xref: /netbsd-src/sys/kern/vfs_lookup.c (revision 82d56013d7b633d116a93943de88e08335357a7c)
1 /*	$NetBSD: vfs_lookup.c,v 1.225 2020/12/29 22:13:40 chs Exp $	*/
2 
3 /*
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)vfs_lookup.c	8.10 (Berkeley) 5/27/95
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: vfs_lookup.c,v 1.225 2020/12/29 22:13:40 chs Exp $");
41 
42 #ifdef _KERNEL_OPT
43 #include "opt_magiclinks.h"
44 #endif
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/kernel.h>
49 #include <sys/syslimits.h>
50 #include <sys/time.h>
51 #include <sys/namei.h>
52 #include <sys/vnode.h>
53 #include <sys/vnode_impl.h>
54 #include <sys/mount.h>
55 #include <sys/errno.h>
56 #include <sys/filedesc.h>
57 #include <sys/hash.h>
58 #include <sys/proc.h>
59 #include <sys/syslog.h>
60 #include <sys/kauth.h>
61 #include <sys/ktrace.h>
62 #include <sys/dirent.h>
63 
64 #ifndef MAGICLINKS
65 #define MAGICLINKS 0
66 #endif
67 
68 int vfs_magiclinks = MAGICLINKS;
69 
70 __CTASSERT(MAXNAMLEN == NAME_MAX);
71 
72 /*
73  * Substitute replacement text for 'magic' strings in symlinks.
74  * Returns 0 if successful, and returns non-zero if an error
75  * occurs.  (Currently, the only possible error is running out
76  * of temporary pathname space.)
77  *
78  * Looks for "@<string>" and "@<string>/", where <string> is a
79  * recognized 'magic' string.  Replaces the "@<string>" with the
80  * appropriate replacement text.  (Note that in some cases the
81  * replacement text may have zero length.)
82  *
83  * This would have been table driven, but the variance in
84  * replacement strings (and replacement string lengths) made
85  * that impractical.
86  */
87 #define	VNL(x)							\
88 	(sizeof(x) - 1)
89 
90 #define	VO	'{'
91 #define	VC	'}'
92 
93 #define	MATCH(str)						\
94 	((termchar == '/' && i + VNL(str) == *len) ||		\
95 	 (i + VNL(str) < *len &&				\
96 	  cp[i + VNL(str)] == termchar)) &&			\
97 	!strncmp((str), &cp[i], VNL(str))
98 
99 #define	SUBSTITUTE(m, s, sl)					\
100 	if ((newlen + (sl)) >= MAXPATHLEN)			\
101 		return 1;					\
102 	i += VNL(m);						\
103 	if (termchar != '/')					\
104 		i++;						\
105 	(void)memcpy(&tmp[newlen], (s), (sl));			\
106 	newlen += (sl);						\
107 	change = 1;						\
108 	termchar = '/';
109 
110 static int
111 symlink_magic(struct proc *p, char *cp, size_t *len)
112 {
113 	char *tmp;
114 	size_t change, i, newlen, slen;
115 	char termchar = '/';
116 	char idtmp[11]; /* enough for 32 bit *unsigned* integer */
117 
118 
119 	tmp = PNBUF_GET();
120 	for (change = i = newlen = 0; i < *len; ) {
121 		if (cp[i] != '@') {
122 			tmp[newlen++] = cp[i++];
123 			continue;
124 		}
125 
126 		i++;
127 
128 		/* Check for @{var} syntax. */
129 		if (cp[i] == VO) {
130 			termchar = VC;
131 			i++;
132 		}
133 
134 		/*
135 		 * The following checks should be ordered according
136 		 * to frequency of use.
137 		 */
138 		if (MATCH("machine_arch")) {
139 			slen = VNL(MACHINE_ARCH);
140 			SUBSTITUTE("machine_arch", MACHINE_ARCH, slen);
141 		} else if (MATCH("machine")) {
142 			slen = VNL(MACHINE);
143 			SUBSTITUTE("machine", MACHINE, slen);
144 		} else if (MATCH("hostname")) {
145 			SUBSTITUTE("hostname", hostname, hostnamelen);
146 		} else if (MATCH("osrelease")) {
147 			slen = strlen(osrelease);
148 			SUBSTITUTE("osrelease", osrelease, slen);
149 		} else if (MATCH("emul")) {
150 			slen = strlen(p->p_emul->e_name);
151 			SUBSTITUTE("emul", p->p_emul->e_name, slen);
152 		} else if (MATCH("kernel_ident")) {
153 			slen = strlen(kernel_ident);
154 			SUBSTITUTE("kernel_ident", kernel_ident, slen);
155 		} else if (MATCH("domainname")) {
156 			SUBSTITUTE("domainname", domainname, domainnamelen);
157 		} else if (MATCH("ostype")) {
158 			slen = strlen(ostype);
159 			SUBSTITUTE("ostype", ostype, slen);
160 		} else if (MATCH("uid")) {
161 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
162 			    kauth_cred_geteuid(kauth_cred_get()));
163 			SUBSTITUTE("uid", idtmp, slen);
164 		} else if (MATCH("ruid")) {
165 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
166 			    kauth_cred_getuid(kauth_cred_get()));
167 			SUBSTITUTE("ruid", idtmp, slen);
168 		} else if (MATCH("gid")) {
169 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
170 			    kauth_cred_getegid(kauth_cred_get()));
171 			SUBSTITUTE("gid", idtmp, slen);
172 		} else if (MATCH("rgid")) {
173 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
174 			    kauth_cred_getgid(kauth_cred_get()));
175 			SUBSTITUTE("rgid", idtmp, slen);
176 		} else {
177 			tmp[newlen++] = '@';
178 			if (termchar == VC)
179 				tmp[newlen++] = VO;
180 		}
181 	}
182 
183 	if (change) {
184 		(void)memcpy(cp, tmp, newlen);
185 		*len = newlen;
186 	}
187 	PNBUF_PUT(tmp);
188 
189 	return 0;
190 }
191 
192 #undef VNL
193 #undef VO
194 #undef VC
195 #undef MATCH
196 #undef SUBSTITUTE
197 
198 ////////////////////////////////////////////////////////////
199 
200 /*
201  * Determine the namei hash (for the namecache) for name.
202  * If *ep != NULL, hash from name to ep-1.
203  * If *ep == NULL, hash from name until the first NUL or '/', and
204  * return the location of this termination character in *ep.
205  *
206  * This function returns an equivalent hash to the MI hash32_strn().
207  * The latter isn't used because in the *ep == NULL case, determining
208  * the length of the string to the first NUL or `/' and then calling
209  * hash32_strn() involves unnecessary double-handling of the data.
210  */
211 uint32_t
212 namei_hash(const char *name, const char **ep)
213 {
214 	uint32_t	hash;
215 
216 	hash = HASH32_STR_INIT;
217 	if (*ep != NULL) {
218 		for (; name < *ep; name++)
219 			hash = hash * 33 + *(const uint8_t *)name;
220 	} else {
221 		for (; *name != '\0' && *name != '/'; name++)
222 			hash = hash * 33 + *(const uint8_t *)name;
223 		*ep = name;
224 	}
225 	return (hash + (hash >> 5));
226 }
227 
228 /*
229  * Find the end of the first path component in NAME and return its
230  * length.
231  */
232 static size_t
233 namei_getcomponent(const char *name)
234 {
235 	size_t pos;
236 
237 	pos = 0;
238 	while (name[pos] != '\0' && name[pos] != '/') {
239 		pos++;
240 	}
241 	return pos;
242 }
243 
244 ////////////////////////////////////////////////////////////
245 
246 /*
247  * Sealed abstraction for pathnames.
248  *
249  * System-call-layer level code that is going to call namei should
250  * first create a pathbuf and adjust all the bells and whistles on it
251  * as needed by context.
252  */
253 
254 struct pathbuf {
255 	char *pb_path;
256 	char *pb_pathcopy;
257 	unsigned pb_pathcopyuses;
258 };
259 
260 static struct pathbuf *
261 pathbuf_create_raw(void)
262 {
263 	struct pathbuf *pb;
264 
265 	pb = kmem_alloc(sizeof(*pb), KM_SLEEP);
266 	pb->pb_path = PNBUF_GET();
267 	if (pb->pb_path == NULL) {
268 		kmem_free(pb, sizeof(*pb));
269 		return NULL;
270 	}
271 	pb->pb_pathcopy = NULL;
272 	pb->pb_pathcopyuses = 0;
273 	return pb;
274 }
275 
276 void
277 pathbuf_destroy(struct pathbuf *pb)
278 {
279 	KASSERT(pb->pb_pathcopyuses == 0);
280 	KASSERT(pb->pb_pathcopy == NULL);
281 	PNBUF_PUT(pb->pb_path);
282 	kmem_free(pb, sizeof(*pb));
283 }
284 
285 struct pathbuf *
286 pathbuf_assimilate(char *pnbuf)
287 {
288 	struct pathbuf *pb;
289 
290 	pb = kmem_alloc(sizeof(*pb), KM_SLEEP);
291 	pb->pb_path = pnbuf;
292 	pb->pb_pathcopy = NULL;
293 	pb->pb_pathcopyuses = 0;
294 	return pb;
295 }
296 
297 struct pathbuf *
298 pathbuf_create(const char *path)
299 {
300 	struct pathbuf *pb;
301 	int error;
302 
303 	pb = pathbuf_create_raw();
304 	if (pb == NULL) {
305 		return NULL;
306 	}
307 	error = copystr(path, pb->pb_path, PATH_MAX, NULL);
308 	if (error != 0) {
309 		KASSERT(!"kernel path too long in pathbuf_create");
310 		/* make sure it's null-terminated, just in case */
311 		pb->pb_path[PATH_MAX-1] = '\0';
312 	}
313 	return pb;
314 }
315 
316 int
317 pathbuf_copyin(const char *userpath, struct pathbuf **ret)
318 {
319 	struct pathbuf *pb;
320 	int error;
321 
322 	pb = pathbuf_create_raw();
323 	if (pb == NULL) {
324 		return ENOMEM;
325 	}
326 	error = copyinstr(userpath, pb->pb_path, PATH_MAX, NULL);
327 	if (error) {
328 		pathbuf_destroy(pb);
329 		return error;
330 	}
331 	*ret = pb;
332 	return 0;
333 }
334 
335 /*
336  * XXX should not exist:
337  *   1. whether a pointer is kernel or user should be statically checkable.
338  *   2. copyin should be handled by the upper part of the syscall layer,
339  *      not in here.
340  */
341 int
342 pathbuf_maybe_copyin(const char *path, enum uio_seg seg, struct pathbuf **ret)
343 {
344 	if (seg == UIO_USERSPACE) {
345 		return pathbuf_copyin(path, ret);
346 	} else {
347 		*ret = pathbuf_create(path);
348 		if (*ret == NULL) {
349 			return ENOMEM;
350 		}
351 		return 0;
352 	}
353 }
354 
355 /*
356  * Get a copy of the path buffer as it currently exists. If this is
357  * called after namei starts the results may be arbitrary.
358  */
359 void
360 pathbuf_copystring(const struct pathbuf *pb, char *buf, size_t maxlen)
361 {
362 	strlcpy(buf, pb->pb_path, maxlen);
363 }
364 
365 /*
366  * These two functions allow access to a saved copy of the original
367  * path string. The first copy should be gotten before namei is
368  * called. Each copy that is gotten should be put back.
369  */
370 
371 const char *
372 pathbuf_stringcopy_get(struct pathbuf *pb)
373 {
374 	if (pb->pb_pathcopyuses == 0) {
375 		pb->pb_pathcopy = PNBUF_GET();
376 		strcpy(pb->pb_pathcopy, pb->pb_path);
377 	}
378 	pb->pb_pathcopyuses++;
379 	return pb->pb_pathcopy;
380 }
381 
382 void
383 pathbuf_stringcopy_put(struct pathbuf *pb, const char *str)
384 {
385 	KASSERT(str == pb->pb_pathcopy);
386 	KASSERT(pb->pb_pathcopyuses > 0);
387 	pb->pb_pathcopyuses--;
388 	if (pb->pb_pathcopyuses == 0) {
389 		PNBUF_PUT(pb->pb_pathcopy);
390 		pb->pb_pathcopy = NULL;
391 	}
392 }
393 
394 
395 ////////////////////////////////////////////////////////////
396 
397 /*
398  * namei: convert a pathname into a pointer to a (maybe-locked) vnode,
399  * and maybe also its parent directory vnode, and assorted other guff.
400  * See namei(9) for the interface documentation.
401  *
402  *
403  * The FOLLOW flag is set when symbolic links are to be followed
404  * when they occur at the end of the name translation process.
405  * Symbolic links are always followed for all other pathname
406  * components other than the last.
407  *
408  * The segflg defines whether the name is to be copied from user
409  * space or kernel space.
410  *
411  * Overall outline of namei:
412  *
413  *	copy in name
414  *	get starting directory
415  *	while (!done && !error) {
416  *		call lookup to search path.
417  *		if symbolic link, massage name in buffer and continue
418  *	}
419  */
420 
421 /*
422  * Search a pathname.
423  * This is a very central and rather complicated routine.
424  *
425  * The pathname is pointed to by ni_ptr and is of length ni_pathlen.
426  * The starting directory is passed in. The pathname is descended
427  * until done, or a symbolic link is encountered. The variable ni_more
428  * is clear if the path is completed; it is set to one if a symbolic
429  * link needing interpretation is encountered.
430  *
431  * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on
432  * whether the name is to be looked up, created, renamed, or deleted.
433  * When CREATE, RENAME, or DELETE is specified, information usable in
434  * creating, renaming, or deleting a directory entry may be calculated.
435  * If flag has LOCKPARENT or'ed into it, the parent directory is returned
436  * locked.  Otherwise the parent directory is not returned. If the target
437  * of the pathname exists and LOCKLEAF is or'ed into the flag the target
438  * is returned locked, otherwise it is returned unlocked.  When creating
439  * or renaming and LOCKPARENT is specified, the target may not be ".".
440  * When deleting and LOCKPARENT is specified, the target may be ".".
441  *
442  * Overall outline of lookup:
443  *
444  * dirloop:
445  *	identify next component of name at ndp->ni_ptr
446  *	handle degenerate case where name is null string
447  *	if .. and crossing mount points and on mounted filesys, find parent
448  *	call VOP_LOOKUP routine for next component name
449  *	    directory vnode returned in ni_dvp, locked.
450  *	    component vnode returned in ni_vp (if it exists), locked.
451  *	if result vnode is mounted on and crossing mount points,
452  *	    find mounted on vnode
453  *	if more components of name, do next level at dirloop
454  *	return the answer in ni_vp, locked if LOCKLEAF set
455  *	    if LOCKPARENT set, return locked parent in ni_dvp
456  */
457 
458 
459 /*
460  * Internal state for a namei operation.
461  *
462  * cnp is always equal to &ndp->ni_cnp.
463  */
464 struct namei_state {
465 	struct nameidata *ndp;
466 	struct componentname *cnp;
467 
468 	int docache;			/* == 0 do not cache last component */
469 	int rdonly;			/* lookup read-only flag bit */
470 	int slashes;
471 
472 	unsigned attempt_retry:1;	/* true if error allows emul retry */
473 	unsigned root_referenced:1;	/* true if ndp->ni_rootdir and
474 					     ndp->ni_erootdir were referenced */
475 };
476 
477 
478 /*
479  * Initialize the namei working state.
480  */
481 static void
482 namei_init(struct namei_state *state, struct nameidata *ndp)
483 {
484 
485 	state->ndp = ndp;
486 	state->cnp = &ndp->ni_cnd;
487 
488 	state->docache = 0;
489 	state->rdonly = 0;
490 	state->slashes = 0;
491 
492 	state->root_referenced = 0;
493 
494 	KASSERTMSG((state->cnp->cn_cred != NULL), "namei: bad cred/proc");
495 	KASSERTMSG(((state->cnp->cn_nameiop & (~OPMASK)) == 0),
496 	    "namei: nameiop contaminated with flags: %08"PRIx32,
497 	    state->cnp->cn_nameiop);
498 	KASSERTMSG(((state->cnp->cn_flags & OPMASK) == 0),
499 	    "name: flags contaminated with nameiops: %08"PRIx32,
500 	    state->cnp->cn_flags);
501 
502 	/*
503 	 * The buffer for name translation shall be the one inside the
504 	 * pathbuf.
505 	 */
506 	state->ndp->ni_pnbuf = state->ndp->ni_pathbuf->pb_path;
507 }
508 
509 /*
510  * Clean up the working namei state, leaving things ready for return
511  * from namei.
512  */
513 static void
514 namei_cleanup(struct namei_state *state)
515 {
516 	KASSERT(state->cnp == &state->ndp->ni_cnd);
517 
518 	if (state->root_referenced) {
519 		if (state->ndp->ni_rootdir != NULL)
520 			vrele(state->ndp->ni_rootdir);
521 		if (state->ndp->ni_erootdir != NULL)
522 			vrele(state->ndp->ni_erootdir);
523 	}
524 }
525 
526 //////////////////////////////
527 
528 /*
529  * Get the directory context.
530  * Initializes the rootdir and erootdir state and returns a reference
531  * to the starting dir.
532  */
533 static struct vnode *
534 namei_getstartdir(struct namei_state *state)
535 {
536 	struct nameidata *ndp = state->ndp;
537 	struct componentname *cnp = state->cnp;
538 	struct cwdinfo *cwdi;		/* pointer to cwd state */
539 	struct lwp *self = curlwp;	/* thread doing namei() */
540 	struct vnode *rootdir, *erootdir, *curdir, *startdir;
541 
542 	if (state->root_referenced) {
543 		if (state->ndp->ni_rootdir != NULL)
544 			vrele(state->ndp->ni_rootdir);
545 		if (state->ndp->ni_erootdir != NULL)
546 			vrele(state->ndp->ni_erootdir);
547 		state->root_referenced = 0;
548 	}
549 
550 	cwdi = self->l_proc->p_cwdi;
551 	rw_enter(&cwdi->cwdi_lock, RW_READER);
552 
553 	/* root dir */
554 	if (cwdi->cwdi_rdir == NULL || (cnp->cn_flags & NOCHROOT)) {
555 		rootdir = rootvnode;
556 	} else {
557 		rootdir = cwdi->cwdi_rdir;
558 	}
559 
560 	/* emulation root dir, if any */
561 	if ((cnp->cn_flags & TRYEMULROOT) == 0) {
562 		/* if we don't want it, don't fetch it */
563 		erootdir = NULL;
564 	} else if (cnp->cn_flags & EMULROOTSET) {
565 		/* explicitly set emulroot; "/../" doesn't override this */
566 		erootdir = ndp->ni_erootdir;
567 	} else if (!strncmp(ndp->ni_pnbuf, "/../", 4)) {
568 		/* explicit reference to real rootdir */
569 		erootdir = NULL;
570 	} else {
571 		/* may be null */
572 		erootdir = cwdi->cwdi_edir;
573 	}
574 
575 	/* current dir */
576 	curdir = cwdi->cwdi_cdir;
577 
578 	if (ndp->ni_pnbuf[0] != '/') {
579 		if (ndp->ni_atdir != NULL) {
580 			startdir = ndp->ni_atdir;
581 		} else {
582 			startdir = curdir;
583 		}
584 		erootdir = NULL;
585 	} else if (cnp->cn_flags & TRYEMULROOT && erootdir != NULL) {
586 		startdir = erootdir;
587 	} else {
588 		startdir = rootdir;
589 		erootdir = NULL;
590 	}
591 
592 	state->ndp->ni_rootdir = rootdir;
593 	state->ndp->ni_erootdir = erootdir;
594 
595 	/*
596 	 * Get a reference to the start dir so we can safely unlock cwdi.
597 	 *
598 	 * Must hold references to rootdir and erootdir while we're running.
599 	 * A multithreaded process may chroot during namei.
600 	 */
601 	if (startdir != NULL)
602 		vref(startdir);
603 	if (state->ndp->ni_rootdir != NULL)
604 		vref(state->ndp->ni_rootdir);
605 	if (state->ndp->ni_erootdir != NULL)
606 		vref(state->ndp->ni_erootdir);
607 	state->root_referenced = 1;
608 
609 	rw_exit(&cwdi->cwdi_lock);
610 	return startdir;
611 }
612 
613 /*
614  * Get the directory context for the nfsd case, in parallel to
615  * getstartdir. Initializes the rootdir and erootdir state and
616  * returns a reference to the passed-in starting dir.
617  */
618 static struct vnode *
619 namei_getstartdir_for_nfsd(struct namei_state *state)
620 {
621 	KASSERT(state->ndp->ni_atdir != NULL);
622 
623 	/* always use the real root, and never set an emulation root */
624 	if (rootvnode == NULL) {
625 		return NULL;
626 	}
627 	state->ndp->ni_rootdir = rootvnode;
628 	state->ndp->ni_erootdir = NULL;
629 
630 	vref(state->ndp->ni_atdir);
631 	KASSERT(! state->root_referenced);
632 	vref(state->ndp->ni_rootdir);
633 	state->root_referenced = 1;
634 	return state->ndp->ni_atdir;
635 }
636 
637 
638 /*
639  * Ktrace the namei operation.
640  */
641 static void
642 namei_ktrace(struct namei_state *state)
643 {
644 	struct nameidata *ndp = state->ndp;
645 	struct componentname *cnp = state->cnp;
646 	struct lwp *self = curlwp;	/* thread doing namei() */
647 	const char *emul_path;
648 
649 	if (ktrpoint(KTR_NAMEI)) {
650 		if (ndp->ni_erootdir != NULL) {
651 			/*
652 			 * To make any sense, the trace entry need to have the
653 			 * text of the emulation path prepended.
654 			 * Usually we can get this from the current process,
655 			 * but when called from emul_find_interp() it is only
656 			 * in the exec_package - so we get it passed in ni_next
657 			 * (this is a hack).
658 			 */
659 			if (cnp->cn_flags & EMULROOTSET)
660 				emul_path = ndp->ni_next;
661 			else
662 				emul_path = self->l_proc->p_emul->e_path;
663 			ktrnamei2(emul_path, strlen(emul_path),
664 			    ndp->ni_pnbuf, ndp->ni_pathlen);
665 		} else
666 			ktrnamei(ndp->ni_pnbuf, ndp->ni_pathlen);
667 	}
668 }
669 
670 /*
671  * Start up namei. Find the root dir and cwd, establish the starting
672  * directory for lookup, and lock it. Also calls ktrace when
673  * appropriate.
674  */
675 static int
676 namei_start(struct namei_state *state, int isnfsd,
677 	    struct vnode **startdir_ret)
678 {
679 	struct nameidata *ndp = state->ndp;
680 	struct vnode *startdir;
681 
682 	/* length includes null terminator (was originally from copyinstr) */
683 	ndp->ni_pathlen = strlen(ndp->ni_pnbuf) + 1;
684 
685 	/*
686 	 * POSIX.1 requirement: "" is not a valid file name.
687 	 */
688 	if (ndp->ni_pathlen == 1) {
689 		ndp->ni_erootdir = NULL;
690 		return ENOENT;
691 	}
692 
693 	ndp->ni_loopcnt = 0;
694 
695 	/* Get starting directory, set up root, and ktrace. */
696 	if (isnfsd) {
697 		startdir = namei_getstartdir_for_nfsd(state);
698 		/* no ktrace */
699 	} else {
700 		startdir = namei_getstartdir(state);
701 		namei_ktrace(state);
702 	}
703 
704 	if (startdir == NULL) {
705 		return ENOENT;
706 	}
707 
708 	/* NDAT may feed us with a non directory namei_getstartdir */
709 	if (startdir->v_type != VDIR) {
710 		vrele(startdir);
711 		return ENOTDIR;
712 	}
713 
714 	*startdir_ret = startdir;
715 	return 0;
716 }
717 
718 /*
719  * Check for being at a symlink that we're going to follow.
720  */
721 static inline int
722 namei_atsymlink(struct namei_state *state, struct vnode *foundobj)
723 {
724 	return (foundobj->v_type == VLNK) &&
725 		(state->cnp->cn_flags & (FOLLOW|REQUIREDIR));
726 }
727 
728 /*
729  * Follow a symlink.
730  *
731  * Updates searchdir. inhibitmagic causes magic symlinks to not be
732  * interpreted; this is used by nfsd.
733  *
734  * Unlocks foundobj on success (ugh)
735  */
736 static inline int
737 namei_follow(struct namei_state *state, int inhibitmagic,
738 	     struct vnode *searchdir, struct vnode *foundobj,
739 	     struct vnode **newsearchdir_ret)
740 {
741 	struct nameidata *ndp = state->ndp;
742 	struct componentname *cnp = state->cnp;
743 
744 	struct lwp *self = curlwp;	/* thread doing namei() */
745 	struct iovec aiov;		/* uio for reading symbolic links */
746 	struct uio auio;
747 	char *cp;			/* pointer into pathname argument */
748 	size_t linklen;
749 	int error;
750 
751 	if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
752 		return ELOOP;
753 	}
754 
755 	vn_lock(foundobj, LK_EXCLUSIVE | LK_RETRY);
756 	if (foundobj->v_mount->mnt_flag & MNT_SYMPERM) {
757 		error = VOP_ACCESS(foundobj, VEXEC, cnp->cn_cred);
758 		if (error != 0) {
759 			VOP_UNLOCK(foundobj);
760 			return error;
761 		}
762 	}
763 
764 	/* FUTURE: fix this to not use a second buffer */
765 	cp = PNBUF_GET();
766 	aiov.iov_base = cp;
767 	aiov.iov_len = MAXPATHLEN;
768 	auio.uio_iov = &aiov;
769 	auio.uio_iovcnt = 1;
770 	auio.uio_offset = 0;
771 	auio.uio_rw = UIO_READ;
772 	auio.uio_resid = MAXPATHLEN;
773 	UIO_SETUP_SYSSPACE(&auio);
774 	error = VOP_READLINK(foundobj, &auio, cnp->cn_cred);
775 	VOP_UNLOCK(foundobj);
776 	if (error) {
777 		PNBUF_PUT(cp);
778 		return error;
779 	}
780 	linklen = MAXPATHLEN - auio.uio_resid;
781 	if (linklen == 0) {
782 		PNBUF_PUT(cp);
783 		return ENOENT;
784 	}
785 
786 	/*
787 	 * Do symlink substitution, if appropriate, and
788 	 * check length for potential overflow.
789 	 *
790 	 * Inhibit symlink substitution for nfsd.
791 	 * XXX: This is how it was before; is that a bug or a feature?
792 	 */
793 	if ((!inhibitmagic && vfs_magiclinks &&
794 	     symlink_magic(self->l_proc, cp, &linklen)) ||
795 	    (linklen + ndp->ni_pathlen >= MAXPATHLEN)) {
796 		PNBUF_PUT(cp);
797 		return ENAMETOOLONG;
798 	}
799 	if (ndp->ni_pathlen > 1) {
800 		/* includes a null-terminator */
801 		memcpy(cp + linklen, ndp->ni_next, ndp->ni_pathlen);
802 	} else {
803 		cp[linklen] = '\0';
804 	}
805 	ndp->ni_pathlen += linklen;
806 	memcpy(ndp->ni_pnbuf, cp, ndp->ni_pathlen);
807 	PNBUF_PUT(cp);
808 
809 	/* we're now starting from the beginning of the buffer again */
810 	cnp->cn_nameptr = ndp->ni_pnbuf;
811 
812 	/*
813 	 * Check if root directory should replace current directory.
814 	 */
815 	if (ndp->ni_pnbuf[0] == '/') {
816 		vrele(searchdir);
817 		/* Keep absolute symbolic links inside emulation root */
818 		searchdir = ndp->ni_erootdir;
819 		if (searchdir == NULL ||
820 		    (ndp->ni_pnbuf[1] == '.'
821 		     && ndp->ni_pnbuf[2] == '.'
822 		     && ndp->ni_pnbuf[3] == '/')) {
823 			ndp->ni_erootdir = NULL;
824 			searchdir = ndp->ni_rootdir;
825 		}
826 		vref(searchdir);
827 		while (cnp->cn_nameptr[0] == '/') {
828 			cnp->cn_nameptr++;
829 			ndp->ni_pathlen--;
830 		}
831 	}
832 
833 	*newsearchdir_ret = searchdir;
834 	return 0;
835 }
836 
837 //////////////////////////////
838 
839 /*
840  * Inspect the leading path component and update the state accordingly.
841  */
842 static int
843 lookup_parsepath(struct namei_state *state)
844 {
845 	const char *cp;			/* pointer into pathname argument */
846 
847 	struct componentname *cnp = state->cnp;
848 	struct nameidata *ndp = state->ndp;
849 
850 	KASSERT(cnp == &ndp->ni_cnd);
851 
852 	/*
853 	 * Search a new directory.
854 	 *
855 	 * The last component of the filename is left accessible via
856 	 * cnp->cn_nameptr for callers that need the name. Callers needing
857 	 * the name set the SAVENAME flag. When done, they assume
858 	 * responsibility for freeing the pathname buffer.
859 	 *
860 	 * At this point, our only vnode state is that the search dir
861 	 * is held.
862 	 */
863 	cnp->cn_consume = 0;
864 	cnp->cn_namelen = namei_getcomponent(cnp->cn_nameptr);
865 	cp = cnp->cn_nameptr + cnp->cn_namelen;
866 	if (cnp->cn_namelen > KERNEL_NAME_MAX) {
867 		return ENAMETOOLONG;
868 	}
869 #ifdef NAMEI_DIAGNOSTIC
870 	{ char c = *cp;
871 	*(char *)cp = '\0';
872 	printf("{%s}: ", cnp->cn_nameptr);
873 	*(char *)cp = c; }
874 #endif /* NAMEI_DIAGNOSTIC */
875 	ndp->ni_pathlen -= cnp->cn_namelen;
876 	ndp->ni_next = cp;
877 	/*
878 	 * If this component is followed by a slash, then move the pointer to
879 	 * the next component forward, and remember that this component must be
880 	 * a directory.
881 	 */
882 	if (*cp == '/') {
883 		do {
884 			cp++;
885 		} while (*cp == '/');
886 		state->slashes = cp - ndp->ni_next;
887 		ndp->ni_pathlen -= state->slashes;
888 		ndp->ni_next = cp;
889 		cnp->cn_flags |= REQUIREDIR;
890 	} else {
891 		state->slashes = 0;
892 		cnp->cn_flags &= ~REQUIREDIR;
893 	}
894 	/*
895 	 * We do special processing on the last component, whether or not it's
896 	 * a directory.  Cache all intervening lookups, but not the final one.
897 	 */
898 	if (*cp == '\0') {
899 		if (state->docache)
900 			cnp->cn_flags |= MAKEENTRY;
901 		else
902 			cnp->cn_flags &= ~MAKEENTRY;
903 		cnp->cn_flags |= ISLASTCN;
904 	} else {
905 		cnp->cn_flags |= MAKEENTRY;
906 		cnp->cn_flags &= ~ISLASTCN;
907 	}
908 	if (cnp->cn_namelen == 2 &&
909 	    cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
910 		cnp->cn_flags |= ISDOTDOT;
911 	else
912 		cnp->cn_flags &= ~ISDOTDOT;
913 
914 	return 0;
915 }
916 
917 /*
918  * Take care of crossing a mounted-on vnode.  On error, foundobj_ret will be
919  * vrele'd, but searchdir is left alone.
920  */
921 static int
922 lookup_crossmount(struct namei_state *state,
923 		  struct vnode **searchdir_ret,
924 		  struct vnode **foundobj_ret,
925 		  bool *searchdir_locked)
926 {
927 	struct componentname *cnp = state->cnp;
928 	struct vnode *foundobj, *vp;
929 	struct vnode *searchdir;
930 	struct mount *mp;
931 	int error, lktype;
932 
933 	searchdir = *searchdir_ret;
934 	foundobj = *foundobj_ret;
935 	error = 0;
936 
937 	KASSERT((cnp->cn_flags & NOCROSSMOUNT) == 0);
938 
939 	/* First, unlock searchdir (oof). */
940 	if (*searchdir_locked) {
941 		KASSERT(searchdir != NULL);
942 		lktype = VOP_ISLOCKED(searchdir);
943 		VOP_UNLOCK(searchdir);
944 		*searchdir_locked = false;
945 	} else {
946 		lktype = LK_NONE;
947 	}
948 
949 	/*
950 	 * Do an unlocked check to see if the vnode has been mounted on; if
951 	 * so find the root of the mounted file system.
952 	 */
953 	while (foundobj->v_type == VDIR &&
954 	    (mp = foundobj->v_mountedhere) != NULL &&
955 	    (cnp->cn_flags & NOCROSSMOUNT) == 0) {
956 		KASSERTMSG(searchdir != foundobj, "same vn %p", searchdir);
957 
958 		/*
959 		 * Try the namecache first.  If that doesn't work, do
960 		 * it the hard way.
961 		 */
962 		if (cache_lookup_mount(foundobj, &vp)) {
963 			vrele(foundobj);
964 			foundobj = vp;
965 		} else {
966 			/* First get the vnode stable. */
967 			error = vn_lock(foundobj, LK_SHARED);
968 			if (error != 0) {
969 				vrele(foundobj);
970 				foundobj = NULL;
971 				break;
972 			}
973 
974 			/*
975 			 * Check to see if something is still mounted on it.
976 			 */
977 			if ((mp = foundobj->v_mountedhere) == NULL) {
978 				VOP_UNLOCK(foundobj);
979 				break;
980 			}
981 
982 			/*
983 			 * Get a reference to the mountpoint, and unlock
984 			 * foundobj.
985 			 */
986 			error = vfs_busy(mp);
987 			VOP_UNLOCK(foundobj);
988 			if (error != 0) {
989 				vrele(foundobj);
990 				foundobj = NULL;
991 				break;
992 			}
993 
994 			/*
995 			 * Now get a reference on the root vnode.
996 			 * XXX Future - maybe allow only VDIR here.
997 			 */
998 			error = VFS_ROOT(mp, LK_NONE, &vp);
999 
1000 			/*
1001 			 * If successful, enter it into the cache while
1002 			 * holding the mount busy (competing with unmount).
1003 			 */
1004 			if (error == 0) {
1005 				cache_enter_mount(foundobj, vp);
1006 			}
1007 
1008 			/* Finally, drop references to foundobj & mountpoint. */
1009 			vrele(foundobj);
1010 			vfs_unbusy(mp);
1011 			if (error) {
1012 				foundobj = NULL;
1013 				break;
1014 			}
1015 			foundobj = vp;
1016 		}
1017 
1018 		/*
1019 		 * Avoid locking vnodes from two filesystems because
1020 		 * it's prone to deadlock, e.g. when using puffs.
1021 		 * Also, it isn't a good idea to propagate slowness of
1022 		 * a filesystem up to the root directory. For now,
1023 		 * only handle the common case, where foundobj is
1024 		 * VDIR.
1025 		 *
1026 		 * In this case set searchdir to null to avoid using
1027 		 * it again. It is not correct to set searchdir ==
1028 		 * foundobj here as that will confuse the caller.
1029 		 * (See PR 40740.)
1030 		 */
1031 		if (searchdir == NULL) {
1032 			/* already been here once; do nothing further */
1033 		} else if (foundobj->v_type == VDIR) {
1034 			vrele(searchdir);
1035 			*searchdir_ret = searchdir = NULL;
1036 			lktype = LK_NONE;
1037 		}
1038 	}
1039 
1040 	/* If searchdir is still around, re-lock it. */
1041  	if (error == 0 && lktype != LK_NONE) {
1042 		vn_lock(searchdir, lktype | LK_RETRY);
1043 		*searchdir_locked = true;
1044 	}
1045 	*foundobj_ret = foundobj;
1046 	return error;
1047 }
1048 
1049 /*
1050  * Determine the desired locking mode for the directory of a lookup.
1051  */
1052 static int
1053 lookup_lktype(struct vnode *searchdir, struct componentname *cnp)
1054 {
1055 
1056 	/*
1057 	 * If the file system supports VOP_LOOKUP() with a shared lock, and
1058 	 * we are not making any modifications (nameiop LOOKUP) or this is
1059 	 * not the last component then get a shared lock.  Where we can't do
1060 	 * fast-forwarded lookups (for example with layered file systems)
1061 	 * then this is the fallback for reducing lock contention.
1062 	 */
1063 	if ((searchdir->v_mount->mnt_iflag & IMNT_SHRLOOKUP) != 0 &&
1064 	    (cnp->cn_nameiop == LOOKUP || (cnp->cn_flags & ISLASTCN) == 0)) {
1065 		return LK_SHARED;
1066 	} else {
1067 		return LK_EXCLUSIVE;
1068 	}
1069 }
1070 
1071 /*
1072  * Call VOP_LOOKUP for a single lookup; return a new search directory
1073  * (used when crossing mountpoints up or searching union mounts down) and
1074  * the found object, which for create operations may be NULL on success.
1075  *
1076  * Note that the new search directory may be null, which means the
1077  * searchdir was unlocked and released. This happens in the common case
1078  * when crossing a mount point downwards, in order to avoid coupling
1079  * locks between different file system volumes. Importantly, this can
1080  * happen even if the call fails. (XXX: this is gross and should be
1081  * tidied somehow.)
1082  */
1083 static int
1084 lookup_once(struct namei_state *state,
1085 	    struct vnode *searchdir,
1086 	    struct vnode **newsearchdir_ret,
1087 	    struct vnode **foundobj_ret,
1088 	    bool *newsearchdir_locked_ret)
1089 {
1090 	struct vnode *tmpvn;		/* scratch vnode */
1091 	struct vnode *foundobj;		/* result */
1092 	struct lwp *l = curlwp;
1093 	bool searchdir_locked = false;
1094 	int error, lktype;
1095 
1096 	struct componentname *cnp = state->cnp;
1097 	struct nameidata *ndp = state->ndp;
1098 
1099 	KASSERT(cnp == &ndp->ni_cnd);
1100 	*newsearchdir_ret = searchdir;
1101 
1102 	/*
1103 	 * Handle "..": two special cases.
1104 	 * 1. If at root directory (e.g. after chroot)
1105 	 *    or at absolute root directory
1106 	 *    then ignore it so can't get out.
1107 	 * 1a. If at the root of the emulation filesystem go to the real
1108 	 *    root. So "/../<path>" is always absolute.
1109 	 * 1b. If we have somehow gotten out of a jail, warn
1110 	 *    and also ignore it so we can't get farther out.
1111 	 * 2. If this vnode is the root of a mounted
1112 	 *    filesystem, then replace it with the
1113 	 *    vnode which was mounted on so we take the
1114 	 *    .. in the other file system.
1115 	 */
1116 	if (cnp->cn_flags & ISDOTDOT) {
1117 		struct proc *p = l->l_proc;
1118 
1119 		for (;;) {
1120 			if (searchdir == ndp->ni_rootdir ||
1121 			    searchdir == rootvnode) {
1122 				foundobj = searchdir;
1123 				vref(foundobj);
1124 				*foundobj_ret = foundobj;
1125 				if (cnp->cn_flags & LOCKPARENT) {
1126 					lktype = lookup_lktype(searchdir, cnp);
1127 					vn_lock(searchdir, lktype | LK_RETRY);
1128 					searchdir_locked = true;
1129 				}
1130 				error = 0;
1131 				goto done;
1132 			}
1133 			if (ndp->ni_rootdir != rootvnode) {
1134 				int retval;
1135 
1136 				retval = vn_isunder(searchdir, ndp->ni_rootdir, l);
1137 				if (!retval) {
1138 				    /* Oops! We got out of jail! */
1139 				    log(LOG_WARNING,
1140 					"chrooted pid %d uid %d (%s) "
1141 					"detected outside of its chroot\n",
1142 					p->p_pid, kauth_cred_geteuid(l->l_cred),
1143 					p->p_comm);
1144 				    /* Put us at the jail root. */
1145 				    vrele(searchdir);
1146 				    searchdir = NULL;
1147 				    foundobj = ndp->ni_rootdir;
1148 				    vref(foundobj);
1149 				    vref(foundobj);
1150 				    *newsearchdir_ret = foundobj;
1151 				    *foundobj_ret = foundobj;
1152 				    error = 0;
1153 				    goto done;
1154 				}
1155 			}
1156 			if ((searchdir->v_vflag & VV_ROOT) == 0 ||
1157 			    (cnp->cn_flags & NOCROSSMOUNT))
1158 				break;
1159 			tmpvn = searchdir;
1160 			searchdir = searchdir->v_mount->mnt_vnodecovered;
1161 			vref(searchdir);
1162 			vrele(tmpvn);
1163 			*newsearchdir_ret = searchdir;
1164 		}
1165 	}
1166 
1167 	lktype = lookup_lktype(searchdir, cnp);
1168 
1169 	/*
1170 	 * We now have a segment name to search for, and a directory to search.
1171 	 * Our vnode state here is that "searchdir" is held.
1172 	 */
1173 unionlookup:
1174 	foundobj = NULL;
1175 	if (!searchdir_locked) {
1176 		vn_lock(searchdir, lktype | LK_RETRY);
1177 		searchdir_locked = true;
1178 	}
1179 	error = VOP_LOOKUP(searchdir, &foundobj, cnp);
1180 
1181 	if (error != 0) {
1182 		KASSERTMSG((foundobj == NULL),
1183 		    "leaf `%s' should be empty but is %p",
1184 		    cnp->cn_nameptr, foundobj);
1185 #ifdef NAMEI_DIAGNOSTIC
1186 		printf("not found\n");
1187 #endif /* NAMEI_DIAGNOSTIC */
1188 
1189 		/*
1190 		 * If ENOLCK, the file system needs us to retry the lookup
1191 		 * with an exclusive lock.  It's likely nothing was found in
1192 		 * cache and/or modifications need to be made.
1193 		 */
1194 		if (error == ENOLCK) {
1195 			KASSERT(VOP_ISLOCKED(searchdir) == LK_SHARED);
1196 			KASSERT(searchdir_locked);
1197 			if (vn_lock(searchdir, LK_UPGRADE | LK_NOWAIT)) {
1198 				VOP_UNLOCK(searchdir);
1199 				searchdir_locked = false;
1200 			}
1201 			lktype = LK_EXCLUSIVE;
1202 			goto unionlookup;
1203 		}
1204 
1205 		if ((error == ENOENT) &&
1206 		    (searchdir->v_vflag & VV_ROOT) &&
1207 		    (searchdir->v_mount->mnt_flag & MNT_UNION)) {
1208 			tmpvn = searchdir;
1209 			searchdir = searchdir->v_mount->mnt_vnodecovered;
1210 			vref(searchdir);
1211 			vput(tmpvn);
1212 			searchdir_locked = false;
1213 			*newsearchdir_ret = searchdir;
1214 			goto unionlookup;
1215 		}
1216 
1217 		if (error != EJUSTRETURN)
1218 			goto done;
1219 
1220 		/*
1221 		 * If this was not the last component, or there were trailing
1222 		 * slashes, and we are not going to create a directory,
1223 		 * then the name must exist.
1224 		 */
1225 		if ((cnp->cn_flags & (REQUIREDIR | CREATEDIR)) == REQUIREDIR) {
1226 			error = ENOENT;
1227 			goto done;
1228 		}
1229 
1230 		/*
1231 		 * If creating and at end of pathname, then can consider
1232 		 * allowing file to be created.
1233 		 */
1234 		if (state->rdonly) {
1235 			error = EROFS;
1236 			goto done;
1237 		}
1238 
1239 		/*
1240 		 * We return success and a NULL foundobj to indicate
1241 		 * that the entry doesn't currently exist, leaving a
1242 		 * pointer to the (normally, locked) directory vnode
1243 		 * as searchdir.
1244 		 */
1245 		*foundobj_ret = NULL;
1246 		error = 0;
1247 		goto done;
1248 	}
1249 #ifdef NAMEI_DIAGNOSTIC
1250 	printf("found\n");
1251 #endif /* NAMEI_DIAGNOSTIC */
1252 
1253 	/*
1254 	 * Take into account any additional components consumed by the
1255 	 * underlying filesystem.  This will include any trailing slashes after
1256 	 * the last component consumed.
1257 	 */
1258 	if (cnp->cn_consume > 0) {
1259 		ndp->ni_pathlen -= cnp->cn_consume - state->slashes;
1260 		ndp->ni_next += cnp->cn_consume - state->slashes;
1261 		cnp->cn_consume = 0;
1262 		if (ndp->ni_next[0] == '\0')
1263 			cnp->cn_flags |= ISLASTCN;
1264 	}
1265 
1266 	/* Unlock, unless the caller needs the parent locked. */
1267 	if (searchdir != NULL) {
1268 		KASSERT(searchdir_locked);
1269 		if ((cnp->cn_flags & (ISLASTCN | LOCKPARENT)) !=
1270 		    (ISLASTCN | LOCKPARENT)) {
1271 		    	VOP_UNLOCK(searchdir);
1272 		    	searchdir_locked = false;
1273 		}
1274 	} else {
1275 		KASSERT(!searchdir_locked);
1276 	}
1277 
1278 	*foundobj_ret = foundobj;
1279 	error = 0;
1280 done:
1281 	*newsearchdir_locked_ret = searchdir_locked;
1282 	return error;
1283 }
1284 
1285 /*
1286  * Parse out the first path name component that we need to to consider.
1287  *
1288  * While doing this, attempt to use the name cache to fast-forward through
1289  * as many "easy" to find components of the path as possible.
1290  *
1291  * We use the namecache's node locks to form a chain, and avoid as many
1292  * vnode references and locks as possible.  In the ideal case, only the
1293  * final vnode will have its reference count adjusted and lock taken.
1294  */
1295 static int
1296 lookup_fastforward(struct namei_state *state, struct vnode **searchdir_ret,
1297 		   struct vnode **foundobj_ret)
1298 {
1299 	struct componentname *cnp = state->cnp;
1300 	struct nameidata *ndp = state->ndp;
1301 	krwlock_t *plock;
1302 	struct vnode *foundobj, *searchdir;
1303 	int error, error2;
1304 	size_t oldpathlen;
1305 	const char *oldnameptr;
1306 	bool terminal;
1307 
1308 	/*
1309 	 * Eat as many path name components as possible before giving up and
1310 	 * letting lookup_once() handle it.  Remember the starting point in
1311 	 * case we can't get vnode references and need to roll back.
1312 	 */
1313 	plock = NULL;
1314 	searchdir = *searchdir_ret;
1315 	oldnameptr = cnp->cn_nameptr;
1316 	oldpathlen = ndp->ni_pathlen;
1317 	terminal = false;
1318 	for (;;) {
1319 		foundobj = NULL;
1320 
1321 		/*
1322 		 * Get the next component name.  There should be no slashes
1323 		 * here, and we shouldn't have looped around if we were
1324 		 * done.
1325 		 */
1326 		KASSERT(cnp->cn_nameptr[0] != '/');
1327 		KASSERT(cnp->cn_nameptr[0] != '\0');
1328 		if ((error = lookup_parsepath(state)) != 0) {
1329 			break;
1330 		}
1331 
1332 		/*
1333 		 * Can't deal with DOTDOT lookups if NOCROSSMOUNT or the
1334 		 * lookup is chrooted.
1335 		 */
1336 		if ((cnp->cn_flags & ISDOTDOT) != 0) {
1337 			if ((searchdir->v_vflag & VV_ROOT) != 0 &&
1338 			    (cnp->cn_flags & NOCROSSMOUNT)) {
1339 			    	error = EOPNOTSUPP;
1340 				break;
1341 			}
1342 			if (ndp->ni_rootdir != rootvnode) {
1343 			    	error = EOPNOTSUPP;
1344 				break;
1345 			}
1346 		}
1347 
1348 		/*
1349 		 * Can't deal with last component when modifying; this needs
1350 		 * searchdir locked and VOP_LOOKUP() called (which can and
1351 		 * does modify state, despite the name).  NB: this case means
1352 		 * terminal is never set true when LOCKPARENT.
1353 		 */
1354 		if ((cnp->cn_flags & ISLASTCN) != 0) {
1355 			if (cnp->cn_nameiop != LOOKUP ||
1356 			    (cnp->cn_flags & LOCKPARENT) != 0) {
1357 				error = EOPNOTSUPP;
1358 				break;
1359 			}
1360 		}
1361 
1362 		/*
1363 		 * Good, now look for it in cache.  cache_lookup_linked()
1364 		 * will fail if there's nothing there, or if there's no
1365 		 * ownership info for the directory, or if the user doesn't
1366 		 * have permission to look up files in this directory.
1367 		 */
1368 		if (!cache_lookup_linked(searchdir, cnp->cn_nameptr,
1369 		    cnp->cn_namelen, &foundobj, &plock, cnp->cn_cred)) {
1370 			error = EOPNOTSUPP;
1371 			break;
1372 		}
1373 		KASSERT(plock != NULL && rw_lock_held(plock));
1374 
1375 		/*
1376 		 * Scored a hit.  Negative is good too (ENOENT).  If there's
1377 		 * a '-o union' mount here, punt and let lookup_once() deal
1378 		 * with it.
1379 		 */
1380 		if (foundobj == NULL) {
1381 			if ((searchdir->v_vflag & VV_ROOT) != 0 &&
1382 			    (searchdir->v_mount->mnt_flag & MNT_UNION) != 0) {
1383 			    	error = EOPNOTSUPP;
1384 			} else {
1385 				error = ENOENT;
1386 				terminal = ((cnp->cn_flags & ISLASTCN) != 0);
1387 			}
1388 			break;
1389 		}
1390 
1391 		/*
1392 		 * Stop and get a hold on the vnode if we've encountered
1393 		 * something other than a dirctory.
1394 		 */
1395 		if (foundobj->v_type != VDIR) {
1396 			error = vcache_tryvget(foundobj);
1397 			if (error != 0) {
1398 				foundobj = NULL;
1399 				error = EOPNOTSUPP;
1400 			} else {
1401 				terminal = (foundobj->v_type != VLNK &&
1402 				    (cnp->cn_flags & ISLASTCN) != 0);
1403 			}
1404 			break;
1405 		}
1406 
1407 		/*
1408 		 * Try to cross mountpoints, bearing in mind that they can
1409 		 * be stacked.  If at any point we can't go further, stop
1410 		 * and try to get a reference on the vnode.  If we are able
1411 		 * to get a ref then lookup_crossmount() will take care of
1412 		 * it, otherwise we'll fall through to lookup_once().
1413 		 */
1414 		if (foundobj->v_mountedhere != NULL) {
1415 			while (foundobj->v_mountedhere != NULL &&
1416 			    (cnp->cn_flags & NOCROSSMOUNT) == 0 &&
1417 			    cache_cross_mount(&foundobj, &plock)) {
1418 				KASSERT(foundobj != NULL);
1419 				KASSERT(foundobj->v_type == VDIR);
1420 			}
1421 			if (foundobj->v_mountedhere != NULL) {
1422 				error = vcache_tryvget(foundobj);
1423 				if (error != 0) {
1424 					foundobj = NULL;
1425 					error = EOPNOTSUPP;
1426 				}
1427 				break;
1428 			} else {
1429 				searchdir = NULL;
1430 			}
1431 		}
1432 
1433 		/*
1434 		 * Time to stop if we found the last component & traversed
1435 		 * all mounts.
1436 		 */
1437 		if ((cnp->cn_flags & ISLASTCN) != 0) {
1438 			error = vcache_tryvget(foundobj);
1439 			if (error != 0) {
1440 				foundobj = NULL;
1441 				error = EOPNOTSUPP;
1442 			} else {
1443 				terminal = (foundobj->v_type != VLNK);
1444 			}
1445 			break;
1446 		}
1447 
1448 		/*
1449 		 * Otherwise, we're still in business.  Set the found VDIR
1450 		 * vnode as the search dir for the next component and
1451 		 * continue on to it.
1452 		 */
1453 		cnp->cn_nameptr = ndp->ni_next;
1454 		searchdir = foundobj;
1455 	}
1456 
1457 	if (terminal) {
1458 		/*
1459 		 * If we exited the loop above having successfully located
1460 		 * the last component with a zero error code, and it's not a
1461 		 * symbolic link, then the parent directory is not needed.
1462 		 * Release reference to the starting parent and make the
1463 		 * terminal parent disappear into thin air.
1464 		 */
1465 		KASSERT(plock != NULL);
1466 		rw_exit(plock);
1467 		vrele(*searchdir_ret);
1468 		*searchdir_ret = NULL;
1469 	} else if (searchdir != *searchdir_ret) {
1470 		/*
1471 		 * Otherwise we need to return the parent.  If we ended up
1472 		 * with a new search dir, ref it before dropping the
1473 		 * namecache's lock.  The lock prevents both searchdir and
1474 		 * foundobj from disappearing.  If we can't ref the new
1475 		 * searchdir, we have a bit of a problem.  Roll back the
1476 		 * fastforward to the beginning and let lookup_once() take
1477 		 * care of it.
1478 		 */
1479 		if (searchdir == NULL) {
1480 			/*
1481 			 * It's possible for searchdir to be NULL in the
1482 			 * case of a root vnode being reclaimed while
1483 			 * trying to cross a mount.
1484 			 */
1485 			error2 = EOPNOTSUPP;
1486 		} else {
1487 			error2 = vcache_tryvget(searchdir);
1488 		}
1489 		KASSERT(plock != NULL);
1490 		rw_exit(plock);
1491 		if (__predict_true(error2 == 0)) {
1492 			/* Returning new searchdir, and maybe new foundobj. */
1493 			vrele(*searchdir_ret);
1494 			*searchdir_ret = searchdir;
1495 		} else {
1496 			/* Returning nothing. */
1497 			if (foundobj != NULL) {
1498 				vrele(foundobj);
1499 				foundobj = NULL;
1500 			}
1501 			cnp->cn_nameptr = oldnameptr;
1502 			ndp->ni_pathlen = oldpathlen;
1503 			error = lookup_parsepath(state);
1504 			if (error == 0) {
1505 				error = EOPNOTSUPP;
1506 			}
1507 		}
1508 	} else if (plock != NULL) {
1509 		/* Drop any namecache lock still held. */
1510 		rw_exit(plock);
1511 	}
1512 
1513 	KASSERT(error == 0 ? foundobj != NULL : foundobj == NULL);
1514 	*foundobj_ret = foundobj;
1515 	return error;
1516 }
1517 
1518 //////////////////////////////
1519 
1520 /*
1521  * Do a complete path search from a single root directory.
1522  * (This is called up to twice if TRYEMULROOT is in effect.)
1523  */
1524 static int
1525 namei_oneroot(struct namei_state *state,
1526 	 int neverfollow, int inhibitmagic, int isnfsd)
1527 {
1528 	struct nameidata *ndp = state->ndp;
1529 	struct componentname *cnp = state->cnp;
1530 	struct vnode *searchdir, *foundobj;
1531 	bool searchdir_locked = false;
1532 	int error;
1533 
1534 	error = namei_start(state, isnfsd, &searchdir);
1535 	if (error) {
1536 		ndp->ni_dvp = NULL;
1537 		ndp->ni_vp = NULL;
1538 		return error;
1539 	}
1540 	KASSERT(searchdir->v_type == VDIR);
1541 
1542 	/*
1543 	 * Setup: break out flag bits into variables.
1544 	 */
1545 	state->docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE;
1546 	if (cnp->cn_nameiop == DELETE)
1547 		state->docache = 0;
1548 	state->rdonly = cnp->cn_flags & RDONLY;
1549 
1550 	/*
1551 	 * Keep going until we run out of path components.
1552 	 */
1553 	cnp->cn_nameptr = ndp->ni_pnbuf;
1554 
1555 	/* drop leading slashes (already used them to choose startdir) */
1556 	while (cnp->cn_nameptr[0] == '/') {
1557 		cnp->cn_nameptr++;
1558 		ndp->ni_pathlen--;
1559 	}
1560 	/* was it just "/"? */
1561 	if (cnp->cn_nameptr[0] == '\0') {
1562 		foundobj = searchdir;
1563 		searchdir = NULL;
1564 		cnp->cn_flags |= ISLASTCN;
1565 
1566 		/* bleh */
1567 		goto skiploop;
1568 	}
1569 
1570 	for (;;) {
1571 		KASSERT(searchdir != NULL);
1572 		KASSERT(!searchdir_locked);
1573 
1574 		/*
1575 		 * Parse out the first path name component that we need to
1576 		 * to consider.  While doing this, attempt to use the name
1577 		 * cache to fast-forward through as many "easy" to find
1578 		 * components of the path as possible.
1579 		 */
1580 		error = lookup_fastforward(state, &searchdir, &foundobj);
1581 
1582 		/*
1583 		 * If we didn't get a good answer from the namecache, then
1584 		 * go directly to the file system.
1585 		 */
1586 		if (error == EOPNOTSUPP) {
1587 			error = lookup_once(state, searchdir, &searchdir,
1588 			    &foundobj, &searchdir_locked);
1589 		}
1590 
1591 		/*
1592 		 * If the vnode we found is mounted on, then cross the mount
1593 		 * and get the root vnode in foundobj.  If this encounters
1594 		 * an error, it will dispose of foundobj, but searchdir is
1595 		 * untouched.
1596 		 */
1597 		if (error == 0 && foundobj != NULL &&
1598 		    foundobj->v_type == VDIR &&
1599 		    foundobj->v_mountedhere != NULL &&
1600 		    (cnp->cn_flags & NOCROSSMOUNT) == 0) {
1601 		    	error = lookup_crossmount(state, &searchdir,
1602 		    	    &foundobj, &searchdir_locked);
1603 		}
1604 
1605 		if (error) {
1606 			if (searchdir != NULL) {
1607 				if (searchdir_locked) {
1608 					searchdir_locked = false;
1609 					vput(searchdir);
1610 				} else {
1611 					vrele(searchdir);
1612 				}
1613 			}
1614 			ndp->ni_dvp = NULL;
1615 			ndp->ni_vp = NULL;
1616 			/*
1617 			 * Note that if we're doing TRYEMULROOT we can
1618 			 * retry with the normal root. Where this is
1619 			 * currently set matches previous practice,
1620 			 * but the previous practice didn't make much
1621 			 * sense and somebody should sit down and
1622 			 * figure out which cases should cause retry
1623 			 * and which shouldn't. XXX.
1624 			 */
1625 			state->attempt_retry = 1;
1626 			return (error);
1627 		}
1628 
1629 		if (foundobj == NULL) {
1630 			/*
1631 			 * Success with no object returned means we're
1632 			 * creating something and it isn't already
1633 			 * there. Break out of the main loop now so
1634 			 * the code below doesn't have to test for
1635 			 * foundobj == NULL.
1636 			 */
1637 			/* lookup_once can't have dropped the searchdir */
1638 			KASSERT(searchdir != NULL ||
1639 			    (cnp->cn_flags & ISLASTCN) != 0);
1640 			break;
1641 		}
1642 
1643 		/*
1644 		 * Check for symbolic link. If we've reached one,
1645 		 * follow it, unless we aren't supposed to. Back up
1646 		 * over any slashes that we skipped, as we will need
1647 		 * them again.
1648 		 */
1649 		if (namei_atsymlink(state, foundobj)) {
1650 			/* Don't need searchdir locked any more. */
1651 			if (searchdir_locked) {
1652 				searchdir_locked = false;
1653 				VOP_UNLOCK(searchdir);
1654 			}
1655 			ndp->ni_pathlen += state->slashes;
1656 			ndp->ni_next -= state->slashes;
1657 			if (neverfollow) {
1658 				error = EINVAL;
1659 			} else if (searchdir == NULL) {
1660 				/*
1661 				 * dholland 20160410: lookup_once only
1662 				 * drops searchdir if it crossed a
1663 				 * mount point. Therefore, if we get
1664 				 * here it means we crossed a mount
1665 				 * point to a mounted filesystem whose
1666 				 * root vnode is a symlink. In theory
1667 				 * we could continue at this point by
1668 				 * using the pre-crossing searchdir
1669 				 * (e.g. just take out an extra
1670 				 * reference on it before calling
1671 				 * lookup_once so we still have it),
1672 				 * but this will make an ugly mess and
1673 				 * it should never happen in practice
1674 				 * as only badly broken filesystems
1675 				 * have non-directory root vnodes. (I
1676 				 * have seen this sort of thing with
1677 				 * NFS occasionally but even then it
1678 				 * means something's badly wrong.)
1679 				 */
1680 				error = ENOTDIR;
1681 			} else {
1682 				/*
1683 				 * dholland 20110410: if we're at a
1684 				 * union mount it might make sense to
1685 				 * use the top of the union stack here
1686 				 * rather than the layer we found the
1687 				 * symlink in. (FUTURE)
1688 				 */
1689 				error = namei_follow(state, inhibitmagic,
1690 						     searchdir, foundobj,
1691 						     &searchdir);
1692 			}
1693 			if (error) {
1694 				KASSERT(searchdir != foundobj);
1695 				if (searchdir != NULL) {
1696 					vrele(searchdir);
1697 				}
1698 				vrele(foundobj);
1699 				ndp->ni_dvp = NULL;
1700 				ndp->ni_vp = NULL;
1701 				return error;
1702 			}
1703 			vrele(foundobj);
1704 			foundobj = NULL;
1705 
1706 			/*
1707 			 * If we followed a symlink to `/' and there
1708 			 * are no more components after the symlink,
1709 			 * we're done with the loop and what we found
1710 			 * is the searchdir.
1711 			 */
1712 			if (cnp->cn_nameptr[0] == '\0') {
1713 				KASSERT(searchdir != NULL);
1714 				foundobj = searchdir;
1715 				searchdir = NULL;
1716 				cnp->cn_flags |= ISLASTCN;
1717 				break;
1718 			}
1719 
1720 			continue;
1721 		}
1722 
1723 		/*
1724 		 * Not a symbolic link.
1725 		 *
1726 		 * Check for directory, if the component was
1727 		 * followed by a series of slashes.
1728 		 */
1729 		if ((foundobj->v_type != VDIR) &&
1730 		    (cnp->cn_flags & REQUIREDIR)) {
1731 			KASSERT(foundobj != searchdir);
1732 			if (searchdir) {
1733 				if (searchdir_locked) {
1734 					searchdir_locked = false;
1735 					vput(searchdir);
1736 				} else {
1737 					vrele(searchdir);
1738 				}
1739 			} else {
1740 				KASSERT(!searchdir_locked);
1741 			}
1742 			vrele(foundobj);
1743 			ndp->ni_dvp = NULL;
1744 			ndp->ni_vp = NULL;
1745 			state->attempt_retry = 1;
1746 			return ENOTDIR;
1747 		}
1748 
1749 		/*
1750 		 * Stop if we've reached the last component.
1751 		 */
1752 		if (cnp->cn_flags & ISLASTCN) {
1753 			break;
1754 		}
1755 
1756 		/*
1757 		 * Continue with the next component.
1758 		 */
1759 		cnp->cn_nameptr = ndp->ni_next;
1760 		if (searchdir != NULL) {
1761 			if (searchdir_locked) {
1762 				searchdir_locked = false;
1763 				vput(searchdir);
1764 			} else {
1765 				vrele(searchdir);
1766 			}
1767 		}
1768 		searchdir = foundobj;
1769 		foundobj = NULL;
1770 	}
1771 
1772 	KASSERT((cnp->cn_flags & LOCKPARENT) == 0 || searchdir == NULL ||
1773 	    VOP_ISLOCKED(searchdir) == LK_EXCLUSIVE);
1774 
1775  skiploop:
1776 
1777 	if (foundobj != NULL) {
1778 		if (foundobj == ndp->ni_erootdir) {
1779 			/*
1780 			 * We are about to return the emulation root.
1781 			 * This isn't a good idea because code might
1782 			 * repeatedly lookup ".." until the file
1783 			 * matches that returned for "/" and loop
1784 			 * forever.  So convert it to the real root.
1785 			 */
1786 			if (searchdir != NULL) {
1787 				if (searchdir_locked) {
1788 					vput(searchdir);
1789 					searchdir_locked = false;
1790 				} else {
1791 					vrele(searchdir);
1792 				}
1793 				searchdir = NULL;
1794 			}
1795 			vrele(foundobj);
1796 			foundobj = ndp->ni_rootdir;
1797 			vref(foundobj);
1798 		}
1799 
1800 		/*
1801 		 * If the caller requested the parent node (i.e. it's
1802 		 * a CREATE, DELETE, or RENAME), and we don't have one
1803 		 * (because this is the root directory, or we crossed
1804 		 * a mount point), then we must fail.
1805 		 */
1806 		if (cnp->cn_nameiop != LOOKUP &&
1807 		    (searchdir == NULL ||
1808 		     searchdir->v_mount != foundobj->v_mount)) {
1809 			if (searchdir) {
1810 				if (searchdir_locked) {
1811 					vput(searchdir);
1812 					searchdir_locked = false;
1813 				} else {
1814 					vrele(searchdir);
1815 				}
1816 				searchdir = NULL;
1817 			}
1818 			vrele(foundobj);
1819 			foundobj = NULL;
1820 			ndp->ni_dvp = NULL;
1821 			ndp->ni_vp = NULL;
1822 			state->attempt_retry = 1;
1823 
1824 			switch (cnp->cn_nameiop) {
1825 			    case CREATE:
1826 				return EEXIST;
1827 			    case DELETE:
1828 			    case RENAME:
1829 				return EBUSY;
1830 			    default:
1831 				break;
1832 			}
1833 			panic("Invalid nameiop\n");
1834 		}
1835 
1836 		/*
1837 		 * Disallow directory write attempts on read-only lookups.
1838 		 * Prefers EEXIST over EROFS for the CREATE case.
1839 		 */
1840 		if (state->rdonly &&
1841 		    (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1842 			if (searchdir) {
1843 				if (searchdir_locked) {
1844 					vput(searchdir);
1845 					searchdir_locked = false;
1846 				} else {
1847 					vrele(searchdir);
1848 				}
1849 				searchdir = NULL;
1850 			}
1851 			vrele(foundobj);
1852 			foundobj = NULL;
1853 			ndp->ni_dvp = NULL;
1854 			ndp->ni_vp = NULL;
1855 			state->attempt_retry = 1;
1856 			return EROFS;
1857 		}
1858 
1859 		/* Lock the leaf node if requested. */
1860 		if ((cnp->cn_flags & (LOCKLEAF | LOCKPARENT)) == LOCKPARENT &&
1861 		    searchdir == foundobj) {
1862 			/*
1863 			 * Note: if LOCKPARENT but not LOCKLEAF is
1864 			 * set, and searchdir == foundobj, this code
1865 			 * necessarily unlocks the parent as well as
1866 			 * the leaf. That is, just because you specify
1867 			 * LOCKPARENT doesn't mean you necessarily get
1868 			 * a locked parent vnode. The code in
1869 			 * vfs_syscalls.c, and possibly elsewhere,
1870 			 * that uses this combination "knows" this, so
1871 			 * it can't be safely changed. Feh. XXX
1872 			 */
1873 			KASSERT(searchdir_locked);
1874 		    	VOP_UNLOCK(searchdir);
1875 		    	searchdir_locked = false;
1876 		} else if ((cnp->cn_flags & LOCKLEAF) != 0 &&
1877 		    (searchdir != foundobj ||
1878 		    (cnp->cn_flags & LOCKPARENT) == 0)) {
1879 			const int lktype = (cnp->cn_flags & LOCKSHARED) != 0 ?
1880 			    LK_SHARED : LK_EXCLUSIVE;
1881 			vn_lock(foundobj, lktype | LK_RETRY);
1882 		}
1883 	}
1884 
1885 	/*
1886 	 * Done.
1887 	 */
1888 
1889 	/*
1890 	 * If LOCKPARENT is not set, the parent directory isn't returned.
1891 	 */
1892 	if ((cnp->cn_flags & LOCKPARENT) == 0 && searchdir != NULL) {
1893 		vrele(searchdir);
1894 		searchdir = NULL;
1895 	}
1896 
1897 	ndp->ni_dvp = searchdir;
1898 	ndp->ni_vp = foundobj;
1899 	return 0;
1900 }
1901 
1902 /*
1903  * Do namei; wrapper layer that handles TRYEMULROOT.
1904  */
1905 static int
1906 namei_tryemulroot(struct namei_state *state,
1907 	 int neverfollow, int inhibitmagic, int isnfsd)
1908 {
1909 	int error;
1910 
1911 	struct nameidata *ndp = state->ndp;
1912 	struct componentname *cnp = state->cnp;
1913 	const char *savepath = NULL;
1914 
1915 	KASSERT(cnp == &ndp->ni_cnd);
1916 
1917 	if (cnp->cn_flags & TRYEMULROOT) {
1918 		savepath = pathbuf_stringcopy_get(ndp->ni_pathbuf);
1919 	}
1920 
1921     emul_retry:
1922 	state->attempt_retry = 0;
1923 
1924 	error = namei_oneroot(state, neverfollow, inhibitmagic, isnfsd);
1925 	if (error) {
1926 		/*
1927 		 * Once namei has started up, the existence of ni_erootdir
1928 		 * tells us whether we're working from an emulation root.
1929 		 * The TRYEMULROOT flag isn't necessarily authoritative.
1930 		 */
1931 		if (ndp->ni_erootdir != NULL && state->attempt_retry) {
1932 			/* Retry the whole thing using the normal root */
1933 			cnp->cn_flags &= ~TRYEMULROOT;
1934 			state->attempt_retry = 0;
1935 
1936 			/* kinda gross */
1937 			strcpy(ndp->ni_pathbuf->pb_path, savepath);
1938 			pathbuf_stringcopy_put(ndp->ni_pathbuf, savepath);
1939 			savepath = NULL;
1940 
1941 			goto emul_retry;
1942 		}
1943 	}
1944 	if (savepath != NULL) {
1945 		pathbuf_stringcopy_put(ndp->ni_pathbuf, savepath);
1946 	}
1947 	return error;
1948 }
1949 
1950 /*
1951  * External interface.
1952  */
1953 int
1954 namei(struct nameidata *ndp)
1955 {
1956 	struct namei_state state;
1957 	int error;
1958 
1959 	namei_init(&state, ndp);
1960 	error = namei_tryemulroot(&state,
1961 				  0/*!neverfollow*/, 0/*!inhibitmagic*/,
1962 				  0/*isnfsd*/);
1963 	namei_cleanup(&state);
1964 
1965 	if (error) {
1966 		/* make sure no stray refs leak out */
1967 		KASSERT(ndp->ni_dvp == NULL);
1968 		KASSERT(ndp->ni_vp == NULL);
1969 	}
1970 
1971 	return error;
1972 }
1973 
1974 ////////////////////////////////////////////////////////////
1975 
1976 /*
1977  * External interface used by nfsd. This is basically different from
1978  * namei only in that it has the ability to pass in the "current
1979  * directory", and uses an extra flag "neverfollow" for which there's
1980  * no physical flag defined in namei.h. (There used to be a cut&paste
1981  * copy of about half of namei in nfsd to allow these minor
1982  * adjustments to exist.)
1983  *
1984  * XXX: the namei interface should be adjusted so nfsd can just use
1985  * ordinary namei().
1986  */
1987 int
1988 lookup_for_nfsd(struct nameidata *ndp, struct vnode *forcecwd, int neverfollow)
1989 {
1990 	struct namei_state state;
1991 	int error;
1992 
1993 	KASSERT(ndp->ni_atdir == NULL);
1994 	ndp->ni_atdir = forcecwd;
1995 
1996 	namei_init(&state, ndp);
1997 	error = namei_tryemulroot(&state,
1998 				  neverfollow, 1/*inhibitmagic*/, 1/*isnfsd*/);
1999 	namei_cleanup(&state);
2000 
2001 	if (error) {
2002 		/* make sure no stray refs leak out */
2003 		KASSERT(ndp->ni_dvp == NULL);
2004 		KASSERT(ndp->ni_vp == NULL);
2005 	}
2006 
2007 	return error;
2008 }
2009 
2010 /*
2011  * A second external interface used by nfsd. This turns out to be a
2012  * single lookup used by the WebNFS code (ha!) to get "index.html" or
2013  * equivalent when asked for a directory. It should eventually evolve
2014  * into some kind of namei_once() call; for the time being it's kind
2015  * of a mess. XXX.
2016  *
2017  * dholland 20110109: I don't think it works, and I don't think it
2018  * worked before I started hacking and slashing either, and I doubt
2019  * anyone will ever notice.
2020  */
2021 
2022 /*
2023  * Internals. This calls lookup_once() after setting up the assorted
2024  * pieces of state the way they ought to be.
2025  */
2026 static int
2027 do_lookup_for_nfsd_index(struct namei_state *state)
2028 {
2029 	int error = 0;
2030 
2031 	struct componentname *cnp = state->cnp;
2032 	struct nameidata *ndp = state->ndp;
2033 	struct vnode *startdir;
2034 	struct vnode *foundobj;
2035 	bool startdir_locked;
2036 	const char *cp;			/* pointer into pathname argument */
2037 
2038 	KASSERT(cnp == &ndp->ni_cnd);
2039 
2040 	startdir = state->ndp->ni_atdir;
2041 
2042 	cnp->cn_nameptr = ndp->ni_pnbuf;
2043 	state->docache = 1;
2044 	state->rdonly = cnp->cn_flags & RDONLY;
2045 	ndp->ni_dvp = NULL;
2046 
2047 	cnp->cn_consume = 0;
2048 	cnp->cn_namelen = namei_getcomponent(cnp->cn_nameptr);
2049 	cp = cnp->cn_nameptr + cnp->cn_namelen;
2050 	KASSERT(cnp->cn_namelen <= KERNEL_NAME_MAX);
2051 	ndp->ni_pathlen -= cnp->cn_namelen;
2052 	ndp->ni_next = cp;
2053 	state->slashes = 0;
2054 	cnp->cn_flags &= ~REQUIREDIR;
2055 	cnp->cn_flags |= MAKEENTRY|ISLASTCN;
2056 
2057 	if (cnp->cn_namelen == 2 &&
2058 	    cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
2059 		cnp->cn_flags |= ISDOTDOT;
2060 	else
2061 		cnp->cn_flags &= ~ISDOTDOT;
2062 
2063 	/*
2064 	 * Because lookup_once can change the startdir, we need our
2065 	 * own reference to it to avoid consuming the caller's.
2066 	 */
2067 	vref(startdir);
2068 	error = lookup_once(state, startdir, &startdir, &foundobj,
2069 	    &startdir_locked);
2070 
2071 	KASSERT((cnp->cn_flags & LOCKPARENT) == 0);
2072 	if (startdir_locked) {
2073 		VOP_UNLOCK(startdir);
2074 		startdir_locked = false;
2075 	}
2076 
2077 	/*
2078 	 * If the vnode we found is mounted on, then cross the mount and get
2079 	 * the root vnode in foundobj.  If this encounters an error, it will
2080 	 * dispose of foundobj, but searchdir is untouched.
2081 	 */
2082 	if (error == 0 && foundobj != NULL &&
2083 	    foundobj->v_type == VDIR &&
2084 	    foundobj->v_mountedhere != NULL &&
2085 	    (cnp->cn_flags & NOCROSSMOUNT) == 0) {
2086 		error = lookup_crossmount(state, &startdir, &foundobj,
2087 		    &startdir_locked);
2088 	}
2089 
2090 	/* Now toss startdir and see if we have an error. */
2091 	if (startdir != NULL)
2092 		vrele(startdir);
2093 	if (error)
2094 		foundobj = NULL;
2095 	else if (foundobj != NULL && (cnp->cn_flags & LOCKLEAF) != 0)
2096 		vn_lock(foundobj, LK_EXCLUSIVE | LK_RETRY);
2097 
2098 	ndp->ni_vp = foundobj;
2099 	return (error);
2100 }
2101 
2102 /*
2103  * External interface. The partitioning between this function and the
2104  * above isn't very clear - the above function exists mostly so code
2105  * that uses "state->" can be shuffled around without having to change
2106  * it to "state.".
2107  */
2108 int
2109 lookup_for_nfsd_index(struct nameidata *ndp, struct vnode *startdir)
2110 {
2111 	struct namei_state state;
2112 	int error;
2113 
2114 	KASSERT(ndp->ni_atdir == NULL);
2115 	ndp->ni_atdir = startdir;
2116 
2117 	/*
2118 	 * Note: the name sent in here (is not|should not be) allowed
2119 	 * to contain a slash.
2120 	 */
2121 	if (strlen(ndp->ni_pathbuf->pb_path) > KERNEL_NAME_MAX) {
2122 		return ENAMETOOLONG;
2123 	}
2124 	if (strchr(ndp->ni_pathbuf->pb_path, '/')) {
2125 		return EINVAL;
2126 	}
2127 
2128 	ndp->ni_pathlen = strlen(ndp->ni_pathbuf->pb_path) + 1;
2129 	ndp->ni_pnbuf = NULL;
2130 	ndp->ni_cnd.cn_nameptr = NULL;
2131 
2132 	namei_init(&state, ndp);
2133 	error = do_lookup_for_nfsd_index(&state);
2134 	namei_cleanup(&state);
2135 
2136 	return error;
2137 }
2138 
2139 ////////////////////////////////////////////////////////////
2140 
2141 /*
2142  * Reacquire a path name component.
2143  * dvp is locked on entry and exit.
2144  * *vpp is locked on exit unless it's NULL.
2145  */
2146 int
2147 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp, int dummy)
2148 {
2149 	int rdonly;			/* lookup read-only flag bit */
2150 	int error = 0;
2151 #ifdef DEBUG
2152 	size_t newlen;			/* DEBUG: check name len */
2153 	const char *cp;			/* DEBUG: check name ptr */
2154 #endif /* DEBUG */
2155 
2156 	(void)dummy;
2157 
2158 	/*
2159 	 * Setup: break out flag bits into variables.
2160 	 */
2161 	rdonly = cnp->cn_flags & RDONLY;
2162 
2163 	/*
2164 	 * Search a new directory.
2165 	 *
2166 	 * The cn_hash value is for use by vfs_cache.
2167 	 * The last component of the filename is left accessible via
2168 	 * cnp->cn_nameptr for callers that need the name. Callers needing
2169 	 * the name set the SAVENAME flag. When done, they assume
2170 	 * responsibility for freeing the pathname buffer.
2171 	 */
2172 #ifdef DEBUG
2173 #if 0
2174 	cp = NULL;
2175 	newhash = namei_hash(cnp->cn_nameptr, &cp);
2176 	if ((uint32_t)newhash != (uint32_t)cnp->cn_hash)
2177 		panic("relookup: bad hash");
2178 #endif
2179 	newlen = namei_getcomponent(cnp->cn_nameptr);
2180 	if (cnp->cn_namelen != newlen)
2181 		panic("relookup: bad len");
2182 	cp = cnp->cn_nameptr + cnp->cn_namelen;
2183 	while (*cp == '/')
2184 		cp++;
2185 	if (*cp != 0)
2186 		panic("relookup: not last component");
2187 #endif /* DEBUG */
2188 
2189 	/*
2190 	 * Check for degenerate name (e.g. / or "")
2191 	 * which is a way of talking about a directory,
2192 	 * e.g. like "/." or ".".
2193 	 */
2194 	if (cnp->cn_nameptr[0] == '\0')
2195 		panic("relookup: null name");
2196 
2197 	if (cnp->cn_flags & ISDOTDOT)
2198 		panic("relookup: lookup on dot-dot");
2199 
2200 	/*
2201 	 * We now have a segment name to search for, and a directory to search.
2202 	 */
2203 	*vpp = NULL;
2204 	error = VOP_LOOKUP(dvp, vpp, cnp);
2205 	if ((error) != 0) {
2206 		KASSERTMSG((*vpp == NULL),
2207 		    "leaf `%s' should be empty but is %p",
2208 		    cnp->cn_nameptr, *vpp);
2209 		if (error != EJUSTRETURN)
2210 			goto bad;
2211 	}
2212 
2213 	/*
2214 	 * Check for symbolic link
2215 	 */
2216 	KASSERTMSG((*vpp == NULL || (*vpp)->v_type != VLNK ||
2217 		(cnp->cn_flags & FOLLOW) == 0),
2218 	    "relookup: symlink found");
2219 
2220 	/*
2221 	 * Check for read-only lookups.
2222 	 */
2223 	if (rdonly && cnp->cn_nameiop != LOOKUP) {
2224 		error = EROFS;
2225 		if (*vpp) {
2226 			vrele(*vpp);
2227 		}
2228 		goto bad;
2229 	}
2230 	/*
2231 	 * Lock result.
2232 	 */
2233 	if (*vpp && *vpp != dvp) {
2234 		error = vn_lock(*vpp, LK_EXCLUSIVE);
2235 		if (error != 0) {
2236 			vrele(*vpp);
2237 			goto bad;
2238 		}
2239 	}
2240 	return (0);
2241 
2242 bad:
2243 	*vpp = NULL;
2244 	return (error);
2245 }
2246 
2247 /*
2248  * namei_simple - simple forms of namei.
2249  *
2250  * These are wrappers to allow the simple case callers of namei to be
2251  * left alone while everything else changes under them.
2252  */
2253 
2254 /* Flags */
2255 struct namei_simple_flags_type {
2256 	int dummy;
2257 };
2258 static const struct namei_simple_flags_type ns_nn, ns_nt, ns_fn, ns_ft;
2259 const namei_simple_flags_t NSM_NOFOLLOW_NOEMULROOT = &ns_nn;
2260 const namei_simple_flags_t NSM_NOFOLLOW_TRYEMULROOT = &ns_nt;
2261 const namei_simple_flags_t NSM_FOLLOW_NOEMULROOT = &ns_fn;
2262 const namei_simple_flags_t NSM_FOLLOW_TRYEMULROOT = &ns_ft;
2263 
2264 static
2265 int
2266 namei_simple_convert_flags(namei_simple_flags_t sflags)
2267 {
2268 	if (sflags == NSM_NOFOLLOW_NOEMULROOT)
2269 		return NOFOLLOW | 0;
2270 	if (sflags == NSM_NOFOLLOW_TRYEMULROOT)
2271 		return NOFOLLOW | TRYEMULROOT;
2272 	if (sflags == NSM_FOLLOW_NOEMULROOT)
2273 		return FOLLOW | 0;
2274 	if (sflags == NSM_FOLLOW_TRYEMULROOT)
2275 		return FOLLOW | TRYEMULROOT;
2276 	panic("namei_simple_convert_flags: bogus sflags\n");
2277 	return 0;
2278 }
2279 
2280 int
2281 namei_simple_kernel(const char *path, namei_simple_flags_t sflags,
2282 	struct vnode **vp_ret)
2283 {
2284 	return nameiat_simple_kernel(NULL, path, sflags, vp_ret);
2285 }
2286 
2287 int
2288 nameiat_simple_kernel(struct vnode *dvp, const char *path,
2289 	namei_simple_flags_t sflags, struct vnode **vp_ret)
2290 {
2291 	struct nameidata nd;
2292 	struct pathbuf *pb;
2293 	int err;
2294 
2295 	pb = pathbuf_create(path);
2296 	if (pb == NULL) {
2297 		return ENOMEM;
2298 	}
2299 
2300 	NDINIT(&nd,
2301 		LOOKUP,
2302 		namei_simple_convert_flags(sflags),
2303 		pb);
2304 
2305 	if (dvp != NULL)
2306 		NDAT(&nd, dvp);
2307 
2308 	err = namei(&nd);
2309 	if (err != 0) {
2310 		pathbuf_destroy(pb);
2311 		return err;
2312 	}
2313 	*vp_ret = nd.ni_vp;
2314 	pathbuf_destroy(pb);
2315 	return 0;
2316 }
2317 
2318 int
2319 namei_simple_user(const char *path, namei_simple_flags_t sflags,
2320 	struct vnode **vp_ret)
2321 {
2322 	return nameiat_simple_user(NULL, path, sflags, vp_ret);
2323 }
2324 
2325 int
2326 nameiat_simple_user(struct vnode *dvp, const char *path,
2327 	namei_simple_flags_t sflags, struct vnode **vp_ret)
2328 {
2329 	struct pathbuf *pb;
2330 	struct nameidata nd;
2331 	int err;
2332 
2333 	err = pathbuf_copyin(path, &pb);
2334 	if (err) {
2335 		return err;
2336 	}
2337 
2338 	NDINIT(&nd,
2339 		LOOKUP,
2340 		namei_simple_convert_flags(sflags),
2341 		pb);
2342 
2343 	if (dvp != NULL)
2344 		NDAT(&nd, dvp);
2345 
2346 	err = namei(&nd);
2347 	if (err != 0) {
2348 		pathbuf_destroy(pb);
2349 		return err;
2350 	}
2351 	*vp_ret = nd.ni_vp;
2352 	pathbuf_destroy(pb);
2353 	return 0;
2354 }
2355