathconf service
3812  */
3813 int
3814 nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3815                struct thread *td, struct mbuf **mrq)
3816 {
3817         struct sockaddr *nam = nfsd->nd_nam;
3818         struct ucred *cred = &nfsd->nd_cr;
3819         struct nfsv3_pathconf *pc;
3820         int error = 0, rdonly, getret = 1;
3821         register_t linkmax, namemax, chownres, notrunc;
3822         struct vnode *vp = NULL;
3823         struct mount *mp = NULL;
3824         struct vattr at;
3825         nfsfh_t nfh;
3826         fhandle_t *fhp;
3827         struct nfsm_info info;
3828
3829         info.mrep = nfsd->nd_mrep;
3830         info.mreq = NULL;
3831         info.md = nfsd->nd_md;
3832         info.dpos = nfsd->nd_dpos;
3833
3834         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3835         fhp = &nfh.fh_generic;
3836         NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3837         error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3838                  &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3839         if (error) {
3840                 NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
3841                 nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3842                 error = 0;
3843                 goto nfsmout;
3844         }
3845         error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
3846         if (!error)
3847                 error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
3848         if (!error)
3849                 error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
3850         if (!error)
3851                 error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
3852         getret = VOP_GETATTR(vp, &at);
3853         vput(vp);
3854         vp = NULL;
3855         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3856                               NFSX_V3POSTOPATTR + NFSX_V3PATHCONF,
3857                               &error));
3858         nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3859         if (error) {
3860                 error = 0;
3861                 goto nfsmout;
3862         }
3863         pc = nfsm_build(&info, NFSX_V3PATHCONF);
3864
3865         pc->pc_linkmax = txdr_unsigned(linkmax);
3866         pc->pc_namemax = txdr_unsigned(namemax);
3867         pc->pc_notrunc = txdr_unsigned(notrunc);
3868         pc->pc_chownrestricted = txdr_unsigned(chownres);
3869
3870         /*
3871          * These should probably be supported by VOP_PATHCONF(), but
3872          * until msdosfs is exportable (why would you want to?), the
3873          * Unix defaults should be ok.
3874          */
3875         pc->pc_caseinsensitive = nfs_false;
3876         pc->pc_casepreserving = nfs_true;
3877 nfsmout:
3878         *mrq = info.mreq;
3879         if (vp)
3880                 vput(vp);
3881         return(error);
3882 }
3883
3884 /*
3885  * Null operation, used by clients to ping server
3886  */
3887 /* ARGSUSED */
3888 int
3889 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3890            struct thread *td, struct mbuf **mrq)
3891 {
3892         struct nfsm_info info;
3893         int error = NFSERR_RETVOID;
3894
3895         info.mrep = nfsd->nd_mrep;
3896         info.mreq = NULL;
3897
3898         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3899         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, 0, &error));
3900 nfsmout:
3901         *mrq = info.mreq;
3902         return (error);
3903 }
3904
3905 /*
3906  * No operation, used for obsolete procedures
3907  */
3908 /* ARGSUSED */
3909 int
3910 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3911            struct thread *td, struct mbuf **mrq)
3912 {
3913         struct nfsm_info info;
3914         int error;
3915
3916         info.mrep = nfsd->nd_mrep;
3917         info.mreq = NULL;
3918
3919         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3920         if (nfsd->nd_repstat)
3921                 error = nfsd->nd_repstat;
3922         else
3923                 error = EPROCUNAVAIL;
3924         NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, 0, &error));
3925         error = 0;
3926 nfsmout:
3927         *mrq = info.mreq;
3928         return (error);
3929 }
3930
3931 /*
3932  * Perform access checking for vnodes obtained from file handles that would
3933  * refer to files already opened by a Unix client. You cannot just use
3934  * vn_writechk() and VOP_ACCESS() for two reasons.
3935  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
3936  * 2 - The owner is to be given access irrespective of mode bits for some
3937  *     operations, so that processes that chmod after opening a file don't
3938  *     break. I don't like this because it opens a security hole, but since
3939  *     the nfs server opens a security hole the size of a barn door anyhow,
3940  *     what the heck.
3941  *
3942  * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
3943  * will return EPERM instead of EACCESS. EPERM is always an error.
3944  */
3945 static int
3946 nfsrv_access(struct mount *mp, struct vnode *vp, int flags, struct ucred *cred,
3947              int rdonly, struct thread *td, int override)
3948 {
3949         struct vattr vattr;
3950         int error;
3951
3952         nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3953         if (flags & VWRITE) {
3954                 /* Just vn_writechk() changed to check rdonly */
3955                 /*
3956                  * Disallow write attempts on read-only file systems;
3957                  * unless the file is a socket or a block or character
3958                  * device resident on the file system.
3959                  */
3960                 if (rdonly ||
3961                     ((mp->mnt_flag | vp->v_mount->mnt_flag) & MNT_RDONLY)) {
3962                         switch (vp->v_type) {
3963                         case VREG:
3964                         case VDIR:
3965                         case VLNK:
3966                                 return (EROFS);
3967                         default:
3968                                 break;
3969                         }
3970                 }
3971                 /*
3972                  * If there's shared text associated with
3973                  * the inode, we can't allow writing.
3974                  */
3975                 if (vp->v_flag & VTEXT)
3976                         return (ETXTBSY);
3977         }
3978         error = VOP_GETATTR(vp, &vattr);
3979         if (error)
3980                 return (error);
3981         error = VOP_ACCESS(vp, flags, cred);
3982         /*
3983          * Allow certain operations for the owner (reads and writes
3984          * on files that are already open).
3985          */
3986         if (override && error == EACCES && cred->cr_uid == vattr.va_uid)
3987                 error = 0;
3988         return error;
3989 }
3990 #endif /* NFS_NOSERVER */
3991