xref: /dflybsd-src/sys/vfs/nfs/nfs_serv.c (revision 28e81a2874cc70f7840d5527a55b62f8caed09b8)
1 /*
2  * Copyright (c) 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Rick Macklem at The University of Guelph.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgement:
18  *	This product includes software developed by the University of
19  *	California, Berkeley and its contributors.
20  * 4. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)nfs_serv.c  8.8 (Berkeley) 7/31/95
37  * $FreeBSD: src/sys/nfs/nfs_serv.c,v 1.93.2.6 2002/12/29 18:19:53 dillon Exp $
38  */
39 
40 /*
41  * nfs version 2 and 3 server calls to vnode ops
42  * - these routines generally have 3 phases
43  *   1 - break down and validate rpc request in mbuf list
44  *   2 - do the vnode ops for the request
45  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
46  *   3 - build the rpc reply in an mbuf list
47  *   nb:
48  *	- do not mix the phases, since the nfsm_?? macros can return failures
49  *	  on a bad rpc or similar and do not do any vrele() or vput()'s
50  *
51  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
52  *	error number iff error != 0 whereas
53  *	returning an error from the server function implies a fatal error
54  *	such as a badly constructed rpc request that should be dropped without
55  *	a reply.
56  *	For Version 3, nfsm_reply() does not return for the error case, since
57  *	most version 3 rpcs return more than the status for error cases.
58  *
59  * Other notes:
60  *	Warning: always pay careful attention to resource cleanup on return
61  *	and note that nfsm_*() macros can terminate a procedure on certain
62  *	errors.
63  */
64 
65 #include <sys/param.h>
66 #include <sys/systm.h>
67 #include <sys/proc.h>
68 #include <sys/priv.h>
69 #include <sys/nlookup.h>
70 #include <sys/namei.h>
71 #include <sys/unistd.h>
72 #include <sys/vnode.h>
73 #include <sys/mount.h>
74 #include <sys/socket.h>
75 #include <sys/socketvar.h>
76 #include <sys/malloc.h>
77 #include <sys/mbuf.h>
78 #include <sys/dirent.h>
79 #include <sys/stat.h>
80 #include <sys/kernel.h>
81 #include <sys/sysctl.h>
82 #include <sys/buf.h>
83 
84 #include <vm/vm.h>
85 #include <vm/vm_extern.h>
86 #include <vm/vm_object.h>
87 
88 #include <sys/buf2.h>
89 
90 #include <sys/thread2.h>
91 
92 #include "nfsproto.h"
93 #include "rpcv2.h"
94 #include "nfs.h"
95 #include "xdr_subs.h"
96 #include "nfsm_subs.h"
97 
98 #ifdef NFSRV_DEBUG
99 #define nfsdbprintf(info)	kprintf info
100 #else
101 #define nfsdbprintf(info)
102 #endif
103 
104 #define MAX_COMMIT_COUNT	(1024 * 1024)
105 
106 #define NUM_HEURISTIC		1031
107 #define NHUSE_INIT		64
108 #define NHUSE_INC		16
109 #define NHUSE_MAX		2048
110 
111 static struct nfsheur {
112     struct vnode *nh_vp;	/* vp to match (unreferenced pointer) */
113     off_t nh_nextoff;		/* next offset for sequential detection */
114     int nh_use;			/* use count for selection */
115     int nh_seqcount;		/* heuristic */
116 } nfsheur[NUM_HEURISTIC];
117 
118 nfstype nfsv3_type[9] = { NFNON, NFREG, NFDIR, NFBLK, NFCHR, NFLNK, NFSOCK,
119 		      NFFIFO, NFNON };
120 #ifndef NFS_NOSERVER
121 nfstype nfsv2_type[9] = { NFNON, NFREG, NFDIR, NFBLK, NFCHR, NFLNK, NFNON,
122 		      NFCHR, NFNON };
123 
124 int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
125 int nfsrvw_procrastinate_v3 = 0;
126 
127 static struct timespec	nfsver;
128 
129 SYSCTL_DECL(_vfs_nfs);
130 
131 int nfs_async;
132 SYSCTL_INT(_vfs_nfs, OID_AUTO, async, CTLFLAG_RW, &nfs_async, 0,
133     "Enable unstable and fast writes");
134 static int nfs_commit_blks;
135 static int nfs_commit_miss;
136 SYSCTL_INT(_vfs_nfs, OID_AUTO, commit_blks, CTLFLAG_RW, &nfs_commit_blks, 0,
137     "Number of committed blocks");
138 SYSCTL_INT(_vfs_nfs, OID_AUTO, commit_miss, CTLFLAG_RW, &nfs_commit_miss, 0,
139     "Number of nfs blocks committed from dirty buffers");
140 
141 static int nfsrv_access (struct mount *, struct vnode *, int,
142 			struct ucred *, int, struct thread *, int);
143 static void nfsrvw_coalesce (struct nfsrv_descript *,
144 		struct nfsrv_descript *);
145 
146 /*
147  * Heuristic to detect sequential operation.
148  */
149 static struct nfsheur *
150 nfsrv_sequential_heuristic(struct uio *uio, struct vnode *vp, int writeop)
151 {
152 	struct nfsheur *nh;
153 	int hi, try;
154 
155 	/* Locate best candidate */
156 	try = 32;
157 	hi = ((int)(vm_offset_t) vp / sizeof(struct vnode)) % NUM_HEURISTIC;
158 	nh = &nfsheur[hi];
159 
160 	while (try--) {
161 		if (nfsheur[hi].nh_vp == vp) {
162 			nh = &nfsheur[hi];
163 			break;
164 		}
165 		if (nfsheur[hi].nh_use > 0)
166 			--nfsheur[hi].nh_use;
167 		hi = (hi + 1) % NUM_HEURISTIC;
168 		if (nfsheur[hi].nh_use < nh->nh_use)
169 			nh = &nfsheur[hi];
170 	}
171 
172 	/* Initialize hint if this is a new file */
173 	if (nh->nh_vp != vp) {
174 		nh->nh_vp = vp;
175 		nh->nh_nextoff = uio->uio_offset;
176 		nh->nh_use = NHUSE_INIT;
177 		if (uio->uio_offset == 0)
178 			nh->nh_seqcount = 4;
179 		else
180 			nh->nh_seqcount = 1;
181 	}
182 
183 	/*
184 	 * Calculate heuristic
185 	 *
186 	 * See vfs_vnops.c:sequential_heuristic().
187 	 */
188 	if ((uio->uio_offset == 0 && nh->nh_seqcount > 0) ||
189 	    uio->uio_offset == nh->nh_nextoff) {
190 		nh->nh_seqcount += howmany(uio->uio_resid, 16384);
191 		if (nh->nh_seqcount > IO_SEQMAX)
192 			nh->nh_seqcount = IO_SEQMAX;
193 	} else if (nh->nh_seqcount > 1) {
194 		nh->nh_seqcount = 1;
195 	} else {
196 		nh->nh_seqcount = 0;
197 	}
198 	nh->nh_use += NHUSE_INC;
199 	if (nh->nh_use > NHUSE_MAX)
200 		nh->nh_use = NHUSE_MAX;
201 	return (nh);
202 }
203 
204 /*
205  * nfs v3 access service
206  */
207 int
208 nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
209 	      struct thread *td, struct mbuf **mrq)
210 {
211 	struct sockaddr *nam = nfsd->nd_nam;
212 	struct ucred *cred = &nfsd->nd_cr;
213 	struct vnode *vp = NULL;
214 	struct mount *mp = NULL;
215 	nfsfh_t nfh;
216 	fhandle_t *fhp;
217 	int error = 0, rdonly, getret;
218 	struct vattr vattr, *vap = &vattr;
219 	u_long testmode, nfsmode;
220 	struct nfsm_info info;
221 	u_int32_t *tl;
222 
223 	info.dpos = nfsd->nd_dpos;
224 	info.md = nfsd->nd_md;
225 	info.mrep = nfsd->nd_mrep;
226 	info.mreq = NULL;
227 
228 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
229 	fhp = &nfh.fh_generic;
230 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
231 	NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
232 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam, &rdonly,
233 	    (nfsd->nd_flag & ND_KERBAUTH), TRUE);
234 	if (error) {
235 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
236 		nfsm_srvpostop_attr(&info, nfsd, 1, NULL);
237 		error = 0;
238 		goto nfsmout;
239 	}
240 	nfsmode = fxdr_unsigned(u_int32_t, *tl);
241 	if ((nfsmode & NFSV3ACCESS_READ) &&
242 		nfsrv_access(mp, vp, VREAD, cred, rdonly, td, 0))
243 		nfsmode &= ~NFSV3ACCESS_READ;
244 	if (vp->v_type == VDIR)
245 		testmode = (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
246 			NFSV3ACCESS_DELETE);
247 	else
248 		testmode = (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
249 	if ((nfsmode & testmode) &&
250 		nfsrv_access(mp, vp, VWRITE, cred, rdonly, td, 0))
251 		nfsmode &= ~testmode;
252 	if (vp->v_type == VDIR)
253 		testmode = NFSV3ACCESS_LOOKUP;
254 	else
255 		testmode = NFSV3ACCESS_EXECUTE;
256 	if ((nfsmode & testmode) &&
257 		nfsrv_access(mp, vp, VEXEC, cred, rdonly, td, 0))
258 		nfsmode &= ~testmode;
259 	getret = VOP_GETATTR(vp, vap);
260 	vput(vp);
261 	vp = NULL;
262 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
263 			      NFSX_POSTOPATTR(1) + NFSX_UNSIGNED, &error));
264 	nfsm_srvpostop_attr(&info, nfsd, getret, vap);
265 	tl = nfsm_build(&info, NFSX_UNSIGNED);
266 	*tl = txdr_unsigned(nfsmode);
267 nfsmout:
268 	*mrq = info.mreq;
269 	if (vp)
270 		vput(vp);
271 	return(error);
272 }
273 
274 /*
275  * nfs getattr service
276  */
277 int
278 nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
279 	      struct thread *td, struct mbuf **mrq)
280 {
281 	struct sockaddr *nam = nfsd->nd_nam;
282 	struct ucred *cred = &nfsd->nd_cr;
283 	struct nfs_fattr *fp;
284 	struct vattr va;
285 	struct vattr *vap = &va;
286 	struct vnode *vp = NULL;
287 	struct mount *mp = NULL;
288 	nfsfh_t nfh;
289 	fhandle_t *fhp;
290 	int error = 0, rdonly;
291 	struct nfsm_info info;
292 
293 	info.mrep = nfsd->nd_mrep;
294 	info.md = nfsd->nd_md;
295 	info.dpos = nfsd->nd_dpos;
296 	info.mreq = NULL;
297 
298 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
299 	fhp = &nfh.fh_generic;
300 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
301 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
302 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
303 	if (error) {
304 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, 0, &error));
305 		error = 0;
306 		goto nfsmout;
307 	}
308 	error = VOP_GETATTR(vp, vap);
309 	vput(vp);
310 	vp = NULL;
311 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
312 			      NFSX_FATTR(nfsd->nd_flag & ND_NFSV3), &error));
313 	if (error) {
314 		error = 0;
315 		goto nfsmout;
316 	}
317 	fp = nfsm_build(&info, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
318 	nfsm_srvfattr(nfsd, vap, fp);
319 	/* fall through */
320 
321 nfsmout:
322 	*mrq = info.mreq;
323 	if (vp)
324 		vput(vp);
325 	return(error);
326 }
327 
328 /*
329  * nfs setattr service
330  */
331 int
332 nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
333 	      struct thread *td, struct mbuf **mrq)
334 {
335 	struct sockaddr *nam = nfsd->nd_nam;
336 	struct ucred *cred = &nfsd->nd_cr;
337 	struct vattr va, preat;
338 	struct vattr *vap = &va;
339 	struct nfsv2_sattr *sp;
340 	struct nfs_fattr *fp;
341 	struct vnode *vp = NULL;
342 	struct mount *mp = NULL;
343 	nfsfh_t nfh;
344 	fhandle_t *fhp;
345 	u_int32_t *tl;
346 	int error = 0, rdonly, preat_ret = 1, postat_ret = 1;
347 	int gcheck = 0;
348 	struct timespec guard;
349 	struct nfsm_info info;
350 
351 	info.mrep = nfsd->nd_mrep;
352 	info.mreq = NULL;
353 	info.md = nfsd->nd_md;
354 	info.dpos = nfsd->nd_dpos;
355 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
356 
357 	guard.tv_sec = 0;	/* fix compiler warning */
358 	guard.tv_nsec = 0;
359 
360 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
361 	fhp = &nfh.fh_generic;
362 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
363 	VATTR_NULL(vap);
364 	if (info.v3) {
365 		ERROROUT(nfsm_srvsattr(&info, vap));
366 		NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
367 		gcheck = fxdr_unsigned(int, *tl);
368 		if (gcheck) {
369 			NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
370 			fxdr_nfsv3time(tl, &guard);
371 		}
372 	} else {
373 		NULLOUT(sp = nfsm_dissect(&info, NFSX_V2SATTR));
374 		/*
375 		 * Nah nah nah nah na nah
376 		 * There is a bug in the Sun client that puts 0xffff in the mode
377 		 * field of sattr when it should put in 0xffffffff. The u_short
378 		 * doesn't sign extend.
379 		 * --> check the low order 2 bytes for 0xffff
380 		 */
381 		if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
382 			vap->va_mode = nfstov_mode(sp->sa_mode);
383 		if (sp->sa_uid != nfs_xdrneg1)
384 			vap->va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
385 		if (sp->sa_gid != nfs_xdrneg1)
386 			vap->va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
387 		if (sp->sa_size != nfs_xdrneg1)
388 			vap->va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
389 		if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
390 #ifdef notyet
391 			fxdr_nfsv2time(&sp->sa_atime, &vap->va_atime);
392 #else
393 			vap->va_atime.tv_sec =
394 				fxdr_unsigned(int32_t, sp->sa_atime.nfsv2_sec);
395 			vap->va_atime.tv_nsec = 0;
396 #endif
397 		}
398 		if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
399 			fxdr_nfsv2time(&sp->sa_mtime, &vap->va_mtime);
400 
401 	}
402 
403 	/*
404 	 * Now that we have all the fields, lets do it.
405 	 */
406 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam, &rdonly,
407 		(nfsd->nd_flag & ND_KERBAUTH), TRUE);
408 	if (error) {
409 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
410 				      2 * NFSX_UNSIGNED, &error));
411 		nfsm_srvwcc_data(&info, nfsd, preat_ret, &preat,
412 				 postat_ret, vap);
413 		error = 0;
414 		goto nfsmout;
415 	}
416 
417 	/*
418 	 * vp now an active resource, pay careful attention to cleanup
419 	 */
420 
421 	if (info.v3) {
422 		error = preat_ret = VOP_GETATTR(vp, &preat);
423 		if (!error && gcheck &&
424 			(preat.va_ctime.tv_sec != guard.tv_sec ||
425 			 preat.va_ctime.tv_nsec != guard.tv_nsec))
426 			error = NFSERR_NOT_SYNC;
427 		if (error) {
428 			vput(vp);
429 			vp = NULL;
430 			NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
431 					      NFSX_WCCDATA(info.v3), &error));
432 			nfsm_srvwcc_data(&info, nfsd, preat_ret, &preat,
433 					 postat_ret, vap);
434 			error = 0;
435 			goto nfsmout;
436 		}
437 	}
438 
439 	/*
440 	 * If the size is being changed write acces is required, otherwise
441 	 * just check for a read only file system.
442 	 */
443 	if (vap->va_size == ((u_quad_t)((quad_t) -1))) {
444 		if (rdonly || (mp->mnt_flag & MNT_RDONLY)) {
445 			error = EROFS;
446 			goto out;
447 		}
448 	} else {
449 		if (vp->v_type == VDIR) {
450 			error = EISDIR;
451 			goto out;
452 		} else if ((error = nfsrv_access(mp, vp, VWRITE, cred, rdonly,
453 			    td, 0)) != 0){
454 			goto out;
455 		}
456 	}
457 	error = VOP_SETATTR(vp, vap, cred);
458 	postat_ret = VOP_GETATTR(vp, vap);
459 	if (!error)
460 		error = postat_ret;
461 out:
462 	vput(vp);
463 	vp = NULL;
464 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
465 		   NFSX_WCCORFATTR(info.v3), &error));
466 	if (info.v3) {
467 		nfsm_srvwcc_data(&info, nfsd, preat_ret, &preat,
468 				 postat_ret, vap);
469 		error = 0;
470 		goto nfsmout;
471 	} else {
472 		fp = nfsm_build(&info, NFSX_V2FATTR);
473 		nfsm_srvfattr(nfsd, vap, fp);
474 	}
475 	/* fall through */
476 
477 nfsmout:
478 	*mrq = info.mreq;
479 	if (vp)
480 		vput(vp);
481 	return(error);
482 }
483 
484 /*
485  * nfs lookup rpc
486  */
487 int
488 nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
489 	     struct thread *td, struct mbuf **mrq)
490 {
491 	struct sockaddr *nam = nfsd->nd_nam;
492 	struct ucred *cred = &nfsd->nd_cr;
493 	struct nfs_fattr *fp;
494 	struct nlookupdata nd;
495 	struct vnode *vp;
496 	struct vnode *dirp;
497 	struct nchandle nch;
498 	nfsfh_t nfh;
499 	fhandle_t *fhp;
500 	int error = 0, len, dirattr_ret = 1;
501 	int pubflag;
502 	struct vattr va, dirattr, *vap = &va;
503 	struct nfsm_info info;
504 
505 	info.mrep = nfsd->nd_mrep;
506 	info.mreq = NULL;
507 	info.md = nfsd->nd_md;
508 	info.dpos = nfsd->nd_dpos;
509 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
510 
511 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
512 	nlookup_zero(&nd);
513 	dirp = NULL;
514 	vp = NULL;
515 
516 	fhp = &nfh.fh_generic;
517 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
518 	NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
519 
520 	pubflag = nfs_ispublicfh(fhp);
521 
522 	error = nfs_namei(&nd, cred, 0, NULL, &vp,
523 		fhp, len, slp, nam, &info.md, &info.dpos,
524 		&dirp, td, (nfsd->nd_flag & ND_KERBAUTH), pubflag);
525 
526 	/*
527 	 * namei failure, only dirp to cleanup.  Clear out garbarge from
528 	 * structure in case macros jump to nfsmout.
529 	 */
530 
531 	if (error) {
532 		if (dirp) {
533 			if (info.v3)
534 				dirattr_ret = VOP_GETATTR(dirp, &dirattr);
535 			vrele(dirp);
536 			dirp = NULL;
537 		}
538 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
539 				      NFSX_POSTOPATTR(info.v3), &error));
540 		nfsm_srvpostop_attr(&info, nfsd, dirattr_ret, &dirattr);
541 		error = 0;
542 		goto nfsmout;
543 	}
544 
545 	/*
546 	 * Locate index file for public filehandle
547 	 *
548 	 * error is 0 on entry and 0 on exit from this block.
549 	 */
550 
551 	if (pubflag) {
552 		if (vp->v_type == VDIR && nfs_pub.np_index != NULL) {
553 			/*
554 			 * Setup call to lookup() to see if we can find
555 			 * the index file. Arguably, this doesn't belong
556 			 * in a kernel.. Ugh.  If an error occurs, do not
557 			 * try to install an index file and then clear the
558 			 * error.
559 			 *
560 			 * When we replace nd with ind and redirect ndp,
561 			 * maintenance of ni_startdir and ni_vp shift to
562 			 * ind and we have to clean them up in the old nd.
563 			 * However, the cnd resource continues to be maintained
564 			 * via the original nd.  Confused?  You aren't alone!
565 			 */
566 			vn_unlock(vp);
567 			cache_copy(&nd.nl_nch, &nch);
568 			nlookup_done(&nd);
569 			error = nlookup_init_raw(&nd, nfs_pub.np_index,
570 						UIO_SYSSPACE, 0, cred, &nch);
571 			cache_drop(&nch);
572 			if (error == 0)
573 				error = nlookup(&nd);
574 
575 			if (error == 0) {
576 				/*
577 				 * Found an index file. Get rid of
578 				 * the old references.  transfer vp and
579 				 * load up the new vp.  Fortunately we do
580 				 * not have to deal with dvp, that would be
581 				 * a huge mess.
582 				 */
583 				if (dirp)
584 					vrele(dirp);
585 				dirp = vp;
586 				vp = NULL;
587 				error = cache_vget(&nd.nl_nch, nd.nl_cred,
588 							LK_EXCLUSIVE, &vp);
589 				KKASSERT(error == 0);
590 			}
591 			error = 0;
592 		}
593 		/*
594 		 * If the public filehandle was used, check that this lookup
595 		 * didn't result in a filehandle outside the publicly exported
596 		 * filesystem.  We clear the poor vp here to avoid lockups due
597 		 * to NFS I/O.
598 		 */
599 
600 		if (vp->v_mount != nfs_pub.np_mount) {
601 			vput(vp);
602 			vp = NULL;
603 			error = EPERM;
604 		}
605 	}
606 
607 	if (dirp) {
608 		if (info.v3)
609 			dirattr_ret = VOP_GETATTR(dirp, &dirattr);
610 		vrele(dirp);
611 		dirp = NULL;
612 	}
613 
614 	/*
615 	 * Resources at this point:
616 	 *	ndp->ni_vp	may not be NULL
617 	 *
618 	 */
619 
620 	if (error) {
621 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
622 				      NFSX_POSTOPATTR(info.v3), &error));
623 		nfsm_srvpostop_attr(&info, nfsd, dirattr_ret, &dirattr);
624 		error = 0;
625 		goto nfsmout;
626 	}
627 
628 	/*
629 	 * Clear out some resources prior to potentially blocking.  This
630 	 * is not as critical as ni_dvp resources in other routines, but
631 	 * it helps.
632 	 */
633 	nlookup_done(&nd);
634 
635 	/*
636 	 * Get underlying attribute, then release remaining resources ( for
637 	 * the same potential blocking reason ) and reply.
638 	 */
639 	bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
640 	error = VFS_VPTOFH(vp, &fhp->fh_fid);
641 	if (!error)
642 		error = VOP_GETATTR(vp, vap);
643 
644 	vput(vp);
645 	vp = NULL;
646 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
647 			      NFSX_SRVFH(info.v3) +
648 			      NFSX_POSTOPORFATTR(info.v3) +
649 			      NFSX_POSTOPATTR(info.v3),
650 			      &error));
651 	if (error) {
652 		nfsm_srvpostop_attr(&info, nfsd, dirattr_ret, &dirattr);
653 		error = 0;
654 		goto nfsmout;
655 	}
656 	nfsm_srvfhtom(&info, fhp);
657 	if (info.v3) {
658 		nfsm_srvpostop_attr(&info, nfsd, 0, vap);
659 		nfsm_srvpostop_attr(&info, nfsd, dirattr_ret, &dirattr);
660 	} else {
661 		fp = nfsm_build(&info, NFSX_V2FATTR);
662 		nfsm_srvfattr(nfsd, vap, fp);
663 	}
664 
665 nfsmout:
666 	*mrq = info.mreq;
667 	if (dirp)
668 		vrele(dirp);
669 	nlookup_done(&nd);		/* may be called twice */
670 	if (vp)
671 		vput(vp);
672 	return (error);
673 }
674 
675 /*
676  * nfs readlink service
677  */
678 int
679 nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
680 	       struct thread *td, struct mbuf **mrq)
681 {
682 	struct sockaddr *nam = nfsd->nd_nam;
683 	struct ucred *cred = &nfsd->nd_cr;
684 	struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
685 	struct iovec *ivp = iv;
686 	u_int32_t *tl;
687 	int error = 0, rdonly, i, tlen, len, getret;
688 	struct mbuf *mp1, *mp2, *mp3;
689 	struct vnode *vp = NULL;
690 	struct mount *mp = NULL;
691 	struct vattr attr;
692 	nfsfh_t nfh;
693 	fhandle_t *fhp;
694 	struct uio io, *uiop = &io;
695 	struct nfsm_info info;
696 
697 	info.mrep = nfsd->nd_mrep;
698 	info.mreq = NULL;
699 	info.md = nfsd->nd_md;
700 	info.dpos = nfsd->nd_dpos;
701 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
702 
703 	bzero(&io, sizeof(struct uio));
704 
705 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
706 #ifndef nolint
707 	mp2 = NULL;
708 #endif
709 	mp3 = NULL;
710 	fhp = &nfh.fh_generic;
711 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
712 	len = 0;
713 	i = 0;
714 	while (len < NFS_MAXPATHLEN) {
715 		mp1 = m_getcl(MB_WAIT, MT_DATA, 0);
716 		mp1->m_len = MCLBYTES;
717 		if (len == 0)
718 			mp3 = mp2 = mp1;
719 		else {
720 			mp2->m_next = mp1;
721 			mp2 = mp1;
722 		}
723 		if ((len + mp1->m_len) > NFS_MAXPATHLEN) {
724 			mp1->m_len = NFS_MAXPATHLEN-len;
725 			len = NFS_MAXPATHLEN;
726 		} else
727 			len += mp1->m_len;
728 		ivp->iov_base = mtod(mp1, caddr_t);
729 		ivp->iov_len = mp1->m_len;
730 		i++;
731 		ivp++;
732 	}
733 	uiop->uio_iov = iv;
734 	uiop->uio_iovcnt = i;
735 	uiop->uio_offset = 0;
736 	uiop->uio_resid = len;
737 	uiop->uio_rw = UIO_READ;
738 	uiop->uio_segflg = UIO_SYSSPACE;
739 	uiop->uio_td = NULL;
740 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
741 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
742 	if (error) {
743 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
744 				      2 * NFSX_UNSIGNED, &error));
745 		nfsm_srvpostop_attr(&info, nfsd, 1, NULL);
746 		error = 0;
747 		goto nfsmout;
748 	}
749 	if (vp->v_type != VLNK) {
750 		if (info.v3)
751 			error = EINVAL;
752 		else
753 			error = ENXIO;
754 		goto out;
755 	}
756 	error = VOP_READLINK(vp, uiop, cred);
757 out:
758 	getret = VOP_GETATTR(vp, &attr);
759 	vput(vp);
760 	vp = NULL;
761 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
762 			     NFSX_POSTOPATTR(info.v3) + NFSX_UNSIGNED,
763 			     &error));
764 	if (info.v3) {
765 		nfsm_srvpostop_attr(&info, nfsd, getret, &attr);
766 		if (error) {
767 			error = 0;
768 			goto nfsmout;
769 		}
770 	}
771 	if (uiop->uio_resid > 0) {
772 		len -= uiop->uio_resid;
773 		tlen = nfsm_rndup(len);
774 		nfsm_adj(mp3, NFS_MAXPATHLEN-tlen, tlen-len);
775 	}
776 	tl = nfsm_build(&info, NFSX_UNSIGNED);
777 	*tl = txdr_unsigned(len);
778 	info.mb->m_next = mp3;
779 	mp3 = NULL;
780 nfsmout:
781 	*mrq = info.mreq;
782 	if (mp3)
783 		m_freem(mp3);
784 	if (vp)
785 		vput(vp);
786 	return(error);
787 }
788 
789 /*
790  * nfs read service
791  */
792 int
793 nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
794 	   struct thread *td, struct mbuf **mrq)
795 {
796 	struct nfsm_info info;
797 	struct sockaddr *nam = nfsd->nd_nam;
798 	struct ucred *cred = &nfsd->nd_cr;
799 	struct iovec *iv;
800 	struct iovec *iv2;
801 	struct mbuf *m;
802 	struct nfs_fattr *fp;
803 	u_int32_t *tl;
804 	int i;
805 	int reqlen;
806 	int error = 0, rdonly, cnt, len, left, siz, tlen, getret;
807 	struct mbuf *m2;
808 	struct vnode *vp = NULL;
809 	struct mount *mp = NULL;
810 	nfsfh_t nfh;
811 	fhandle_t *fhp;
812 	struct uio io, *uiop = &io;
813 	struct vattr va, *vap = &va;
814 	struct nfsheur *nh;
815 	off_t off;
816 	int ioflag = 0;
817 
818 	info.mrep = nfsd->nd_mrep;
819 	info.mreq = NULL;
820 	info.md = nfsd->nd_md;
821 	info.dpos = nfsd->nd_dpos;
822 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
823 
824 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
825 	fhp = &nfh.fh_generic;
826 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
827 	if (info.v3) {
828 		NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
829 		off = fxdr_hyper(tl);
830 	} else {
831 		NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
832 		off = (off_t)fxdr_unsigned(u_int32_t, *tl);
833 	}
834 	NEGREPLYOUT(reqlen = nfsm_srvstrsiz(&info,
835 					    NFS_SRVMAXDATA(nfsd), &error));
836 
837 	/*
838 	 * Reference vp.  If an error occurs, vp will be invalid, but we
839 	 * have to NULL it just in case.  The macros might goto nfsmout
840 	 * as well.
841 	 */
842 
843 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
844 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
845 	if (error) {
846 		vp = NULL;
847 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
848 				      2 * NFSX_UNSIGNED, &error));
849 		nfsm_srvpostop_attr(&info, nfsd, 1, NULL);
850 		error = 0;
851 		goto nfsmout;
852 	}
853 
854 	if (vp->v_type != VREG) {
855 		if (info.v3)
856 			error = EINVAL;
857 		else
858 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
859 	}
860 	if (!error) {
861 	    if ((error = nfsrv_access(mp, vp, VREAD, cred, rdonly, td, 1)) != 0)
862 		error = nfsrv_access(mp, vp, VEXEC, cred, rdonly, td, 1);
863 	}
864 	getret = VOP_GETATTR(vp, vap);
865 	if (!error)
866 		error = getret;
867 	if (error) {
868 		vput(vp);
869 		vp = NULL;
870 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
871 				      NFSX_POSTOPATTR(info.v3), &error));
872 		nfsm_srvpostop_attr(&info, nfsd, getret, vap);
873 		error = 0;
874 		goto nfsmout;
875 	}
876 
877 	/*
878 	 * Calculate byte count to read
879 	 */
880 
881 	if (off >= vap->va_size)
882 		cnt = 0;
883 	else if ((off + reqlen) > vap->va_size)
884 		cnt = vap->va_size - off;
885 	else
886 		cnt = reqlen;
887 
888 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
889 			      NFSX_POSTOPORFATTR(info.v3) +
890 			      3 * NFSX_UNSIGNED + nfsm_rndup(cnt),
891 			      &error));
892 	if (info.v3) {
893 		tl = nfsm_build(&info, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
894 		*tl++ = nfs_true;
895 		fp = (struct nfs_fattr *)tl;
896 		tl += (NFSX_V3FATTR / sizeof (u_int32_t));
897 	} else {
898 		tl = nfsm_build(&info, NFSX_V2FATTR + NFSX_UNSIGNED);
899 		fp = (struct nfs_fattr *)tl;
900 		tl += (NFSX_V2FATTR / sizeof (u_int32_t));
901 	}
902 	len = left = nfsm_rndup(cnt);
903 	if (cnt > 0) {
904 		/*
905 		 * Generate the mbuf list with the uio_iov ref. to it.
906 		 */
907 		i = 0;
908 		m = m2 = info.mb;
909 		while (left > 0) {
910 			siz = min(M_TRAILINGSPACE(m), left);
911 			if (siz > 0) {
912 				left -= siz;
913 				i++;
914 			}
915 			if (left > 0) {
916 				m = m_getcl(MB_WAIT, MT_DATA, 0);
917 				m->m_len = 0;
918 				m2->m_next = m;
919 				m2 = m;
920 			}
921 		}
922 		iv = kmalloc(i * sizeof(struct iovec), M_TEMP, M_WAITOK);
923 		uiop->uio_iov = iv2 = iv;
924 		m = info.mb;
925 		left = len;
926 		i = 0;
927 		while (left > 0) {
928 			if (m == NULL)
929 				panic("nfsrv_read iov");
930 			siz = min(M_TRAILINGSPACE(m), left);
931 			if (siz > 0) {
932 				iv->iov_base = mtod(m, caddr_t) + m->m_len;
933 				iv->iov_len = siz;
934 				m->m_len += siz;
935 				left -= siz;
936 				iv++;
937 				i++;
938 			}
939 			m = m->m_next;
940 		}
941 		uiop->uio_iovcnt = i;
942 		uiop->uio_offset = off;
943 		uiop->uio_resid = len;
944 		uiop->uio_rw = UIO_READ;
945 		uiop->uio_segflg = UIO_SYSSPACE;
946 		nh = nfsrv_sequential_heuristic(uiop, vp, 0);
947 		ioflag |= nh->nh_seqcount << IO_SEQSHIFT;
948 		error = VOP_READ(vp, uiop, IO_NODELOCKED | ioflag, cred);
949 		if (error == 0) {
950 			off = uiop->uio_offset;
951 			nh->nh_nextoff = off;
952 		}
953 		kfree((caddr_t)iv2, M_TEMP);
954 		if (error || (getret = VOP_GETATTR(vp, vap))) {
955 			if (!error)
956 				error = getret;
957 			m_freem(info.mreq);
958 			info.mreq = NULL;
959 			vput(vp);
960 			vp = NULL;
961 			NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
962 					      NFSX_POSTOPATTR(info.v3),
963 					      &error));
964 			nfsm_srvpostop_attr(&info, nfsd, getret, vap);
965 			error = 0;
966 			goto nfsmout;
967 		}
968 	} else {
969 		uiop->uio_resid = 0;
970 	}
971 	vput(vp);
972 	vp = NULL;
973 	nfsm_srvfattr(nfsd, vap, fp);
974 	tlen = len - uiop->uio_resid;
975 	cnt = cnt < tlen ? cnt : tlen;
976 	tlen = nfsm_rndup(cnt);
977 	if (len != tlen || tlen != cnt)
978 		nfsm_adj(info.mb, len - tlen, tlen - cnt);
979 	if (info.v3) {
980 		*tl++ = txdr_unsigned(cnt);
981 		if (cnt < reqlen)
982 			*tl++ = nfs_true;
983 		else
984 			*tl++ = nfs_false;
985 	}
986 	*tl = txdr_unsigned(cnt);
987 nfsmout:
988 	*mrq = info.mreq;
989 	if (vp)
990 		vput(vp);
991 	return(error);
992 }
993 
994 /*
995  * nfs write service
996  */
997 int
998 nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
999 	    struct thread *td, struct mbuf **mrq)
1000 {
1001 	struct sockaddr *nam = nfsd->nd_nam;
1002 	struct ucred *cred = &nfsd->nd_cr;
1003 	struct iovec *ivp;
1004 	int i, cnt;
1005 	struct mbuf *mp1;
1006 	struct nfs_fattr *fp;
1007 	struct iovec *iv;
1008 	struct vattr va, forat;
1009 	struct vattr *vap = &va;
1010 	u_int32_t *tl;
1011 	int error = 0, rdonly, len, forat_ret = 1;
1012 	int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
1013 	int stable = NFSV3WRITE_FILESYNC;
1014 	struct vnode *vp = NULL;
1015 	struct mount *mp = NULL;
1016 	struct nfsheur *nh;
1017 	nfsfh_t nfh;
1018 	fhandle_t *fhp;
1019 	struct uio io, *uiop = &io;
1020 	struct nfsm_info info;
1021 	off_t off;
1022 
1023 	info.mrep = nfsd->nd_mrep;
1024 	info.mreq = NULL;
1025 	info.md = nfsd->nd_md;
1026 	info.dpos = nfsd->nd_dpos;
1027 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
1028 
1029 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
1030 	if (info.mrep == NULL) {
1031 		error = 0;
1032 		goto nfsmout;
1033 	}
1034 	fhp = &nfh.fh_generic;
1035 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
1036 	if (info.v3) {
1037 		NULLOUT(tl = nfsm_dissect(&info, 5 * NFSX_UNSIGNED));
1038 		off = fxdr_hyper(tl);
1039 		tl += 3;
1040 		stable = fxdr_unsigned(int, *tl++);
1041 	} else {
1042 		NULLOUT(tl = nfsm_dissect(&info, 4 * NFSX_UNSIGNED));
1043 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1044 		tl += 2;
1045 		if (nfs_async)
1046 	    		stable = NFSV3WRITE_UNSTABLE;
1047 	}
1048 	retlen = len = fxdr_unsigned(int32_t, *tl);
1049 	cnt = i = 0;
1050 
1051 	/*
1052 	 * For NFS Version 2, it is not obvious what a write of zero length
1053 	 * should do, but I might as well be consistent with Version 3,
1054 	 * which is to return ok so long as there are no permission problems.
1055 	 */
1056 	if (len > 0) {
1057 	    zeroing = 1;
1058 	    mp1 = info.mrep;
1059 	    while (mp1) {
1060 		if (mp1 == info.md) {
1061 			zeroing = 0;
1062 			adjust = info.dpos - mtod(mp1, caddr_t);
1063 			mp1->m_len -= adjust;
1064 			if (mp1->m_len > 0 && adjust > 0)
1065 				mp1->m_data += adjust;
1066 		}
1067 		if (zeroing)
1068 			mp1->m_len = 0;
1069 		else if (mp1->m_len > 0) {
1070 			i += mp1->m_len;
1071 			if (i > len) {
1072 				mp1->m_len -= (i - len);
1073 				zeroing	= 1;
1074 			}
1075 			if (mp1->m_len > 0)
1076 				cnt++;
1077 		}
1078 		mp1 = mp1->m_next;
1079 	    }
1080 	}
1081 	if (len > NFS_MAXDATA || len < 0 || i < len) {
1082 		error = EIO;
1083 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1084 				      2 * NFSX_UNSIGNED, &error));
1085 		nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1086 				 aftat_ret, vap);
1087 		error = 0;
1088 		goto nfsmout;
1089 	}
1090 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
1091 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
1092 	if (error) {
1093 		vp = NULL;
1094 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1095 				      2 * NFSX_UNSIGNED, &error));
1096 		nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1097 				 aftat_ret, vap);
1098 		error = 0;
1099 		goto nfsmout;
1100 	}
1101 	if (info.v3)
1102 		forat_ret = VOP_GETATTR(vp, &forat);
1103 	if (vp->v_type != VREG) {
1104 		if (info.v3)
1105 			error = EINVAL;
1106 		else
1107 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1108 	}
1109 	if (!error) {
1110 		error = nfsrv_access(mp, vp, VWRITE, cred, rdonly, td, 1);
1111 	}
1112 	if (error) {
1113 		vput(vp);
1114 		vp = NULL;
1115 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1116 				      NFSX_WCCDATA(info.v3), &error));
1117 		nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1118 				 aftat_ret, vap);
1119 		error = 0;
1120 		goto nfsmout;
1121 	}
1122 
1123 	if (len > 0) {
1124 	    ivp = kmalloc(cnt * sizeof(struct iovec), M_TEMP, M_WAITOK);
1125 	    uiop->uio_iov = iv = ivp;
1126 	    uiop->uio_iovcnt = cnt;
1127 	    mp1 = info.mrep;
1128 	    while (mp1) {
1129 		if (mp1->m_len > 0) {
1130 			ivp->iov_base = mtod(mp1, caddr_t);
1131 			ivp->iov_len = mp1->m_len;
1132 			ivp++;
1133 		}
1134 		mp1 = mp1->m_next;
1135 	    }
1136 
1137 	    /*
1138 	     * XXX
1139 	     * The IO_METASYNC flag indicates that all metadata (and not just
1140 	     * enough to ensure data integrity) mus be written to stable storage
1141 	     * synchronously.
1142 	     * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
1143 	     */
1144 	    if (stable == NFSV3WRITE_UNSTABLE)
1145 		ioflags = IO_NODELOCKED;
1146 	    else if (stable == NFSV3WRITE_DATASYNC)
1147 		ioflags = (IO_SYNC | IO_NODELOCKED);
1148 	    else
1149 		ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1150 	    uiop->uio_resid = len;
1151 	    uiop->uio_rw = UIO_WRITE;
1152 	    uiop->uio_segflg = UIO_SYSSPACE;
1153 	    uiop->uio_td = NULL;
1154 	    uiop->uio_offset = off;
1155 	    nh = nfsrv_sequential_heuristic(uiop, vp, 1);
1156 	    ioflags |= nh->nh_seqcount << IO_SEQSHIFT;
1157 	    error = VOP_WRITE(vp, uiop, ioflags, cred);
1158 	    if (error == 0)
1159 		nh->nh_nextoff = uiop->uio_offset;
1160 	    nfsstats.srvvop_writes++;
1161 	    kfree((caddr_t)iv, M_TEMP);
1162 	}
1163 	aftat_ret = VOP_GETATTR(vp, vap);
1164 	vput(vp);
1165 	vp = NULL;
1166 	if (!error)
1167 		error = aftat_ret;
1168 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1169 			      NFSX_PREOPATTR(info.v3) +
1170 			      NFSX_POSTOPORFATTR(info.v3) +
1171 			      2 * NFSX_UNSIGNED + NFSX_WRITEVERF(info.v3),
1172 			      &error));
1173 	if (info.v3) {
1174 		nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1175 				 aftat_ret, vap);
1176 		if (error) {
1177 			error = 0;
1178 			goto nfsmout;
1179 		}
1180 		tl = nfsm_build(&info, 4 * NFSX_UNSIGNED);
1181 		*tl++ = txdr_unsigned(retlen);
1182 		/*
1183 		 * If nfs_async is set, then pretend the write was FILESYNC.
1184 		 */
1185 		if (stable == NFSV3WRITE_UNSTABLE && !nfs_async)
1186 			*tl++ = txdr_unsigned(stable);
1187 		else
1188 			*tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
1189 		/*
1190 		 * Actually, there is no need to txdr these fields,
1191 		 * but it may make the values more human readable,
1192 		 * for debugging purposes.
1193 		 */
1194 		if (nfsver.tv_sec == 0)
1195 			nfsver = boottime;
1196 		*tl++ = txdr_unsigned(nfsver.tv_sec);
1197 		*tl = txdr_unsigned(nfsver.tv_nsec / 1000);
1198 	} else {
1199 		fp = nfsm_build(&info, NFSX_V2FATTR);
1200 		nfsm_srvfattr(nfsd, vap, fp);
1201 	}
1202 nfsmout:
1203 	*mrq = info.mreq;
1204 	if (vp)
1205 		vput(vp);
1206 	return(error);
1207 }
1208 
1209 /*
1210  * NFS write service with write gathering support. Called when
1211  * nfsrvw_procrastinate > 0.
1212  * See: Chet Juszczak, "Improving the Write Performance of an NFS Server",
1213  * in Proc. of the Winter 1994 Usenix Conference, pg. 247-259, San Franscisco,
1214  * Jan. 1994.
1215  */
1216 int
1217 nfsrv_writegather(struct nfsrv_descript **ndp, struct nfssvc_sock *slp,
1218 		  struct thread *td, struct mbuf **mrq)
1219 {
1220 	struct iovec *ivp;
1221 	struct nfsrv_descript *wp, *nfsd, *owp, *swp;
1222 	struct nfs_fattr *fp;
1223 	int i;
1224 	struct iovec *iov;
1225 	struct nfsrvw_delayhash *wpp;
1226 	struct ucred *cred;
1227 	struct vattr va, forat;
1228 	u_int32_t *tl;
1229 	int error = 0, rdonly, len, forat_ret = 1;
1230 	int ioflags, aftat_ret = 1, adjust, zeroing;
1231 	struct mbuf *mp1;
1232 	struct vnode *vp = NULL;
1233 	struct mount *mp = NULL;
1234 	struct uio io, *uiop = &io;
1235 	u_quad_t cur_usec;
1236 	struct nfsm_info info;
1237 
1238 	info.mreq = NULL;
1239 
1240 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
1241 #ifndef nolint
1242 	i = 0;
1243 	len = 0;
1244 #endif
1245 	if (*ndp) {
1246 	    nfsd = *ndp;
1247 	    *ndp = NULL;
1248 	    info.mrep = nfsd->nd_mrep;
1249 	    info.mreq = NULL;
1250 	    info.md = nfsd->nd_md;
1251 	    info.dpos = nfsd->nd_dpos;
1252 	    info.v3 = (nfsd->nd_flag & ND_NFSV3);
1253 	    cred = &nfsd->nd_cr;
1254 	    LIST_INIT(&nfsd->nd_coalesce);
1255 	    nfsd->nd_mreq = NULL;
1256 	    nfsd->nd_stable = NFSV3WRITE_FILESYNC;
1257 	    cur_usec = nfs_curusec();
1258 	    nfsd->nd_time = cur_usec +
1259 		(info.v3 ? nfsrvw_procrastinate_v3 : nfsrvw_procrastinate);
1260 
1261 	    /*
1262 	     * Now, get the write header..
1263 	     */
1264 	    NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, &nfsd->nd_fh, &error));
1265 	    if (info.v3) {
1266 		NULLOUT(tl = nfsm_dissect(&info, 5 * NFSX_UNSIGNED));
1267 		nfsd->nd_off = fxdr_hyper(tl);
1268 		tl += 3;
1269 		nfsd->nd_stable = fxdr_unsigned(int, *tl++);
1270 	    } else {
1271 		NULLOUT(tl = nfsm_dissect(&info, 4 * NFSX_UNSIGNED));
1272 		nfsd->nd_off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1273 		tl += 2;
1274 		if (nfs_async)
1275 			nfsd->nd_stable = NFSV3WRITE_UNSTABLE;
1276 	    }
1277 	    len = fxdr_unsigned(int32_t, *tl);
1278 	    nfsd->nd_len = len;
1279 	    nfsd->nd_eoff = nfsd->nd_off + len;
1280 
1281 	    /*
1282 	     * Trim the header out of the mbuf list and trim off any trailing
1283 	     * junk so that the mbuf list has only the write data.
1284 	     */
1285 	    zeroing = 1;
1286 	    i = 0;
1287 	    mp1 = info.mrep;
1288 	    while (mp1) {
1289 		if (mp1 == info.md) {
1290 		    zeroing = 0;
1291 		    adjust = info.dpos - mtod(mp1, caddr_t);
1292 		    mp1->m_len -= adjust;
1293 		    if (mp1->m_len > 0 && adjust > 0)
1294 			mp1->m_data += adjust;
1295 		}
1296 		if (zeroing)
1297 		    mp1->m_len = 0;
1298 		else {
1299 		    i += mp1->m_len;
1300 		    if (i > len) {
1301 			mp1->m_len -= (i - len);
1302 			zeroing = 1;
1303 		    }
1304 		}
1305 		mp1 = mp1->m_next;
1306 	    }
1307 	    if (len > NFS_MAXDATA || len < 0  || i < len) {
1308 nfsmout:
1309 		m_freem(info.mrep);
1310 		info.mrep = NULL;
1311 		error = EIO;
1312 		nfsm_writereply(&info, nfsd, slp, error, 2 * NFSX_UNSIGNED);
1313 		if (info.v3) {
1314 		    nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1315 				     aftat_ret, &va);
1316 		}
1317 		nfsd->nd_mreq = info.mreq;
1318 		nfsd->nd_mrep = NULL;
1319 		nfsd->nd_time = 0;
1320 	    }
1321 
1322 	    /*
1323 	     * Add this entry to the hash and time queues.
1324 	     */
1325 	    owp = NULL;
1326 	    wp = slp->ns_tq.lh_first;
1327 	    while (wp && wp->nd_time < nfsd->nd_time) {
1328 		owp = wp;
1329 		wp = wp->nd_tq.le_next;
1330 	    }
1331 	    NFS_DPF(WG, ("Q%03x", nfsd->nd_retxid & 0xfff));
1332 	    if (owp) {
1333 		LIST_INSERT_AFTER(owp, nfsd, nd_tq);
1334 	    } else {
1335 		LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1336 	    }
1337 	    if (nfsd->nd_mrep) {
1338 		wpp = NWDELAYHASH(slp, nfsd->nd_fh.fh_fid.fid_data);
1339 		owp = NULL;
1340 		wp = wpp->lh_first;
1341 		while (wp &&
1342 		    bcmp((caddr_t)&nfsd->nd_fh,(caddr_t)&wp->nd_fh,NFSX_V3FH)) {
1343 		    owp = wp;
1344 		    wp = wp->nd_hash.le_next;
1345 		}
1346 		while (wp && wp->nd_off < nfsd->nd_off &&
1347 		    !bcmp((caddr_t)&nfsd->nd_fh,(caddr_t)&wp->nd_fh,NFSX_V3FH)) {
1348 		    owp = wp;
1349 		    wp = wp->nd_hash.le_next;
1350 		}
1351 		if (owp) {
1352 		    LIST_INSERT_AFTER(owp, nfsd, nd_hash);
1353 
1354 		    /*
1355 		     * Search the hash list for overlapping entries and
1356 		     * coalesce.
1357 		     */
1358 		    for(; nfsd && NFSW_CONTIG(owp, nfsd); nfsd = wp) {
1359 			wp = nfsd->nd_hash.le_next;
1360 			if (NFSW_SAMECRED(owp, nfsd))
1361 			    nfsrvw_coalesce(owp, nfsd);
1362 		    }
1363 		} else {
1364 		    LIST_INSERT_HEAD(wpp, nfsd, nd_hash);
1365 		}
1366 	    }
1367 	}
1368 
1369 	/*
1370 	 * Now, do VOP_WRITE()s for any one(s) that need to be done now
1371 	 * and generate the associated reply mbuf list(s).
1372 	 */
1373 loop1:
1374 	cur_usec = nfs_curusec();
1375 	for (nfsd = slp->ns_tq.lh_first; nfsd; nfsd = owp) {
1376 		owp = nfsd->nd_tq.le_next;
1377 		if (nfsd->nd_time > cur_usec)
1378 		    break;
1379 		if (nfsd->nd_mreq)
1380 		    continue;
1381 		NFS_DPF(WG, ("P%03x", nfsd->nd_retxid & 0xfff));
1382 		LIST_REMOVE(nfsd, nd_tq);
1383 		LIST_REMOVE(nfsd, nd_hash);
1384 		info.mrep = nfsd->nd_mrep;
1385 		info.mreq = NULL;
1386 		info.v3 = (nfsd->nd_flag & ND_NFSV3);
1387 		nfsd->nd_mrep = NULL;
1388 		cred = &nfsd->nd_cr;
1389 		forat_ret = aftat_ret = 1;
1390 		error = nfsrv_fhtovp(&nfsd->nd_fh, 1, &mp, &vp, cred, slp,
1391 				     nfsd->nd_nam, &rdonly,
1392 				     (nfsd->nd_flag & ND_KERBAUTH), TRUE);
1393 		if (!error) {
1394 		    if (info.v3)
1395 			forat_ret = VOP_GETATTR(vp, &forat);
1396 		    if (vp->v_type != VREG) {
1397 			if (info.v3)
1398 			    error = EINVAL;
1399 			else
1400 			    error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1401 		    }
1402 		} else {
1403 		    vp = NULL;
1404 		}
1405 		if (!error) {
1406 		    error = nfsrv_access(mp, vp, VWRITE, cred, rdonly, td, 1);
1407 		}
1408 
1409 		if (nfsd->nd_stable == NFSV3WRITE_UNSTABLE)
1410 		    ioflags = IO_NODELOCKED;
1411 		else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC)
1412 		    ioflags = (IO_SYNC | IO_NODELOCKED);
1413 		else
1414 		    ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1415 		uiop->uio_rw = UIO_WRITE;
1416 		uiop->uio_segflg = UIO_SYSSPACE;
1417 		uiop->uio_td = NULL;
1418 		uiop->uio_offset = nfsd->nd_off;
1419 		uiop->uio_resid = nfsd->nd_eoff - nfsd->nd_off;
1420 		if (uiop->uio_resid > 0) {
1421 		    mp1 = info.mrep;
1422 		    i = 0;
1423 		    while (mp1) {
1424 			if (mp1->m_len > 0)
1425 			    i++;
1426 			mp1 = mp1->m_next;
1427 		    }
1428 		    uiop->uio_iovcnt = i;
1429 		    iov = kmalloc(i * sizeof(struct iovec), M_TEMP, M_WAITOK);
1430 		    uiop->uio_iov = ivp = iov;
1431 		    mp1 = info.mrep;
1432 		    while (mp1) {
1433 			if (mp1->m_len > 0) {
1434 			    ivp->iov_base = mtod(mp1, caddr_t);
1435 			    ivp->iov_len = mp1->m_len;
1436 			    ivp++;
1437 			}
1438 			mp1 = mp1->m_next;
1439 		    }
1440 		    if (!error) {
1441 			error = VOP_WRITE(vp, uiop, ioflags, cred);
1442 			nfsstats.srvvop_writes++;
1443 		    }
1444 		    kfree((caddr_t)iov, M_TEMP);
1445 		}
1446 		m_freem(info.mrep);
1447 		info.mrep = NULL;
1448 		if (vp) {
1449 		    aftat_ret = VOP_GETATTR(vp, &va);
1450 		    vput(vp);
1451 		    vp = NULL;
1452 		}
1453 
1454 		/*
1455 		 * Loop around generating replies for all write rpcs that have
1456 		 * now been completed.
1457 		 */
1458 		swp = nfsd;
1459 		do {
1460 		    NFS_DPF(WG, ("R%03x", nfsd->nd_retxid & 0xfff));
1461 		    if (error) {
1462 			nfsm_writereply(&info, nfsd, slp, error,
1463 					NFSX_WCCDATA(info.v3));
1464 			if (info.v3) {
1465 			    nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1466 					     aftat_ret, &va);
1467 			}
1468 		    } else {
1469 			nfsm_writereply(&info, nfsd, slp, error,
1470 					NFSX_PREOPATTR(info.v3) +
1471 					NFSX_POSTOPORFATTR(info.v3) +
1472 					2 * NFSX_UNSIGNED +
1473 					NFSX_WRITEVERF(info.v3));
1474 			if (info.v3) {
1475 			    nfsm_srvwcc_data(&info, nfsd, forat_ret, &forat,
1476 					     aftat_ret, &va);
1477 			    tl = nfsm_build(&info, 4 * NFSX_UNSIGNED);
1478 			    *tl++ = txdr_unsigned(nfsd->nd_len);
1479 			    *tl++ = txdr_unsigned(swp->nd_stable);
1480 			    /*
1481 			     * Actually, there is no need to txdr these fields,
1482 			     * but it may make the values more human readable,
1483 			     * for debugging purposes.
1484 			     */
1485 			    if (nfsver.tv_sec == 0)
1486 				    nfsver = boottime;
1487 			    *tl++ = txdr_unsigned(nfsver.tv_sec);
1488 			    *tl = txdr_unsigned(nfsver.tv_nsec / 1000);
1489 			} else {
1490 			    fp = nfsm_build(&info, NFSX_V2FATTR);
1491 			    nfsm_srvfattr(nfsd, &va, fp);
1492 			}
1493 		    }
1494 		    nfsd->nd_mreq = info.mreq;
1495 		    if (nfsd->nd_mrep)
1496 			panic("nfsrv_write: nd_mrep not free");
1497 
1498 		    /*
1499 		     * Done. Put it at the head of the timer queue so that
1500 		     * the final phase can return the reply.
1501 		     */
1502 		    if (nfsd != swp) {
1503 			nfsd->nd_time = 0;
1504 			LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1505 		    }
1506 		    nfsd = swp->nd_coalesce.lh_first;
1507 		    if (nfsd) {
1508 			LIST_REMOVE(nfsd, nd_tq);
1509 		    }
1510 		} while (nfsd);
1511 		swp->nd_time = 0;
1512 		LIST_INSERT_HEAD(&slp->ns_tq, swp, nd_tq);
1513 		goto loop1;
1514 	}
1515 
1516 	/*
1517 	 * Search for a reply to return.
1518 	 */
1519 	for (nfsd = slp->ns_tq.lh_first; nfsd; nfsd = nfsd->nd_tq.le_next) {
1520 		if (nfsd->nd_mreq) {
1521 		    NFS_DPF(WG, ("X%03x", nfsd->nd_retxid & 0xfff));
1522 		    LIST_REMOVE(nfsd, nd_tq);
1523 		    break;
1524 		}
1525 	}
1526 	if (nfsd) {
1527 		*ndp = nfsd;
1528 		*mrq = nfsd->nd_mreq;
1529 	} else {
1530 		*ndp = NULL;
1531 		*mrq = NULL;
1532 	}
1533 	return (0);
1534 }
1535 
1536 /*
1537  * Coalesce the write request nfsd into owp. To do this we must:
1538  * - remove nfsd from the queues
1539  * - merge nfsd->nd_mrep into owp->nd_mrep
1540  * - update the nd_eoff and nd_stable for owp
1541  * - put nfsd on owp's nd_coalesce list
1542  * NB: Must be called at splsoftclock().
1543  */
1544 static void
1545 nfsrvw_coalesce(struct nfsrv_descript *owp, struct nfsrv_descript *nfsd)
1546 {
1547         int overlap;
1548         struct mbuf *mp1;
1549 	struct nfsrv_descript *p;
1550 
1551 	NFS_DPF(WG, ("C%03x-%03x",
1552 		     nfsd->nd_retxid & 0xfff, owp->nd_retxid & 0xfff));
1553         LIST_REMOVE(nfsd, nd_hash);
1554         LIST_REMOVE(nfsd, nd_tq);
1555         if (owp->nd_eoff < nfsd->nd_eoff) {
1556             overlap = owp->nd_eoff - nfsd->nd_off;
1557             if (overlap < 0)
1558                 panic("nfsrv_coalesce: bad off");
1559             if (overlap > 0)
1560                 m_adj(nfsd->nd_mrep, overlap);
1561             mp1 = owp->nd_mrep;
1562             while (mp1->m_next)
1563                 mp1 = mp1->m_next;
1564             mp1->m_next = nfsd->nd_mrep;
1565             owp->nd_eoff = nfsd->nd_eoff;
1566         } else
1567             m_freem(nfsd->nd_mrep);
1568         nfsd->nd_mrep = NULL;
1569         if (nfsd->nd_stable == NFSV3WRITE_FILESYNC)
1570             owp->nd_stable = NFSV3WRITE_FILESYNC;
1571         else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC &&
1572             owp->nd_stable == NFSV3WRITE_UNSTABLE)
1573             owp->nd_stable = NFSV3WRITE_DATASYNC;
1574         LIST_INSERT_HEAD(&owp->nd_coalesce, nfsd, nd_tq);
1575 
1576 	/*
1577 	 * If nfsd had anything else coalesced into it, transfer them
1578 	 * to owp, otherwise their replies will never get sent.
1579 	 */
1580 	for (p = nfsd->nd_coalesce.lh_first; p;
1581 	     p = nfsd->nd_coalesce.lh_first) {
1582 	    LIST_REMOVE(p, nd_tq);
1583 	    LIST_INSERT_HEAD(&owp->nd_coalesce, p, nd_tq);
1584 	}
1585 }
1586 
1587 /*
1588  * nfs create service
1589  * now does a truncate to 0 length via. setattr if it already exists
1590  */
1591 int
1592 nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1593 	     struct thread *td, struct mbuf **mrq)
1594 {
1595 	struct sockaddr *nam = nfsd->nd_nam;
1596 	struct ucred *cred = &nfsd->nd_cr;
1597 	struct nfs_fattr *fp;
1598 	struct vattr va, dirfor, diraft;
1599 	struct vattr *vap = &va;
1600 	struct nfsv2_sattr *sp;
1601 	u_int32_t *tl;
1602 	struct nlookupdata nd;
1603 	int error = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
1604 	udev_t rdev = NOUDEV;
1605 	caddr_t cp;
1606 	int how, exclusive_flag = 0;
1607 	struct vnode *dirp;
1608 	struct vnode *dvp;
1609 	struct vnode *vp;
1610 	struct mount *mp;
1611 	nfsfh_t nfh;
1612 	fhandle_t *fhp;
1613 	u_quad_t tempsize;
1614 	u_char cverf[NFSX_V3CREATEVERF];
1615 	struct nfsm_info info;
1616 
1617 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
1618 	nlookup_zero(&nd);
1619 	dirp = NULL;
1620 	dvp = NULL;
1621 	vp = NULL;
1622 
1623 	info.mrep = nfsd->nd_mrep;
1624 	info.mreq = NULL;
1625 	info.md = nfsd->nd_md;
1626 	info.dpos = nfsd->nd_dpos;
1627 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
1628 
1629 	fhp = &nfh.fh_generic;
1630 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
1631 	NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
1632 
1633 	/*
1634 	 * Call namei and do initial cleanup to get a few things
1635 	 * out of the way.  If we get an initial error we cleanup
1636 	 * and return here to avoid special-casing the invalid nd
1637 	 * structure through the rest of the case.  dirp may be
1638 	 * set even if an error occurs, but the nd structure will not
1639 	 * be valid at all if an error occurs so we have to invalidate it
1640 	 * prior to calling nfsm_reply ( which might goto nfsmout ).
1641 	 */
1642 	error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
1643 			  fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
1644 			  td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
1645 	mp = vfs_getvfs(&fhp->fh_fsid);
1646 
1647 	if (dirp) {
1648 		if (info.v3) {
1649 			dirfor_ret = VOP_GETATTR(dirp, &dirfor);
1650 		} else {
1651 			vrele(dirp);
1652 			dirp = NULL;
1653 		}
1654 	}
1655 	if (error) {
1656 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1657 				      NFSX_WCCDATA(info.v3), &error));
1658 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
1659 				 diraft_ret, &diraft);
1660 		error = 0;
1661 		goto nfsmout;
1662 	}
1663 
1664 	/*
1665 	 * No error.  Continue.  State:
1666 	 *
1667 	 *	dirp 		may be valid
1668 	 *	vp		may be valid or NULL if the target does not
1669 	 *			exist.
1670 	 *	dvp		is valid
1671 	 *
1672 	 * The error state is set through the code and we may also do some
1673 	 * opportunistic releasing of vnodes to avoid holding locks through
1674 	 * NFS I/O.  The cleanup at the end is a catch-all
1675 	 */
1676 
1677 	VATTR_NULL(vap);
1678 	if (info.v3) {
1679 		NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
1680 		how = fxdr_unsigned(int, *tl);
1681 		switch (how) {
1682 		case NFSV3CREATE_GUARDED:
1683 			if (vp) {
1684 				error = EEXIST;
1685 				break;
1686 			}
1687 			/* fall through */
1688 		case NFSV3CREATE_UNCHECKED:
1689 			ERROROUT(nfsm_srvsattr(&info, vap));
1690 			break;
1691 		case NFSV3CREATE_EXCLUSIVE:
1692 			NULLOUT(cp = nfsm_dissect(&info, NFSX_V3CREATEVERF));
1693 			bcopy(cp, cverf, NFSX_V3CREATEVERF);
1694 			exclusive_flag = 1;
1695 			break;
1696 		};
1697 		vap->va_type = VREG;
1698 	} else {
1699 		NULLOUT(sp = nfsm_dissect(&info, NFSX_V2SATTR));
1700 		vap->va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1701 		if (vap->va_type == VNON)
1702 			vap->va_type = VREG;
1703 		vap->va_mode = nfstov_mode(sp->sa_mode);
1704 		switch (vap->va_type) {
1705 		case VREG:
1706 			tsize = fxdr_unsigned(int32_t, sp->sa_size);
1707 			if (tsize != -1)
1708 				vap->va_size = (u_quad_t)tsize;
1709 			break;
1710 		case VCHR:
1711 		case VBLK:
1712 		case VFIFO:
1713 			rdev = fxdr_unsigned(long, sp->sa_size);
1714 			break;
1715 		default:
1716 			break;
1717 		};
1718 	}
1719 
1720 	/*
1721 	 * Iff doesn't exist, create it
1722 	 * otherwise just truncate to 0 length
1723 	 *   should I set the mode too ?
1724 	 *
1725 	 * The only possible error we can have at this point is EEXIST.
1726 	 * nd.ni_vp will also be non-NULL in that case.
1727 	 */
1728 	if (vp == NULL) {
1729 		if (vap->va_mode == (mode_t)VNOVAL)
1730 			vap->va_mode = 0;
1731 		if (vap->va_type == VREG || vap->va_type == VSOCK) {
1732 			vn_unlock(dvp);
1733 			error = VOP_NCREATE(&nd.nl_nch, dvp, &vp,
1734 					    nd.nl_cred, vap);
1735 			vrele(dvp);
1736 			dvp = NULL;
1737 			if (error == 0) {
1738 				if (exclusive_flag) {
1739 					exclusive_flag = 0;
1740 					VATTR_NULL(vap);
1741 					bcopy(cverf, (caddr_t)&vap->va_atime,
1742 						NFSX_V3CREATEVERF);
1743 					error = VOP_SETATTR(vp, vap, cred);
1744 				}
1745 			}
1746 		} else if (
1747 			vap->va_type == VCHR ||
1748 			vap->va_type == VBLK ||
1749 			vap->va_type == VFIFO
1750 		) {
1751 			/*
1752 			 * Handle SysV FIFO node special cases.  All other
1753 			 * devices require super user to access.
1754 			 */
1755 			if (vap->va_type == VCHR && rdev == 0xffffffff)
1756 				vap->va_type = VFIFO;
1757                         if (vap->va_type != VFIFO &&
1758                             (error = priv_check_cred(cred, PRIV_ROOT, 0))) {
1759 				goto nfsmreply0;
1760                         }
1761 			vap->va_rmajor = umajor(rdev);
1762 			vap->va_rminor = uminor(rdev);
1763 
1764 			vn_unlock(dvp);
1765 			error = VOP_NMKNOD(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap);
1766 			vrele(dvp);
1767 			dvp = NULL;
1768 			if (error)
1769 				goto nfsmreply0;
1770 #if 0
1771 			/*
1772 			 * XXX what is this junk supposed to do ?
1773 			 */
1774 
1775 			vput(vp);
1776 			vp = NULL;
1777 
1778 			/*
1779 			 * release dvp prior to lookup
1780 			 */
1781 			vput(dvp);
1782 			dvp = NULL;
1783 
1784 			/*
1785 			 * Setup for lookup.
1786 			 *
1787 			 * Even though LOCKPARENT was cleared, ni_dvp may
1788 			 * be garbage.
1789 			 */
1790 			nd.ni_cnd.cn_nameiop = NAMEI_LOOKUP;
1791 			nd.ni_cnd.cn_flags &= ~(CNP_LOCKPARENT);
1792 			nd.ni_cnd.cn_td = td;
1793 			nd.ni_cnd.cn_cred = cred;
1794 
1795 			error = lookup(&nd);
1796 			nd.ni_dvp = NULL;
1797 
1798 			if (error != 0) {
1799 				NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1800 						      0, &error));
1801 				/* fall through on certain errors */
1802 			}
1803 			nfsrv_object_create(nd.ni_vp);
1804 			if (nd.ni_cnd.cn_flags & CNP_ISSYMLINK) {
1805 				error = EINVAL;
1806 				goto nfsmreply0;
1807 			}
1808 #endif
1809 		} else {
1810 			error = ENXIO;
1811 		}
1812 	} else {
1813 		if (vap->va_size != -1) {
1814 			error = nfsrv_access(mp, vp, VWRITE, cred,
1815 			    (nd.nl_flags & NLC_NFS_RDONLY), td, 0);
1816 			if (!error) {
1817 				tempsize = vap->va_size;
1818 				VATTR_NULL(vap);
1819 				vap->va_size = tempsize;
1820 				error = VOP_SETATTR(vp, vap, cred);
1821 			}
1822 		}
1823 	}
1824 
1825 	if (!error) {
1826 		bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
1827 		error = VFS_VPTOFH(vp, &fhp->fh_fid);
1828 		if (!error)
1829 			error = VOP_GETATTR(vp, vap);
1830 	}
1831 	if (info.v3) {
1832 		if (exclusive_flag && !error &&
1833 			bcmp(cverf, (caddr_t)&vap->va_atime, NFSX_V3CREATEVERF))
1834 			error = EEXIST;
1835 		diraft_ret = VOP_GETATTR(dirp, &diraft);
1836 		vrele(dirp);
1837 		dirp = NULL;
1838 	}
1839 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1840 			      NFSX_SRVFH(info.v3) + NFSX_FATTR(info.v3) +
1841 			      NFSX_WCCDATA(info.v3),
1842 			      &error));
1843 	if (info.v3) {
1844 		if (!error) {
1845 			nfsm_srvpostop_fh(&info, fhp);
1846 			nfsm_srvpostop_attr(&info, nfsd, 0, vap);
1847 		}
1848 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
1849 				 diraft_ret, &diraft);
1850 		error = 0;
1851 	} else {
1852 		nfsm_srvfhtom(&info, fhp);
1853 		fp = nfsm_build(&info, NFSX_V2FATTR);
1854 		nfsm_srvfattr(nfsd, vap, fp);
1855 	}
1856 	goto nfsmout;
1857 
1858 nfsmreply0:
1859 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, 0, &error));
1860 	error = 0;
1861 	/* fall through */
1862 
1863 nfsmout:
1864 	*mrq = info.mreq;
1865 	if (dirp)
1866 		vrele(dirp);
1867 	nlookup_done(&nd);
1868 	if (dvp) {
1869 		if (dvp == vp)
1870 			vrele(dvp);
1871 		else
1872 			vput(dvp);
1873 	}
1874 	if (vp)
1875 		vput(vp);
1876 	return (error);
1877 }
1878 
1879 /*
1880  * nfs v3 mknod service
1881  */
1882 int
1883 nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1884 	    struct thread *td, struct mbuf **mrq)
1885 {
1886 	struct sockaddr *nam = nfsd->nd_nam;
1887 	struct ucred *cred = &nfsd->nd_cr;
1888 	struct vattr va, dirfor, diraft;
1889 	struct vattr *vap = &va;
1890 	u_int32_t *tl;
1891 	struct nlookupdata nd;
1892 	int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
1893 	enum vtype vtyp;
1894 	struct vnode *dirp;
1895 	struct vnode *dvp;
1896 	struct vnode *vp;
1897 	nfsfh_t nfh;
1898 	fhandle_t *fhp;
1899 	struct nfsm_info info;
1900 
1901 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
1902 	nlookup_zero(&nd);
1903 	dirp = NULL;
1904 	dvp = NULL;
1905 	vp = NULL;
1906 
1907 	info.mrep = nfsd->nd_mrep;
1908 	info.mreq = NULL;
1909 	info.md = nfsd->nd_md;
1910 	info.dpos = nfsd->nd_dpos;
1911 
1912 	fhp = &nfh.fh_generic;
1913 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
1914 	NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
1915 
1916 	/*
1917 	 * Handle nfs_namei() call.  If an error occurs, the nd structure
1918 	 * is not valid.  However, nfsm_*() routines may still jump to
1919 	 * nfsmout.
1920 	 */
1921 
1922 	error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
1923 			  fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
1924 			  td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
1925 	if (dirp)
1926 		dirfor_ret = VOP_GETATTR(dirp, &dirfor);
1927 	if (error) {
1928 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
1929 			   NFSX_WCCDATA(1), &error));
1930 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
1931 				 diraft_ret, &diraft);
1932 		error = 0;
1933 		goto nfsmout;
1934 	}
1935 	NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
1936 	vtyp = nfsv3tov_type(*tl);
1937 	if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1938 		error = NFSERR_BADTYPE;
1939 		goto out;
1940 	}
1941 	VATTR_NULL(vap);
1942 	ERROROUT(nfsm_srvsattr(&info, vap));
1943 	if (vtyp == VCHR || vtyp == VBLK) {
1944 		NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
1945 		vap->va_rmajor = fxdr_unsigned(u_int32_t, *tl++);
1946 		vap->va_rminor = fxdr_unsigned(u_int32_t, *tl);
1947 	}
1948 
1949 	/*
1950 	 * Iff doesn't exist, create it.
1951 	 */
1952 	if (vp) {
1953 		error = EEXIST;
1954 		goto out;
1955 	}
1956 	vap->va_type = vtyp;
1957 	if (vap->va_mode == (mode_t)VNOVAL)
1958 		vap->va_mode = 0;
1959 	if (vtyp == VSOCK) {
1960 		vn_unlock(dvp);
1961 		error = VOP_NCREATE(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap);
1962 		vrele(dvp);
1963 		dvp = NULL;
1964 	} else {
1965 		if (vtyp != VFIFO && (error = priv_check_cred(cred, PRIV_ROOT, 0)))
1966 			goto out;
1967 
1968 		vn_unlock(dvp);
1969 		error = VOP_NMKNOD(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap);
1970 		vrele(dvp);
1971 		dvp = NULL;
1972 		if (error)
1973 			goto out;
1974 	}
1975 
1976 	/*
1977 	 * send response, cleanup, return.
1978 	 */
1979 out:
1980 	nlookup_done(&nd);
1981 	if (dvp) {
1982 		if (dvp == vp)
1983 			vrele(dvp);
1984 		else
1985 			vput(dvp);
1986 		dvp = NULL;
1987 	}
1988 	if (!error) {
1989 		bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
1990 		error = VFS_VPTOFH(vp, &fhp->fh_fid);
1991 		if (!error)
1992 			error = VOP_GETATTR(vp, vap);
1993 	}
1994 	if (vp) {
1995 		vput(vp);
1996 		vp = NULL;
1997 	}
1998 	diraft_ret = VOP_GETATTR(dirp, &diraft);
1999 	if (dirp) {
2000 		vrele(dirp);
2001 		dirp = NULL;
2002 	}
2003 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2004 			      NFSX_SRVFH(1) + NFSX_POSTOPATTR(1) +
2005 			      NFSX_WCCDATA(1), &error));
2006 	if (!error) {
2007 		nfsm_srvpostop_fh(&info, fhp);
2008 		nfsm_srvpostop_attr(&info, nfsd, 0, vap);
2009 	}
2010 	nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2011 			 diraft_ret, &diraft);
2012 	*mrq = info.mreq;
2013 	return (0);
2014 nfsmout:
2015 	*mrq = info.mreq;
2016 	if (dirp)
2017 		vrele(dirp);
2018 	nlookup_done(&nd);
2019 	if (dvp) {
2020 		if (dvp == vp)
2021 			vrele(dvp);
2022 		else
2023 			vput(dvp);
2024 	}
2025 	if (vp)
2026 		vput(vp);
2027 	return (error);
2028 }
2029 
2030 /*
2031  * nfs remove service
2032  */
2033 int
2034 nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2035 	     struct thread *td, struct mbuf **mrq)
2036 {
2037 	struct sockaddr *nam = nfsd->nd_nam;
2038 	struct ucred *cred = &nfsd->nd_cr;
2039 	struct nlookupdata nd;
2040 	int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
2041 	struct vnode *dirp;
2042 	struct vnode *dvp;
2043 	struct vnode *vp;
2044 	struct vattr dirfor, diraft;
2045 	nfsfh_t nfh;
2046 	fhandle_t *fhp;
2047 	struct nfsm_info info;
2048 
2049 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2050 	nlookup_zero(&nd);
2051 	dirp = NULL;
2052 	dvp = NULL;
2053 	vp = NULL;
2054 
2055 	info.mrep = nfsd->nd_mrep;
2056 	info.mreq = NULL;
2057 	info.md = nfsd->nd_md;
2058 	info.dpos = nfsd->nd_dpos;
2059 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
2060 
2061 	fhp = &nfh.fh_generic;
2062 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2063 	NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2064 
2065 	error = nfs_namei(&nd, cred, NLC_DELETE, &dvp, &vp,
2066 			  fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2067 			  td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2068 	if (dirp) {
2069 		if (info.v3)
2070 			dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2071 	}
2072 	if (error == 0) {
2073 		if (vp->v_type == VDIR) {
2074 			error = EPERM;		/* POSIX */
2075 			goto out;
2076 		}
2077 		/*
2078 		 * The root of a mounted filesystem cannot be deleted.
2079 		 */
2080 		if (vp->v_flag & VROOT) {
2081 			error = EBUSY;
2082 			goto out;
2083 		}
2084 out:
2085 		if (!error) {
2086 			if (dvp != vp)
2087 				vn_unlock(dvp);
2088 			if (vp) {
2089 				vput(vp);
2090 				vp = NULL;
2091 			}
2092 			error = VOP_NREMOVE(&nd.nl_nch, dvp, nd.nl_cred);
2093 			vrele(dvp);
2094 			dvp = NULL;
2095 		}
2096 	}
2097 	if (dirp && info.v3)
2098 		diraft_ret = VOP_GETATTR(dirp, &diraft);
2099 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_WCCDATA(info.v3), &error));
2100 	if (info.v3) {
2101 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2102 				 diraft_ret, &diraft);
2103 		error = 0;
2104 	}
2105 nfsmout:
2106 	*mrq = info.mreq;
2107 	nlookup_done(&nd);
2108 	if (dirp)
2109 		vrele(dirp);
2110 	if (dvp) {
2111 		if (dvp == vp)
2112 			vrele(dvp);
2113 		else
2114 			vput(dvp);
2115 	}
2116 	if (vp)
2117 		vput(vp);
2118 	return(error);
2119 }
2120 
2121 /*
2122  * nfs rename service
2123  */
2124 int
2125 nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2126 	     struct thread *td, struct mbuf **mrq)
2127 {
2128 	struct sockaddr *nam = nfsd->nd_nam;
2129 	struct ucred *cred = &nfsd->nd_cr;
2130 	int error = 0, len, len2, fdirfor_ret = 1, fdiraft_ret = 1;
2131 	int tdirfor_ret = 1, tdiraft_ret = 1;
2132 	struct nlookupdata fromnd, tond;
2133 	struct vnode *fvp, *fdirp, *fdvp;
2134 	struct vnode *tvp, *tdirp, *tdvp;
2135 	struct namecache *ncp;
2136 	struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
2137 	nfsfh_t fnfh, tnfh;
2138 	fhandle_t *ffhp, *tfhp;
2139 	uid_t saved_uid;
2140 	struct nfsm_info info;
2141 
2142 	info.mrep = nfsd->nd_mrep;
2143 	info.mreq = NULL;
2144 	info.md = nfsd->nd_md;
2145 	info.dpos = nfsd->nd_dpos;
2146 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
2147 
2148 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2149 #ifndef nolint
2150 	fvp = NULL;
2151 #endif
2152 	ffhp = &fnfh.fh_generic;
2153 	tfhp = &tnfh.fh_generic;
2154 
2155 	/*
2156 	 * Clear fields incase goto nfsmout occurs from macro.
2157 	 */
2158 
2159 	nlookup_zero(&fromnd);
2160 	nlookup_zero(&tond);
2161 	fdirp = NULL;
2162 	tdirp = NULL;
2163 
2164 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, ffhp, &error));
2165 	NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2166 
2167 	/*
2168 	 * Remember our original uid so that we can reset cr_uid before
2169 	 * the second nfs_namei() call, in case it is remapped.
2170 	 */
2171 	saved_uid = cred->cr_uid;
2172 	error = nfs_namei(&fromnd, cred, NLC_RENAME_SRC,
2173 			  NULL, NULL,
2174 			  ffhp, len, slp, nam, &info.md, &info.dpos, &fdirp,
2175 			  td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2176 	if (fdirp) {
2177 		if (info.v3)
2178 			fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor);
2179 	}
2180 	if (error) {
2181 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2182 				      2 * NFSX_WCCDATA(info.v3), &error));
2183 		nfsm_srvwcc_data(&info, nfsd, fdirfor_ret, &fdirfor,
2184 				 fdiraft_ret, &fdiraft);
2185 		nfsm_srvwcc_data(&info, nfsd, tdirfor_ret, &tdirfor,
2186 				 tdiraft_ret, &tdiraft);
2187 		error = 0;
2188 		goto nfsmout;
2189 	}
2190 
2191 	/*
2192 	 * We have to unlock the from ncp before we can safely lookup
2193 	 * the target ncp.
2194 	 */
2195 	KKASSERT(fromnd.nl_flags & NLC_NCPISLOCKED);
2196 	cache_unlock(&fromnd.nl_nch);
2197 	fromnd.nl_flags &= ~NLC_NCPISLOCKED;
2198 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, tfhp, &error));
2199 	NEGATIVEOUT(len2 = nfsm_strsiz(&info, NFS_MAXNAMLEN));
2200 	cred->cr_uid = saved_uid;
2201 
2202 	error = nfs_namei(&tond, cred, NLC_RENAME_DST, NULL, NULL,
2203 			  tfhp, len2, slp, nam, &info.md, &info.dpos, &tdirp,
2204 			  td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2205 	if (tdirp) {
2206 		if (info.v3)
2207 			tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor);
2208 	}
2209 	if (error)
2210 		goto out1;
2211 
2212 	/*
2213 	 * relock the source
2214 	 */
2215 	if (cache_lock_nonblock(&fromnd.nl_nch) == 0) {
2216 		cache_resolve(&fromnd.nl_nch, fromnd.nl_cred);
2217 	} else if (fromnd.nl_nch.ncp > tond.nl_nch.ncp) {
2218 		cache_lock(&fromnd.nl_nch);
2219 		cache_resolve(&fromnd.nl_nch, fromnd.nl_cred);
2220 	} else {
2221 		cache_unlock(&tond.nl_nch);
2222 		cache_lock(&fromnd.nl_nch);
2223 		cache_resolve(&fromnd.nl_nch, fromnd.nl_cred);
2224 		cache_lock(&tond.nl_nch);
2225 		cache_resolve(&tond.nl_nch, tond.nl_cred);
2226 	}
2227 	fromnd.nl_flags |= NLC_NCPISLOCKED;
2228 
2229 	fvp = fromnd.nl_nch.ncp->nc_vp;
2230 	tvp = tond.nl_nch.ncp->nc_vp;
2231 
2232 	/*
2233 	 * Set fdvp and tdvp.  We haven't done all the topology checks
2234 	 * so these can wind up NULL (e.g. if either fvp or tvp is a mount
2235 	 * point).  If we get through the checks these will be guarenteed
2236 	 * to be non-NULL.
2237 	 *
2238 	 * Holding the children ncp's should be sufficient to prevent
2239 	 * fdvp and tdvp ripouts.
2240 	 */
2241 	if (fromnd.nl_nch.ncp->nc_parent)
2242 		fdvp = fromnd.nl_nch.ncp->nc_parent->nc_vp;
2243 	else
2244 		fdvp = NULL;
2245 	if (tond.nl_nch.ncp->nc_parent)
2246 		tdvp = tond.nl_nch.ncp->nc_parent->nc_vp;
2247 	else
2248 		tdvp = NULL;
2249 
2250 	if (tvp != NULL) {
2251 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
2252 			if (info.v3)
2253 				error = EEXIST;
2254 			else
2255 				error = EISDIR;
2256 			goto out;
2257 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
2258 			if (info.v3)
2259 				error = EEXIST;
2260 			else
2261 				error = ENOTDIR;
2262 			goto out;
2263 		}
2264 		if (tvp->v_type == VDIR && (tond.nl_nch.ncp->nc_flag & NCF_ISMOUNTPT)) {
2265 			if (info.v3)
2266 				error = EXDEV;
2267 			else
2268 				error = ENOTEMPTY;
2269 			goto out;
2270 		}
2271 	}
2272 	if (fvp->v_type == VDIR && (fromnd.nl_nch.ncp->nc_flag & NCF_ISMOUNTPT)) {
2273 		if (info.v3)
2274 			error = EXDEV;
2275 		else
2276 			error = ENOTEMPTY;
2277 		goto out;
2278 	}
2279 	if (fromnd.nl_nch.mount != tond.nl_nch.mount) {
2280 		if (info.v3)
2281 			error = EXDEV;
2282 		else
2283 			error = ENOTEMPTY;
2284 		goto out;
2285 	}
2286 	if (fromnd.nl_nch.ncp == tond.nl_nch.ncp->nc_parent) {
2287 		if (info.v3)
2288 			error = EINVAL;
2289 		else
2290 			error = ENOTEMPTY;
2291 	}
2292 
2293 	/*
2294 	 * You cannot rename a source into itself or a subdirectory of itself.
2295 	 * We check this by travsering the target directory upwards looking
2296 	 * for a match against the source.
2297 	 */
2298 	if (error == 0) {
2299 		for (ncp = tond.nl_nch.ncp; ncp; ncp = ncp->nc_parent) {
2300 			if (fromnd.nl_nch.ncp == ncp) {
2301 				error = EINVAL;
2302 				break;
2303 			}
2304 		}
2305 	}
2306 
2307 	/*
2308 	 * If source is the same as the destination (that is the
2309 	 * same vnode with the same name in the same directory),
2310 	 * then there is nothing to do.
2311 	 */
2312 	if (fromnd.nl_nch.ncp == tond.nl_nch.ncp)
2313 		error = -1;
2314 out:
2315 	if (!error) {
2316 		/*
2317 		 * The VOP_NRENAME function releases all vnode references &
2318 		 * locks prior to returning so we need to clear the pointers
2319 		 * to bypass cleanup code later on.
2320 		 */
2321 		error = VOP_NRENAME(&fromnd.nl_nch, &tond.nl_nch,
2322 				    fdvp, tdvp, tond.nl_cred);
2323 	} else {
2324 		if (error == -1)
2325 			error = 0;
2326 	}
2327 	/* fall through */
2328 
2329 out1:
2330 	if (fdirp)
2331 		fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft);
2332 	if (tdirp)
2333 		tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft);
2334 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2335 			      2 * NFSX_WCCDATA(info.v3), &error));
2336 	if (info.v3) {
2337 		nfsm_srvwcc_data(&info, nfsd, fdirfor_ret, &fdirfor,
2338 				 fdiraft_ret, &fdiraft);
2339 		nfsm_srvwcc_data(&info, nfsd, tdirfor_ret, &tdirfor,
2340 				 tdiraft_ret, &tdiraft);
2341 	}
2342 	error = 0;
2343 	/* fall through */
2344 
2345 nfsmout:
2346 	*mrq = info.mreq;
2347 	if (tdirp)
2348 		vrele(tdirp);
2349 	nlookup_done(&tond);
2350 	if (fdirp)
2351 		vrele(fdirp);
2352 	nlookup_done(&fromnd);
2353 	return (error);
2354 }
2355 
2356 /*
2357  * nfs link service
2358  */
2359 int
2360 nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2361 	   struct thread *td, struct mbuf **mrq)
2362 {
2363 	struct sockaddr *nam = nfsd->nd_nam;
2364 	struct ucred *cred = &nfsd->nd_cr;
2365 	struct nlookupdata nd;
2366 	int error = 0, rdonly, len, dirfor_ret = 1, diraft_ret = 1;
2367 	int getret = 1;
2368 	struct vnode *dirp;
2369 	struct vnode *dvp;
2370 	struct vnode *vp;
2371 	struct vnode *xp;
2372 	struct mount *mp;
2373 	struct mount *xmp;
2374 	struct vattr dirfor, diraft, at;
2375 	nfsfh_t nfh, dnfh;
2376 	fhandle_t *fhp, *dfhp;
2377 	struct nfsm_info info;
2378 
2379 	info.mrep = nfsd->nd_mrep;
2380 	info.mreq = NULL;
2381 	info.md = nfsd->nd_md;
2382 	info.dpos = nfsd->nd_dpos;
2383 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
2384 
2385 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2386 	nlookup_zero(&nd);
2387 	dirp = dvp = vp = xp = NULL;
2388 	mp = xmp = NULL;
2389 
2390 	fhp = &nfh.fh_generic;
2391 	dfhp = &dnfh.fh_generic;
2392 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2393 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, dfhp, &error));
2394 	NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2395 
2396 	error = nfsrv_fhtovp(fhp, FALSE, &xmp, &xp, cred, slp, nam,
2397 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
2398 	if (error) {
2399 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2400 				      NFSX_POSTOPATTR(info.v3) +
2401 				      NFSX_WCCDATA(info.v3),
2402 				      &error));
2403 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
2404 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2405 				 diraft_ret, &diraft);
2406 		xp = NULL;
2407 		error = 0;
2408 		goto nfsmout;
2409 	}
2410 	if (xp->v_type == VDIR) {
2411 		error = EPERM;		/* POSIX */
2412 		goto out1;
2413 	}
2414 
2415 	error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
2416 			  dfhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2417 			  td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2418 	if (dirp) {
2419 		if (info.v3)
2420 			dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2421 	}
2422 	if (error)
2423 		goto out1;
2424 
2425 	if (vp != NULL) {
2426 		error = EEXIST;
2427 		goto out;
2428 	}
2429 	if (xp->v_mount != dvp->v_mount)
2430 		error = EXDEV;
2431 out:
2432 	if (!error) {
2433 		vn_unlock(dvp);
2434 		error = VOP_NLINK(&nd.nl_nch, dvp, xp, nd.nl_cred);
2435 		vrele(dvp);
2436 		dvp = NULL;
2437 	}
2438 	/* fall through */
2439 
2440 out1:
2441 	if (info.v3)
2442 		getret = VOP_GETATTR(xp, &at);
2443 	if (dirp)
2444 		diraft_ret = VOP_GETATTR(dirp, &diraft);
2445 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2446 			      NFSX_POSTOPATTR(info.v3) + NFSX_WCCDATA(info.v3),
2447 			      &error));
2448 	if (info.v3) {
2449 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
2450 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2451 				 diraft_ret, &diraft);
2452 		error = 0;
2453 	}
2454 	/* fall through */
2455 
2456 nfsmout:
2457 	*mrq = info.mreq;
2458 	nlookup_done(&nd);
2459 	if (dirp)
2460 		vrele(dirp);
2461 	if (xp)
2462 		vrele(xp);
2463 	if (dvp) {
2464 		if (dvp == vp)
2465 			vrele(dvp);
2466 		else
2467 			vput(dvp);
2468 	}
2469 	if (vp)
2470 		vput(vp);
2471 	return(error);
2472 }
2473 
2474 /*
2475  * nfs symbolic link service
2476  */
2477 int
2478 nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2479 	      struct thread *td, struct mbuf **mrq)
2480 {
2481 	struct sockaddr *nam = nfsd->nd_nam;
2482 	struct ucred *cred = &nfsd->nd_cr;
2483 	struct vattr va, dirfor, diraft;
2484 	struct nlookupdata nd;
2485 	struct vattr *vap = &va;
2486 	struct nfsv2_sattr *sp;
2487 	char *pathcp = NULL;
2488 	struct uio io;
2489 	struct iovec iv;
2490 	int error = 0, len, len2, dirfor_ret = 1, diraft_ret = 1;
2491 	struct vnode *dirp;
2492 	struct vnode *vp;
2493 	struct vnode *dvp;
2494 	nfsfh_t nfh;
2495 	fhandle_t *fhp;
2496 	struct nfsm_info info;
2497 
2498 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2499 	nlookup_zero(&nd);
2500 	dirp = NULL;
2501 	dvp = NULL;
2502 	vp = NULL;
2503 
2504 	info.mrep = nfsd->nd_mrep;
2505 	info.mreq =  NULL;
2506 	info.md = nfsd->nd_md;
2507 	info.dpos = nfsd->nd_dpos;
2508 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
2509 
2510 	fhp = &nfh.fh_generic;
2511 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2512 	NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2513 
2514 	error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
2515 			fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2516 			td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2517 	if (dirp) {
2518 		if (info.v3)
2519 			dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2520 	}
2521 	if (error)
2522 		goto out;
2523 
2524 	VATTR_NULL(vap);
2525 	if (info.v3) {
2526 		ERROROUT(nfsm_srvsattr(&info, vap));
2527 	}
2528 	NEGATIVEOUT(len2 = nfsm_strsiz(&info, NFS_MAXPATHLEN));
2529 	pathcp = kmalloc(len2 + 1, M_TEMP, M_WAITOK);
2530 	iv.iov_base = pathcp;
2531 	iv.iov_len = len2;
2532 	io.uio_resid = len2;
2533 	io.uio_offset = 0;
2534 	io.uio_iov = &iv;
2535 	io.uio_iovcnt = 1;
2536 	io.uio_segflg = UIO_SYSSPACE;
2537 	io.uio_rw = UIO_READ;
2538 	io.uio_td = NULL;
2539 	ERROROUT(nfsm_mtouio(&info, &io, len2));
2540 	if (info.v3 == 0) {
2541 		NULLOUT(sp = nfsm_dissect(&info, NFSX_V2SATTR));
2542 		vap->va_mode = nfstov_mode(sp->sa_mode);
2543 	}
2544 	*(pathcp + len2) = '\0';
2545 	if (vp) {
2546 		error = EEXIST;
2547 		goto out;
2548 	}
2549 
2550 	if (vap->va_mode == (mode_t)VNOVAL)
2551 		vap->va_mode = 0;
2552 	if (dvp != vp)
2553 		vn_unlock(dvp);
2554 	error = VOP_NSYMLINK(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap, pathcp);
2555 	vrele(dvp);
2556 	dvp = NULL;
2557 	if (error == 0) {
2558 		bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
2559 		error = VFS_VPTOFH(vp, &fhp->fh_fid);
2560 		if (!error)
2561 			error = VOP_GETATTR(vp, vap);
2562 	}
2563 
2564 out:
2565 	if (dvp) {
2566 		if (dvp == vp)
2567 			vrele(dvp);
2568 		else
2569 			vput(dvp);
2570 	}
2571 	if (vp) {
2572 		vput(vp);
2573 		vp = NULL;
2574 	}
2575 	if (pathcp) {
2576 		kfree(pathcp, M_TEMP);
2577 		pathcp = NULL;
2578 	}
2579 	if (dirp) {
2580 		diraft_ret = VOP_GETATTR(dirp, &diraft);
2581 		vrele(dirp);
2582 		dirp = NULL;
2583 	}
2584 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2585 			      NFSX_SRVFH(info.v3) + NFSX_POSTOPATTR(info.v3) +
2586 			      NFSX_WCCDATA(info.v3),
2587 			      &error));
2588 	if (info.v3) {
2589 		if (!error) {
2590 			nfsm_srvpostop_fh(&info, fhp);
2591 			nfsm_srvpostop_attr(&info, nfsd, 0, vap);
2592 		}
2593 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2594 				 diraft_ret, &diraft);
2595 	}
2596 	error = 0;
2597 	/* fall through */
2598 
2599 nfsmout:
2600 	*mrq = info.mreq;
2601 	nlookup_done(&nd);
2602 	if (vp)
2603 		vput(vp);
2604 	if (dirp)
2605 		vrele(dirp);
2606 	if (pathcp)
2607 		kfree(pathcp, M_TEMP);
2608 	return (error);
2609 }
2610 
2611 /*
2612  * nfs mkdir service
2613  */
2614 int
2615 nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2616 	    struct thread *td, struct mbuf **mrq)
2617 {
2618 	struct sockaddr *nam = nfsd->nd_nam;
2619 	struct ucred *cred = &nfsd->nd_cr;
2620 	struct vattr va, dirfor, diraft;
2621 	struct vattr *vap = &va;
2622 	struct nfs_fattr *fp;
2623 	struct nlookupdata nd;
2624 	u_int32_t *tl;
2625 	int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
2626 	struct vnode *dirp;
2627 	struct vnode *dvp;
2628 	struct vnode *vp;
2629 	nfsfh_t nfh;
2630 	fhandle_t *fhp;
2631 	struct nfsm_info info;
2632 
2633 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2634 	nlookup_zero(&nd);
2635 	dirp = NULL;
2636 	dvp = NULL;
2637 	vp = NULL;
2638 
2639 	info.dpos = nfsd->nd_dpos;
2640 	info.mrep = nfsd->nd_mrep;
2641 	info.mreq =  NULL;
2642 	info.md = nfsd->nd_md;
2643 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
2644 
2645 	fhp = &nfh.fh_generic;
2646 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2647 	NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2648 
2649 	error = nfs_namei(&nd, cred, NLC_CREATE, &dvp, &vp,
2650 			  fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2651 			  td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2652 	if (dirp) {
2653 		if (info.v3)
2654 			dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2655 	}
2656 	if (error) {
2657 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2658 				      NFSX_WCCDATA(info.v3), &error));
2659 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2660 				 diraft_ret, &diraft);
2661 		error = 0;
2662 		goto nfsmout;
2663 	}
2664 	VATTR_NULL(vap);
2665 	if (info.v3) {
2666 		ERROROUT(nfsm_srvsattr(&info, vap));
2667 	} else {
2668 		NULLOUT(tl = nfsm_dissect(&info, NFSX_UNSIGNED));
2669 		vap->va_mode = nfstov_mode(*tl++);
2670 	}
2671 
2672 	/*
2673 	 * At this point nd.ni_dvp is referenced and exclusively locked and
2674 	 * nd.ni_vp, if it exists, is referenced but not locked.
2675 	 */
2676 
2677 	vap->va_type = VDIR;
2678 	if (vp != NULL) {
2679 		error = EEXIST;
2680 		goto out;
2681 	}
2682 
2683 	/*
2684 	 * Issue mkdir op.  Since SAVESTART is not set, the pathname
2685 	 * component is freed by the VOP call.  This will fill-in
2686 	 * nd.ni_vp, reference, and exclusively lock it.
2687 	 */
2688 	if (vap->va_mode == (mode_t)VNOVAL)
2689 		vap->va_mode = 0;
2690 	vn_unlock(dvp);
2691 	error = VOP_NMKDIR(&nd.nl_nch, dvp, &vp, nd.nl_cred, vap);
2692 	vrele(dvp);
2693 	dvp = NULL;
2694 
2695 	if (error == 0) {
2696 		bzero(&fhp->fh_fid, sizeof(fhp->fh_fid));
2697 		error = VFS_VPTOFH(vp, &fhp->fh_fid);
2698 		if (error == 0)
2699 			error = VOP_GETATTR(vp, vap);
2700 	}
2701 out:
2702 	if (dirp)
2703 		diraft_ret = VOP_GETATTR(dirp, &diraft);
2704 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2705 			      NFSX_SRVFH(info.v3) + NFSX_POSTOPATTR(info.v3) +
2706 			      NFSX_WCCDATA(info.v3),
2707 			      &error));
2708 	if (info.v3) {
2709 		if (!error) {
2710 			nfsm_srvpostop_fh(&info, fhp);
2711 			nfsm_srvpostop_attr(&info, nfsd, 0, vap);
2712 		}
2713 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2714 				 diraft_ret, &diraft);
2715 	} else {
2716 		nfsm_srvfhtom(&info, fhp);
2717 		fp = nfsm_build(&info, NFSX_V2FATTR);
2718 		nfsm_srvfattr(nfsd, vap, fp);
2719 	}
2720 	error = 0;
2721 	/* fall through */
2722 
2723 nfsmout:
2724 	*mrq = info.mreq;
2725 	nlookup_done(&nd);
2726 	if (dirp)
2727 		vrele(dirp);
2728 	if (dvp) {
2729 		if (dvp == vp)
2730 			vrele(dvp);
2731 		else
2732 			vput(dvp);
2733 	}
2734 	if (vp)
2735 		vput(vp);
2736 	return (error);
2737 }
2738 
2739 /*
2740  * nfs rmdir service
2741  */
2742 int
2743 nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2744 	    struct thread *td, struct mbuf **mrq)
2745 {
2746 	struct sockaddr *nam = nfsd->nd_nam;
2747 	struct ucred *cred = &nfsd->nd_cr;
2748 	int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
2749 	struct vnode *dirp;
2750 	struct vnode *dvp;
2751 	struct vnode *vp;
2752 	struct vattr dirfor, diraft;
2753 	nfsfh_t nfh;
2754 	fhandle_t *fhp;
2755 	struct nlookupdata nd;
2756 	struct nfsm_info info;
2757 
2758 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2759 	nlookup_zero(&nd);
2760 	dirp = NULL;
2761 	dvp = NULL;
2762 	vp = NULL;
2763 
2764 	info.mrep = nfsd->nd_mrep;
2765 	info.mreq = NULL;
2766 	info.md = nfsd->nd_md;
2767 	info.dpos = nfsd->nd_dpos;
2768 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
2769 
2770 	fhp = &nfh.fh_generic;
2771 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2772 	NEGREPLYOUT(len = nfsm_srvnamesiz(&info, &error));
2773 
2774 	error = nfs_namei(&nd, cred, NLC_DELETE, &dvp, &vp,
2775 			  fhp, len, slp, nam, &info.md, &info.dpos, &dirp,
2776 			  td, (nfsd->nd_flag & ND_KERBAUTH), FALSE);
2777 	if (dirp) {
2778 		if (info.v3)
2779 			dirfor_ret = VOP_GETATTR(dirp, &dirfor);
2780 	}
2781 	if (error) {
2782 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2783 				      NFSX_WCCDATA(info.v3), &error));
2784 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2785 				 diraft_ret, &diraft);
2786 		error = 0;
2787 		goto nfsmout;
2788 	}
2789 	if (vp->v_type != VDIR) {
2790 		error = ENOTDIR;
2791 		goto out;
2792 	}
2793 
2794 	/*
2795 	 * The root of a mounted filesystem cannot be deleted.
2796 	 */
2797 	if (vp->v_flag & VROOT)
2798 		error = EBUSY;
2799 out:
2800 	/*
2801 	 * Issue or abort op.  Since SAVESTART is not set, path name
2802 	 * component is freed by the VOP after either.
2803 	 */
2804 	if (!error) {
2805 		if (dvp != vp)
2806 			vn_unlock(dvp);
2807 		vput(vp);
2808 		vp = NULL;
2809 		error = VOP_NRMDIR(&nd.nl_nch, dvp, nd.nl_cred);
2810 		vrele(dvp);
2811 		dvp = NULL;
2812 	}
2813 	nlookup_done(&nd);
2814 
2815 	if (dirp)
2816 		diraft_ret = VOP_GETATTR(dirp, &diraft);
2817 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_WCCDATA(info.v3), &error));
2818 	if (info.v3) {
2819 		nfsm_srvwcc_data(&info, nfsd, dirfor_ret, &dirfor,
2820 				 diraft_ret, &diraft);
2821 		error = 0;
2822 	}
2823 	/* fall through */
2824 
2825 nfsmout:
2826 	*mrq = info.mreq;
2827 	if (dvp) {
2828 		if (dvp == vp)
2829 			vrele(dvp);
2830 		else
2831 			vput(dvp);
2832 	}
2833 	nlookup_done(&nd);
2834 	if (dirp)
2835 		vrele(dirp);
2836 	if (vp)
2837 		vput(vp);
2838 	return(error);
2839 }
2840 
2841 /*
2842  * nfs readdir service
2843  * - mallocs what it thinks is enough to read
2844  *	count rounded up to a multiple of NFS_DIRBLKSIZ <= NFS_MAXREADDIR
2845  * - calls VOP_READDIR()
2846  * - loops around building the reply
2847  *	if the output generated exceeds count break out of loop
2848  *	The nfsm_clget macro is used here so that the reply will be packed
2849  *	tightly in mbuf clusters.
2850  * - it only knows that it has encountered eof when the VOP_READDIR()
2851  *	reads nothing
2852  * - as such one readdir rpc will return eof false although you are there
2853  *	and then the next will return eof
2854  * - it trims out records with d_fileno == 0
2855  *	this doesn't matter for Unix clients, but they might confuse clients
2856  *	for other os'.
2857  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2858  *	than requested, but this may not apply to all filesystems. For
2859  *	example, client NFS does not { although it is never remote mounted
2860  *	anyhow }
2861  *     The alternate call nfsrv_readdirplus() does lookups as well.
2862  * PS: The NFS protocol spec. does not clarify what the "count" byte
2863  *	argument is a count of.. just name strings and file id's or the
2864  *	entire reply rpc or ...
2865  *	I tried just file name and id sizes and it confused the Sun client,
2866  *	so I am using the full rpc size now. The "paranoia.." comment refers
2867  *	to including the status longwords that are not a part of the dir.
2868  *	"entry" structures, but are in the rpc.
2869  */
2870 struct flrep {
2871 	nfsuint64	fl_off;
2872 	u_int32_t	fl_postopok;
2873 	u_int32_t	fl_fattr[NFSX_V3FATTR / sizeof (u_int32_t)];
2874 	u_int32_t	fl_fhok;
2875 	u_int32_t	fl_fhsize;
2876 	u_int32_t	fl_nfh[NFSX_V3FH / sizeof (u_int32_t)];
2877 };
2878 
2879 int
2880 nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2881 	      struct thread *td, struct mbuf **mrq)
2882 {
2883 	struct sockaddr *nam = nfsd->nd_nam;
2884 	struct ucred *cred = &nfsd->nd_cr;
2885 	char *bp, *be;
2886 	struct dirent *dp;
2887 	caddr_t cp;
2888 	u_int32_t *tl;
2889 	struct mbuf *mp1, *mp2;
2890 	char *cpos, *cend, *rbuf;
2891 	struct vnode *vp = NULL;
2892 	struct mount *mp = NULL;
2893 	struct vattr at;
2894 	nfsfh_t nfh;
2895 	fhandle_t *fhp;
2896 	struct uio io;
2897 	struct iovec iv;
2898 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2899 	int siz, cnt, fullsiz, eofflag, rdonly, ncookies;
2900 	u_quad_t off, toff, verf;
2901 	off_t *cookies = NULL, *cookiep;
2902 	struct nfsm_info info;
2903 
2904 	info.mrep = nfsd->nd_mrep;
2905 	info.mreq = NULL;
2906 	info.md = nfsd->nd_md;
2907 	info.dpos = nfsd->nd_dpos;
2908 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
2909 
2910 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
2911 	fhp = &nfh.fh_generic;
2912 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
2913 	if (info.v3) {
2914 		NULLOUT(tl = nfsm_dissect(&info, 5 * NFSX_UNSIGNED));
2915 		toff = fxdr_hyper(tl);
2916 		tl += 2;
2917 		verf = fxdr_hyper(tl);
2918 		tl += 2;
2919 	} else {
2920 		NULLOUT(tl = nfsm_dissect(&info, 2 * NFSX_UNSIGNED));
2921 		toff = fxdr_unsigned(u_quad_t, *tl++);
2922 		verf = 0;	/* shut up gcc */
2923 	}
2924 	off = toff;
2925 	cnt = fxdr_unsigned(int, *tl);
2926 	siz = ((cnt + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
2927 	xfer = NFS_SRVMAXDATA(nfsd);
2928 	if ((unsigned)cnt > xfer)
2929 		cnt = xfer;
2930 	if ((unsigned)siz > xfer)
2931 		siz = xfer;
2932 	fullsiz = siz;
2933 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
2934 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
2935 	if (!error && vp->v_type != VDIR) {
2936 		error = ENOTDIR;
2937 		vput(vp);
2938 		vp = NULL;
2939 	}
2940 	if (error) {
2941 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
2942 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
2943 		error = 0;
2944 		goto nfsmout;
2945 	}
2946 
2947 	/*
2948 	 * Obtain lock on vnode for this section of the code
2949 	 */
2950 
2951 	if (info.v3) {
2952 		error = getret = VOP_GETATTR(vp, &at);
2953 #if 0
2954 		/*
2955 		 * XXX This check may be too strict for Solaris 2.5 clients.
2956 		 */
2957 		if (!error && toff && verf && verf != at.va_filerev)
2958 			error = NFSERR_BAD_COOKIE;
2959 #endif
2960 	}
2961 	if (!error)
2962 		error = nfsrv_access(mp, vp, VEXEC, cred, rdonly, td, 0);
2963 	if (error) {
2964 		vput(vp);
2965 		vp = NULL;
2966 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
2967 				      NFSX_POSTOPATTR(info.v3), &error));
2968 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
2969 		error = 0;
2970 		goto nfsmout;
2971 	}
2972 	vn_unlock(vp);
2973 
2974 	/*
2975 	 * end section.  Allocate rbuf and continue
2976 	 */
2977 	rbuf = kmalloc(siz, M_TEMP, M_WAITOK);
2978 again:
2979 	iv.iov_base = rbuf;
2980 	iv.iov_len = fullsiz;
2981 	io.uio_iov = &iv;
2982 	io.uio_iovcnt = 1;
2983 	io.uio_offset = (off_t)off;
2984 	io.uio_resid = fullsiz;
2985 	io.uio_segflg = UIO_SYSSPACE;
2986 	io.uio_rw = UIO_READ;
2987 	io.uio_td = NULL;
2988 	eofflag = 0;
2989 	if (cookies) {
2990 		kfree((caddr_t)cookies, M_TEMP);
2991 		cookies = NULL;
2992 	}
2993 	error = VOP_READDIR(vp, &io, cred, &eofflag, &ncookies, &cookies);
2994 	off = (off_t)io.uio_offset;
2995 	if (!cookies && !error)
2996 		error = NFSERR_PERM;
2997 	if (info.v3) {
2998 		getret = VOP_GETATTR(vp, &at);
2999 		if (!error)
3000 			error = getret;
3001 	}
3002 	if (error) {
3003 		vrele(vp);
3004 		vp = NULL;
3005 		kfree((caddr_t)rbuf, M_TEMP);
3006 		if (cookies)
3007 			kfree((caddr_t)cookies, M_TEMP);
3008 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3009 				      NFSX_POSTOPATTR(info.v3), &error));
3010 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3011 		error = 0;
3012 		goto nfsmout;
3013 	}
3014 	if (io.uio_resid) {
3015 		siz -= io.uio_resid;
3016 
3017 		/*
3018 		 * If nothing read, return eof
3019 		 * rpc reply
3020 		 */
3021 		if (siz == 0) {
3022 			vrele(vp);
3023 			vp = NULL;
3024 			NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3025 					      NFSX_POSTOPATTR(info.v3) +
3026 					      NFSX_COOKIEVERF(info.v3) +
3027 					      2 * NFSX_UNSIGNED,
3028 					      &error));
3029 			if (info.v3) {
3030 				nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3031 				tl = nfsm_build(&info, 4 * NFSX_UNSIGNED);
3032 				txdr_hyper(at.va_filerev, tl);
3033 				tl += 2;
3034 			} else
3035 				tl = nfsm_build(&info, 2 * NFSX_UNSIGNED);
3036 			*tl++ = nfs_false;
3037 			*tl = nfs_true;
3038 			kfree((caddr_t)rbuf, M_TEMP);
3039 			kfree((caddr_t)cookies, M_TEMP);
3040 			error = 0;
3041 			goto nfsmout;
3042 		}
3043 	}
3044 
3045 	/*
3046 	 * Check for degenerate cases of nothing useful read.
3047 	 * If so go try again
3048 	 */
3049 	cpos = rbuf;
3050 	cend = rbuf + siz;
3051 	dp = (struct dirent *)cpos;
3052 	cookiep = cookies;
3053 	/*
3054 	 * For some reason FreeBSD's ufs_readdir() chooses to back the
3055 	 * directory offset up to a block boundary, so it is necessary to
3056 	 * skip over the records that preceed the requested offset. This
3057 	 * requires the assumption that file offset cookies monotonically
3058 	 * increase.
3059 	 */
3060 	while (cpos < cend && ncookies > 0 &&
3061 		(dp->d_ino == 0 || dp->d_type == DT_WHT ||
3062 		 ((u_quad_t)(*cookiep)) <= toff)) {
3063 		dp = _DIRENT_NEXT(dp);
3064 		cpos = (char *)dp;
3065 		cookiep++;
3066 		ncookies--;
3067 	}
3068 	if (cpos >= cend || ncookies == 0) {
3069 		toff = off;
3070 		siz = fullsiz;
3071 		goto again;
3072 	}
3073 
3074 	len = 3 * NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
3075 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3076 			      NFSX_POSTOPATTR(info.v3) +
3077 			      NFSX_COOKIEVERF(info.v3) + siz,
3078 			      &error));
3079 	if (info.v3) {
3080 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3081 		tl = nfsm_build(&info, 2 * NFSX_UNSIGNED);
3082 		txdr_hyper(at.va_filerev, tl);
3083 	}
3084 	mp1 = mp2 = info.mb;
3085 	bp = info.bpos;
3086 	be = bp + M_TRAILINGSPACE(mp1);
3087 
3088 	/* Loop through the records and build reply */
3089 	while (cpos < cend && ncookies > 0) {
3090 		if (dp->d_ino != 0 && dp->d_type != DT_WHT) {
3091 			nlen = dp->d_namlen;
3092 			rem = nfsm_rndup(nlen) - nlen;
3093 			len += (4 * NFSX_UNSIGNED + nlen + rem);
3094 			if (info.v3)
3095 				len += 2 * NFSX_UNSIGNED;
3096 			if (len > cnt) {
3097 				eofflag = 0;
3098 				break;
3099 			}
3100 			/*
3101 			 * Build the directory record xdr from
3102 			 * the dirent entry.
3103 			 */
3104 			tl = nfsm_clget(&info, mp1, mp2, bp, be);
3105 			*tl = nfs_true;
3106 			bp += NFSX_UNSIGNED;
3107 			if (info.v3) {
3108 				tl = nfsm_clget(&info, mp1, mp2, bp, be);
3109 				*tl = txdr_unsigned(dp->d_ino >> 32);
3110 				bp += NFSX_UNSIGNED;
3111 			}
3112 			tl = nfsm_clget(&info, mp1, mp2, bp, be);
3113 			*tl = txdr_unsigned(dp->d_ino);
3114 			bp += NFSX_UNSIGNED;
3115 			tl = nfsm_clget(&info, mp1, mp2, bp, be);
3116 			*tl = txdr_unsigned(nlen);
3117 			bp += NFSX_UNSIGNED;
3118 
3119 			/* And loop around copying the name */
3120 			xfer = nlen;
3121 			cp = dp->d_name;
3122 			while (xfer > 0) {
3123 				tl = nfsm_clget(&info, mp1, mp2, bp, be);
3124 				if ((bp+xfer) > be)
3125 					tsiz = be-bp;
3126 				else
3127 					tsiz = xfer;
3128 				bcopy(cp, bp, tsiz);
3129 				bp += tsiz;
3130 				xfer -= tsiz;
3131 				if (xfer > 0)
3132 					cp += tsiz;
3133 			}
3134 			/* And null pad to a int32_t boundary */
3135 			for (i = 0; i < rem; i++)
3136 				*bp++ = '\0';
3137 			tl = nfsm_clget(&info, mp1, mp2, bp, be);
3138 
3139 			/* Finish off the record */
3140 			if (info.v3) {
3141 				*tl = txdr_unsigned(*cookiep >> 32);
3142 				bp += NFSX_UNSIGNED;
3143 				tl = nfsm_clget(&info, mp1, mp2, bp, be);
3144 			}
3145 			*tl = txdr_unsigned(*cookiep);
3146 			bp += NFSX_UNSIGNED;
3147 		}
3148 		dp = _DIRENT_NEXT(dp);
3149 		cpos = (char *)dp;
3150 		cookiep++;
3151 		ncookies--;
3152 	}
3153 	vrele(vp);
3154 	vp = NULL;
3155 	tl = nfsm_clget(&info, mp1, mp2, bp, be);
3156 	*tl = nfs_false;
3157 	bp += NFSX_UNSIGNED;
3158 	tl = nfsm_clget(&info, mp1, mp2, bp, be);
3159 	if (eofflag)
3160 		*tl = nfs_true;
3161 	else
3162 		*tl = nfs_false;
3163 	bp += NFSX_UNSIGNED;
3164 	if (mp1 != info.mb) {
3165 		if (bp < be)
3166 			mp1->m_len = bp - mtod(mp1, caddr_t);
3167 	} else
3168 		mp1->m_len += bp - info.bpos;
3169 	kfree((caddr_t)rbuf, M_TEMP);
3170 	kfree((caddr_t)cookies, M_TEMP);
3171 
3172 nfsmout:
3173 	*mrq = info.mreq;
3174 	if (vp)
3175 		vrele(vp);
3176 	return(error);
3177 }
3178 
3179 int
3180 nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3181 		  struct thread *td, struct mbuf **mrq)
3182 {
3183 	struct sockaddr *nam = nfsd->nd_nam;
3184 	struct ucred *cred = &nfsd->nd_cr;
3185 	char *bp, *be;
3186 	struct dirent *dp;
3187 	caddr_t cp;
3188 	u_int32_t *tl;
3189 	struct mbuf *mp1, *mp2;
3190 	char *cpos, *cend, *rbuf;
3191 	struct vnode *vp = NULL, *nvp;
3192 	struct mount *mp = NULL;
3193 	struct flrep fl;
3194 	nfsfh_t nfh;
3195 	fhandle_t *fhp, *nfhp = (fhandle_t *)fl.fl_nfh;
3196 	struct uio io;
3197 	struct iovec iv;
3198 	struct vattr va, at, *vap = &va;
3199 	struct nfs_fattr *fp;
3200 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
3201 	int siz, cnt, fullsiz, eofflag, rdonly, dirlen, ncookies;
3202 	u_quad_t off, toff, verf;
3203 	off_t *cookies = NULL, *cookiep; /* needs to be int64_t or off_t */
3204 	struct nfsm_info info;
3205 
3206 	info.mrep = nfsd->nd_mrep;
3207 	info.mreq = NULL;
3208 	info.md = nfsd->nd_md;
3209 	info.dpos = nfsd->nd_dpos;
3210 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
3211 
3212 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3213 	fhp = &nfh.fh_generic;
3214 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3215 	NULLOUT(tl = nfsm_dissect(&info, 6 * NFSX_UNSIGNED));
3216 	toff = fxdr_hyper(tl);
3217 	tl += 2;
3218 	verf = fxdr_hyper(tl);
3219 	tl += 2;
3220 	siz = fxdr_unsigned(int, *tl++);
3221 	cnt = fxdr_unsigned(int, *tl);
3222 	off = toff;
3223 	siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
3224 	xfer = NFS_SRVMAXDATA(nfsd);
3225 	if ((unsigned)cnt > xfer)
3226 		cnt = xfer;
3227 	if ((unsigned)siz > xfer)
3228 		siz = xfer;
3229 	fullsiz = siz;
3230 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3231 			     &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3232 	if (!error && vp->v_type != VDIR) {
3233 		error = ENOTDIR;
3234 		vput(vp);
3235 		vp = NULL;
3236 	}
3237 	if (error) {
3238 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
3239 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3240 		error = 0;
3241 		goto nfsmout;
3242 	}
3243 	error = getret = VOP_GETATTR(vp, &at);
3244 #if 0
3245 	/*
3246 	 * XXX This check may be too strict for Solaris 2.5 clients.
3247 	 */
3248 	if (!error && toff && verf && verf != at.va_filerev)
3249 		error = NFSERR_BAD_COOKIE;
3250 #endif
3251 	if (!error) {
3252 		error = nfsrv_access(mp, vp, VEXEC, cred, rdonly, td, 0);
3253 	}
3254 	if (error) {
3255 		vput(vp);
3256 		vp = NULL;
3257 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3258 				      NFSX_V3POSTOPATTR, &error));
3259 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3260 		error = 0;
3261 		goto nfsmout;
3262 	}
3263 	vn_unlock(vp);
3264 	rbuf = kmalloc(siz, M_TEMP, M_WAITOK);
3265 again:
3266 	iv.iov_base = rbuf;
3267 	iv.iov_len = fullsiz;
3268 	io.uio_iov = &iv;
3269 	io.uio_iovcnt = 1;
3270 	io.uio_offset = (off_t)off;
3271 	io.uio_resid = fullsiz;
3272 	io.uio_segflg = UIO_SYSSPACE;
3273 	io.uio_rw = UIO_READ;
3274 	io.uio_td = NULL;
3275 	eofflag = 0;
3276 	if (cookies) {
3277 		kfree((caddr_t)cookies, M_TEMP);
3278 		cookies = NULL;
3279 	}
3280 	error = VOP_READDIR(vp, &io, cred, &eofflag, &ncookies, &cookies);
3281 	off = (u_quad_t)io.uio_offset;
3282 	getret = VOP_GETATTR(vp, &at);
3283 	if (!cookies && !error)
3284 		error = NFSERR_PERM;
3285 	if (!error)
3286 		error = getret;
3287 	if (error) {
3288 		vrele(vp);
3289 		vp = NULL;
3290 		if (cookies)
3291 			kfree((caddr_t)cookies, M_TEMP);
3292 		kfree((caddr_t)rbuf, M_TEMP);
3293 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3294 				      NFSX_V3POSTOPATTR, &error));
3295 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3296 		error = 0;
3297 		goto nfsmout;
3298 	}
3299 	if (io.uio_resid) {
3300 		siz -= io.uio_resid;
3301 
3302 		/*
3303 		 * If nothing read, return eof
3304 		 * rpc reply
3305 		 */
3306 		if (siz == 0) {
3307 			vrele(vp);
3308 			vp = NULL;
3309 			NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3310 					      NFSX_V3POSTOPATTR +
3311 					      NFSX_V3COOKIEVERF +
3312 					      2 * NFSX_UNSIGNED,
3313 					      &error));
3314 			nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3315 			tl = nfsm_build(&info, 4 * NFSX_UNSIGNED);
3316 			txdr_hyper(at.va_filerev, tl);
3317 			tl += 2;
3318 			*tl++ = nfs_false;
3319 			*tl = nfs_true;
3320 			kfree((caddr_t)cookies, M_TEMP);
3321 			kfree((caddr_t)rbuf, M_TEMP);
3322 			error = 0;
3323 			goto nfsmout;
3324 		}
3325 	}
3326 
3327 	/*
3328 	 * Check for degenerate cases of nothing useful read.
3329 	 * If so go try again
3330 	 */
3331 	cpos = rbuf;
3332 	cend = rbuf + siz;
3333 	dp = (struct dirent *)cpos;
3334 	cookiep = cookies;
3335 	/*
3336 	 * For some reason FreeBSD's ufs_readdir() chooses to back the
3337 	 * directory offset up to a block boundary, so it is necessary to
3338 	 * skip over the records that preceed the requested offset. This
3339 	 * requires the assumption that file offset cookies monotonically
3340 	 * increase.
3341 	 */
3342 	while (cpos < cend && ncookies > 0 &&
3343 		(dp->d_ino == 0 || dp->d_type == DT_WHT ||
3344 		 ((u_quad_t)(*cookiep)) <= toff)) {
3345 		dp = _DIRENT_NEXT(dp);
3346 		cpos = (char *)dp;
3347 		cookiep++;
3348 		ncookies--;
3349 	}
3350 	if (cpos >= cend || ncookies == 0) {
3351 		toff = off;
3352 		siz = fullsiz;
3353 		goto again;
3354 	}
3355 
3356 	/*
3357 	 * Probe one of the directory entries to see if the filesystem
3358 	 * supports VGET.
3359 	 */
3360 	if (VFS_VGET(vp->v_mount, vp, dp->d_ino, &nvp) == EOPNOTSUPP) {
3361 		error = NFSERR_NOTSUPP;
3362 		vrele(vp);
3363 		vp = NULL;
3364 		kfree((caddr_t)cookies, M_TEMP);
3365 		kfree((caddr_t)rbuf, M_TEMP);
3366 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3367 				      NFSX_V3POSTOPATTR, &error));
3368 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3369 		error = 0;
3370 		goto nfsmout;
3371 	}
3372 	if (nvp) {
3373 		vput(nvp);
3374 		nvp = NULL;
3375 	}
3376 
3377 	dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
3378 			2 * NFSX_UNSIGNED;
3379 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, cnt, &error));
3380 	nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3381 	tl = nfsm_build(&info, 2 * NFSX_UNSIGNED);
3382 	txdr_hyper(at.va_filerev, tl);
3383 	mp1 = mp2 = info.mb;
3384 	bp = info.bpos;
3385 	be = bp + M_TRAILINGSPACE(mp1);
3386 
3387 	/* Loop through the records and build reply */
3388 	while (cpos < cend && ncookies > 0) {
3389 		if (dp->d_ino != 0 && dp->d_type != DT_WHT) {
3390 			nlen = dp->d_namlen;
3391 			rem = nfsm_rndup(nlen) - nlen;
3392 
3393 			/*
3394 			 * For readdir_and_lookup get the vnode using
3395 			 * the file number.
3396 			 */
3397 			if (VFS_VGET(vp->v_mount, vp, dp->d_ino, &nvp))
3398 				goto invalid;
3399 			bzero((caddr_t)nfhp, NFSX_V3FH);
3400 			nfhp->fh_fsid = fhp->fh_fsid;
3401 			if (VFS_VPTOFH(nvp, &nfhp->fh_fid)) {
3402 				vput(nvp);
3403 				nvp = NULL;
3404 				goto invalid;
3405 			}
3406 			if (VOP_GETATTR(nvp, vap)) {
3407 				vput(nvp);
3408 				nvp = NULL;
3409 				goto invalid;
3410 			}
3411 			vput(nvp);
3412 			nvp = NULL;
3413 
3414 			/*
3415 			 * If either the dircount or maxcount will be
3416 			 * exceeded, get out now. Both of these lengths
3417 			 * are calculated conservatively, including all
3418 			 * XDR overheads.
3419 			 */
3420 			len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
3421 				NFSX_V3POSTOPATTR);
3422 			dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
3423 			if (len > cnt || dirlen > fullsiz) {
3424 				eofflag = 0;
3425 				break;
3426 			}
3427 
3428 			/*
3429 			 * Build the directory record xdr from
3430 			 * the dirent entry.
3431 			 */
3432 			fp = (struct nfs_fattr *)&fl.fl_fattr;
3433 			nfsm_srvfattr(nfsd, vap, fp);
3434 			fl.fl_off.nfsuquad[0] = txdr_unsigned(*cookiep >> 32);
3435 			fl.fl_off.nfsuquad[1] = txdr_unsigned(*cookiep);
3436 			fl.fl_postopok = nfs_true;
3437 			fl.fl_fhok = nfs_true;
3438 			fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
3439 
3440 			tl = nfsm_clget(&info, mp1, mp2, bp, be);
3441 			*tl = nfs_true;
3442 			bp += NFSX_UNSIGNED;
3443 			tl = nfsm_clget(&info, mp1, mp2, bp, be);
3444 			*tl = txdr_unsigned(dp->d_ino >> 32);
3445 			bp += NFSX_UNSIGNED;
3446 			tl = nfsm_clget(&info, mp1, mp2, bp, be);
3447 			*tl = txdr_unsigned(dp->d_ino);
3448 			bp += NFSX_UNSIGNED;
3449 			tl = nfsm_clget(&info, mp1, mp2, bp, be);
3450 			*tl = txdr_unsigned(nlen);
3451 			bp += NFSX_UNSIGNED;
3452 
3453 			/* And loop around copying the name */
3454 			xfer = nlen;
3455 			cp = dp->d_name;
3456 			while (xfer > 0) {
3457 				tl = nfsm_clget(&info, mp1, mp2, bp, be);
3458 				if ((bp + xfer) > be)
3459 					tsiz = be - bp;
3460 				else
3461 					tsiz = xfer;
3462 				bcopy(cp, bp, tsiz);
3463 				bp += tsiz;
3464 				xfer -= tsiz;
3465 				cp += tsiz;
3466 			}
3467 			/* And null pad to a int32_t boundary */
3468 			for (i = 0; i < rem; i++)
3469 				*bp++ = '\0';
3470 
3471 			/*
3472 			 * Now copy the flrep structure out.
3473 			 */
3474 			xfer = sizeof (struct flrep);
3475 			cp = (caddr_t)&fl;
3476 			while (xfer > 0) {
3477 				tl = nfsm_clget(&info, mp1, mp2, bp, be);
3478 				if ((bp + xfer) > be)
3479 					tsiz = be - bp;
3480 				else
3481 					tsiz = xfer;
3482 				bcopy(cp, bp, tsiz);
3483 				bp += tsiz;
3484 				xfer -= tsiz;
3485 				cp += tsiz;
3486 			}
3487 		}
3488 invalid:
3489 		dp = _DIRENT_NEXT(dp);
3490 		cpos = (char *)dp;
3491 		cookiep++;
3492 		ncookies--;
3493 	}
3494 	vrele(vp);
3495 	vp = NULL;
3496 	tl = nfsm_clget(&info, mp1, mp2, bp, be);
3497 	*tl = nfs_false;
3498 	bp += NFSX_UNSIGNED;
3499 	tl = nfsm_clget(&info, mp1, mp2, bp, be);
3500 	if (eofflag)
3501 		*tl = nfs_true;
3502 	else
3503 		*tl = nfs_false;
3504 	bp += NFSX_UNSIGNED;
3505 	if (mp1 != info.mb) {
3506 		if (bp < be)
3507 			mp1->m_len = bp - mtod(mp1, caddr_t);
3508 	} else
3509 		mp1->m_len += bp - info.bpos;
3510 	kfree((caddr_t)cookies, M_TEMP);
3511 	kfree((caddr_t)rbuf, M_TEMP);
3512 nfsmout:
3513 	*mrq = info.mreq;
3514 	if (vp)
3515 		vrele(vp);
3516 	return(error);
3517 }
3518 
3519 /*
3520  * nfs commit service
3521  */
3522 int
3523 nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3524 	     struct thread *td, struct mbuf **mrq)
3525 {
3526 	struct sockaddr *nam = nfsd->nd_nam;
3527 	struct ucred *cred = &nfsd->nd_cr;
3528 	struct vattr bfor, aft;
3529 	struct vnode *vp = NULL;
3530 	struct mount *mp = NULL;
3531 	nfsfh_t nfh;
3532 	fhandle_t *fhp;
3533 	u_int32_t *tl;
3534 	int error = 0, rdonly, for_ret = 1, aft_ret = 1, cnt;
3535 	u_quad_t off;
3536 	struct nfsm_info info;
3537 
3538 	info.mrep = nfsd->nd_mrep;
3539 	info.mreq = NULL;
3540 	info.md = nfsd->nd_md;
3541 	info.dpos = nfsd->nd_dpos;
3542 
3543 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3544 	fhp = &nfh.fh_generic;
3545 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3546 	NULLOUT(tl = nfsm_dissect(&info, 3 * NFSX_UNSIGNED));
3547 
3548 	/*
3549 	 * XXX At this time VOP_FSYNC() does not accept offset and byte
3550 	 * count parameters, so these arguments are useless (someday maybe).
3551 	 */
3552 	off = fxdr_hyper(tl);
3553 	tl += 2;
3554 	cnt = fxdr_unsigned(int, *tl);
3555 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3556 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3557 	if (error) {
3558 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3559 				      2 * NFSX_UNSIGNED, &error));
3560 		nfsm_srvwcc_data(&info, nfsd, for_ret, &bfor,
3561 				 aft_ret, &aft);
3562 		error = 0;
3563 		goto nfsmout;
3564 	}
3565 	for_ret = VOP_GETATTR(vp, &bfor);
3566 
3567 	/*
3568 	 * RFC 1813 3.3.21: If count is 0, a flush from offset to the end of
3569 	 * file is done. At this time VOP_FSYNC does not accept offset and
3570 	 * byte count parameters, so call VOP_FSYNC the whole file for now.
3571 	 */
3572 	if (cnt == 0 || cnt > MAX_COMMIT_COUNT) {
3573 		/*
3574 		 * Give up and do the whole thing
3575 		 */
3576 		if (vp->v_object &&
3577 		   (vp->v_object->flags & OBJ_MIGHTBEDIRTY)) {
3578 			vm_object_page_clean(vp->v_object, 0, 0, OBJPC_SYNC);
3579 		}
3580 		error = VOP_FSYNC(vp, MNT_WAIT, 0);
3581 	} else {
3582 		/*
3583 		 * Locate and synchronously write any buffers that fall
3584 		 * into the requested range.  Note:  we are assuming that
3585 		 * f_iosize is a power of 2.
3586 		 */
3587 		int iosize = vp->v_mount->mnt_stat.f_iosize;
3588 		int iomask = iosize - 1;
3589 		off_t loffset;
3590 
3591 		/*
3592 		 * Align to iosize boundry, super-align to page boundry.
3593 		 */
3594 		if (off & iomask) {
3595 			cnt += off & iomask;
3596 			off &= ~(u_quad_t)iomask;
3597 		}
3598 		if (off & PAGE_MASK) {
3599 			cnt += off & PAGE_MASK;
3600 			off &= ~(u_quad_t)PAGE_MASK;
3601 		}
3602 		loffset = off;
3603 
3604 		if (vp->v_object &&
3605 		   (vp->v_object->flags & OBJ_MIGHTBEDIRTY)) {
3606 			vm_object_page_clean(vp->v_object, off / PAGE_SIZE,
3607 			    (cnt + PAGE_MASK) / PAGE_SIZE, OBJPC_SYNC);
3608 		}
3609 
3610 		crit_enter();
3611 		while (error == 0 || cnt > 0) {
3612 			struct buf *bp;
3613 
3614 			/*
3615 			 * If we have a buffer and it is marked B_DELWRI we
3616 			 * have to lock and write it.  Otherwise the prior
3617 			 * write is assumed to have already been committed.
3618 			 *
3619 			 * WARNING: FINDBLK_TEST buffers represent stable
3620 			 *	    storage but not necessarily stable
3621 			 *	    content.  It is ok in this case.
3622 			 */
3623 			if ((bp = findblk(vp, loffset, FINDBLK_TEST)) != NULL) {
3624 				if (bp->b_flags & B_DELWRI)
3625 					bp = findblk(vp, loffset, 0);
3626 				else
3627 					bp = NULL;
3628 			}
3629 			if (bp) {
3630 				if (bp->b_flags & B_DELWRI) {
3631 					bremfree(bp);
3632 					error = bwrite(bp);
3633 					++nfs_commit_miss;
3634 				} else {
3635 					BUF_UNLOCK(bp);
3636 				}
3637 			}
3638 			++nfs_commit_blks;
3639 			if (cnt < iosize)
3640 				break;
3641 			cnt -= iosize;
3642 			loffset += iosize;
3643 		}
3644 		crit_exit();
3645 	}
3646 
3647 	aft_ret = VOP_GETATTR(vp, &aft);
3648 	vput(vp);
3649 	vp = NULL;
3650 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3651 			      NFSX_V3WCCDATA + NFSX_V3WRITEVERF,
3652 			      &error));
3653 	nfsm_srvwcc_data(&info, nfsd, for_ret, &bfor,
3654 			 aft_ret, &aft);
3655 	if (!error) {
3656 		tl = nfsm_build(&info, NFSX_V3WRITEVERF);
3657 		if (nfsver.tv_sec == 0)
3658 			nfsver = boottime;
3659 		*tl++ = txdr_unsigned(nfsver.tv_sec);
3660 		*tl = txdr_unsigned(nfsver.tv_nsec / 1000);
3661 	} else {
3662 		error = 0;
3663 	}
3664 nfsmout:
3665 	*mrq = info.mreq;
3666 	if (vp)
3667 		vput(vp);
3668 	return(error);
3669 }
3670 
3671 /*
3672  * nfs statfs service
3673  */
3674 int
3675 nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3676 	     struct thread *td, struct mbuf **mrq)
3677 {
3678 	struct sockaddr *nam = nfsd->nd_nam;
3679 	struct ucred *cred = &nfsd->nd_cr;
3680 	struct statfs *sf;
3681 	struct nfs_statfs *sfp;
3682 	int error = 0, rdonly, getret = 1;
3683 	struct vnode *vp = NULL;
3684 	struct mount *mp = NULL;
3685 	struct vattr at;
3686 	nfsfh_t nfh;
3687 	fhandle_t *fhp;
3688 	struct statfs statfs;
3689 	u_quad_t tval;
3690 	struct nfsm_info info;
3691 
3692 	info.mrep = nfsd->nd_mrep;
3693 	info.mreq = NULL;
3694 	info.md = nfsd->nd_md;
3695 	info.dpos = nfsd->nd_dpos;
3696 	info.v3 = (nfsd->nd_flag & ND_NFSV3);
3697 
3698 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3699 	fhp = &nfh.fh_generic;
3700 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3701 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3702 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3703 	if (error) {
3704 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
3705 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3706 		error = 0;
3707 		goto nfsmout;
3708 	}
3709 	sf = &statfs;
3710 	error = VFS_STATFS(vp->v_mount, sf, proc0.p_ucred);
3711 	getret = VOP_GETATTR(vp, &at);
3712 	vput(vp);
3713 	vp = NULL;
3714 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3715 			      NFSX_POSTOPATTR(info.v3) + NFSX_STATFS(info.v3),
3716 			      &error));
3717 	if (info.v3)
3718 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3719 	if (error) {
3720 		error = 0;
3721 		goto nfsmout;
3722 	}
3723 	sfp = nfsm_build(&info, NFSX_STATFS(info.v3));
3724 	if (info.v3) {
3725 		tval = (u_quad_t)sf->f_blocks;
3726 		tval *= (u_quad_t)sf->f_bsize;
3727 		txdr_hyper(tval, &sfp->sf_tbytes);
3728 		tval = (u_quad_t)sf->f_bfree;
3729 		tval *= (u_quad_t)sf->f_bsize;
3730 		txdr_hyper(tval, &sfp->sf_fbytes);
3731 		tval = (u_quad_t)sf->f_bavail;
3732 		tval *= (u_quad_t)sf->f_bsize;
3733 		txdr_hyper(tval, &sfp->sf_abytes);
3734 		sfp->sf_tfiles.nfsuquad[0] = 0;
3735 		sfp->sf_tfiles.nfsuquad[1] = txdr_unsigned(sf->f_files);
3736 		sfp->sf_ffiles.nfsuquad[0] = 0;
3737 		sfp->sf_ffiles.nfsuquad[1] = txdr_unsigned(sf->f_ffree);
3738 		sfp->sf_afiles.nfsuquad[0] = 0;
3739 		sfp->sf_afiles.nfsuquad[1] = txdr_unsigned(sf->f_ffree);
3740 		sfp->sf_invarsec = 0;
3741 	} else {
3742 		sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
3743 		sfp->sf_bsize = txdr_unsigned(sf->f_bsize);
3744 		sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
3745 		sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
3746 		sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
3747 	}
3748 nfsmout:
3749 	*mrq = info.mreq;
3750 	if (vp)
3751 		vput(vp);
3752 	return(error);
3753 }
3754 
3755 /*
3756  * nfs fsinfo service
3757  */
3758 int
3759 nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3760 	     struct thread *td, struct mbuf **mrq)
3761 {
3762 	struct sockaddr *nam = nfsd->nd_nam;
3763 	struct ucred *cred = &nfsd->nd_cr;
3764 	struct nfsv3_fsinfo *sip;
3765 	int error = 0, rdonly, getret = 1, pref;
3766 	struct vnode *vp = NULL;
3767 	struct mount *mp = NULL;
3768 	struct vattr at;
3769 	nfsfh_t nfh;
3770 	fhandle_t *fhp;
3771 	u_quad_t maxfsize;
3772 	struct statfs sb;
3773 	struct nfsm_info info;
3774 
3775 	info.mrep = nfsd->nd_mrep;
3776 	info.mreq = NULL;
3777 	info.md = nfsd->nd_md;
3778 	info.dpos = nfsd->nd_dpos;
3779 
3780 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3781 	fhp = &nfh.fh_generic;
3782 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3783 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3784 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3785 	if (error) {
3786 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
3787 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3788 		error = 0;
3789 		goto nfsmout;
3790 	}
3791 
3792 	/* XXX Try to make a guess on the max file size. */
3793 	VFS_STATFS(vp->v_mount, &sb, proc0.p_ucred);
3794 	maxfsize = (u_quad_t)0x80000000 * sb.f_bsize - 1;
3795 
3796 	getret = VOP_GETATTR(vp, &at);
3797 	vput(vp);
3798 	vp = NULL;
3799 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3800 			      NFSX_V3POSTOPATTR + NFSX_V3FSINFO, &error));
3801 	nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3802 	sip = nfsm_build(&info, NFSX_V3FSINFO);
3803 
3804 	/*
3805 	 * XXX
3806 	 * There should be file system VFS OP(s) to get this information.
3807 	 * For now, assume ufs.
3808 	 */
3809 	if (slp->ns_so->so_type == SOCK_DGRAM)
3810 		pref = NFS_MAXDGRAMDATA;
3811 	else
3812 		pref = NFS_MAXDATA;
3813 	sip->fs_rtmax = txdr_unsigned(NFS_MAXDATA);
3814 	sip->fs_rtpref = txdr_unsigned(pref);
3815 	sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
3816 	sip->fs_wtmax = txdr_unsigned(NFS_MAXDATA);
3817 	sip->fs_wtpref = txdr_unsigned(pref);
3818 	sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
3819 	sip->fs_dtpref = txdr_unsigned(pref);
3820 	txdr_hyper(maxfsize, &sip->fs_maxfilesize);
3821 	sip->fs_timedelta.nfsv3_sec = 0;
3822 	sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
3823 	sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
3824 		NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
3825 		NFSV3FSINFO_CANSETTIME);
3826 nfsmout:
3827 	*mrq = info.mreq;
3828 	if (vp)
3829 		vput(vp);
3830 	return(error);
3831 }
3832 
3833 /*
3834  * nfs pathconf service
3835  */
3836 int
3837 nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3838 	       struct thread *td, struct mbuf **mrq)
3839 {
3840 	struct sockaddr *nam = nfsd->nd_nam;
3841 	struct ucred *cred = &nfsd->nd_cr;
3842 	struct nfsv3_pathconf *pc;
3843 	int error = 0, rdonly, getret = 1;
3844 	register_t linkmax, namemax, chownres, notrunc;
3845 	struct vnode *vp = NULL;
3846 	struct mount *mp = NULL;
3847 	struct vattr at;
3848 	nfsfh_t nfh;
3849 	fhandle_t *fhp;
3850 	struct nfsm_info info;
3851 
3852 	info.mrep = nfsd->nd_mrep;
3853 	info.mreq = NULL;
3854 	info.md = nfsd->nd_md;
3855 	info.dpos = nfsd->nd_dpos;
3856 
3857 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3858 	fhp = &nfh.fh_generic;
3859 	NEGREPLYOUT(nfsm_srvmtofh(&info, nfsd, fhp, &error));
3860 	error = nfsrv_fhtovp(fhp, 1, &mp, &vp, cred, slp, nam,
3861 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), TRUE);
3862 	if (error) {
3863 		NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, NFSX_UNSIGNED, &error));
3864 		nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3865 		error = 0;
3866 		goto nfsmout;
3867 	}
3868 	error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
3869 	if (!error)
3870 		error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
3871 	if (!error)
3872 		error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
3873 	if (!error)
3874 		error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
3875 	getret = VOP_GETATTR(vp, &at);
3876 	vput(vp);
3877 	vp = NULL;
3878 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp,
3879 			      NFSX_V3POSTOPATTR + NFSX_V3PATHCONF,
3880 			      &error));
3881 	nfsm_srvpostop_attr(&info, nfsd, getret, &at);
3882 	if (error) {
3883 		error = 0;
3884 		goto nfsmout;
3885 	}
3886 	pc = nfsm_build(&info, NFSX_V3PATHCONF);
3887 
3888 	pc->pc_linkmax = txdr_unsigned(linkmax);
3889 	pc->pc_namemax = txdr_unsigned(namemax);
3890 	pc->pc_notrunc = txdr_unsigned(notrunc);
3891 	pc->pc_chownrestricted = txdr_unsigned(chownres);
3892 
3893 	/*
3894 	 * These should probably be supported by VOP_PATHCONF(), but
3895 	 * until msdosfs is exportable (why would you want to?), the
3896 	 * Unix defaults should be ok.
3897 	 */
3898 	pc->pc_caseinsensitive = nfs_false;
3899 	pc->pc_casepreserving = nfs_true;
3900 nfsmout:
3901 	*mrq = info.mreq;
3902 	if (vp)
3903 		vput(vp);
3904 	return(error);
3905 }
3906 
3907 /*
3908  * Null operation, used by clients to ping server
3909  */
3910 /* ARGSUSED */
3911 int
3912 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3913 	   struct thread *td, struct mbuf **mrq)
3914 {
3915 	struct nfsm_info info;
3916 	int error = NFSERR_RETVOID;
3917 
3918 	info.mrep = nfsd->nd_mrep;
3919 	info.mreq = NULL;
3920 
3921 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3922 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, 0, &error));
3923 nfsmout:
3924 	*mrq = info.mreq;
3925 	return (error);
3926 }
3927 
3928 /*
3929  * No operation, used for obsolete procedures
3930  */
3931 /* ARGSUSED */
3932 int
3933 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3934 	   struct thread *td, struct mbuf **mrq)
3935 {
3936 	struct nfsm_info info;
3937 	int error;
3938 
3939 	info.mrep = nfsd->nd_mrep;
3940 	info.mreq = NULL;
3941 
3942 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3943 	if (nfsd->nd_repstat)
3944 		error = nfsd->nd_repstat;
3945 	else
3946 		error = EPROCUNAVAIL;
3947 	NEGKEEPOUT(nfsm_reply(&info, nfsd, slp, 0, &error));
3948 	error = 0;
3949 nfsmout:
3950 	*mrq = info.mreq;
3951 	return (error);
3952 }
3953 
3954 /*
3955  * Perform access checking for vnodes obtained from file handles that would
3956  * refer to files already opened by a Unix client. You cannot just use
3957  * vn_writechk() and VOP_ACCESS() for two reasons.
3958  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
3959  * 2 - The owner is to be given access irrespective of mode bits for some
3960  *     operations, so that processes that chmod after opening a file don't
3961  *     break. I don't like this because it opens a security hole, but since
3962  *     the nfs server opens a security hole the size of a barn door anyhow,
3963  *     what the heck.
3964  *
3965  * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
3966  * will return EPERM instead of EACCESS. EPERM is always an error.
3967  */
3968 static int
3969 nfsrv_access(struct mount *mp, struct vnode *vp, int flags, struct ucred *cred,
3970 	     int rdonly, struct thread *td, int override)
3971 {
3972 	struct vattr vattr;
3973 	int error;
3974 
3975 	nfsdbprintf(("%s %d\n", __FILE__, __LINE__));
3976 	if (flags & VWRITE) {
3977 		/* Just vn_writechk() changed to check rdonly */
3978 		/*
3979 		 * Disallow write attempts on read-only file systems;
3980 		 * unless the file is a socket or a block or character
3981 		 * device resident on the file system.
3982 		 */
3983 		if (rdonly ||
3984 		    ((mp->mnt_flag | vp->v_mount->mnt_flag) & MNT_RDONLY)) {
3985 			switch (vp->v_type) {
3986 			case VREG:
3987 			case VDIR:
3988 			case VLNK:
3989 				return (EROFS);
3990 			default:
3991 				break;
3992 			}
3993 		}
3994 		/*
3995 		 * If there's shared text associated with
3996 		 * the inode, we can't allow writing.
3997 		 */
3998 		if (vp->v_flag & VTEXT)
3999 			return (ETXTBSY);
4000 	}
4001 	error = VOP_GETATTR(vp, &vattr);
4002 	if (error)
4003 		return (error);
4004 	error = VOP_ACCESS(vp, flags, cred);	/* XXX ruid/rgid vs uid/gid */
4005 	/*
4006 	 * Allow certain operations for the owner (reads and writes
4007 	 * on files that are already open).
4008 	 */
4009 	if (override && error == EACCES && cred->cr_uid == vattr.va_uid)
4010 		error = 0;
4011 	return error;
4012 }
4013 #endif /* NFS_NOSERVER */
4014 
4015