xref: /netbsd-src/sys/kern/vfs_lookup.c (revision e94a5d02693120d4ad9d909e488894e9fcf0eb76)
1 /*	$NetBSD: vfs_lookup.c,v 1.238 2024/12/07 02:27:38 riastradh Exp $	*/
2 
3 /*
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)vfs_lookup.c	8.10 (Berkeley) 5/27/95
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: vfs_lookup.c,v 1.238 2024/12/07 02:27:38 riastradh Exp $");
41 
42 #ifdef _KERNEL_OPT
43 #include "opt_magiclinks.h"
44 #endif
45 
46 #include <sys/param.h>
47 #include <sys/types.h>
48 
49 #include <sys/dirent.h>
50 #include <sys/errno.h>
51 #include <sys/filedesc.h>
52 #include <sys/fstrans.h>
53 #include <sys/hash.h>
54 #include <sys/kauth.h>
55 #include <sys/kernel.h>
56 #include <sys/ktrace.h>
57 #include <sys/mount.h>
58 #include <sys/namei.h>
59 #include <sys/proc.h>
60 #include <sys/sdt.h>
61 #include <sys/syslimits.h>
62 #include <sys/syslog.h>
63 #include <sys/systm.h>
64 #include <sys/time.h>
65 #include <sys/vnode.h>
66 #include <sys/vnode_impl.h>
67 
68 #ifndef MAGICLINKS
69 #define MAGICLINKS 0
70 #endif
71 
72 int vfs_magiclinks = MAGICLINKS;
73 
74 __CTASSERT(MAXNAMLEN == NAME_MAX);
75 
76 /*
77  * Substitute replacement text for 'magic' strings in symlinks.
78  * Returns 0 if successful, and returns non-zero if an error
79  * occurs.  (Currently, the only possible error is running out
80  * of temporary pathname space.)
81  *
82  * Looks for "@<string>" and "@<string>/", where <string> is a
83  * recognized 'magic' string.  Replaces the "@<string>" with the
84  * appropriate replacement text.  (Note that in some cases the
85  * replacement text may have zero length.)
86  *
87  * This would have been table driven, but the variance in
88  * replacement strings (and replacement string lengths) made
89  * that impractical.
90  */
91 #define	VNL(x)							\
92 	(sizeof(x) - 1)
93 
94 #define	VO	'{'
95 #define	VC	'}'
96 
97 #define	MATCH(str)						\
98 	((termchar == '/' && i + VNL(str) == *len) ||		\
99 	 (i + VNL(str) < *len &&				\
100 	  cp[i + VNL(str)] == termchar)) &&			\
101 	!strncmp((str), &cp[i], VNL(str))
102 
103 #define	SUBSTITUTE(m, s, sl)					\
104 	if ((newlen + (sl)) >= MAXPATHLEN)			\
105 		return 1;					\
106 	i += VNL(m);						\
107 	if (termchar != '/')					\
108 		i++;						\
109 	(void)memcpy(&tmp[newlen], (s), (sl));			\
110 	newlen += (sl);						\
111 	change = 1;						\
112 	termchar = '/';
113 
114 static int
115 symlink_magic(struct proc *p, char *cp, size_t *len)
116 {
117 	char *tmp;
118 	size_t change, i, newlen, slen;
119 	char termchar = '/';
120 	char idtmp[11]; /* enough for 32 bit *unsigned* integer */
121 
122 
123 	tmp = PNBUF_GET();
124 	for (change = i = newlen = 0; i < *len; ) {
125 		if (cp[i] != '@') {
126 			tmp[newlen++] = cp[i++];
127 			continue;
128 		}
129 
130 		i++;
131 
132 		/* Check for @{var} syntax. */
133 		if (cp[i] == VO) {
134 			termchar = VC;
135 			i++;
136 		}
137 
138 		/*
139 		 * The following checks should be ordered according
140 		 * to frequency of use.
141 		 */
142 		if (MATCH("machine_arch")) {
143 			slen = strlen(PROC_MACHINE_ARCH(p));
144 			SUBSTITUTE("machine_arch", PROC_MACHINE_ARCH(p), slen);
145 		} else if (MATCH("machine")) {
146 			slen = VNL(MACHINE);
147 			SUBSTITUTE("machine", MACHINE, slen);
148 		} else if (MATCH("hostname")) {
149 			SUBSTITUTE("hostname", hostname, hostnamelen);
150 		} else if (MATCH("osrelease")) {
151 			slen = strlen(osrelease);
152 			SUBSTITUTE("osrelease", osrelease, slen);
153 		} else if (MATCH("emul")) {
154 			slen = strlen(p->p_emul->e_name);
155 			SUBSTITUTE("emul", p->p_emul->e_name, slen);
156 		} else if (MATCH("kernel_ident")) {
157 			slen = strlen(kernel_ident);
158 			SUBSTITUTE("kernel_ident", kernel_ident, slen);
159 		} else if (MATCH("domainname")) {
160 			SUBSTITUTE("domainname", domainname, domainnamelen);
161 		} else if (MATCH("ostype")) {
162 			slen = strlen(ostype);
163 			SUBSTITUTE("ostype", ostype, slen);
164 		} else if (MATCH("uid")) {
165 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
166 			    kauth_cred_geteuid(kauth_cred_get()));
167 			SUBSTITUTE("uid", idtmp, slen);
168 		} else if (MATCH("ruid")) {
169 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
170 			    kauth_cred_getuid(kauth_cred_get()));
171 			SUBSTITUTE("ruid", idtmp, slen);
172 		} else if (MATCH("gid")) {
173 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
174 			    kauth_cred_getegid(kauth_cred_get()));
175 			SUBSTITUTE("gid", idtmp, slen);
176 		} else if (MATCH("rgid")) {
177 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
178 			    kauth_cred_getgid(kauth_cred_get()));
179 			SUBSTITUTE("rgid", idtmp, slen);
180 		} else {
181 			tmp[newlen++] = '@';
182 			if (termchar == VC)
183 				tmp[newlen++] = VO;
184 		}
185 	}
186 
187 	if (change) {
188 		(void)memcpy(cp, tmp, newlen);
189 		*len = newlen;
190 	}
191 	PNBUF_PUT(tmp);
192 
193 	return 0;
194 }
195 
196 #undef VNL
197 #undef VO
198 #undef VC
199 #undef MATCH
200 #undef SUBSTITUTE
201 
202 ////////////////////////////////////////////////////////////
203 
204 /*
205  * Determine the namei hash (for the namecache) for name.
206  * If *ep != NULL, hash from name to ep-1.
207  * If *ep == NULL, hash from name until the first NUL or '/', and
208  * return the location of this termination character in *ep.
209  *
210  * This function returns an equivalent hash to the MI hash32_strn().
211  * The latter isn't used because in the *ep == NULL case, determining
212  * the length of the string to the first NUL or `/' and then calling
213  * hash32_strn() involves unnecessary double-handling of the data.
214  */
215 uint32_t
216 namei_hash(const char *name, const char **ep)
217 {
218 	uint32_t	hash;
219 
220 	hash = HASH32_STR_INIT;
221 	if (*ep != NULL) {
222 		for (; name < *ep; name++)
223 			hash = hash * 33 + *(const uint8_t *)name;
224 	} else {
225 		for (; *name != '\0' && *name != '/'; name++)
226 			hash = hash * 33 + *(const uint8_t *)name;
227 		*ep = name;
228 	}
229 	return (hash + (hash >> 5));
230 }
231 
232 ////////////////////////////////////////////////////////////
233 
234 /*
235  * Sealed abstraction for pathnames.
236  *
237  * System-call-layer level code that is going to call namei should
238  * first create a pathbuf and adjust all the bells and whistles on it
239  * as needed by context.
240  */
241 
242 struct pathbuf {
243 	char *pb_path;
244 	char *pb_pathcopy;
245 	unsigned pb_pathcopyuses;
246 };
247 
248 static struct pathbuf *
249 pathbuf_create_raw(void)
250 {
251 	struct pathbuf *pb;
252 
253 	pb = kmem_alloc(sizeof(*pb), KM_SLEEP);
254 	pb->pb_path = PNBUF_GET();
255 	if (pb->pb_path == NULL) {
256 		kmem_free(pb, sizeof(*pb));
257 		return NULL;
258 	}
259 	pb->pb_pathcopy = NULL;
260 	pb->pb_pathcopyuses = 0;
261 	return pb;
262 }
263 
264 void
265 pathbuf_destroy(struct pathbuf *pb)
266 {
267 
268 	KASSERT(pb->pb_pathcopyuses == 0);
269 	KASSERT(pb->pb_pathcopy == NULL);
270 	PNBUF_PUT(pb->pb_path);
271 	kmem_free(pb, sizeof(*pb));
272 }
273 
274 struct pathbuf *
275 pathbuf_assimilate(char *pnbuf)
276 {
277 	struct pathbuf *pb;
278 
279 	pb = kmem_alloc(sizeof(*pb), KM_SLEEP);
280 	pb->pb_path = pnbuf;
281 	pb->pb_pathcopy = NULL;
282 	pb->pb_pathcopyuses = 0;
283 	return pb;
284 }
285 
286 struct pathbuf *
287 pathbuf_create(const char *path)
288 {
289 	struct pathbuf *pb;
290 	int error;
291 
292 	pb = pathbuf_create_raw();
293 	if (pb == NULL) {
294 		return NULL;
295 	}
296 	error = copystr(path, pb->pb_path, PATH_MAX, NULL);
297 	if (error != 0) {
298 		KASSERT(!"kernel path too long in pathbuf_create");
299 		/* make sure it's null-terminated, just in case */
300 		pb->pb_path[PATH_MAX-1] = '\0';
301 	}
302 	return pb;
303 }
304 
305 int
306 pathbuf_copyin(const char *userpath, struct pathbuf **ret)
307 {
308 	struct pathbuf *pb;
309 	int error;
310 
311 	pb = pathbuf_create_raw();
312 	if (pb == NULL) {
313 		return SET_ERROR(ENOMEM);
314 	}
315 	error = copyinstr(userpath, pb->pb_path, PATH_MAX, NULL);
316 	if (error) {
317 		pathbuf_destroy(pb);
318 		return error;
319 	}
320 	*ret = pb;
321 	return 0;
322 }
323 
324 /*
325  * XXX should not exist:
326  *   1. whether a pointer is kernel or user should be statically checkable.
327  *   2. copyin should be handled by the upper part of the syscall layer,
328  *      not in here.
329  */
330 int
331 pathbuf_maybe_copyin(const char *path, enum uio_seg seg, struct pathbuf **ret)
332 {
333 
334 	if (seg == UIO_USERSPACE) {
335 		return pathbuf_copyin(path, ret);
336 	} else {
337 		*ret = pathbuf_create(path);
338 		if (*ret == NULL) {
339 			return SET_ERROR(ENOMEM);
340 		}
341 		return 0;
342 	}
343 }
344 
345 /*
346  * Get a copy of the path buffer as it currently exists. If this is
347  * called after namei starts the results may be arbitrary.
348  */
349 void
350 pathbuf_copystring(const struct pathbuf *pb, char *buf, size_t maxlen)
351 {
352 
353 	strlcpy(buf, pb->pb_path, maxlen);
354 }
355 
356 /*
357  * These two functions allow access to a saved copy of the original
358  * path string. The first copy should be gotten before namei is
359  * called. Each copy that is gotten should be put back.
360  */
361 
362 const char *
363 pathbuf_stringcopy_get(struct pathbuf *pb)
364 {
365 
366 	if (pb->pb_pathcopyuses == 0) {
367 		pb->pb_pathcopy = PNBUF_GET();
368 		strcpy(pb->pb_pathcopy, pb->pb_path);
369 	}
370 	pb->pb_pathcopyuses++;
371 	return pb->pb_pathcopy;
372 }
373 
374 void
375 pathbuf_stringcopy_put(struct pathbuf *pb, const char *str)
376 {
377 
378 	KASSERT(str == pb->pb_pathcopy);
379 	KASSERT(pb->pb_pathcopyuses > 0);
380 	pb->pb_pathcopyuses--;
381 	if (pb->pb_pathcopyuses == 0) {
382 		PNBUF_PUT(pb->pb_pathcopy);
383 		pb->pb_pathcopy = NULL;
384 	}
385 }
386 
387 
388 ////////////////////////////////////////////////////////////
389 
390 /*
391  * namei: convert a pathname into a pointer to a (maybe-locked) vnode,
392  * and maybe also its parent directory vnode, and assorted other guff.
393  * See namei(9) for the interface documentation.
394  *
395  *
396  * The FOLLOW flag is set when symbolic links are to be followed
397  * when they occur at the end of the name translation process.
398  * Symbolic links are always followed for all other pathname
399  * components other than the last.
400  *
401  * The segflg defines whether the name is to be copied from user
402  * space or kernel space.
403  *
404  * Overall outline of namei:
405  *
406  *	copy in name
407  *	get starting directory
408  *	while (!done && !error) {
409  *		call lookup to search path.
410  *		if symbolic link, massage name in buffer and continue
411  *	}
412  */
413 
414 /*
415  * Search a pathname.
416  * This is a very central and rather complicated routine.
417  *
418  * The pathname is pointed to by ni_ptr and is of length ni_pathlen.
419  * The starting directory is passed in. The pathname is descended
420  * until done, or a symbolic link is encountered. The variable ni_more
421  * is clear if the path is completed; it is set to one if a symbolic
422  * link needing interpretation is encountered.
423  *
424  * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on
425  * whether the name is to be looked up, created, renamed, or deleted.
426  * When CREATE, RENAME, or DELETE is specified, information usable in
427  * creating, renaming, or deleting a directory entry may be calculated.
428  * If flag has LOCKPARENT or'ed into it, the parent directory is returned
429  * locked.  Otherwise the parent directory is not returned. If the target
430  * of the pathname exists and LOCKLEAF is or'ed into the flag the target
431  * is returned locked, otherwise it is returned unlocked.  When creating
432  * or renaming and LOCKPARENT is specified, the target may not be ".".
433  * When deleting and LOCKPARENT is specified, the target may be ".".
434  *
435  * Overall outline of lookup:
436  *
437  * dirloop:
438  *	identify next component of name at ndp->ni_ptr
439  *	handle degenerate case where name is null string
440  *	if .. and crossing mount points and on mounted filesys, find parent
441  *	call VOP_LOOKUP routine for next component name
442  *	    directory vnode returned in ni_dvp, locked.
443  *	    component vnode returned in ni_vp (if it exists), locked.
444  *	if result vnode is mounted on and crossing mount points,
445  *	    find mounted on vnode
446  *	if more components of name, do next level at dirloop
447  *	return the answer in ni_vp, locked if LOCKLEAF set
448  *	    if LOCKPARENT set, return locked parent in ni_dvp
449  */
450 
451 
452 /*
453  * Internal state for a namei operation.
454  *
455  * cnp is always equal to &ndp->ni_cnp.
456  */
457 struct namei_state {
458 	struct nameidata *ndp;
459 	struct componentname *cnp;
460 
461 	int docache;			/* == 0 do not cache last component */
462 	int rdonly;			/* lookup read-only flag bit */
463 	int slashes;
464 
465 	unsigned attempt_retry:1;	/* true if error allows emul retry */
466 	unsigned root_referenced:1;	/* true if ndp->ni_rootdir and
467 					    ndp->ni_erootdir were referenced */
468 };
469 
470 
471 /*
472  * Initialize the namei working state.
473  */
474 static void
475 namei_init(struct namei_state *state, struct nameidata *ndp)
476 {
477 
478 	state->ndp = ndp;
479 	state->cnp = &ndp->ni_cnd;
480 
481 	state->docache = 0;
482 	state->rdonly = 0;
483 	state->slashes = 0;
484 
485 	state->root_referenced = 0;
486 
487 	KASSERTMSG((state->cnp->cn_cred != NULL), "namei: bad cred/proc");
488 	KASSERTMSG(((state->cnp->cn_nameiop & (~OPMASK)) == 0),
489 	    "namei: nameiop contaminated with flags: %08"PRIx32,
490 	    state->cnp->cn_nameiop);
491 	KASSERTMSG(((state->cnp->cn_flags & OPMASK) == 0),
492 	    "name: flags contaminated with nameiops: %08"PRIx32,
493 	    state->cnp->cn_flags);
494 
495 	/*
496 	 * The buffer for name translation shall be the one inside the
497 	 * pathbuf.
498 	 */
499 	state->ndp->ni_pnbuf = state->ndp->ni_pathbuf->pb_path;
500 }
501 
502 /*
503  * Clean up the working namei state, leaving things ready for return
504  * from namei.
505  */
506 static void
507 namei_cleanup(struct namei_state *state)
508 {
509 
510 	KASSERT(state->cnp == &state->ndp->ni_cnd);
511 
512 	if (state->root_referenced) {
513 		if (state->ndp->ni_rootdir != NULL)
514 			vrele(state->ndp->ni_rootdir);
515 		if (state->ndp->ni_erootdir != NULL)
516 			vrele(state->ndp->ni_erootdir);
517 	}
518 }
519 
520 //////////////////////////////
521 
522 /*
523  * Get the directory context.
524  * Initializes the rootdir and erootdir state and returns a reference
525  * to the starting dir.
526  */
527 static struct vnode *
528 namei_getstartdir(struct namei_state *state)
529 {
530 	struct nameidata *ndp = state->ndp;
531 	struct componentname *cnp = state->cnp;
532 	struct cwdinfo *cwdi;		/* pointer to cwd state */
533 	struct lwp *self = curlwp;	/* thread doing namei() */
534 	struct vnode *rootdir, *erootdir, *curdir, *startdir;
535 
536 	if (state->root_referenced) {
537 		if (state->ndp->ni_rootdir != NULL)
538 			vrele(state->ndp->ni_rootdir);
539 		if (state->ndp->ni_erootdir != NULL)
540 			vrele(state->ndp->ni_erootdir);
541 		state->root_referenced = 0;
542 	}
543 
544 	cwdi = self->l_proc->p_cwdi;
545 	rw_enter(&cwdi->cwdi_lock, RW_READER);
546 
547 	/* root dir */
548 	if (cwdi->cwdi_rdir == NULL || (cnp->cn_flags & NOCHROOT)) {
549 		rootdir = rootvnode;
550 	} else {
551 		rootdir = cwdi->cwdi_rdir;
552 	}
553 
554 	/* emulation root dir, if any */
555 	if ((cnp->cn_flags & TRYEMULROOT) == 0) {
556 		/* if we don't want it, don't fetch it */
557 		erootdir = NULL;
558 	} else if (cnp->cn_flags & EMULROOTSET) {
559 		/* explicitly set emulroot; "/../" doesn't override this */
560 		erootdir = ndp->ni_erootdir;
561 	} else if (!strncmp(ndp->ni_pnbuf, "/../", 4)) {
562 		/* explicit reference to real rootdir */
563 		erootdir = NULL;
564 	} else {
565 		/* may be null */
566 		erootdir = cwdi->cwdi_edir;
567 	}
568 
569 	/* current dir */
570 	curdir = cwdi->cwdi_cdir;
571 
572 	if (ndp->ni_pnbuf[0] != '/') {
573 		if (ndp->ni_atdir != NULL) {
574 			startdir = ndp->ni_atdir;
575 		} else {
576 			startdir = curdir;
577 		}
578 		erootdir = NULL;
579 	} else if (cnp->cn_flags & TRYEMULROOT && erootdir != NULL) {
580 		startdir = erootdir;
581 	} else {
582 		startdir = rootdir;
583 		erootdir = NULL;
584 	}
585 
586 	state->ndp->ni_rootdir = rootdir;
587 	state->ndp->ni_erootdir = erootdir;
588 
589 	/*
590 	 * Get a reference to the start dir so we can safely unlock cwdi.
591 	 *
592 	 * Must hold references to rootdir and erootdir while we're running.
593 	 * A multithreaded process may chroot during namei.
594 	 */
595 	if (startdir != NULL)
596 		vref(startdir);
597 	if (state->ndp->ni_rootdir != NULL)
598 		vref(state->ndp->ni_rootdir);
599 	if (state->ndp->ni_erootdir != NULL)
600 		vref(state->ndp->ni_erootdir);
601 	state->root_referenced = 1;
602 
603 	rw_exit(&cwdi->cwdi_lock);
604 	return startdir;
605 }
606 
607 /*
608  * Get the directory context for the nfsd case, in parallel to
609  * getstartdir. Initializes the rootdir and erootdir state and
610  * returns a reference to the passed-in starting dir.
611  */
612 static struct vnode *
613 namei_getstartdir_for_nfsd(struct namei_state *state)
614 {
615 
616 	KASSERT(state->ndp->ni_atdir != NULL);
617 
618 	/* always use the real root, and never set an emulation root */
619 	if (rootvnode == NULL) {
620 		return NULL;
621 	}
622 	state->ndp->ni_rootdir = rootvnode;
623 	state->ndp->ni_erootdir = NULL;
624 
625 	vref(state->ndp->ni_atdir);
626 	KASSERT(! state->root_referenced);
627 	vref(state->ndp->ni_rootdir);
628 	state->root_referenced = 1;
629 	return state->ndp->ni_atdir;
630 }
631 
632 
633 /*
634  * Ktrace the namei operation.
635  */
636 static void
637 namei_ktrace(struct namei_state *state)
638 {
639 	struct nameidata *ndp = state->ndp;
640 	struct componentname *cnp = state->cnp;
641 	struct lwp *self = curlwp;	/* thread doing namei() */
642 	const char *emul_path;
643 
644 	if (ktrpoint(KTR_NAMEI)) {
645 		if (ndp->ni_erootdir != NULL) {
646 			/*
647 			 * To make any sense, the trace entry need to have the
648 			 * text of the emulation path prepended.
649 			 * Usually we can get this from the current process,
650 			 * but when called from emul_find_interp() it is only
651 			 * in the exec_package - so we get it passed in ni_next
652 			 * (this is a hack).
653 			 */
654 			if (cnp->cn_flags & EMULROOTSET)
655 				emul_path = ndp->ni_next;
656 			else
657 				emul_path = self->l_proc->p_emul->e_path;
658 			ktrnamei2(emul_path, strlen(emul_path),
659 			    ndp->ni_pnbuf, ndp->ni_pathlen);
660 		} else
661 			ktrnamei(ndp->ni_pnbuf, ndp->ni_pathlen);
662 	}
663 }
664 
665 /*
666  * Start up namei. Find the root dir and cwd, establish the starting
667  * directory for lookup, and lock it. Also calls ktrace when
668  * appropriate.
669  */
670 static int
671 namei_start(struct namei_state *state, int isnfsd,
672     struct vnode **startdir_ret)
673 {
674 	struct nameidata *ndp = state->ndp;
675 	struct vnode *startdir;
676 
677 	/* length includes null terminator (was originally from copyinstr) */
678 	ndp->ni_pathlen = strlen(ndp->ni_pnbuf) + 1;
679 
680 	/*
681 	 * POSIX.1 requirement: "" is not a valid file name.
682 	 */
683 	if (ndp->ni_pathlen == 1) {
684 		ndp->ni_erootdir = NULL;
685 		return SET_ERROR(ENOENT);
686 	}
687 
688 	ndp->ni_loopcnt = 0;
689 
690 	/* Get starting directory, set up root, and ktrace. */
691 	if (isnfsd) {
692 		startdir = namei_getstartdir_for_nfsd(state);
693 		/* no ktrace */
694 	} else {
695 		startdir = namei_getstartdir(state);
696 		namei_ktrace(state);
697 	}
698 
699 	if (startdir == NULL) {
700 		return SET_ERROR(ENOENT);
701 	}
702 
703 	/* NDAT may feed us with a non directory namei_getstartdir */
704 	if (startdir->v_type != VDIR) {
705 		vrele(startdir);
706 		return SET_ERROR(ENOTDIR);
707 	}
708 
709 	*startdir_ret = startdir;
710 	return 0;
711 }
712 
713 /*
714  * Check for being at a symlink that we're going to follow.
715  */
716 static inline int
717 namei_atsymlink(struct namei_state *state, struct vnode *foundobj)
718 {
719 
720 	return (foundobj->v_type == VLNK) &&
721 	    (state->cnp->cn_flags & (FOLLOW|REQUIREDIR));
722 }
723 
724 /*
725  * Follow a symlink.
726  *
727  * Updates searchdir. inhibitmagic causes magic symlinks to not be
728  * interpreted; this is used by nfsd.
729  *
730  * Unlocks foundobj on success (ugh)
731  */
732 static inline int
733 namei_follow(struct namei_state *state, int inhibitmagic,
734     struct vnode *searchdir, struct vnode *foundobj,
735     struct vnode **newsearchdir_ret)
736 {
737 	struct nameidata *ndp = state->ndp;
738 	struct componentname *cnp = state->cnp;
739 
740 	struct lwp *self = curlwp;	/* thread doing namei() */
741 	struct iovec aiov;		/* uio for reading symbolic links */
742 	struct uio auio;
743 	char *cp;			/* pointer into pathname argument */
744 	size_t linklen;
745 	int error;
746 
747 	if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
748 		return SET_ERROR(ELOOP);
749 	}
750 
751 	vn_lock(foundobj, LK_EXCLUSIVE | LK_RETRY);
752 	if (foundobj->v_mount->mnt_flag & MNT_SYMPERM) {
753 		error = VOP_ACCESS(foundobj, VEXEC, cnp->cn_cred);
754 		if (error != 0) {
755 			VOP_UNLOCK(foundobj);
756 			return error;
757 		}
758 	}
759 
760 	/* FUTURE: fix this to not use a second buffer */
761 	cp = PNBUF_GET();
762 	aiov.iov_base = cp;
763 	aiov.iov_len = MAXPATHLEN;
764 	auio.uio_iov = &aiov;
765 	auio.uio_iovcnt = 1;
766 	auio.uio_offset = 0;
767 	auio.uio_rw = UIO_READ;
768 	auio.uio_resid = MAXPATHLEN;
769 	UIO_SETUP_SYSSPACE(&auio);
770 	error = VOP_READLINK(foundobj, &auio, cnp->cn_cred);
771 	VOP_UNLOCK(foundobj);
772 	if (error) {
773 		PNBUF_PUT(cp);
774 		return error;
775 	}
776 	linklen = MAXPATHLEN - auio.uio_resid;
777 	if (linklen == 0) {
778 		PNBUF_PUT(cp);
779 		return SET_ERROR(ENOENT);
780 	}
781 
782 	/*
783 	 * Do symlink substitution, if appropriate, and
784 	 * check length for potential overflow.
785 	 *
786 	 * Inhibit symlink substitution for nfsd.
787 	 * XXX: This is how it was before; is that a bug or a feature?
788 	 */
789 	if ((!inhibitmagic && vfs_magiclinks &&
790 		symlink_magic(self->l_proc, cp, &linklen)) ||
791 	    (linklen + ndp->ni_pathlen >= MAXPATHLEN)) {
792 		PNBUF_PUT(cp);
793 		return SET_ERROR(ENAMETOOLONG);
794 	}
795 	if (ndp->ni_pathlen > 1) {
796 		/* includes a null-terminator */
797 		memcpy(cp + linklen, ndp->ni_next, ndp->ni_pathlen);
798 	} else {
799 		cp[linklen] = '\0';
800 	}
801 	ndp->ni_pathlen += linklen;
802 	memcpy(ndp->ni_pnbuf, cp, ndp->ni_pathlen);
803 	PNBUF_PUT(cp);
804 
805 	/* we're now starting from the beginning of the buffer again */
806 	cnp->cn_nameptr = ndp->ni_pnbuf;
807 
808 	/*
809 	 * Check if root directory should replace current directory.
810 	 */
811 	if (ndp->ni_pnbuf[0] == '/') {
812 		vrele(searchdir);
813 		/* Keep absolute symbolic links inside emulation root */
814 		searchdir = ndp->ni_erootdir;
815 		if (searchdir == NULL ||
816 		    (ndp->ni_pnbuf[1] == '.'
817 			&& ndp->ni_pnbuf[2] == '.'
818 			&& ndp->ni_pnbuf[3] == '/')) {
819 			ndp->ni_erootdir = NULL;
820 			searchdir = ndp->ni_rootdir;
821 		}
822 		vref(searchdir);
823 		while (cnp->cn_nameptr[0] == '/') {
824 			cnp->cn_nameptr++;
825 			ndp->ni_pathlen--;
826 		}
827 	}
828 
829 	*newsearchdir_ret = searchdir;
830 	return 0;
831 }
832 
833 //////////////////////////////
834 
835 /*
836  * Inspect the leading path component and update the state accordingly.
837  */
838 static int
839 lookup_parsepath(struct namei_state *state, struct vnode *searchdir)
840 {
841 	const char *cp;			/* pointer into pathname argument */
842 	int error;
843 	struct componentname *cnp = state->cnp;
844 	struct nameidata *ndp = state->ndp;
845 
846 	KASSERT(cnp == &ndp->ni_cnd);
847 
848 	/*
849 	 * Search a new directory.
850 	 *
851 	 * The last component of the filename is left accessible via
852 	 * cnp->cn_nameptr for callers that need the name. Callers needing
853 	 * the name set the SAVENAME flag. When done, they assume
854 	 * responsibility for freeing the pathname buffer.
855 	 *
856 	 * At this point, our only vnode state is that the search dir
857 	 * is held.
858 	 */
859 	error = VOP_PARSEPATH(searchdir, cnp->cn_nameptr, &cnp->cn_namelen);
860 	if (error) {
861 		return error;
862 	}
863 	cp = cnp->cn_nameptr + cnp->cn_namelen;
864 	if (cnp->cn_namelen > KERNEL_NAME_MAX) {
865 		return SET_ERROR(ENAMETOOLONG);
866 	}
867 #ifdef NAMEI_DIAGNOSTIC
868 	{ char c = *cp;
869 		*(char *)cp = '\0';
870 		printf("{%s}: ", cnp->cn_nameptr);
871 		*(char *)cp = c; }
872 #endif /* NAMEI_DIAGNOSTIC */
873 	ndp->ni_pathlen -= cnp->cn_namelen;
874 	ndp->ni_next = cp;
875 	/*
876 	 * If this component is followed by a slash, then move the pointer to
877 	 * the next component forward, and remember that this component must be
878 	 * a directory.
879 	 */
880 	if (*cp == '/') {
881 		do {
882 			cp++;
883 		} while (*cp == '/');
884 		state->slashes = cp - ndp->ni_next;
885 		ndp->ni_pathlen -= state->slashes;
886 		ndp->ni_next = cp;
887 		cnp->cn_flags |= REQUIREDIR;
888 	} else {
889 		state->slashes = 0;
890 		cnp->cn_flags &= ~REQUIREDIR;
891 	}
892 	/*
893 	 * We do special processing on the last component, whether or not it's
894 	 * a directory.  Cache all intervening lookups, but not the final one.
895 	 */
896 	if (*cp == '\0') {
897 		if (state->docache)
898 			cnp->cn_flags |= MAKEENTRY;
899 		else
900 			cnp->cn_flags &= ~MAKEENTRY;
901 		cnp->cn_flags |= ISLASTCN;
902 	} else {
903 		cnp->cn_flags |= MAKEENTRY;
904 		cnp->cn_flags &= ~ISLASTCN;
905 	}
906 	if (cnp->cn_namelen == 2 &&
907 	    cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
908 		cnp->cn_flags |= ISDOTDOT;
909 	else
910 		cnp->cn_flags &= ~ISDOTDOT;
911 
912 	return 0;
913 }
914 
915 /*
916  * Take care of crossing a mounted-on vnode.  On error, foundobj_ret will be
917  * vrele'd, but searchdir is left alone.
918  */
919 static int
920 lookup_crossmount(struct namei_state *state,
921     struct vnode **searchdir_ret,
922     struct vnode **foundobj_ret,
923     bool *searchdir_locked)
924 {
925 	struct componentname *cnp = state->cnp;
926 	struct vnode *foundobj, *vp;
927 	struct vnode *searchdir;
928 	struct mount *mp;
929 	int error, lktype;
930 
931 	searchdir = *searchdir_ret;
932 	foundobj = *foundobj_ret;
933 	error = 0;
934 
935 	KASSERT((cnp->cn_flags & NOCROSSMOUNT) == 0);
936 
937 	/* First, unlock searchdir (oof). */
938 	if (*searchdir_locked) {
939 		KASSERT(searchdir != NULL);
940 		lktype = VOP_ISLOCKED(searchdir);
941 		VOP_UNLOCK(searchdir);
942 		*searchdir_locked = false;
943 	} else {
944 		lktype = LK_NONE;
945 	}
946 
947 	/*
948 	 * Do an unlocked check to see if the vnode has been mounted on; if
949 	 * so find the root of the mounted file system.
950 	 */
951 	while (foundobj->v_type == VDIR &&
952 	    (mp = foundobj->v_mountedhere) != NULL &&
953 	    (cnp->cn_flags & NOCROSSMOUNT) == 0) {
954 		/*
955 		 * Try the namecache first.  If that doesn't work, do
956 		 * it the hard way.
957 		 */
958 		if (cache_lookup_mount(foundobj, &vp)) {
959 			vrele(foundobj);
960 			foundobj = vp;
961 		} else {
962 			/* First get the vnodes mount stable. */
963 			while ((mp = foundobj->v_mountedhere) != NULL) {
964 				fstrans_start(mp);
965 				if (fstrans_held(mp) &&
966 				    mp == foundobj->v_mountedhere) {
967 					break;
968 				}
969 				fstrans_done(mp);
970 			}
971 			if (mp == NULL) {
972 				break;
973 			}
974 
975 			/*
976 			 * Now get a reference on the root vnode.
977 			 * XXX Future - maybe allow only VDIR here.
978 			 */
979 			error = VFS_ROOT(mp, LK_NONE, &vp);
980 
981 			/*
982 			 * If successful, enter it into the cache while
983 			 * holding the mount busy (competing with unmount).
984 			 */
985 			if (error == 0) {
986 				cache_enter_mount(foundobj, vp);
987 			}
988 
989 			/*
990 			 * Finally, drop references to foundobj & mountpoint.
991 			 */
992 			vrele(foundobj);
993 			fstrans_done(mp);
994 			if (error) {
995 				foundobj = NULL;
996 				break;
997 			}
998 			foundobj = vp;
999 		}
1000 
1001 		/*
1002 		 * Avoid locking vnodes from two filesystems because
1003 		 * it's prone to deadlock, e.g. when using puffs.
1004 		 * Also, it isn't a good idea to propagate slowness of
1005 		 * a filesystem up to the root directory. For now,
1006 		 * only handle the common case, where foundobj is
1007 		 * VDIR.
1008 		 *
1009 		 * In this case set searchdir to null to avoid using
1010 		 * it again. It is not correct to set searchdir ==
1011 		 * foundobj here as that will confuse the caller.
1012 		 * (See PR 40740.)
1013 		 */
1014 		if (searchdir == NULL) {
1015 			/* already been here once; do nothing further */
1016 		} else if (foundobj->v_type == VDIR) {
1017 			vrele(searchdir);
1018 			*searchdir_ret = searchdir = NULL;
1019 			lktype = LK_NONE;
1020 		}
1021 	}
1022 
1023 	/* If searchdir is still around, re-lock it. */
1024 	if (error == 0 && lktype != LK_NONE) {
1025 		vn_lock(searchdir, lktype | LK_RETRY);
1026 		*searchdir_locked = true;
1027 	}
1028 	*foundobj_ret = foundobj;
1029 	return error;
1030 }
1031 
1032 /*
1033  * Determine the desired locking mode for the directory of a lookup.
1034  */
1035 static int
1036 lookup_lktype(struct vnode *searchdir, struct componentname *cnp)
1037 {
1038 
1039 	/*
1040 	 * If the file system supports VOP_LOOKUP() with a shared lock, and
1041 	 * we are not making any modifications (nameiop LOOKUP) or this is
1042 	 * not the last component then get a shared lock.  Where we can't do
1043 	 * fast-forwarded lookups (for example with layered file systems)
1044 	 * then this is the fallback for reducing lock contention.
1045 	 */
1046 	if ((searchdir->v_mount->mnt_iflag & IMNT_SHRLOOKUP) != 0 &&
1047 	    (cnp->cn_nameiop == LOOKUP || (cnp->cn_flags & ISLASTCN) == 0)) {
1048 		return LK_SHARED;
1049 	} else {
1050 		return LK_EXCLUSIVE;
1051 	}
1052 }
1053 
1054 /*
1055  * Call VOP_LOOKUP for a single lookup; return a new search directory
1056  * (used when crossing mountpoints up or searching union mounts down) and
1057  * the found object, which for create operations may be NULL on success.
1058  *
1059  * Note that the new search directory may be null, which means the
1060  * searchdir was unlocked and released. This happens in the common case
1061  * when crossing a mount point downwards, in order to avoid coupling
1062  * locks between different file system volumes. Importantly, this can
1063  * happen even if the call fails. (XXX: this is gross and should be
1064  * tidied somehow.)
1065  */
1066 static int
1067 lookup_once(struct namei_state *state,
1068     struct vnode *searchdir,
1069     struct vnode **newsearchdir_ret,
1070     struct vnode **foundobj_ret,
1071     bool *newsearchdir_locked_ret)
1072 {
1073 	struct vnode *tmpvn;		/* scratch vnode */
1074 	struct vnode *foundobj;		/* result */
1075 	struct lwp *l = curlwp;
1076 	bool searchdir_locked = false;
1077 	int error, lktype;
1078 
1079 	struct componentname *cnp = state->cnp;
1080 	struct nameidata *ndp = state->ndp;
1081 
1082 	KASSERT(cnp == &ndp->ni_cnd);
1083 	*newsearchdir_ret = searchdir;
1084 
1085 	/*
1086 	 * Handle "..": two special cases.
1087 	 * 1. If at root directory (e.g. after chroot)
1088 	 *    or at absolute root directory
1089 	 *    then ignore it so can't get out.
1090 	 * 1a. If at the root of the emulation filesystem go to the real
1091 	 *    root. So "/../<path>" is always absolute.
1092 	 * 1b. If we have somehow gotten out of a jail, warn
1093 	 *    and also ignore it so we can't get farther out.
1094 	 * 2. If this vnode is the root of a mounted
1095 	 *    filesystem, then replace it with the
1096 	 *    vnode which was mounted on so we take the
1097 	 *    .. in the other file system.
1098 	 */
1099 	if (cnp->cn_flags & ISDOTDOT) {
1100 		struct proc *p = l->l_proc;
1101 
1102 		for (;;) {
1103 			if (searchdir == ndp->ni_rootdir ||
1104 			    searchdir == rootvnode) {
1105 				foundobj = searchdir;
1106 				vref(foundobj);
1107 				*foundobj_ret = foundobj;
1108 				if (cnp->cn_flags & LOCKPARENT) {
1109 					lktype = lookup_lktype(searchdir, cnp);
1110 					vn_lock(searchdir, lktype | LK_RETRY);
1111 					searchdir_locked = true;
1112 				}
1113 				error = 0;
1114 				goto done;
1115 			}
1116 			if (ndp->ni_rootdir != rootvnode) {
1117 				int retval;
1118 
1119 				retval = vn_isunder(searchdir, ndp->ni_rootdir,
1120 				    l);
1121 				if (!retval) {
1122 					/* Oops! We got out of jail! */
1123 					log(LOG_WARNING,
1124 					    "chrooted pid %d uid %d (%s) "
1125 					    "detected outside of its chroot\n",
1126 					    p->p_pid,
1127 					    kauth_cred_geteuid(l->l_cred),
1128 					    p->p_comm);
1129 					/* Put us at the jail root. */
1130 					vrele(searchdir);
1131 					searchdir = NULL;
1132 					foundobj = ndp->ni_rootdir;
1133 					vref(foundobj);
1134 					vref(foundobj);
1135 					*newsearchdir_ret = foundobj;
1136 					*foundobj_ret = foundobj;
1137 					error = 0;
1138 					goto done;
1139 				}
1140 			}
1141 			if ((searchdir->v_vflag & VV_ROOT) == 0 ||
1142 			    (cnp->cn_flags & NOCROSSMOUNT))
1143 				break;
1144 			tmpvn = searchdir;
1145 			searchdir = searchdir->v_mount->mnt_vnodecovered;
1146 			vref(searchdir);
1147 			vrele(tmpvn);
1148 			*newsearchdir_ret = searchdir;
1149 		}
1150 	}
1151 
1152 	lktype = lookup_lktype(searchdir, cnp);
1153 
1154 	/*
1155 	 * We now have a segment name to search for, and a directory to search.
1156 	 * Our vnode state here is that "searchdir" is held.
1157 	 */
1158 unionlookup:
1159 	foundobj = NULL;
1160 	if (!searchdir_locked) {
1161 		vn_lock(searchdir, lktype | LK_RETRY);
1162 		searchdir_locked = true;
1163 	}
1164 	error = VOP_LOOKUP(searchdir, &foundobj, cnp);
1165 
1166 	if (error != 0) {
1167 		KASSERTMSG((foundobj == NULL),
1168 		    "leaf `%s' should be empty but is %p",
1169 		    cnp->cn_nameptr, foundobj);
1170 #ifdef NAMEI_DIAGNOSTIC
1171 		printf("not found\n");
1172 #endif /* NAMEI_DIAGNOSTIC */
1173 
1174 		/*
1175 		 * If ENOLCK, the file system needs us to retry the lookup
1176 		 * with an exclusive lock.  It's likely nothing was found in
1177 		 * cache and/or modifications need to be made.
1178 		 */
1179 		if (error == ENOLCK) {
1180 			KASSERT(VOP_ISLOCKED(searchdir) == LK_SHARED);
1181 			KASSERT(searchdir_locked);
1182 			if (vn_lock(searchdir, LK_UPGRADE | LK_NOWAIT)) {
1183 				VOP_UNLOCK(searchdir);
1184 				searchdir_locked = false;
1185 			}
1186 			lktype = LK_EXCLUSIVE;
1187 			goto unionlookup;
1188 		}
1189 
1190 		if ((error == ENOENT) &&
1191 		    (searchdir->v_vflag & VV_ROOT) &&
1192 		    (searchdir->v_mount->mnt_flag & MNT_UNION)) {
1193 			tmpvn = searchdir;
1194 			searchdir = searchdir->v_mount->mnt_vnodecovered;
1195 			vref(searchdir);
1196 			vput(tmpvn);
1197 			searchdir_locked = false;
1198 			*newsearchdir_ret = searchdir;
1199 			goto unionlookup;
1200 		}
1201 
1202 		if (error != EJUSTRETURN)
1203 			goto done;
1204 
1205 		/*
1206 		 * If this was not the last component, or there were trailing
1207 		 * slashes, and we are not going to create a directory,
1208 		 * then the name must exist.
1209 		 */
1210 		if ((cnp->cn_flags & (REQUIREDIR | CREATEDIR)) == REQUIREDIR) {
1211 			error = SET_ERROR(ENOENT);
1212 			goto done;
1213 		}
1214 
1215 		/*
1216 		 * If creating and at end of pathname, then can consider
1217 		 * allowing file to be created.
1218 		 */
1219 		if (state->rdonly) {
1220 			error = SET_ERROR(EROFS);
1221 			goto done;
1222 		}
1223 
1224 		/*
1225 		 * We return success and a NULL foundobj to indicate
1226 		 * that the entry doesn't currently exist, leaving a
1227 		 * pointer to the (normally, locked) directory vnode
1228 		 * as searchdir.
1229 		 */
1230 		*foundobj_ret = NULL;
1231 		error = 0;
1232 		goto done;
1233 	}
1234 #ifdef NAMEI_DIAGNOSTIC
1235 	printf("found\n");
1236 #endif /* NAMEI_DIAGNOSTIC */
1237 
1238 	/* Unlock, unless the caller needs the parent locked. */
1239 	if (searchdir != NULL) {
1240 		KASSERT(searchdir_locked);
1241 		if ((cnp->cn_flags & (ISLASTCN | LOCKPARENT)) !=
1242 		    (ISLASTCN | LOCKPARENT)) {
1243 			VOP_UNLOCK(searchdir);
1244 			searchdir_locked = false;
1245 		}
1246 	} else {
1247 		KASSERT(!searchdir_locked);
1248 	}
1249 
1250 	*foundobj_ret = foundobj;
1251 	error = 0;
1252 done:
1253 	*newsearchdir_locked_ret = searchdir_locked;
1254 	return error;
1255 }
1256 
1257 /*
1258  * Parse out the first path name component that we need to to consider.
1259  *
1260  * While doing this, attempt to use the name cache to fast-forward through
1261  * as many "easy" to find components of the path as possible.
1262  *
1263  * We use the namecache's node locks to form a chain, and avoid as many
1264  * vnode references and locks as possible.  In the ideal case, only the
1265  * final vnode will have its reference count adjusted and lock taken.
1266  */
1267 static int
1268 lookup_fastforward(struct namei_state *state, struct vnode **searchdir_ret,
1269     struct vnode **foundobj_ret)
1270 {
1271 	struct componentname *cnp = state->cnp;
1272 	struct nameidata *ndp = state->ndp;
1273 	krwlock_t *plock;
1274 	struct vnode *foundobj, *searchdir;
1275 	int error, error2;
1276 	size_t oldpathlen;
1277 	const char *oldnameptr;
1278 	bool terminal;
1279 
1280 	/*
1281 	 * Eat as many path name components as possible before giving up and
1282 	 * letting lookup_once() handle it.  Remember the starting point in
1283 	 * case we can't get vnode references and need to roll back.
1284 	 */
1285 	plock = NULL;
1286 	searchdir = *searchdir_ret;
1287 	oldnameptr = cnp->cn_nameptr;
1288 	oldpathlen = ndp->ni_pathlen;
1289 	terminal = false;
1290 	for (;;) {
1291 		foundobj = NULL;
1292 
1293 		/*
1294 		 * Get the next component name.  There should be no slashes
1295 		 * here, and we shouldn't have looped around if we were
1296 		 * done.
1297 		 */
1298 		KASSERT(cnp->cn_nameptr[0] != '/');
1299 		KASSERT(cnp->cn_nameptr[0] != '\0');
1300 		if ((error = lookup_parsepath(state, searchdir)) != 0) {
1301 			break;
1302 		}
1303 
1304 		/*
1305 		 * Can't deal with DOTDOT lookups if NOCROSSMOUNT or the
1306 		 * lookup is chrooted.
1307 		 */
1308 		if ((cnp->cn_flags & ISDOTDOT) != 0) {
1309 			if ((searchdir->v_vflag & VV_ROOT) != 0 &&
1310 			    (cnp->cn_flags & NOCROSSMOUNT)) {
1311 				error = SET_ERROR(EOPNOTSUPP);
1312 				break;
1313 			}
1314 			if (ndp->ni_rootdir != rootvnode) {
1315 				error = SET_ERROR(EOPNOTSUPP);
1316 				break;
1317 			}
1318 		}
1319 
1320 		/*
1321 		 * Can't deal with last component when modifying; this needs
1322 		 * searchdir locked and VOP_LOOKUP() called (which can and
1323 		 * does modify state, despite the name).  NB: this case means
1324 		 * terminal is never set true when LOCKPARENT.
1325 		 */
1326 		if ((cnp->cn_flags & ISLASTCN) != 0) {
1327 			if (cnp->cn_nameiop != LOOKUP ||
1328 			    (cnp->cn_flags & LOCKPARENT) != 0) {
1329 				error = SET_ERROR(EOPNOTSUPP);
1330 				break;
1331 			}
1332 		}
1333 
1334 		/*
1335 		 * Good, now look for it in cache.  cache_lookup_linked()
1336 		 * will fail if there's nothing there, or if there's no
1337 		 * ownership info for the directory, or if the user doesn't
1338 		 * have permission to look up files in this directory.
1339 		 */
1340 		if (!cache_lookup_linked(searchdir, cnp->cn_nameptr,
1341 			cnp->cn_namelen, &foundobj, &plock, cnp->cn_cred)) {
1342 			error = SET_ERROR(EOPNOTSUPP);
1343 			break;
1344 		}
1345 		KASSERT(plock != NULL);
1346 		KASSERT(rw_lock_held(plock));
1347 
1348 		/*
1349 		 * Scored a hit.  Negative is good too (ENOENT).  If there's
1350 		 * a '-o union' mount here, punt and let lookup_once() deal
1351 		 * with it.
1352 		 */
1353 		if (foundobj == NULL) {
1354 			if ((searchdir->v_vflag & VV_ROOT) != 0 &&
1355 			    (searchdir->v_mount->mnt_flag & MNT_UNION) != 0) {
1356 				error = SET_ERROR(EOPNOTSUPP);
1357 			} else {
1358 				error = SET_ERROR(ENOENT);
1359 				terminal = ((cnp->cn_flags & ISLASTCN) != 0);
1360 			}
1361 			break;
1362 		}
1363 
1364 		/*
1365 		 * Stop and get a hold on the vnode if we've encountered
1366 		 * something other than a dirctory.
1367 		 */
1368 		if (foundobj->v_type != VDIR) {
1369 			error = vcache_tryvget(foundobj);
1370 			if (error != 0) {
1371 				foundobj = NULL;
1372 				error = SET_ERROR(EOPNOTSUPP);
1373 			} else {
1374 				terminal = (foundobj->v_type != VLNK &&
1375 				    (cnp->cn_flags & ISLASTCN) != 0);
1376 			}
1377 			break;
1378 		}
1379 
1380 		/*
1381 		 * Try to cross mountpoints, bearing in mind that they can
1382 		 * be stacked.  If at any point we can't go further, stop
1383 		 * and try to get a reference on the vnode.  If we are able
1384 		 * to get a ref then lookup_crossmount() will take care of
1385 		 * it, otherwise we'll fall through to lookup_once().
1386 		 */
1387 		if (foundobj->v_mountedhere != NULL) {
1388 			while (foundobj->v_mountedhere != NULL &&
1389 			    (cnp->cn_flags & NOCROSSMOUNT) == 0 &&
1390 			    cache_cross_mount(&foundobj, &plock)) {
1391 				KASSERT(foundobj != NULL);
1392 				KASSERT(foundobj->v_type == VDIR);
1393 			}
1394 			if (foundobj->v_mountedhere != NULL) {
1395 				error = vcache_tryvget(foundobj);
1396 				if (error != 0) {
1397 					foundobj = NULL;
1398 					error = SET_ERROR(EOPNOTSUPP);
1399 				}
1400 				break;
1401 			} else {
1402 				searchdir = NULL;
1403 			}
1404 		}
1405 
1406 		/*
1407 		 * Time to stop if we found the last component & traversed
1408 		 * all mounts.
1409 		 */
1410 		if ((cnp->cn_flags & ISLASTCN) != 0) {
1411 			error = vcache_tryvget(foundobj);
1412 			if (error != 0) {
1413 				foundobj = NULL;
1414 				error = SET_ERROR(EOPNOTSUPP);
1415 			} else {
1416 				terminal = (foundobj->v_type != VLNK);
1417 			}
1418 			break;
1419 		}
1420 
1421 		/*
1422 		 * Otherwise, we're still in business.  Set the found VDIR
1423 		 * vnode as the search dir for the next component and
1424 		 * continue on to it.
1425 		 */
1426 		cnp->cn_nameptr = ndp->ni_next;
1427 		searchdir = foundobj;
1428 	}
1429 
1430 	if (terminal) {
1431 		/*
1432 		 * If we exited the loop above having successfully located
1433 		 * the last component with a zero error code, and it's not a
1434 		 * symbolic link, then the parent directory is not needed.
1435 		 * Release reference to the starting parent and make the
1436 		 * terminal parent disappear into thin air.
1437 		 */
1438 		KASSERT(plock != NULL);
1439 		rw_exit(plock);
1440 		vrele(*searchdir_ret);
1441 		*searchdir_ret = NULL;
1442 	} else if (searchdir != *searchdir_ret) {
1443 		/*
1444 		 * Otherwise we need to return the parent.  If we ended up
1445 		 * with a new search dir, ref it before dropping the
1446 		 * namecache's lock.  The lock prevents both searchdir and
1447 		 * foundobj from disappearing.  If we can't ref the new
1448 		 * searchdir, we have a bit of a problem.  Roll back the
1449 		 * fastforward to the beginning and let lookup_once() take
1450 		 * care of it.
1451 		 */
1452 		if (searchdir == NULL) {
1453 			/*
1454 			 * It's possible for searchdir to be NULL in the
1455 			 * case of a root vnode being reclaimed while
1456 			 * trying to cross a mount.
1457 			 */
1458 			error2 = SET_ERROR(EOPNOTSUPP);
1459 		} else {
1460 			error2 = vcache_tryvget(searchdir);
1461 		}
1462 		KASSERT(plock != NULL);
1463 		rw_exit(plock);
1464 		if (__predict_true(error2 == 0)) {
1465 			/* Returning new searchdir, and maybe new foundobj. */
1466 			vrele(*searchdir_ret);
1467 			*searchdir_ret = searchdir;
1468 		} else {
1469 			/* Returning nothing. */
1470 			if (foundobj != NULL) {
1471 				vrele(foundobj);
1472 				foundobj = NULL;
1473 			}
1474 			cnp->cn_nameptr = oldnameptr;
1475 			ndp->ni_pathlen = oldpathlen;
1476 			error = lookup_parsepath(state, *searchdir_ret);
1477 			if (error == 0) {
1478 				error = SET_ERROR(EOPNOTSUPP);
1479 			}
1480 		}
1481 	} else if (plock != NULL) {
1482 		/* Drop any namecache lock still held. */
1483 		rw_exit(plock);
1484 	}
1485 
1486 	KASSERT(error == 0 ? foundobj != NULL : foundobj == NULL);
1487 	*foundobj_ret = foundobj;
1488 	return error;
1489 }
1490 
1491 //////////////////////////////
1492 
1493 /*
1494  * Do a complete path search from a single root directory.
1495  * (This is called up to twice if TRYEMULROOT is in effect.)
1496  */
1497 static int
1498 namei_oneroot(struct namei_state *state,
1499     int neverfollow, int inhibitmagic, int isnfsd)
1500 {
1501 	struct nameidata *ndp = state->ndp;
1502 	struct componentname *cnp = state->cnp;
1503 	struct vnode *searchdir, *foundobj;
1504 	bool searchdir_locked = false;
1505 	int error;
1506 
1507 	error = namei_start(state, isnfsd, &searchdir);
1508 	if (error) {
1509 		ndp->ni_dvp = NULL;
1510 		ndp->ni_vp = NULL;
1511 		return error;
1512 	}
1513 	KASSERT(searchdir->v_type == VDIR);
1514 
1515 	/*
1516 	 * Setup: break out flag bits into variables.
1517 	 */
1518 	state->docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE;
1519 	if (cnp->cn_nameiop == DELETE)
1520 		state->docache = 0;
1521 	state->rdonly = cnp->cn_flags & RDONLY;
1522 
1523 	/*
1524 	 * Keep going until we run out of path components.
1525 	 */
1526 	cnp->cn_nameptr = ndp->ni_pnbuf;
1527 
1528 	/* drop leading slashes (already used them to choose startdir) */
1529 	while (cnp->cn_nameptr[0] == '/') {
1530 		cnp->cn_nameptr++;
1531 		ndp->ni_pathlen--;
1532 	}
1533 	/* was it just "/"? */
1534 	if (cnp->cn_nameptr[0] == '\0') {
1535 		foundobj = searchdir;
1536 		searchdir = NULL;
1537 		cnp->cn_flags |= ISLASTCN;
1538 
1539 		/* bleh */
1540 		goto skiploop;
1541 	}
1542 
1543 	for (;;) {
1544 		KASSERT(searchdir != NULL);
1545 		KASSERT(!searchdir_locked);
1546 
1547 		/*
1548 		 * Parse out the first path name component that we need to
1549 		 * to consider.  While doing this, attempt to use the name
1550 		 * cache to fast-forward through as many "easy" to find
1551 		 * components of the path as possible.
1552 		 */
1553 		error = lookup_fastforward(state, &searchdir, &foundobj);
1554 
1555 		/*
1556 		 * If we didn't get a good answer from the namecache, then
1557 		 * go directly to the file system.
1558 		 */
1559 		if (error == EOPNOTSUPP) {
1560 			error = lookup_once(state, searchdir, &searchdir,
1561 			    &foundobj, &searchdir_locked);
1562 		}
1563 
1564 		/*
1565 		 * If the vnode we found is mounted on, then cross the mount
1566 		 * and get the root vnode in foundobj.  If this encounters
1567 		 * an error, it will dispose of foundobj, but searchdir is
1568 		 * untouched.
1569 		 */
1570 		if (error == 0 && foundobj != NULL &&
1571 		    foundobj->v_type == VDIR &&
1572 		    foundobj->v_mountedhere != NULL &&
1573 		    (cnp->cn_flags & NOCROSSMOUNT) == 0) {
1574 			error = lookup_crossmount(state, &searchdir,
1575 			    &foundobj, &searchdir_locked);
1576 		}
1577 
1578 		if (error) {
1579 			if (searchdir != NULL) {
1580 				if (searchdir_locked) {
1581 					searchdir_locked = false;
1582 					vput(searchdir);
1583 				} else {
1584 					vrele(searchdir);
1585 				}
1586 			}
1587 			ndp->ni_dvp = NULL;
1588 			ndp->ni_vp = NULL;
1589 			/*
1590 			 * Note that if we're doing TRYEMULROOT we can
1591 			 * retry with the normal root. Where this is
1592 			 * currently set matches previous practice,
1593 			 * but the previous practice didn't make much
1594 			 * sense and somebody should sit down and
1595 			 * figure out which cases should cause retry
1596 			 * and which shouldn't. XXX.
1597 			 */
1598 			state->attempt_retry = 1;
1599 			return error;
1600 		}
1601 
1602 		if (foundobj == NULL) {
1603 			/*
1604 			 * Success with no object returned means we're
1605 			 * creating something and it isn't already
1606 			 * there. Break out of the main loop now so
1607 			 * the code below doesn't have to test for
1608 			 * foundobj == NULL.
1609 			 */
1610 			/* lookup_once can't have dropped the searchdir */
1611 			KASSERT(searchdir != NULL ||
1612 			    (cnp->cn_flags & ISLASTCN) != 0);
1613 			break;
1614 		}
1615 
1616 		/*
1617 		 * Check for symbolic link. If we've reached one,
1618 		 * follow it, unless we aren't supposed to. Back up
1619 		 * over any slashes that we skipped, as we will need
1620 		 * them again.
1621 		 */
1622 		if (namei_atsymlink(state, foundobj)) {
1623 			/* Don't need searchdir locked any more. */
1624 			if (searchdir_locked) {
1625 				searchdir_locked = false;
1626 				VOP_UNLOCK(searchdir);
1627 			}
1628 			ndp->ni_pathlen += state->slashes;
1629 			ndp->ni_next -= state->slashes;
1630 			if (neverfollow) {
1631 				error = SET_ERROR(EINVAL);
1632 			} else if (searchdir == NULL) {
1633 				/*
1634 				 * dholland 20160410: lookup_once only
1635 				 * drops searchdir if it crossed a
1636 				 * mount point. Therefore, if we get
1637 				 * here it means we crossed a mount
1638 				 * point to a mounted filesystem whose
1639 				 * root vnode is a symlink. In theory
1640 				 * we could continue at this point by
1641 				 * using the pre-crossing searchdir
1642 				 * (e.g. just take out an extra
1643 				 * reference on it before calling
1644 				 * lookup_once so we still have it),
1645 				 * but this will make an ugly mess and
1646 				 * it should never happen in practice
1647 				 * as only badly broken filesystems
1648 				 * have non-directory root vnodes. (I
1649 				 * have seen this sort of thing with
1650 				 * NFS occasionally but even then it
1651 				 * means something's badly wrong.)
1652 				 */
1653 				error = SET_ERROR(ENOTDIR);
1654 			} else {
1655 				/*
1656 				 * dholland 20110410: if we're at a
1657 				 * union mount it might make sense to
1658 				 * use the top of the union stack here
1659 				 * rather than the layer we found the
1660 				 * symlink in. (FUTURE)
1661 				 */
1662 				error = namei_follow(state, inhibitmagic,
1663 				    searchdir, foundobj,
1664 				    &searchdir);
1665 			}
1666 			if (error) {
1667 				KASSERT(searchdir != foundobj);
1668 				if (searchdir != NULL) {
1669 					vrele(searchdir);
1670 				}
1671 				vrele(foundobj);
1672 				ndp->ni_dvp = NULL;
1673 				ndp->ni_vp = NULL;
1674 				return error;
1675 			}
1676 			vrele(foundobj);
1677 			foundobj = NULL;
1678 
1679 			/*
1680 			 * If we followed a symlink to `/' and there
1681 			 * are no more components after the symlink,
1682 			 * we're done with the loop and what we found
1683 			 * is the searchdir.
1684 			 */
1685 			if (cnp->cn_nameptr[0] == '\0') {
1686 				KASSERT(searchdir != NULL);
1687 				foundobj = searchdir;
1688 				searchdir = NULL;
1689 				cnp->cn_flags |= ISLASTCN;
1690 				break;
1691 			}
1692 
1693 			continue;
1694 		}
1695 
1696 		/*
1697 		 * Not a symbolic link.
1698 		 *
1699 		 * Check for directory, if the component was
1700 		 * followed by a series of slashes.
1701 		 */
1702 		if ((foundobj->v_type != VDIR) &&
1703 		    (cnp->cn_flags & REQUIREDIR)) {
1704 			KASSERT(foundobj != searchdir);
1705 			if (searchdir) {
1706 				if (searchdir_locked) {
1707 					searchdir_locked = false;
1708 					vput(searchdir);
1709 				} else {
1710 					vrele(searchdir);
1711 				}
1712 			} else {
1713 				KASSERT(!searchdir_locked);
1714 			}
1715 			vrele(foundobj);
1716 			ndp->ni_dvp = NULL;
1717 			ndp->ni_vp = NULL;
1718 			state->attempt_retry = 1;
1719 			return SET_ERROR(ENOTDIR);
1720 		}
1721 
1722 		/*
1723 		 * Stop if we've reached the last component.
1724 		 */
1725 		if (cnp->cn_flags & ISLASTCN) {
1726 			break;
1727 		}
1728 
1729 		/*
1730 		 * Continue with the next component.
1731 		 */
1732 		cnp->cn_nameptr = ndp->ni_next;
1733 		if (searchdir != NULL) {
1734 			if (searchdir_locked) {
1735 				searchdir_locked = false;
1736 				vput(searchdir);
1737 			} else {
1738 				vrele(searchdir);
1739 			}
1740 		}
1741 		searchdir = foundobj;
1742 		foundobj = NULL;
1743 	}
1744 
1745 	KASSERT((cnp->cn_flags & LOCKPARENT) == 0 || searchdir == NULL ||
1746 	    VOP_ISLOCKED(searchdir) == LK_EXCLUSIVE);
1747 
1748 skiploop:
1749 	if (foundobj != NULL) {
1750 		if (foundobj == ndp->ni_erootdir) {
1751 			/*
1752 			 * We are about to return the emulation root.
1753 			 * This isn't a good idea because code might
1754 			 * repeatedly lookup ".." until the file
1755 			 * matches that returned for "/" and loop
1756 			 * forever.  So convert it to the real root.
1757 			 */
1758 			if (searchdir != NULL) {
1759 				if (searchdir_locked) {
1760 					vput(searchdir);
1761 					searchdir_locked = false;
1762 				} else {
1763 					vrele(searchdir);
1764 				}
1765 				searchdir = NULL;
1766 			}
1767 			vrele(foundobj);
1768 			foundobj = ndp->ni_rootdir;
1769 			vref(foundobj);
1770 		}
1771 
1772 		/*
1773 		 * If the caller requested the parent node (i.e. it's
1774 		 * a CREATE, DELETE, or RENAME), and we don't have one
1775 		 * (because this is the root directory, or we crossed
1776 		 * a mount point), then we must fail.
1777 		 *
1778 		 * 20210604 dholland when NONEXCLHACK is set (open
1779 		 * with O_CREAT but not O_EXCL) skip this logic. Since
1780 		 * we have a foundobj, open will not be creating, so
1781 		 * it doesn't actually need or use the searchdir, so
1782 		 * it's ok to return it even if it's on a different
1783 		 * volume, and it's also ok to return NULL; by setting
1784 		 * NONEXCLHACK the open code promises to cope with
1785 		 * those cases correctly. (That is, it should do what
1786 		 * it would do anyway, that is, just release the
1787 		 * searchdir, except not crash if it's null.) This is
1788 		 * needed because otherwise opening mountpoints with
1789 		 * O_CREAT but not O_EXCL fails... which is a silly
1790 		 * thing to do but ought to work. (This whole issue
1791 		 * came to light because 3rd party code wanted to open
1792 		 * certain procfs nodes with O_CREAT for some 3rd
1793 		 * party reason, and it failed.)
1794 		 *
1795 		 * Note that NONEXCLHACK is properly a different
1796 		 * nameiop (it is partway between LOOKUP and CREATE)
1797 		 * but it was stuffed in as a flag instead to make the
1798 		 * resulting patch less invasive for pullup. Blah.
1799 		 */
1800 		if (cnp->cn_nameiop != LOOKUP &&
1801 		    (searchdir == NULL ||
1802 			searchdir->v_mount != foundobj->v_mount) &&
1803 		    (cnp->cn_flags & NONEXCLHACK) == 0) {
1804 			if (searchdir) {
1805 				if (searchdir_locked) {
1806 					vput(searchdir);
1807 					searchdir_locked = false;
1808 				} else {
1809 					vrele(searchdir);
1810 				}
1811 				searchdir = NULL;
1812 			}
1813 			vrele(foundobj);
1814 			foundobj = NULL;
1815 			ndp->ni_dvp = NULL;
1816 			ndp->ni_vp = NULL;
1817 			state->attempt_retry = 1;
1818 
1819 			switch (cnp->cn_nameiop) {
1820 			case CREATE:
1821 				return SET_ERROR(EEXIST);
1822 			case DELETE:
1823 			case RENAME:
1824 				return SET_ERROR(EBUSY);
1825 			default:
1826 				break;
1827 			}
1828 			panic("Invalid nameiop\n");
1829 		}
1830 
1831 		/*
1832 		 * Disallow directory write attempts on read-only lookups.
1833 		 * Prefers EEXIST over EROFS for the CREATE case.
1834 		 */
1835 		if (state->rdonly &&
1836 		    (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1837 			if (searchdir) {
1838 				if (searchdir_locked) {
1839 					vput(searchdir);
1840 					searchdir_locked = false;
1841 				} else {
1842 					vrele(searchdir);
1843 				}
1844 				searchdir = NULL;
1845 			}
1846 			vrele(foundobj);
1847 			foundobj = NULL;
1848 			ndp->ni_dvp = NULL;
1849 			ndp->ni_vp = NULL;
1850 			state->attempt_retry = 1;
1851 			return SET_ERROR(EROFS);
1852 		}
1853 
1854 		/* Lock the leaf node if requested. */
1855 		if ((cnp->cn_flags & (LOCKLEAF | LOCKPARENT)) == LOCKPARENT &&
1856 		    searchdir == foundobj) {
1857 			/*
1858 			 * Note: if LOCKPARENT but not LOCKLEAF is
1859 			 * set, and searchdir == foundobj, this code
1860 			 * necessarily unlocks the parent as well as
1861 			 * the leaf. That is, just because you specify
1862 			 * LOCKPARENT doesn't mean you necessarily get
1863 			 * a locked parent vnode. The code in
1864 			 * vfs_syscalls.c, and possibly elsewhere,
1865 			 * that uses this combination "knows" this, so
1866 			 * it can't be safely changed. Feh. XXX
1867 			 */
1868 			KASSERT(searchdir_locked);
1869 			VOP_UNLOCK(searchdir);
1870 			searchdir_locked = false;
1871 		} else if ((cnp->cn_flags & LOCKLEAF) != 0 &&
1872 		    (searchdir != foundobj ||
1873 			(cnp->cn_flags & LOCKPARENT) == 0)) {
1874 			const int lktype = (cnp->cn_flags & LOCKSHARED) != 0 ?
1875 			    LK_SHARED : LK_EXCLUSIVE;
1876 			vn_lock(foundobj, lktype | LK_RETRY);
1877 		}
1878 	}
1879 
1880 	/*
1881 	 * Done.
1882 	 */
1883 
1884 	/*
1885 	 * If LOCKPARENT is not set, the parent directory isn't returned.
1886 	 */
1887 	if ((cnp->cn_flags & LOCKPARENT) == 0 && searchdir != NULL) {
1888 		vrele(searchdir);
1889 		searchdir = NULL;
1890 	}
1891 
1892 	ndp->ni_dvp = searchdir;
1893 	ndp->ni_vp = foundobj;
1894 	return 0;
1895 }
1896 
1897 /*
1898  * Do namei; wrapper layer that handles TRYEMULROOT.
1899  */
1900 static int
1901 namei_tryemulroot(struct namei_state *state,
1902     int neverfollow, int inhibitmagic, int isnfsd)
1903 {
1904 	int error;
1905 
1906 	struct nameidata *ndp = state->ndp;
1907 	struct componentname *cnp = state->cnp;
1908 	const char *savepath = NULL;
1909 
1910 	KASSERT(cnp == &ndp->ni_cnd);
1911 
1912 	if (cnp->cn_flags & TRYEMULROOT) {
1913 		savepath = pathbuf_stringcopy_get(ndp->ni_pathbuf);
1914 	}
1915 
1916 emul_retry:
1917 	state->attempt_retry = 0;
1918 
1919 	error = namei_oneroot(state, neverfollow, inhibitmagic, isnfsd);
1920 	if (error) {
1921 		/*
1922 		 * Once namei has started up, the existence of ni_erootdir
1923 		 * tells us whether we're working from an emulation root.
1924 		 * The TRYEMULROOT flag isn't necessarily authoritative.
1925 		 */
1926 		if (ndp->ni_erootdir != NULL && state->attempt_retry) {
1927 			/* Retry the whole thing using the normal root */
1928 			cnp->cn_flags &= ~TRYEMULROOT;
1929 			state->attempt_retry = 0;
1930 
1931 			/* kinda gross */
1932 			strcpy(ndp->ni_pathbuf->pb_path, savepath);
1933 			pathbuf_stringcopy_put(ndp->ni_pathbuf, savepath);
1934 			savepath = NULL;
1935 
1936 			goto emul_retry;
1937 		}
1938 	}
1939 	if (savepath != NULL) {
1940 		pathbuf_stringcopy_put(ndp->ni_pathbuf, savepath);
1941 	}
1942 	return error;
1943 }
1944 
1945 /*
1946  * External interface.
1947  */
1948 int
1949 namei(struct nameidata *ndp)
1950 {
1951 	struct namei_state state;
1952 	int error;
1953 
1954 	namei_init(&state, ndp);
1955 	error = namei_tryemulroot(&state,
1956 	    0/*!neverfollow*/, 0/*!inhibitmagic*/, 0/*isnfsd*/);
1957 	namei_cleanup(&state);
1958 
1959 	if (error) {
1960 		/* make sure no stray refs leak out */
1961 		KASSERT(ndp->ni_dvp == NULL);
1962 		KASSERT(ndp->ni_vp == NULL);
1963 	}
1964 
1965 	return error;
1966 }
1967 
1968 ////////////////////////////////////////////////////////////
1969 
1970 /*
1971  * External interface used by nfsd. This is basically different from
1972  * namei only in that it has the ability to pass in the "current
1973  * directory", and uses an extra flag "neverfollow" for which there's
1974  * no physical flag defined in namei.h. (There used to be a cut&paste
1975  * copy of about half of namei in nfsd to allow these minor
1976  * adjustments to exist.)
1977  *
1978  * XXX: the namei interface should be adjusted so nfsd can just use
1979  * ordinary namei().
1980  */
1981 int
1982 lookup_for_nfsd(struct nameidata *ndp, struct vnode *forcecwd, int neverfollow)
1983 {
1984 	struct namei_state state;
1985 	int error;
1986 
1987 	KASSERT(ndp->ni_atdir == NULL);
1988 	ndp->ni_atdir = forcecwd;
1989 
1990 	namei_init(&state, ndp);
1991 	error = namei_tryemulroot(&state,
1992 	    neverfollow, 1/*inhibitmagic*/, 1/*isnfsd*/);
1993 	namei_cleanup(&state);
1994 
1995 	if (error) {
1996 		/* make sure no stray refs leak out */
1997 		KASSERT(ndp->ni_dvp == NULL);
1998 		KASSERT(ndp->ni_vp == NULL);
1999 	}
2000 
2001 	return error;
2002 }
2003 
2004 /*
2005  * A second external interface used by nfsd. This turns out to be a
2006  * single lookup used by the WebNFS code (ha!) to get "index.html" or
2007  * equivalent when asked for a directory. It should eventually evolve
2008  * into some kind of namei_once() call; for the time being it's kind
2009  * of a mess. XXX.
2010  *
2011  * dholland 20110109: I don't think it works, and I don't think it
2012  * worked before I started hacking and slashing either, and I doubt
2013  * anyone will ever notice.
2014  */
2015 
2016 /*
2017  * Internals. This calls lookup_once() after setting up the assorted
2018  * pieces of state the way they ought to be.
2019  */
2020 static int
2021 do_lookup_for_nfsd_index(struct namei_state *state)
2022 {
2023 	int error;
2024 
2025 	struct componentname *cnp = state->cnp;
2026 	struct nameidata *ndp = state->ndp;
2027 	struct vnode *startdir;
2028 	struct vnode *foundobj;
2029 	bool startdir_locked;
2030 	const char *cp;			/* pointer into pathname argument */
2031 
2032 	KASSERT(cnp == &ndp->ni_cnd);
2033 
2034 	startdir = state->ndp->ni_atdir;
2035 
2036 	cnp->cn_nameptr = ndp->ni_pnbuf;
2037 	state->docache = 1;
2038 	state->rdonly = cnp->cn_flags & RDONLY;
2039 	ndp->ni_dvp = NULL;
2040 
2041 	error = VOP_PARSEPATH(startdir, cnp->cn_nameptr, &cnp->cn_namelen);
2042 	if (error) {
2043 		return error;
2044 	}
2045 
2046 	cp = cnp->cn_nameptr + cnp->cn_namelen;
2047 	KASSERT(cnp->cn_namelen <= KERNEL_NAME_MAX);
2048 	ndp->ni_pathlen -= cnp->cn_namelen;
2049 	ndp->ni_next = cp;
2050 	state->slashes = 0;
2051 	cnp->cn_flags &= ~REQUIREDIR;
2052 	cnp->cn_flags |= MAKEENTRY|ISLASTCN;
2053 
2054 	if (cnp->cn_namelen == 2 &&
2055 	    cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
2056 		cnp->cn_flags |= ISDOTDOT;
2057 	else
2058 		cnp->cn_flags &= ~ISDOTDOT;
2059 
2060 	/*
2061 	 * Because lookup_once can change the startdir, we need our
2062 	 * own reference to it to avoid consuming the caller's.
2063 	 */
2064 	vref(startdir);
2065 	error = lookup_once(state, startdir, &startdir, &foundobj,
2066 	    &startdir_locked);
2067 
2068 	KASSERT((cnp->cn_flags & LOCKPARENT) == 0);
2069 	if (startdir_locked) {
2070 		VOP_UNLOCK(startdir);
2071 		startdir_locked = false;
2072 	}
2073 
2074 	/*
2075 	 * If the vnode we found is mounted on, then cross the mount and get
2076 	 * the root vnode in foundobj.  If this encounters an error, it will
2077 	 * dispose of foundobj, but searchdir is untouched.
2078 	 */
2079 	if (error == 0 && foundobj != NULL &&
2080 	    foundobj->v_type == VDIR &&
2081 	    foundobj->v_mountedhere != NULL &&
2082 	    (cnp->cn_flags & NOCROSSMOUNT) == 0) {
2083 		error = lookup_crossmount(state, &startdir, &foundobj,
2084 		    &startdir_locked);
2085 	}
2086 
2087 	/* Now toss startdir and see if we have an error. */
2088 	if (startdir != NULL)
2089 		vrele(startdir);
2090 	if (error)
2091 		foundobj = NULL;
2092 	else if (foundobj != NULL && (cnp->cn_flags & LOCKLEAF) != 0)
2093 		vn_lock(foundobj, LK_EXCLUSIVE | LK_RETRY);
2094 
2095 	ndp->ni_vp = foundobj;
2096 	return error;
2097 }
2098 
2099 /*
2100  * External interface. The partitioning between this function and the
2101  * above isn't very clear - the above function exists mostly so code
2102  * that uses "state->" can be shuffled around without having to change
2103  * it to "state.".
2104  */
2105 int
2106 lookup_for_nfsd_index(struct nameidata *ndp, struct vnode *startdir)
2107 {
2108 	struct namei_state state;
2109 	int error;
2110 
2111 	KASSERT(ndp->ni_atdir == NULL);
2112 	ndp->ni_atdir = startdir;
2113 
2114 	/*
2115 	 * Note: the name sent in here (is not|should not be) allowed
2116 	 * to contain a slash.
2117 	 */
2118 	if (strlen(ndp->ni_pathbuf->pb_path) > KERNEL_NAME_MAX) {
2119 		return SET_ERROR(ENAMETOOLONG);
2120 	}
2121 	if (strchr(ndp->ni_pathbuf->pb_path, '/')) {
2122 		return SET_ERROR(EINVAL);
2123 	}
2124 
2125 	ndp->ni_pathlen = strlen(ndp->ni_pathbuf->pb_path) + 1;
2126 	ndp->ni_pnbuf = NULL;
2127 	ndp->ni_cnd.cn_nameptr = NULL;
2128 
2129 	namei_init(&state, ndp);
2130 	error = do_lookup_for_nfsd_index(&state);
2131 	namei_cleanup(&state);
2132 
2133 	return error;
2134 }
2135 
2136 ////////////////////////////////////////////////////////////
2137 
2138 /*
2139  * Reacquire a path name component.
2140  * dvp is locked on entry and exit.
2141  * *vpp is locked on exit unless it's NULL.
2142  */
2143 int
2144 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp,
2145     int dummy)
2146 {
2147 	int rdonly;			/* lookup read-only flag bit */
2148 	int error = 0;
2149 #ifdef DEBUG
2150 	size_t newlen;			/* DEBUG: check name len */
2151 	const char *cp;			/* DEBUG: check name ptr */
2152 #endif /* DEBUG */
2153 
2154 	(void)dummy;
2155 
2156 	/*
2157 	 * Setup: break out flag bits into variables.
2158 	 */
2159 	rdonly = cnp->cn_flags & RDONLY;
2160 
2161 	/*
2162 	 * Search a new directory.
2163 	 *
2164 	 * The cn_hash value is for use by vfs_cache.
2165 	 * The last component of the filename is left accessible via
2166 	 * cnp->cn_nameptr for callers that need the name. Callers needing
2167 	 * the name set the SAVENAME flag. When done, they assume
2168 	 * responsibility for freeing the pathname buffer.
2169 	 */
2170 #ifdef DEBUG
2171 #if 0
2172 	cp = NULL;
2173 	newhash = namei_hash(cnp->cn_nameptr, &cp);
2174 	if ((uint32_t)newhash != (uint32_t)cnp->cn_hash)
2175 		panic("relookup: bad hash");
2176 #endif
2177 	error = VOP_PARSEPATH(dvp, cnp->cn_nameptr, &newlen);
2178 	if (error) {
2179 		panic("relookup: parsepath failed with error %d", error);
2180 	}
2181 	if (cnp->cn_namelen != newlen)
2182 		panic("relookup: bad len");
2183 	cp = cnp->cn_nameptr + cnp->cn_namelen;
2184 	while (*cp == '/')
2185 		cp++;
2186 	if (*cp != 0)
2187 		panic("relookup: not last component");
2188 #endif /* DEBUG */
2189 
2190 	/*
2191 	 * Check for degenerate name (e.g. / or "")
2192 	 * which is a way of talking about a directory,
2193 	 * e.g. like "/." or ".".
2194 	 */
2195 	if (cnp->cn_nameptr[0] == '\0')
2196 		panic("relookup: null name");
2197 
2198 	if (cnp->cn_flags & ISDOTDOT)
2199 		panic("relookup: lookup on dot-dot");
2200 
2201 	/*
2202 	 * We now have a segment name to search for, and a directory to search.
2203 	 */
2204 	*vpp = NULL;
2205 	error = VOP_LOOKUP(dvp, vpp, cnp);
2206 	if ((error) != 0) {
2207 		KASSERTMSG((*vpp == NULL),
2208 		    "leaf `%s' should be empty but is %p",
2209 		    cnp->cn_nameptr, *vpp);
2210 		if (error != EJUSTRETURN)
2211 			goto bad;
2212 	}
2213 
2214 	/*
2215 	 * Check for symbolic link
2216 	 */
2217 	KASSERTMSG((*vpp == NULL || (*vpp)->v_type != VLNK ||
2218 		(cnp->cn_flags & FOLLOW) == 0),
2219 	    "relookup: symlink found");
2220 
2221 	/*
2222 	 * Check for read-only lookups.
2223 	 */
2224 	if (rdonly && cnp->cn_nameiop != LOOKUP) {
2225 		error = SET_ERROR(EROFS);
2226 		if (*vpp) {
2227 			vrele(*vpp);
2228 		}
2229 		goto bad;
2230 	}
2231 	/*
2232 	 * Lock result.
2233 	 */
2234 	if (*vpp && *vpp != dvp) {
2235 		error = vn_lock(*vpp, LK_EXCLUSIVE);
2236 		if (error != 0) {
2237 			vrele(*vpp);
2238 			goto bad;
2239 		}
2240 	}
2241 	return 0;
2242 
2243 bad:
2244 	*vpp = NULL;
2245 	return error;
2246 }
2247 
2248 /*
2249  * namei_simple - simple forms of namei.
2250  *
2251  * These are wrappers to allow the simple case callers of namei to be
2252  * left alone while everything else changes under them.
2253  */
2254 
2255 /* Flags */
2256 struct namei_simple_flags_type {
2257 	int dummy;
2258 };
2259 static const struct namei_simple_flags_type ns_nn, ns_nt, ns_fn, ns_ft;
2260 const namei_simple_flags_t NSM_NOFOLLOW_NOEMULROOT = &ns_nn;
2261 const namei_simple_flags_t NSM_NOFOLLOW_TRYEMULROOT = &ns_nt;
2262 const namei_simple_flags_t NSM_FOLLOW_NOEMULROOT = &ns_fn;
2263 const namei_simple_flags_t NSM_FOLLOW_TRYEMULROOT = &ns_ft;
2264 
2265 static int
2266 namei_simple_convert_flags(namei_simple_flags_t sflags)
2267 {
2268 
2269 	if (sflags == NSM_NOFOLLOW_NOEMULROOT)
2270 		return NOFOLLOW | 0;
2271 	if (sflags == NSM_NOFOLLOW_TRYEMULROOT)
2272 		return NOFOLLOW | TRYEMULROOT;
2273 	if (sflags == NSM_FOLLOW_NOEMULROOT)
2274 		return FOLLOW | 0;
2275 	if (sflags == NSM_FOLLOW_TRYEMULROOT)
2276 		return FOLLOW | TRYEMULROOT;
2277 	panic("namei_simple_convert_flags: bogus sflags\n");
2278 	return 0;
2279 }
2280 
2281 int
2282 namei_simple_kernel(const char *path, namei_simple_flags_t sflags,
2283     struct vnode **vp_ret)
2284 {
2285 
2286 	return nameiat_simple_kernel(NULL, path, sflags, vp_ret);
2287 }
2288 
2289 int
2290 nameiat_simple(struct vnode *dvp, struct pathbuf *pb,
2291     namei_simple_flags_t sflags, struct vnode **vp_ret)
2292 {
2293 	struct nameidata nd;
2294 	int error;
2295 
2296 	NDINIT(&nd, LOOKUP, namei_simple_convert_flags(sflags), pb);
2297 
2298 	if (dvp != NULL)
2299 		NDAT(&nd, dvp);
2300 
2301 	error = namei(&nd);
2302 	if (error != 0)
2303 		return error;
2304 
2305 	*vp_ret = nd.ni_vp;
2306 	return 0;
2307 }
2308 
2309 int
2310 nameiat_simple_kernel(struct vnode *dvp, const char *path,
2311     namei_simple_flags_t sflags, struct vnode **vp_ret)
2312 {
2313 	struct pathbuf *pb;
2314 	int error;
2315 
2316 	pb = pathbuf_create(path);
2317 	if (pb == NULL)
2318 		return SET_ERROR(ENOMEM);
2319 
2320 	error = nameiat_simple(dvp, pb, sflags, vp_ret);
2321 
2322 	pathbuf_destroy(pb);
2323 	return error;
2324 }
2325 
2326 int
2327 namei_simple_user(const char *path, namei_simple_flags_t sflags,
2328     struct vnode **vp_ret)
2329 {
2330 
2331 	return nameiat_simple_user(NULL, path, sflags, vp_ret);
2332 }
2333 
2334 int
2335 nameiat_simple_user(struct vnode *dvp, const char *path,
2336     namei_simple_flags_t sflags, struct vnode **vp_ret)
2337 {
2338 	struct pathbuf *pb;
2339 	int error;
2340 
2341 	error = pathbuf_copyin(path, &pb);
2342 	if (error)
2343 		return error;
2344 
2345 	error = nameiat_simple(dvp, pb, sflags, vp_ret);
2346 
2347 	pathbuf_destroy(pb);
2348 	return error;
2349 }
2350