xref: /csrg-svn/sys/nfs/nfs_serv.c (revision 52234)
1 /*
2  * Copyright (c) 1989 The Regents of the University of California.
3  * All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Rick Macklem at The University of Guelph.
7  *
8  * %sccs.include.redist.c%
9  *
10  *	@(#)nfs_serv.c	7.44 (Berkeley) 01/22/92
11  */
12 
13 /*
14  * nfs version 2 server calls to vnode ops
15  * - these routines generally have 3 phases
16  *   1 - break down and validate rpc request in mbuf list
17  *   2 - do the vnode ops for the request
18  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
19  *   3 - build the rpc reply in an mbuf list
20  *   nb:
21  *	- do not mix the phases, since the nfsm_?? macros can return failures
22  *	  on a bad rpc or similar and do not do any vrele() or vput()'s
23  *
24  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
25  *	error number iff error != 0 whereas
26  *	returning an error from the server function implies a fatal error
27  *	such as a badly constructed rpc request that should be dropped without
28  *	a reply.
29  */
30 
31 #include "param.h"
32 #include "proc.h"
33 #include "file.h"
34 #include "namei.h"
35 #include "vnode.h"
36 #include "mount.h"
37 #include "mbuf.h"
38 
39 #include "ufs/ufs/quota.h"
40 #include "ufs/ufs/inode.h"
41 #include "ufs/ufs/dir.h"
42 
43 #include "nfsv2.h"
44 #include "rpcv2.h"
45 #include "nfs.h"
46 #include "xdr_subs.h"
47 #include "nfsm_subs.h"
48 #include "nqnfs.h"
49 
50 /* Defs */
51 #define	TRUE	1
52 #define	FALSE	0
53 
54 /* Global vars */
55 extern u_long nfs_procids[NFS_NPROCS];
56 extern u_long nfs_xdrneg1;
57 extern u_long nfs_false, nfs_true;
58 nfstype nfs_type[9] = { NFNON, NFREG, NFDIR, NFBLK, NFCHR, NFLNK, NFNON,
59 		      NFCHR, NFNON };
60 
61 /*
62  * nfs getattr service
63  */
64 nfsrv_getattr(nfsd, mrep, md, dpos, cred, nam, mrq)
65 	struct nfsd *nfsd;
66 	struct mbuf *mrep, *md;
67 	caddr_t dpos;
68 	struct ucred *cred;
69 	struct mbuf *nam, **mrq;
70 {
71 	register struct nfsv2_fattr *fp;
72 	struct vattr va;
73 	register struct vattr *vap = &va;
74 	struct vnode *vp;
75 	nfsv2fh_t nfh;
76 	fhandle_t *fhp;
77 	register u_long *tl;
78 	register long t1;
79 	caddr_t bpos;
80 	int error = 0, rdonly, cache;
81 	char *cp2;
82 	struct mbuf *mb, *mb2, *mreq;
83 	u_quad_t frev;
84 
85 	fhp = &nfh.fh_generic;
86 	nfsm_srvmtofh(fhp);
87 	if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
88 		nfsm_reply(0);
89 	nqsrv_getl(vp, NQL_READ);
90 	error = VOP_GETATTR(vp, vap, cred, nfsd->nd_procp);
91 	vput(vp);
92 	nfsm_reply(NFSX_FATTR);
93 	nfsm_build(fp, struct nfsv2_fattr *, NFSX_FATTR);
94 	nfsm_srvfillattr;
95 	nfsm_srvdone;
96 }
97 
98 /*
99  * nfs setattr service
100  */
101 nfsrv_setattr(nfsd, mrep, md, dpos, cred, nam, mrq)
102 	struct nfsd *nfsd;
103 	struct mbuf *mrep, *md;
104 	caddr_t dpos;
105 	struct ucred *cred;
106 	struct mbuf *nam, **mrq;
107 {
108 	struct vattr va;
109 	register struct vattr *vap = &va;
110 	register struct nfsv2_sattr *sp;
111 	register struct nfsv2_fattr *fp;
112 	struct vnode *vp;
113 	nfsv2fh_t nfh;
114 	fhandle_t *fhp;
115 	register u_long *tl;
116 	register long t1;
117 	caddr_t bpos;
118 	int error = 0, rdonly, cache, duration2, cache2;
119 	char *cp2;
120 	struct mbuf *mb, *mb2, *mreq;
121 	u_quad_t frev, frev2;
122 
123 	fhp = &nfh.fh_generic;
124 	nfsm_srvmtofh(fhp);
125 	nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_SATTR);
126 	if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
127 		nfsm_reply(0);
128 	nqsrv_getl(vp, NQL_WRITE);
129 	if (error = nfsrv_access(vp, VWRITE, cred, rdonly, nfsd->nd_procp))
130 		goto out;
131 	VATTR_NULL(vap);
132 	/*
133 	 * Nah nah nah nah na nah
134 	 * There is a bug in the Sun client that puts 0xffff in the mode
135 	 * field of sattr when it should put in 0xffffffff. The u_short
136 	 * doesn't sign extend.
137 	 * --> check the low order 2 bytes for 0xffff
138 	 */
139 	if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
140 		vap->va_mode = nfstov_mode(sp->sa_mode);
141 	if (sp->sa_uid != nfs_xdrneg1)
142 		vap->va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
143 	if (sp->sa_gid != nfs_xdrneg1)
144 		vap->va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
145 	if (sp->sa_size != nfs_xdrneg1)
146 		vap->va_size = fxdr_unsigned(u_long, sp->sa_size);
147 	/*
148 	 * The usec field of sa_atime is overloaded with the va_flags field
149 	 * for 4.4BSD clients. Hopefully other clients always set both the
150 	 * sec and usec fields to -1 when not setting the atime.
151 	 */
152 	if (sp->sa_atime.tv_sec != nfs_xdrneg1) {
153 		vap->va_atime.tv_sec = fxdr_unsigned(long, sp->sa_atime.tv_sec);
154 		vap->va_atime.tv_usec = 0;
155 	}
156 	if (sp->sa_atime.tv_usec != nfs_xdrneg1)
157 		vap->va_flags = fxdr_unsigned(u_long, sp->sa_atime.tv_usec);
158 	if (sp->sa_mtime.tv_sec != nfs_xdrneg1)
159 		fxdr_time(&sp->sa_mtime, &vap->va_mtime);
160 	if (error = VOP_SETATTR(vp, vap, cred, nfsd->nd_procp)) {
161 		vput(vp);
162 		nfsm_reply(0);
163 	}
164 	error = VOP_GETATTR(vp, vap, cred, nfsd->nd_procp);
165 out:
166 	vput(vp);
167 	nfsm_reply(NFSX_FATTR + 2*NFSX_UNSIGNED);
168 	nfsm_build(fp, struct nfsv2_fattr *, NFSX_FATTR);
169 	nfsm_srvfillattr;
170 	if (nfsd->nd_nqlflag != NQL_NOVAL) {
171 		nfsm_build(tl, u_long *, 2*NFSX_UNSIGNED);
172 		txdr_hyper(&frev2, tl);
173 	}
174 	nfsm_srvdone;
175 }
176 
177 /*
178  * nfs lookup rpc
179  */
180 nfsrv_lookup(nfsd, mrep, md, dpos, cred, nam, mrq)
181 	struct nfsd *nfsd;
182 	struct mbuf *mrep, *md;
183 	caddr_t dpos;
184 	struct ucred *cred;
185 	struct mbuf *nam, **mrq;
186 {
187 	register struct nfsv2_fattr *fp;
188 	struct nameidata nd;
189 	struct vnode *vp;
190 	nfsv2fh_t nfh;
191 	fhandle_t *fhp;
192 	register caddr_t cp;
193 	register u_long *tl;
194 	register long t1;
195 	caddr_t bpos;
196 	int error = 0, lflag = 0, rdonly, cache, duration2, cache2, len;
197 	char *cp2;
198 	struct mbuf *mb, *mb2, *mreq;
199 	struct vattr va, *vap = &va;
200 	u_quad_t frev, frev2;
201 
202 	fhp = &nfh.fh_generic;
203 	if (nfsd->nd_nqlflag != NQL_NOVAL) {
204 		nfsm_dissect(tl, u_long *, NFSX_UNSIGNED);
205 		if (*tl) {
206 			lflag = fxdr_unsigned(int, *tl);
207 			nfsm_dissect(tl, u_long *, NFSX_UNSIGNED);
208 			duration2 = fxdr_unsigned(int, *tl);
209 		}
210 	}
211 	nfsm_srvmtofh(fhp);
212 	nfsm_srvstrsiz(len, NFS_MAXNAMLEN);
213 	nd.ni_cred = cred;
214 	nd.ni_nameiop = LOOKUP | LOCKLEAF | SAVESTART;
215 	if (error = nfs_namei(&nd, fhp, len, nfsd->nd_slp, nam, &md, &dpos, nfsd->nd_procp))
216 		nfsm_reply(0);
217 	nqsrv_getl(nd.ni_startdir, NQL_READ);
218 	vrele(nd.ni_startdir);
219 	vp = nd.ni_vp;
220 	bzero((caddr_t)fhp, sizeof(nfh));
221 	fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
222 	if (error = VFS_VPTOFH(vp, &fhp->fh_fid)) {
223 		vput(vp);
224 		nfsm_reply(0);
225 	}
226 	if (lflag)
227 		(void) nqsrv_getlease(vp, &duration2, lflag, nfsd,
228 			nam, &cache2, &frev2, cred);
229 	error = VOP_GETATTR(vp, vap, cred, nfsd->nd_procp);
230 	vput(vp);
231 	nfsm_reply(NFSX_FH + NFSX_FATTR + 5*NFSX_UNSIGNED);
232 	if (nfsd->nd_nqlflag != NQL_NOVAL) {
233 		if (lflag) {
234 			nfsm_build(tl, u_long *, 5*NFSX_UNSIGNED);
235 			*tl++ = txdr_unsigned(lflag);
236 			*tl++ = txdr_unsigned(cache2);
237 			*tl++ = txdr_unsigned(duration2);
238 			txdr_hyper(&frev2, tl);
239 		} else {
240 			nfsm_build(tl, u_long *, NFSX_UNSIGNED);
241 			*tl = 0;
242 		}
243 	}
244 	nfsm_srvfhtom(fhp);
245 	nfsm_build(fp, struct nfsv2_fattr *, NFSX_FATTR);
246 	nfsm_srvfillattr;
247 	nfsm_srvdone;
248 }
249 
250 /*
251  * nfs readlink service
252  */
253 nfsrv_readlink(nfsd, mrep, md, dpos, cred, nam, mrq)
254 	struct nfsd *nfsd;
255 	struct mbuf *mrep, *md;
256 	caddr_t dpos;
257 	struct ucred *cred;
258 	struct mbuf *nam, **mrq;
259 {
260 	struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
261 	register struct iovec *ivp = iv;
262 	register struct mbuf *mp;
263 	register u_long *tl;
264 	register long t1;
265 	caddr_t bpos;
266 	int error = 0, rdonly, cache, i, tlen, len;
267 	char *cp2;
268 	struct mbuf *mb, *mb2, *mp2, *mp3, *mreq;
269 	struct vnode *vp;
270 	nfsv2fh_t nfh;
271 	fhandle_t *fhp;
272 	struct uio io, *uiop = &io;
273 	u_quad_t frev;
274 
275 	fhp = &nfh.fh_generic;
276 	nfsm_srvmtofh(fhp);
277 	len = 0;
278 	i = 0;
279 	while (len < NFS_MAXPATHLEN) {
280 		MGET(mp, M_WAIT, MT_DATA);
281 		MCLGET(mp, M_WAIT);
282 		mp->m_len = NFSMSIZ(mp);
283 		if (len == 0)
284 			mp3 = mp2 = mp;
285 		else {
286 			mp2->m_next = mp;
287 			mp2 = mp;
288 		}
289 		if ((len+mp->m_len) > NFS_MAXPATHLEN) {
290 			mp->m_len = NFS_MAXPATHLEN-len;
291 			len = NFS_MAXPATHLEN;
292 		} else
293 			len += mp->m_len;
294 		ivp->iov_base = mtod(mp, caddr_t);
295 		ivp->iov_len = mp->m_len;
296 		i++;
297 		ivp++;
298 	}
299 	uiop->uio_iov = iv;
300 	uiop->uio_iovcnt = i;
301 	uiop->uio_offset = 0;
302 	uiop->uio_resid = len;
303 	uiop->uio_rw = UIO_READ;
304 	uiop->uio_segflg = UIO_SYSSPACE;
305 	uiop->uio_procp = (struct proc *)0;
306 	if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly)) {
307 		m_freem(mp3);
308 		nfsm_reply(0);
309 	}
310 	if (vp->v_type != VLNK) {
311 		error = EINVAL;
312 		goto out;
313 	}
314 	nqsrv_getl(vp, NQL_READ);
315 	error = VOP_READLINK(vp, uiop, cred);
316 out:
317 	vput(vp);
318 	if (error)
319 		m_freem(mp3);
320 	nfsm_reply(NFSX_UNSIGNED);
321 	if (uiop->uio_resid > 0) {
322 		len -= uiop->uio_resid;
323 		tlen = nfsm_rndup(len);
324 		nfsm_adj(mp3, NFS_MAXPATHLEN-tlen, tlen-len);
325 	}
326 	nfsm_build(tl, u_long *, NFSX_UNSIGNED);
327 	*tl = txdr_unsigned(len);
328 	mb->m_next = mp3;
329 	nfsm_srvdone;
330 }
331 
332 /*
333  * nfs read service
334  */
335 nfsrv_read(nfsd, mrep, md, dpos, cred, nam, mrq)
336 	struct nfsd *nfsd;
337 	struct mbuf *mrep, *md;
338 	caddr_t dpos;
339 	struct ucred *cred;
340 	struct mbuf *nam, **mrq;
341 {
342 	register struct iovec *iv;
343 	struct iovec *iv2;
344 	register struct mbuf *m;
345 	register struct nfsv2_fattr *fp;
346 	register u_long *tl;
347 	register long t1;
348 	caddr_t bpos;
349 	int error = 0, rdonly, cache, i, cnt, len, left, siz, tlen;
350 	char *cp2;
351 	struct mbuf *mb, *mb2, *mreq;
352 	struct mbuf *m2;
353 	struct vnode *vp;
354 	nfsv2fh_t nfh;
355 	fhandle_t *fhp;
356 	struct uio io, *uiop = &io;
357 	struct vattr va, *vap = &va;
358 	off_t off;
359 	u_quad_t frev;
360 
361 	fhp = &nfh.fh_generic;
362 	nfsm_srvmtofh(fhp);
363 	nfsm_dissect(tl, u_long *, NFSX_UNSIGNED);
364 	off = fxdr_unsigned(off_t, *tl);
365 	nfsm_srvstrsiz(cnt, NFS_MAXDATA);
366 	if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
367 		nfsm_reply(0);
368 	nqsrv_getl(vp, NQL_READ);
369 	if (error = nfsrv_access(vp, VREAD | VEXEC, cred, rdonly, nfsd->nd_procp)) {
370 		vput(vp);
371 		nfsm_reply(0);
372 	}
373 	if (error = VOP_GETATTR(vp, vap, cred, nfsd->nd_procp)) {
374 		vput(vp);
375 		nfsm_reply(0);
376 	}
377 	if (off >= vap->va_size)
378 		cnt = 0;
379 	else if ((off + cnt) > vap->va_size)
380 		cnt = nfsm_rndup(vap->va_size - off);
381 	nfsm_reply(NFSX_FATTR+NFSX_UNSIGNED+nfsm_rndup(cnt));
382 	nfsm_build(fp, struct nfsv2_fattr *, NFSX_FATTR);
383 	nfsm_build(tl, u_long *, NFSX_UNSIGNED);
384 	len = left = cnt;
385 	if (cnt > 0) {
386 		/*
387 		 * Generate the mbuf list with the uio_iov ref. to it.
388 		 */
389 		i = 0;
390 		m = m2 = mb;
391 		MALLOC(iv, struct iovec *,
392 		       ((NFS_MAXDATA+MLEN-1)/MLEN) * sizeof (struct iovec),
393 		       M_TEMP, M_WAITOK);
394 		iv2 = iv;
395 		while (left > 0) {
396 			siz = MIN(M_TRAILINGSPACE(m), left);
397 			if (siz > 0) {
398 				m->m_len += siz;
399 				iv->iov_base = bpos;
400 				iv->iov_len = siz;
401 				iv++;
402 				i++;
403 				left -= siz;
404 			}
405 			if (left > 0) {
406 				MGET(m, M_WAIT, MT_DATA);
407 				MCLGET(m, M_WAIT);
408 				m->m_len = 0;
409 				m2->m_next = m;
410 				m2 = m;
411 				bpos = mtod(m, caddr_t);
412 			}
413 		}
414 		uiop->uio_iov = iv2;
415 		uiop->uio_iovcnt = i;
416 		uiop->uio_offset = off;
417 		uiop->uio_resid = cnt;
418 		uiop->uio_rw = UIO_READ;
419 		uiop->uio_segflg = UIO_SYSSPACE;
420 		error = VOP_READ(vp, uiop, IO_NODELOCKED, cred);
421 		off = uiop->uio_offset;
422 		FREE((caddr_t)iv2, M_TEMP);
423 		if (error || (error = VOP_GETATTR(vp, vap, cred, nfsd->nd_procp))) {
424 			m_freem(mreq);
425 			vput(vp);
426 			nfsm_reply(0);
427 		}
428 	} else
429 		uiop->uio_resid = 0;
430 	vput(vp);
431 	nfsm_srvfillattr;
432 	len -= uiop->uio_resid;
433 	tlen = nfsm_rndup(len);
434 	if (cnt != tlen || tlen != len)
435 		nfsm_adj(mb, cnt-tlen, tlen-len);
436 	*tl = txdr_unsigned(len);
437 	nfsm_srvdone;
438 }
439 
440 /*
441  * nfs write service
442  */
443 nfsrv_write(nfsd, mrep, md, dpos, cred, nam, mrq)
444 	struct nfsd *nfsd;
445 	struct mbuf *mrep, *md;
446 	caddr_t dpos;
447 	struct ucred *cred;
448 	struct mbuf *nam, **mrq;
449 {
450 	register struct iovec *ivp;
451 	register struct mbuf *mp;
452 	register struct nfsv2_fattr *fp;
453 	struct iovec iv[NFS_MAXIOVEC];
454 	struct vattr va;
455 	register struct vattr *vap = &va;
456 	register u_long *tl;
457 	register long t1;
458 	caddr_t bpos;
459 	int error = 0, rdonly, cache, siz, len, xfer;
460 	char *cp2;
461 	struct mbuf *mb, *mb2, *mreq;
462 	struct vnode *vp;
463 	nfsv2fh_t nfh;
464 	fhandle_t *fhp;
465 	struct uio io, *uiop = &io;
466 	off_t off;
467 	u_quad_t frev;
468 
469 	fhp = &nfh.fh_generic;
470 	nfsm_srvmtofh(fhp);
471 	nfsm_dissect(tl, u_long *, 4*NFSX_UNSIGNED);
472 	off = fxdr_unsigned(off_t, *++tl);
473 	tl += 2;
474 	len = fxdr_unsigned(long, *tl);
475 	if (len > NFS_MAXDATA || len <= 0) {
476 		error = EBADRPC;
477 		nfsm_reply(0);
478 	}
479 	if (dpos == (mtod(md, caddr_t)+md->m_len)) {
480 		mp = md->m_next;
481 		if (mp == NULL) {
482 			error = EBADRPC;
483 			nfsm_reply(0);
484 		}
485 	} else {
486 		mp = md;
487 		siz = dpos-mtod(mp, caddr_t);
488 		mp->m_len -= siz;
489 		NFSMADV(mp, siz);
490 	}
491 	if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
492 		nfsm_reply(0);
493 	nqsrv_getl(vp, NQL_WRITE);
494 	if (error = nfsrv_access(vp, VWRITE, cred, rdonly, nfsd->nd_procp)) {
495 		vput(vp);
496 		nfsm_reply(0);
497 	}
498 	uiop->uio_resid = 0;
499 	uiop->uio_rw = UIO_WRITE;
500 	uiop->uio_segflg = UIO_SYSSPACE;
501 	uiop->uio_procp = (struct proc *)0;
502 	/*
503 	 * Do up to NFS_MAXIOVEC mbufs of write each iteration of the
504 	 * loop until done.
505 	 */
506 	while (len > 0 && uiop->uio_resid == 0) {
507 		ivp = iv;
508 		siz = 0;
509 		uiop->uio_iov = ivp;
510 		uiop->uio_iovcnt = 0;
511 		uiop->uio_offset = off;
512 		while (len > 0 && uiop->uio_iovcnt < NFS_MAXIOVEC && mp != NULL) {
513 			ivp->iov_base = mtod(mp, caddr_t);
514 			if (len < mp->m_len)
515 				ivp->iov_len = xfer = len;
516 			else
517 				ivp->iov_len = xfer = mp->m_len;
518 #ifdef notdef
519 			/* Not Yet .. */
520 			if (M_HASCL(mp) && (((u_long)ivp->iov_base) & CLOFSET) == 0)
521 				ivp->iov_op = NULL;	/* what should it be ?? */
522 			else
523 				ivp->iov_op = NULL;
524 #endif
525 			uiop->uio_iovcnt++;
526 			ivp++;
527 			len -= xfer;
528 			siz += xfer;
529 			mp = mp->m_next;
530 		}
531 		if (len > 0 && mp == NULL) {
532 			error = EBADRPC;
533 			vput(vp);
534 			nfsm_reply(0);
535 		}
536 		uiop->uio_resid = siz;
537 		if (error = VOP_WRITE(vp, uiop, IO_SYNC | IO_NODELOCKED,
538 			cred)) {
539 			vput(vp);
540 			nfsm_reply(0);
541 		}
542 		off = uiop->uio_offset;
543 	}
544 	error = VOP_GETATTR(vp, vap, cred, nfsd->nd_procp);
545 	vput(vp);
546 	nfsm_reply(NFSX_FATTR);
547 	nfsm_build(fp, struct nfsv2_fattr *, NFSX_FATTR);
548 	nfsm_srvfillattr;
549 	nfsm_srvdone;
550 }
551 
552 /*
553  * nfs create service
554  * now does a truncate to 0 length via. setattr if it already exists
555  */
556 nfsrv_create(nfsd, mrep, md, dpos, cred, nam, mrq)
557 	struct nfsd *nfsd;
558 	struct mbuf *mrep, *md;
559 	caddr_t dpos;
560 	struct ucred *cred;
561 	struct mbuf *nam, **mrq;
562 {
563 	register struct nfsv2_fattr *fp;
564 	struct vattr va;
565 	register struct vattr *vap = &va;
566 	struct nameidata nd;
567 	register caddr_t cp;
568 	register u_long *tl;
569 	register long t1;
570 	caddr_t bpos;
571 	int error = 0, rdev, cache, len;
572 	char *cp2;
573 	struct mbuf *mb, *mb2, *mreq;
574 	struct vnode *vp;
575 	nfsv2fh_t nfh;
576 	fhandle_t *fhp;
577 	u_quad_t frev;
578 
579 	nd.ni_nameiop = 0;
580 	fhp = &nfh.fh_generic;
581 	nfsm_srvmtofh(fhp);
582 	nfsm_srvstrsiz(len, NFS_MAXNAMLEN);
583 	nd.ni_cred = cred;
584 	nd.ni_nameiop = CREATE | LOCKPARENT | LOCKLEAF | SAVESTART;
585 	if (error = nfs_namei(&nd, fhp, len, nfsd->nd_slp, nam, &md, &dpos, nfsd->nd_procp))
586 		nfsm_reply(0);
587 	VATTR_NULL(vap);
588 	nfsm_dissect(tl, u_long *, NFSX_SATTR);
589 	/*
590 	 * Iff doesn't exist, create it
591 	 * otherwise just truncate to 0 length
592 	 *   should I set the mode too ??
593 	 */
594 	if (nd.ni_vp == NULL) {
595 		vap->va_type = IFTOVT(fxdr_unsigned(u_long, *tl));
596 		if (vap->va_type == VNON)
597 			vap->va_type = VREG;
598 		vap->va_mode = nfstov_mode(*tl);
599 		rdev = fxdr_unsigned(long, *(tl+3));
600 		if (vap->va_type == VREG || vap->va_type == VSOCK) {
601 			vrele(nd.ni_startdir);
602 			nqsrv_getl(nd.ni_dvp, NQL_WRITE);
603 			if (error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap))
604 				nfsm_reply(0);
605 			FREE(nd.ni_pnbuf, M_NAMEI);
606 		} else if (vap->va_type == VCHR || vap->va_type == VBLK ||
607 			vap->va_type == VFIFO) {
608 			if (vap->va_type == VCHR && rdev == 0xffffffff)
609 				vap->va_type = VFIFO;
610 			if (vap->va_type == VFIFO) {
611 #ifndef FIFO
612 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
613 				vput(nd.ni_dvp);
614 				error = ENXIO;
615 				goto out;
616 #endif /* FIFO */
617 			} else if (error = suser(cred, (u_short *)0)) {
618 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
619 				vput(nd.ni_dvp);
620 				goto out;
621 			} else
622 				vap->va_rdev = (dev_t)rdev;
623 			nqsrv_getl(nd.ni_dvp, NQL_WRITE);
624 			if (error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap)) {
625 				vrele(nd.ni_startdir);
626 				nfsm_reply(0);
627 			}
628 			nd.ni_nameiop &= ~(OPMASK | LOCKPARENT | SAVESTART);
629 			nd.ni_nameiop |= LOOKUP;
630 			if (error = lookup(&nd, nfsd->nd_procp)) {
631 				free(nd.ni_pnbuf, M_NAMEI);
632 				nfsm_reply(0);
633 			}
634 			FREE(nd.ni_pnbuf, M_NAMEI);
635 			if (nd.ni_nameiop & ISSYMLINK) {
636 				vrele(nd.ni_dvp);
637 				vput(nd.ni_vp);
638 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
639 				error = EINVAL;
640 				nfsm_reply(0);
641 			}
642 		} else {
643 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
644 			vput(nd.ni_dvp);
645 			error = ENXIO;
646 			goto out;
647 		}
648 		vp = nd.ni_vp;
649 	} else {
650 		vrele(nd.ni_startdir);
651 		free(nd.ni_pnbuf, M_NAMEI);
652 		vp = nd.ni_vp;
653 		if (nd.ni_dvp == vp)
654 			vrele(nd.ni_dvp);
655 		else
656 			vput(nd.ni_dvp);
657 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
658 		vap->va_size = 0;
659 		nqsrv_getl(vp, NQL_WRITE);
660 		if (error = VOP_SETATTR(vp, vap, cred, nfsd->nd_procp)) {
661 			vput(vp);
662 			nfsm_reply(0);
663 		}
664 	}
665 	bzero((caddr_t)fhp, sizeof(nfh));
666 	fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
667 	if (error = VFS_VPTOFH(vp, &fhp->fh_fid)) {
668 		vput(vp);
669 		nfsm_reply(0);
670 	}
671 	error = VOP_GETATTR(vp, vap, cred, nfsd->nd_procp);
672 	vput(vp);
673 	nfsm_reply(NFSX_FH+NFSX_FATTR);
674 	nfsm_srvfhtom(fhp);
675 	nfsm_build(fp, struct nfsv2_fattr *, NFSX_FATTR);
676 	nfsm_srvfillattr;
677 	return (error);
678 nfsmout:
679 	if (nd.ni_nameiop)
680 		vrele(nd.ni_startdir);
681 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
682 	if (nd.ni_dvp == nd.ni_vp)
683 		vrele(nd.ni_dvp);
684 	else
685 		vput(nd.ni_dvp);
686 	if (nd.ni_vp)
687 		vput(nd.ni_vp);
688 	return (error);
689 
690 out:
691 	vrele(nd.ni_startdir);
692 	free(nd.ni_pnbuf, M_NAMEI);
693 	nfsm_reply(0);
694 }
695 
696 /*
697  * nfs remove service
698  */
699 nfsrv_remove(nfsd, mrep, md, dpos, cred, nam, mrq)
700 	struct nfsd *nfsd;
701 	struct mbuf *mrep, *md;
702 	caddr_t dpos;
703 	struct ucred *cred;
704 	struct mbuf *nam, **mrq;
705 {
706 	struct nameidata nd;
707 	register u_long *tl;
708 	register long t1;
709 	caddr_t bpos;
710 	int error = 0, cache, len;
711 	char *cp2;
712 	struct mbuf *mb, *mreq;
713 	struct vnode *vp;
714 	nfsv2fh_t nfh;
715 	fhandle_t *fhp;
716 	u_quad_t frev;
717 
718 	fhp = &nfh.fh_generic;
719 	nfsm_srvmtofh(fhp);
720 	nfsm_srvstrsiz(len, NFS_MAXNAMLEN);
721 	nd.ni_cred = cred;
722 	nd.ni_nameiop = DELETE | LOCKPARENT | LOCKLEAF;
723 	if (error = nfs_namei(&nd, fhp, len, nfsd->nd_slp, nam, &md, &dpos, nfsd->nd_procp))
724 		nfsm_reply(0);
725 	vp = nd.ni_vp;
726 	if (vp->v_type == VDIR &&
727 		(error = suser(cred, (u_short *)0)))
728 		goto out;
729 	/*
730 	 * The root of a mounted filesystem cannot be deleted.
731 	 */
732 	if (vp->v_flag & VROOT) {
733 		error = EBUSY;
734 		goto out;
735 	}
736 	if (vp->v_flag & VTEXT)
737 		(void) vnode_pager_uncache(vp);
738 out:
739 	if (!error) {
740 		nqsrv_getl(nd.ni_dvp, NQL_WRITE);
741 		nqsrv_getl(vp, NQL_WRITE);
742 		error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
743 	} else {
744 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
745 		if (nd.ni_dvp == vp)
746 			vrele(nd.ni_dvp);
747 		else
748 			vput(nd.ni_dvp);
749 		vput(vp);
750 	}
751 	nfsm_reply(0);
752 	nfsm_srvdone;
753 }
754 
755 /*
756  * nfs rename service
757  */
758 nfsrv_rename(nfsd, mrep, md, dpos, cred, nam, mrq)
759 	struct nfsd *nfsd;
760 	struct mbuf *mrep, *md;
761 	caddr_t dpos;
762 	struct ucred *cred;
763 	struct mbuf *nam, **mrq;
764 {
765 	register u_long *tl;
766 	register long t1;
767 	caddr_t bpos;
768 	int error = 0, rdonly, cache, len, len2;
769 	char *cp2;
770 	struct mbuf *mb, *mreq;
771 	struct nameidata fromnd, tond;
772 	struct vnode *fvp, *tvp, *tdvp;
773 	nfsv2fh_t fnfh, tnfh;
774 	fhandle_t *ffhp, *tfhp;
775 	u_quad_t frev;
776 	uid_t saved_uid;
777 
778 	ffhp = &fnfh.fh_generic;
779 	tfhp = &tnfh.fh_generic;
780 	fromnd.ni_nameiop = 0;
781 	tond.ni_nameiop = 0;
782 	nfsm_srvmtofh(ffhp);
783 	nfsm_srvstrsiz(len, NFS_MAXNAMLEN);
784 	/*
785 	 * Remember our original uid so that we can reset cr_uid before
786 	 * the second nfs_namei() call, in case it is remapped.
787 	 */
788 	saved_uid = cred->cr_uid;
789 	fromnd.ni_cred = cred;
790 	fromnd.ni_nameiop = DELETE | WANTPARENT | SAVESTART;
791 	if (error = nfs_namei(&fromnd, ffhp, len, nfsd->nd_slp, nam, &md, &dpos, nfsd->nd_procp))
792 		nfsm_reply(0);
793 	fvp = fromnd.ni_vp;
794 	nfsm_srvmtofh(tfhp);
795 	nfsm_strsiz(len2, NFS_MAXNAMLEN);
796 	cred->cr_uid = saved_uid;
797 	tond.ni_cred = cred;
798 	tond.ni_nameiop = RENAME | LOCKPARENT | LOCKLEAF | NOCACHE
799 		| SAVESTART;
800 	if (error = nfs_namei(&tond, tfhp, len2, nfsd->nd_slp, nam, &md, &dpos, nfsd->nd_procp)) {
801 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
802 		vrele(fromnd.ni_dvp);
803 		vrele(fvp);
804 		goto out1;
805 	}
806 	tdvp = tond.ni_dvp;
807 	tvp = tond.ni_vp;
808 	if (tvp != NULL) {
809 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
810 			error = EISDIR;
811 			goto out;
812 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
813 			error = ENOTDIR;
814 			goto out;
815 		}
816 		if (tvp->v_type == VDIR && tvp->v_mountedhere) {
817 			error = EXDEV;
818 			goto out;
819 		}
820 	}
821 	if (fvp->v_type == VDIR && fvp->v_mountedhere) {
822 		error = EBUSY;
823 		goto out;
824 	}
825 	if (fvp->v_mount != tdvp->v_mount) {
826 		error = EXDEV;
827 		goto out;
828 	}
829 	if (fvp == tdvp)
830 		error = EINVAL;
831 	/*
832 	 * If source is the same as the destination (that is the
833 	 * same vnode with the same name in the same directory),
834 	 * then there is nothing to do.
835 	 */
836 	if (fvp == tvp && fromnd.ni_dvp == tdvp &&
837 	    fromnd.ni_namelen == tond.ni_namelen &&
838 	    !bcmp(fromnd.ni_ptr, tond.ni_ptr, fromnd.ni_namelen))
839 		error = -1;
840 out:
841 	if (!error) {
842 		nqsrv_getl(fromnd.ni_dvp, NQL_WRITE);
843 		nqsrv_getl(tdvp, NQL_WRITE);
844 		if (tvp)
845 			nqsrv_getl(tvp, NQL_WRITE);
846 		error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
847 				   tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
848 	} else {
849 		VOP_ABORTOP(tond.ni_dvp, &tond.ni_cnd);
850 		if (tdvp == tvp)
851 			vrele(tdvp);
852 		else
853 			vput(tdvp);
854 		if (tvp)
855 			vput(tvp);
856 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
857 		vrele(fromnd.ni_dvp);
858 		vrele(fvp);
859 	}
860 	vrele(tond.ni_startdir);
861 	FREE(tond.ni_pnbuf, M_NAMEI);
862 out1:
863 	vrele(fromnd.ni_startdir);
864 	FREE(fromnd.ni_pnbuf, M_NAMEI);
865 	nfsm_reply(0);
866 	return (error);
867 
868 nfsmout:
869 	if (tond.ni_nameiop) {
870 		vrele(tond.ni_startdir);
871 		FREE(tond.ni_pnbuf, M_NAMEI);
872 	}
873 	if (fromnd.ni_nameiop) {
874 		vrele(fromnd.ni_startdir);
875 		FREE(fromnd.ni_pnbuf, M_NAMEI);
876 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
877 		vrele(fromnd.ni_dvp);
878 		vrele(fvp);
879 	}
880 	return (error);
881 }
882 
883 /*
884  * nfs link service
885  */
886 nfsrv_link(nfsd, mrep, md, dpos, cred, nam, mrq)
887 	struct nfsd *nfsd;
888 	struct mbuf *mrep, *md;
889 	caddr_t dpos;
890 	struct ucred *cred;
891 	struct mbuf *nam, **mrq;
892 {
893 	struct nameidata nd;
894 	register u_long *tl;
895 	register long t1;
896 	caddr_t bpos;
897 	int error = 0, rdonly, cache, len;
898 	char *cp2;
899 	struct mbuf *mb, *mreq;
900 	struct vnode *vp, *xp;
901 	nfsv2fh_t nfh, dnfh;
902 	fhandle_t *fhp, *dfhp;
903 	u_quad_t frev;
904 
905 	fhp = &nfh.fh_generic;
906 	dfhp = &dnfh.fh_generic;
907 	nfsm_srvmtofh(fhp);
908 	nfsm_srvmtofh(dfhp);
909 	nfsm_srvstrsiz(len, NFS_MAXNAMLEN);
910 	if (error = nfsrv_fhtovp(fhp, FALSE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
911 		nfsm_reply(0);
912 	if (vp->v_type == VDIR && (error = suser(cred, (u_short *)0)))
913 		goto out1;
914 	nd.ni_cred = cred;
915 	nd.ni_nameiop = CREATE | LOCKPARENT;
916 	if (error = nfs_namei(&nd, dfhp, len, nfsd->nd_slp, nam, &md, &dpos, nfsd->nd_procp))
917 		goto out1;
918 	xp = nd.ni_vp;
919 	if (xp != NULL) {
920 		error = EEXIST;
921 		goto out;
922 	}
923 	xp = nd.ni_dvp;
924 	if (vp->v_mount != xp->v_mount)
925 		error = EXDEV;
926 out:
927 	if (!error) {
928 		nqsrv_getl(vp, NQL_WRITE);
929 		nqsrv_getl(xp, NQL_WRITE);
930 		error = VOP_LINK(vp, nd.ni_dvp, &nd.ni_cnd);
931 	} else {
932 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
933 		if (nd.ni_dvp == nd.ni_vp)
934 			vrele(nd.ni_dvp);
935 		else
936 			vput(nd.ni_dvp);
937 		if (nd.ni_vp)
938 			vrele(nd.ni_vp);
939 	}
940 out1:
941 	vrele(vp);
942 	nfsm_reply(0);
943 	nfsm_srvdone;
944 }
945 
946 /*
947  * nfs symbolic link service
948  */
949 nfsrv_symlink(nfsd, mrep, md, dpos, cred, nam, mrq)
950 	struct nfsd *nfsd;
951 	struct mbuf *mrep, *md;
952 	caddr_t dpos;
953 	struct ucred *cred;
954 	struct mbuf *nam, **mrq;
955 {
956 	struct vattr va;
957 	struct nameidata nd;
958 	register struct vattr *vap = &va;
959 	register u_long *tl;
960 	register long t1;
961 	struct nfsv2_sattr *sp;
962 	caddr_t bpos;
963 	struct uio io;
964 	struct iovec iv;
965 	int error = 0, rdonly, cache, len, len2;
966 	char *pathcp, *cp2;
967 	struct mbuf *mb, *mreq;
968 	nfsv2fh_t nfh;
969 	fhandle_t *fhp;
970 	u_quad_t frev;
971 
972 	pathcp = (char *)0;
973 	fhp = &nfh.fh_generic;
974 	nfsm_srvmtofh(fhp);
975 	nfsm_srvstrsiz(len, NFS_MAXNAMLEN);
976 	nd.ni_cred = cred;
977 	nd.ni_nameiop = CREATE | LOCKPARENT;
978 	if (error = nfs_namei(&nd, fhp, len, nfsd->nd_slp, nam, &md, &dpos, nfsd->nd_procp))
979 		goto out;
980 	nfsm_strsiz(len2, NFS_MAXPATHLEN);
981 	MALLOC(pathcp, caddr_t, len2 + 1, M_TEMP, M_WAITOK);
982 	iv.iov_base = pathcp;
983 	iv.iov_len = len2;
984 	io.uio_resid = len2;
985 	io.uio_offset = 0;
986 	io.uio_iov = &iv;
987 	io.uio_iovcnt = 1;
988 	io.uio_segflg = UIO_SYSSPACE;
989 	io.uio_rw = UIO_READ;
990 	io.uio_procp = (struct proc *)0;
991 	nfsm_mtouio(&io, len2);
992 	nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_SATTR);
993 	*(pathcp + len2) = '\0';
994 	if (nd.ni_vp) {
995 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
996 		if (nd.ni_dvp == nd.ni_vp)
997 			vrele(nd.ni_dvp);
998 		else
999 			vput(nd.ni_dvp);
1000 		vrele(nd.ni_vp);
1001 		error = EEXIST;
1002 		goto out;
1003 	}
1004 	VATTR_NULL(vap);
1005 	vap->va_mode = fxdr_unsigned(u_short, sp->sa_mode);
1006 	nqsrv_getl(nd.ni_dvp, NQL_WRITE);
1007 	error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap, pathcp);
1008 out:
1009 	if (pathcp)
1010 		FREE(pathcp, M_TEMP);
1011 	nfsm_reply(0);
1012 	return (error);
1013 nfsmout:
1014 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1015 	if (nd.ni_dvp == nd.ni_vp)
1016 		vrele(nd.ni_dvp);
1017 	else
1018 		vput(nd.ni_dvp);
1019 	if (nd.ni_vp)
1020 		vrele(nd.ni_vp);
1021 	if (pathcp)
1022 		FREE(pathcp, M_TEMP);
1023 	return (error);
1024 }
1025 
1026 /*
1027  * nfs mkdir service
1028  */
1029 nfsrv_mkdir(nfsd, mrep, md, dpos, cred, nam, mrq)
1030 	struct nfsd *nfsd;
1031 	struct mbuf *mrep, *md;
1032 	caddr_t dpos;
1033 	struct ucred *cred;
1034 	struct mbuf *nam, **mrq;
1035 {
1036 	struct vattr va;
1037 	register struct vattr *vap = &va;
1038 	register struct nfsv2_fattr *fp;
1039 	struct nameidata nd;
1040 	register caddr_t cp;
1041 	register u_long *tl;
1042 	register long t1;
1043 	caddr_t bpos;
1044 	int error = 0, rdonly, cache, len;
1045 	char *cp2;
1046 	struct mbuf *mb, *mb2, *mreq;
1047 	struct vnode *vp;
1048 	nfsv2fh_t nfh;
1049 	fhandle_t *fhp;
1050 	u_quad_t frev;
1051 
1052 	fhp = &nfh.fh_generic;
1053 	nfsm_srvmtofh(fhp);
1054 	nfsm_srvstrsiz(len, NFS_MAXNAMLEN);
1055 	nd.ni_cred = cred;
1056 	nd.ni_nameiop = CREATE | LOCKPARENT;
1057 	if (error = nfs_namei(&nd, fhp, len, nfsd->nd_slp, nam, &md, &dpos, nfsd->nd_procp))
1058 		nfsm_reply(0);
1059 	nfsm_dissect(tl, u_long *, NFSX_UNSIGNED);
1060 	VATTR_NULL(vap);
1061 	vap->va_type = VDIR;
1062 	vap->va_mode = nfstov_mode(*tl++);
1063 	vp = nd.ni_vp;
1064 	if (vp != NULL) {
1065 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1066 		if (nd.ni_dvp == vp)
1067 			vrele(nd.ni_dvp);
1068 		else
1069 			vput(nd.ni_dvp);
1070 		vrele(vp);
1071 		error = EEXIST;
1072 		nfsm_reply(0);
1073 	}
1074 	nqsrv_getl(nd.ni_dvp, NQL_WRITE);
1075 	if (error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, vap))
1076 		nfsm_reply(0);
1077 	vp = nd.ni_vp;
1078 	bzero((caddr_t)fhp, sizeof(nfh));
1079 	fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
1080 	if (error = VFS_VPTOFH(vp, &fhp->fh_fid)) {
1081 		vput(vp);
1082 		nfsm_reply(0);
1083 	}
1084 	error = VOP_GETATTR(vp, vap, cred, nfsd->nd_procp);
1085 	vput(vp);
1086 	nfsm_reply(NFSX_FH+NFSX_FATTR);
1087 	nfsm_srvfhtom(fhp);
1088 	nfsm_build(fp, struct nfsv2_fattr *, NFSX_FATTR);
1089 	nfsm_srvfillattr;
1090 	return (error);
1091 nfsmout:
1092 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1093 	if (nd.ni_dvp == nd.ni_vp)
1094 		vrele(nd.ni_dvp);
1095 	else
1096 		vput(nd.ni_dvp);
1097 	if (nd.ni_vp)
1098 		vrele(nd.ni_vp);
1099 	return (error);
1100 }
1101 
1102 /*
1103  * nfs rmdir service
1104  */
1105 nfsrv_rmdir(nfsd, mrep, md, dpos, cred, nam, mrq)
1106 	struct nfsd *nfsd;
1107 	struct mbuf *mrep, *md;
1108 	caddr_t dpos;
1109 	struct ucred *cred;
1110 	struct mbuf *nam, **mrq;
1111 {
1112 	register u_long *tl;
1113 	register long t1;
1114 	caddr_t bpos;
1115 	int error = 0, rdonly, cache, len;
1116 	char *cp2;
1117 	struct mbuf *mb, *mreq;
1118 	struct vnode *vp;
1119 	nfsv2fh_t nfh;
1120 	fhandle_t *fhp;
1121 	struct nameidata nd;
1122 	u_quad_t frev;
1123 
1124 	fhp = &nfh.fh_generic;
1125 	nfsm_srvmtofh(fhp);
1126 	nfsm_srvstrsiz(len, NFS_MAXNAMLEN);
1127 	nd.ni_cred = cred;
1128 	nd.ni_nameiop = DELETE | LOCKPARENT | LOCKLEAF;
1129 	if (error = nfs_namei(&nd, fhp, len, nfsd->nd_slp, nam, &md, &dpos, nfsd->nd_procp))
1130 		nfsm_reply(0);
1131 	vp = nd.ni_vp;
1132 	if (vp->v_type != VDIR) {
1133 		error = ENOTDIR;
1134 		goto out;
1135 	}
1136 	/*
1137 	 * No rmdir "." please.
1138 	 */
1139 	if (nd.ni_dvp == vp) {
1140 		error = EINVAL;
1141 		goto out;
1142 	}
1143 	/*
1144 	 * The root of a mounted filesystem cannot be deleted.
1145 	 */
1146 	if (vp->v_flag & VROOT)
1147 		error = EBUSY;
1148 out:
1149 	if (!error) {
1150 		nqsrv_getl(nd.ni_dvp, NQL_WRITE);
1151 		nqsrv_getl(vp, NQL_WRITE);
1152 		error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1153 	} else {
1154 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1155 		if (nd.ni_dvp == nd.ni_vp)
1156 			vrele(nd.ni_dvp);
1157 		else
1158 			vput(nd.ni_dvp);
1159 		vput(vp);
1160 	}
1161 	nfsm_reply(0);
1162 	nfsm_srvdone;
1163 }
1164 
1165 /*
1166  * nfs readdir service
1167  * - mallocs what it thinks is enough to read
1168  *	count rounded up to a multiple of NFS_DIRBLKSIZ <= NFS_MAXREADDIR
1169  * - calls VOP_READDIR()
1170  * - loops around building the reply
1171  *	if the output generated exceeds count break out of loop
1172  *	The nfsm_clget macro is used here so that the reply will be packed
1173  *	tightly in mbuf clusters.
1174  * - it only knows that it has encountered eof when the VOP_READDIR()
1175  *	reads nothing
1176  * - as such one readdir rpc will return eof false although you are there
1177  *	and then the next will return eof
1178  * - it trims out records with d_ino == 0
1179  *	this doesn't matter for Unix clients, but they might confuse clients
1180  *	for other os'.
1181  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
1182  *	than requested, but this may not apply to all filesystems. For
1183  *	example, client NFS does not { although it is never remote mounted
1184  *	anyhow }
1185  *     The alternate call nqnfsrv_readdirlook() does lookups as well.
1186  * PS: The NFS protocol spec. does not clarify what the "count" byte
1187  *	argument is a count of.. just name strings and file id's or the
1188  *	entire reply rpc or ...
1189  *	I tried just file name and id sizes and it confused the Sun client,
1190  *	so I am using the full rpc size now. The "paranoia.." comment refers
1191  *	to including the status longwords that are not a part of the dir.
1192  *	"entry" structures, but are in the rpc.
1193  */
1194 struct flrep {
1195 	u_long fl_cachable;
1196 	u_long fl_duration;
1197 	u_quad_t fl_frev;
1198 	nfsv2fh_t fl_nfh;
1199 	struct nfsv2_fattr fl_fattr;
1200 };
1201 
1202 nfsrv_readdir(nfsd, mrep, md, dpos, cred, nam, mrq)
1203 	struct nfsd *nfsd;
1204 	struct mbuf *mrep, *md;
1205 	caddr_t dpos;
1206 	struct ucred *cred;
1207 	struct mbuf *nam, **mrq;
1208 {
1209 	register char *bp, *be;
1210 	register struct mbuf *mp;
1211 	register struct direct *dp;
1212 	register caddr_t cp;
1213 	register u_long *tl;
1214 	register long t1;
1215 	caddr_t bpos;
1216 	struct mbuf *mb, *mb2, *mreq, *mp2;
1217 	char *cpos, *cend, *cp2, *rbuf;
1218 	struct vnode *vp;
1219 	nfsv2fh_t nfh;
1220 	fhandle_t *fhp;
1221 	struct uio io;
1222 	struct iovec iv;
1223 	struct vattr va;
1224 	int len, nlen, rem, xfer, tsiz, i, error = 0;
1225 	int siz, cnt, fullsiz, eofflag, rdonly, cache;
1226 	u_quad_t frev;
1227 	u_long on;
1228 	off_t off, toff;
1229 
1230 	fhp = &nfh.fh_generic;
1231 	nfsm_srvmtofh(fhp);
1232 	nfsm_dissect(tl, u_long *, 2*NFSX_UNSIGNED);
1233 	toff = fxdr_unsigned(off_t, *tl++);
1234 	off = (toff & ~(NFS_DIRBLKSIZ-1));
1235 	on = (toff & (NFS_DIRBLKSIZ-1));
1236 	cnt = fxdr_unsigned(int, *tl);
1237 	siz = ((cnt+NFS_DIRBLKSIZ-1) & ~(NFS_DIRBLKSIZ-1));
1238 	if (cnt > NFS_MAXREADDIR)
1239 		siz = NFS_MAXREADDIR;
1240 	fullsiz = siz;
1241 	if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
1242 		nfsm_reply(0);
1243 	nqsrv_getl(vp, NQL_READ);
1244 	if (error = nfsrv_access(vp, VEXEC, cred, rdonly, nfsd->nd_procp)) {
1245 		vput(vp);
1246 		nfsm_reply(0);
1247 	}
1248 	VOP_UNLOCK(vp);
1249 	MALLOC(rbuf, caddr_t, siz, M_TEMP, M_WAITOK);
1250 again:
1251 	iv.iov_base = rbuf;
1252 	iv.iov_len = fullsiz;
1253 	io.uio_iov = &iv;
1254 	io.uio_iovcnt = 1;
1255 	io.uio_offset = off;
1256 	io.uio_resid = fullsiz;
1257 	io.uio_segflg = UIO_SYSSPACE;
1258 	io.uio_rw = UIO_READ;
1259 	io.uio_procp = (struct proc *)0;
1260 	error = VOP_READDIR(vp, &io, cred, &eofflag);
1261 	off = io.uio_offset;
1262 	if (error) {
1263 		vrele(vp);
1264 		free((caddr_t)rbuf, M_TEMP);
1265 		nfsm_reply(0);
1266 	}
1267 	if (io.uio_resid) {
1268 		siz -= io.uio_resid;
1269 
1270 		/*
1271 		 * If nothing read, return eof
1272 		 * rpc reply
1273 		 */
1274 		if (siz == 0) {
1275 			vrele(vp);
1276 			nfsm_reply(2*NFSX_UNSIGNED);
1277 			nfsm_build(tl, u_long *, 2*NFSX_UNSIGNED);
1278 			*tl++ = nfs_false;
1279 			*tl = nfs_true;
1280 			FREE((caddr_t)rbuf, M_TEMP);
1281 			return (0);
1282 		}
1283 	}
1284 
1285 	/*
1286 	 * Check for degenerate cases of nothing useful read.
1287 	 * If so go try again
1288 	 */
1289 	cpos = rbuf + on;
1290 	cend = rbuf + siz;
1291 	dp = (struct direct *)cpos;
1292 	while (cpos < cend && dp->d_ino == 0) {
1293 		cpos += dp->d_reclen;
1294 		dp = (struct direct *)cpos;
1295 	}
1296 	if (cpos >= cend) {
1297 		toff = off;
1298 		siz = fullsiz;
1299 		on = 0;
1300 		goto again;
1301 	}
1302 
1303 	cpos = rbuf + on;
1304 	cend = rbuf + siz;
1305 	dp = (struct direct *)cpos;
1306 	len = 3*NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
1307 	nfsm_reply(siz);
1308 	mp = mp2 = mb;
1309 	bp = bpos;
1310 	be = bp + M_TRAILINGSPACE(mp);
1311 
1312 	/* Loop through the records and build reply */
1313 	while (cpos < cend) {
1314 		if (dp->d_ino != 0) {
1315 			nlen = dp->d_namlen;
1316 			rem = nfsm_rndup(nlen)-nlen;
1317 			len += (4*NFSX_UNSIGNED + nlen + rem);
1318 			if (len > cnt) {
1319 				eofflag = 0;
1320 				break;
1321 			}
1322 
1323 			/* Build the directory record xdr from the direct entry */
1324 			nfsm_clget;
1325 			*tl = nfs_true;
1326 			bp += NFSX_UNSIGNED;
1327 			nfsm_clget;
1328 			*tl = txdr_unsigned(dp->d_ino);
1329 			bp += NFSX_UNSIGNED;
1330 			nfsm_clget;
1331 			*tl = txdr_unsigned(nlen);
1332 			bp += NFSX_UNSIGNED;
1333 
1334 			/* And loop around copying the name */
1335 			xfer = nlen;
1336 			cp = dp->d_name;
1337 			while (xfer > 0) {
1338 				nfsm_clget;
1339 				if ((bp+xfer) > be)
1340 					tsiz = be-bp;
1341 				else
1342 					tsiz = xfer;
1343 				bcopy(cp, bp, tsiz);
1344 				bp += tsiz;
1345 				xfer -= tsiz;
1346 				if (xfer > 0)
1347 					cp += tsiz;
1348 			}
1349 			/* And null pad to a long boundary */
1350 			for (i = 0; i < rem; i++)
1351 				*bp++ = '\0';
1352 			nfsm_clget;
1353 
1354 			/* Finish off the record */
1355 			toff += dp->d_reclen;
1356 			*tl = txdr_unsigned(toff);
1357 			bp += NFSX_UNSIGNED;
1358 		} else
1359 			toff += dp->d_reclen;
1360 		cpos += dp->d_reclen;
1361 		dp = (struct direct *)cpos;
1362 	}
1363 	vrele(vp);
1364 	nfsm_clget;
1365 	*tl = nfs_false;
1366 	bp += NFSX_UNSIGNED;
1367 	nfsm_clget;
1368 	if (eofflag)
1369 		*tl = nfs_true;
1370 	else
1371 		*tl = nfs_false;
1372 	bp += NFSX_UNSIGNED;
1373 	if (mp != mb) {
1374 		if (bp < be)
1375 			mp->m_len = bp - mtod(mp, caddr_t);
1376 	} else
1377 		mp->m_len += bp - bpos;
1378 	FREE(rbuf, M_TEMP);
1379 	nfsm_srvdone;
1380 }
1381 
1382 nqnfsrv_readdirlook(nfsd, mrep, md, dpos, cred, nam, mrq)
1383 	struct nfsd *nfsd;
1384 	struct mbuf *mrep, *md;
1385 	caddr_t dpos;
1386 	struct ucred *cred;
1387 	struct mbuf *nam, **mrq;
1388 {
1389 	register char *bp, *be;
1390 	register struct mbuf *mp;
1391 	register struct direct *dp;
1392 	register caddr_t cp;
1393 	register u_long *tl;
1394 	register long t1;
1395 	caddr_t bpos;
1396 	struct mbuf *mb, *mb2, *mreq, *mp2;
1397 	char *cpos, *cend, *cp2, *rbuf;
1398 	struct vnode *vp, *nvp;
1399 	struct flrep fl;
1400 	struct ufid *ufp = (struct ufid *)&fl.fl_nfh.fh_generic.fh_fid;
1401 	struct mount *mntp;
1402 	nfsv2fh_t nfh;
1403 	fhandle_t *fhp;
1404 	struct uio io;
1405 	struct iovec iv;
1406 	struct vattr va, *vap = &va;
1407 	struct nfsv2_fattr *fp;
1408 	int len, nlen, rem, xfer, tsiz, i, error = 0, duration2, cache2;
1409 	int siz, cnt, fullsiz, eofflag, rdonly, cache;
1410 	u_quad_t frev, frev2;
1411 	u_long on;
1412 	off_t off, toff;
1413 
1414 	fhp = &nfh.fh_generic;
1415 	nfsm_srvmtofh(fhp);
1416 	nfsm_dissect(tl, u_long *, 3*NFSX_UNSIGNED);
1417 	toff = fxdr_unsigned(off_t, *tl++);
1418 	off = (toff & ~(NFS_DIRBLKSIZ-1));
1419 	on = (toff & (NFS_DIRBLKSIZ-1));
1420 	cnt = fxdr_unsigned(int, *tl++);
1421 	duration2 = fxdr_unsigned(int, *tl);
1422 	siz = ((cnt+NFS_DIRBLKSIZ-1) & ~(NFS_DIRBLKSIZ-1));
1423 	if (cnt > NFS_MAXREADDIR)
1424 		siz = NFS_MAXREADDIR;
1425 	fullsiz = siz;
1426 	if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
1427 		nfsm_reply(0);
1428 	nqsrv_getl(vp, NQL_READ);
1429 	if (error = nfsrv_access(vp, VEXEC, cred, rdonly, nfsd->nd_procp)) {
1430 		vput(vp);
1431 		nfsm_reply(0);
1432 	}
1433 	VOP_UNLOCK(vp);
1434 	MALLOC(rbuf, caddr_t, siz, M_TEMP, M_WAITOK);
1435 again:
1436 	iv.iov_base = rbuf;
1437 	iv.iov_len = fullsiz;
1438 	io.uio_iov = &iv;
1439 	io.uio_iovcnt = 1;
1440 	io.uio_offset = off;
1441 	io.uio_resid = fullsiz;
1442 	io.uio_segflg = UIO_SYSSPACE;
1443 	io.uio_rw = UIO_READ;
1444 	io.uio_procp = (struct proc *)0;
1445 	error = VOP_READDIR(vp, &io, cred, &eofflag);
1446 	off = io.uio_offset;
1447 	if (error) {
1448 		vrele(vp);
1449 		free((caddr_t)rbuf, M_TEMP);
1450 		nfsm_reply(0);
1451 	}
1452 	if (io.uio_resid) {
1453 		siz -= io.uio_resid;
1454 
1455 		/*
1456 		 * If nothing read, return eof
1457 		 * rpc reply
1458 		 */
1459 		if (siz == 0) {
1460 			vrele(vp);
1461 			nfsm_reply(2*NFSX_UNSIGNED);
1462 			nfsm_build(tl, u_long *, 2*NFSX_UNSIGNED);
1463 			*tl++ = nfs_false;
1464 			*tl = nfs_true;
1465 			FREE((caddr_t)rbuf, M_TEMP);
1466 			return (0);
1467 		}
1468 	}
1469 
1470 	/*
1471 	 * Check for degenerate cases of nothing useful read.
1472 	 * If so go try again
1473 	 */
1474 	cpos = rbuf + on;
1475 	cend = rbuf + siz;
1476 	dp = (struct direct *)cpos;
1477 	while (cpos < cend && dp->d_ino == 0) {
1478 		cpos += dp->d_reclen;
1479 		dp = (struct direct *)cpos;
1480 	}
1481 	if (cpos >= cend) {
1482 		toff = off;
1483 		siz = fullsiz;
1484 		on = 0;
1485 		goto again;
1486 	}
1487 
1488 	cpos = rbuf + on;
1489 	cend = rbuf + siz;
1490 	dp = (struct direct *)cpos;
1491 	len = 3*NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
1492 	nfsm_reply(siz);
1493 	mp = mp2 = mb;
1494 	bp = bpos;
1495 	be = bp + M_TRAILINGSPACE(mp);
1496 	mntp = vp->v_mount;
1497 
1498 	/* Loop through the records and build reply */
1499 	while (cpos < cend) {
1500 		if (dp->d_ino != 0) {
1501 			nlen = dp->d_namlen;
1502 			rem = nfsm_rndup(nlen)-nlen;
1503 
1504 			/*
1505 			 * For readdir_and_lookup get the vnode using
1506 			 * the file number.
1507 			 */
1508 			bzero((caddr_t)&fl.fl_nfh, sizeof (nfsv2fh_t));
1509 			ufp->ufid_len = sizeof (struct ufid);
1510 			ufp->ufid_ino = dp->d_ino;
1511 			fl.fl_nfh.fh_generic.fh_fsid = mntp->mnt_stat.f_fsid;
1512 			if (VFS_FHTOVP(mntp, (struct fid *)ufp, 1, &nvp))
1513 				goto invalid;
1514 			(void) nqsrv_getlease(nvp, &duration2, NQL_READ, nfsd,
1515 				nam, &cache2, &frev2, cred);
1516 			fl.fl_duration = txdr_unsigned(duration2);
1517 			fl.fl_cachable = txdr_unsigned(cache2);
1518 			txdr_hyper(&frev2, &fl.fl_frev);
1519 			if (VOP_GETATTR(nvp, vap, cred, nfsd->nd_procp)) {
1520 				vput(nvp);
1521 				goto invalid;
1522 			}
1523 			vput(nvp);
1524 			fp = &fl.fl_fattr;
1525 			nfsm_srvfillattr;
1526 			len += (4*NFSX_UNSIGNED + nlen + rem + NFSX_FH
1527 				+ NFSX_FATTR);
1528 			if (len > cnt) {
1529 				eofflag = 0;
1530 				break;
1531 			}
1532 
1533 			/* Build the directory record xdr from the direct entry */
1534 			nfsm_clget;
1535 			*tl = nfs_true;
1536 			bp += NFSX_UNSIGNED;
1537 
1538 			/*
1539 			 * For readdir_and_lookup copy the stuff out.
1540 			 */
1541 			xfer = sizeof (struct flrep);
1542 			cp = (caddr_t)&fl;
1543 			while (xfer > 0) {
1544 				nfsm_clget;
1545 				if ((bp+xfer) > be)
1546 					tsiz = be-bp;
1547 				else
1548 					tsiz = xfer;
1549 				bcopy(cp, bp, tsiz);
1550 				bp += tsiz;
1551 				xfer -= tsiz;
1552 				if (xfer > 0)
1553 					cp += tsiz;
1554 			}
1555 			nfsm_clget;
1556 			*tl = txdr_unsigned(dp->d_ino);
1557 			bp += NFSX_UNSIGNED;
1558 			nfsm_clget;
1559 			*tl = txdr_unsigned(nlen);
1560 			bp += NFSX_UNSIGNED;
1561 
1562 			/* And loop around copying the name */
1563 			xfer = nlen;
1564 			cp = dp->d_name;
1565 			while (xfer > 0) {
1566 				nfsm_clget;
1567 				if ((bp+xfer) > be)
1568 					tsiz = be-bp;
1569 				else
1570 					tsiz = xfer;
1571 				bcopy(cp, bp, tsiz);
1572 				bp += tsiz;
1573 				xfer -= tsiz;
1574 				if (xfer > 0)
1575 					cp += tsiz;
1576 			}
1577 			/* And null pad to a long boundary */
1578 			for (i = 0; i < rem; i++)
1579 				*bp++ = '\0';
1580 			nfsm_clget;
1581 
1582 			/* Finish off the record */
1583 			toff += dp->d_reclen;
1584 			*tl = txdr_unsigned(toff);
1585 			bp += NFSX_UNSIGNED;
1586 		} else
1587 invalid:
1588 			toff += dp->d_reclen;
1589 		cpos += dp->d_reclen;
1590 		dp = (struct direct *)cpos;
1591 	}
1592 	vrele(vp);
1593 	nfsm_clget;
1594 	*tl = nfs_false;
1595 	bp += NFSX_UNSIGNED;
1596 	nfsm_clget;
1597 	if (eofflag)
1598 		*tl = nfs_true;
1599 	else
1600 		*tl = nfs_false;
1601 	bp += NFSX_UNSIGNED;
1602 	if (mp != mb) {
1603 		if (bp < be)
1604 			mp->m_len = bp - mtod(mp, caddr_t);
1605 	} else
1606 		mp->m_len += bp - bpos;
1607 	FREE(rbuf, M_TEMP);
1608 	nfsm_srvdone;
1609 }
1610 
1611 /*
1612  * nfs statfs service
1613  */
1614 nfsrv_statfs(nfsd, mrep, md, dpos, cred, nam, mrq)
1615 	struct nfsd *nfsd;
1616 	struct mbuf *mrep, *md;
1617 	caddr_t dpos;
1618 	struct ucred *cred;
1619 	struct mbuf *nam, **mrq;
1620 {
1621 	register struct statfs *sf;
1622 	register struct nfsv2_statfs *sfp;
1623 	register u_long *tl;
1624 	register long t1;
1625 	caddr_t bpos;
1626 	int error = 0, rdonly, cache;
1627 	char *cp2;
1628 	struct mbuf *mb, *mb2, *mreq;
1629 	struct vnode *vp;
1630 	nfsv2fh_t nfh;
1631 	fhandle_t *fhp;
1632 	struct statfs statfs;
1633 	u_quad_t frev;
1634 
1635 	fhp = &nfh.fh_generic;
1636 	nfsm_srvmtofh(fhp);
1637 	if (error = nfsrv_fhtovp(fhp, TRUE, &vp, cred, nfsd->nd_slp, nam, &rdonly))
1638 		nfsm_reply(0);
1639 	sf = &statfs;
1640 	error = VFS_STATFS(vp->v_mount, sf, nfsd->nd_procp);
1641 	vput(vp);
1642 	nfsm_reply(NFSX_STATFS);
1643 	nfsm_build(sfp, struct nfsv2_statfs *, NFSX_STATFS);
1644 	sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
1645 	sfp->sf_bsize = txdr_unsigned(sf->f_bsize);
1646 	sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
1647 	sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
1648 	sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
1649 	nfsm_srvdone;
1650 }
1651 
1652 /*
1653  * Null operation, used by clients to ping server
1654  */
1655 /* ARGSUSED */
1656 nfsrv_null(nfsd, mrep, md, dpos, cred, nam, mrq)
1657 	struct nfsd *nfsd;
1658 	struct mbuf *mrep, *md;
1659 	caddr_t dpos;
1660 	struct ucred *cred;
1661 	struct mbuf *nam, **mrq;
1662 {
1663 	caddr_t bpos;
1664 	int error = VNOVAL, cache;
1665 	struct mbuf *mb, *mreq;
1666 	u_quad_t frev;
1667 
1668 	nfsm_reply(0);
1669 	return (error);
1670 }
1671 
1672 /*
1673  * No operation, used for obsolete procedures
1674  */
1675 /* ARGSUSED */
1676 nfsrv_noop(nfsd, mrep, md, dpos, cred, nam, mrq)
1677 	struct nfsd *nfsd;
1678 	struct mbuf *mrep, *md;
1679 	caddr_t dpos;
1680 	struct ucred *cred;
1681 	struct mbuf *nam, **mrq;
1682 {
1683 	caddr_t bpos;
1684 	int error, cache;
1685 	struct mbuf *mb, *mreq;
1686 	u_quad_t frev;
1687 
1688 	if (nfsd->nd_repstat)
1689 		error = nfsd->nd_repstat;
1690 	else
1691 		error = EPROCUNAVAIL;
1692 	nfsm_reply(0);
1693 	return (error);
1694 }
1695 
1696 /*
1697  * Perform access checking for vnodes obtained from file handles that would
1698  * refer to files already opened by a Unix client. You cannot just use
1699  * vn_writechk() and VOP_ACCESS() for two reasons.
1700  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
1701  * 2 - The owner is to be given access irrespective of mode bits so that
1702  *     processes that chmod after opening a file don't break. I don't like
1703  *     this because it opens a security hole, but since the nfs server opens
1704  *     a security hole the size of a barn door anyhow, what the heck.
1705  */
1706 nfsrv_access(vp, flags, cred, rdonly, p)
1707 	register struct vnode *vp;
1708 	int flags;
1709 	register struct ucred *cred;
1710 	int rdonly;
1711 	struct proc *p;
1712 {
1713 	struct vattr vattr;
1714 	int error;
1715 	if (flags & VWRITE) {
1716 		/* Just vn_writechk() changed to check rdonly */
1717 		/*
1718 		 * Disallow write attempts on read-only file systems;
1719 		 * unless the file is a socket or a block or character
1720 		 * device resident on the file system.
1721 		 */
1722 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
1723 			switch (vp->v_type) {
1724 			case VREG: case VDIR: case VLNK:
1725 				return (EROFS);
1726 			}
1727 		}
1728 		/*
1729 		 * If there's shared text associated with
1730 		 * the inode, try to free it up once.  If
1731 		 * we fail, we can't allow writing.
1732 		 */
1733 		if ((vp->v_flag & VTEXT) && !vnode_pager_uncache(vp))
1734 			return (ETXTBSY);
1735 	}
1736 	if (error = VOP_GETATTR(vp, &vattr, cred, p))
1737 		return (error);
1738 	if ((error = VOP_ACCESS(vp, flags, cred, p)) &&
1739 	    cred->cr_uid != vattr.va_uid)
1740 		return (error);
1741 	return (0);
1742 }
1743