xref: /netbsd-src/sys/kern/vfs_lookup.c (revision 8ecbf5f02b752fcb7debe1a8fab1dc82602bc760)
1 /*	$NetBSD: vfs_lookup.c,v 1.224 2020/06/15 18:44:10 ad Exp $	*/
2 
3 /*
4  * Copyright (c) 1982, 1986, 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  * (c) UNIX System Laboratories, Inc.
7  * All or some portions of this file are derived from material licensed
8  * to the University of California by American Telephone and Telegraph
9  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10  * the permission of UNIX System Laboratories, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	@(#)vfs_lookup.c	8.10 (Berkeley) 5/27/95
37  */
38 
39 #include <sys/cdefs.h>
40 __KERNEL_RCSID(0, "$NetBSD: vfs_lookup.c,v 1.224 2020/06/15 18:44:10 ad Exp $");
41 
42 #ifdef _KERNEL_OPT
43 #include "opt_magiclinks.h"
44 #endif
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/kernel.h>
49 #include <sys/syslimits.h>
50 #include <sys/time.h>
51 #include <sys/namei.h>
52 #include <sys/vnode.h>
53 #include <sys/vnode_impl.h>
54 #include <sys/mount.h>
55 #include <sys/errno.h>
56 #include <sys/filedesc.h>
57 #include <sys/hash.h>
58 #include <sys/proc.h>
59 #include <sys/syslog.h>
60 #include <sys/kauth.h>
61 #include <sys/ktrace.h>
62 #include <sys/dirent.h>
63 
64 #ifndef MAGICLINKS
65 #define MAGICLINKS 0
66 #endif
67 
68 int vfs_magiclinks = MAGICLINKS;
69 
70 __CTASSERT(MAXNAMLEN == NAME_MAX);
71 
72 /*
73  * Substitute replacement text for 'magic' strings in symlinks.
74  * Returns 0 if successful, and returns non-zero if an error
75  * occurs.  (Currently, the only possible error is running out
76  * of temporary pathname space.)
77  *
78  * Looks for "@<string>" and "@<string>/", where <string> is a
79  * recognized 'magic' string.  Replaces the "@<string>" with the
80  * appropriate replacement text.  (Note that in some cases the
81  * replacement text may have zero length.)
82  *
83  * This would have been table driven, but the variance in
84  * replacement strings (and replacement string lengths) made
85  * that impractical.
86  */
87 #define	VNL(x)							\
88 	(sizeof(x) - 1)
89 
90 #define	VO	'{'
91 #define	VC	'}'
92 
93 #define	MATCH(str)						\
94 	((termchar == '/' && i + VNL(str) == *len) ||		\
95 	 (i + VNL(str) < *len &&				\
96 	  cp[i + VNL(str)] == termchar)) &&			\
97 	!strncmp((str), &cp[i], VNL(str))
98 
99 #define	SUBSTITUTE(m, s, sl)					\
100 	if ((newlen + (sl)) >= MAXPATHLEN)			\
101 		return 1;					\
102 	i += VNL(m);						\
103 	if (termchar != '/')					\
104 		i++;						\
105 	(void)memcpy(&tmp[newlen], (s), (sl));			\
106 	newlen += (sl);						\
107 	change = 1;						\
108 	termchar = '/';
109 
110 static int
111 symlink_magic(struct proc *p, char *cp, size_t *len)
112 {
113 	char *tmp;
114 	size_t change, i, newlen, slen;
115 	char termchar = '/';
116 	char idtmp[11]; /* enough for 32 bit *unsigned* integer */
117 
118 
119 	tmp = PNBUF_GET();
120 	for (change = i = newlen = 0; i < *len; ) {
121 		if (cp[i] != '@') {
122 			tmp[newlen++] = cp[i++];
123 			continue;
124 		}
125 
126 		i++;
127 
128 		/* Check for @{var} syntax. */
129 		if (cp[i] == VO) {
130 			termchar = VC;
131 			i++;
132 		}
133 
134 		/*
135 		 * The following checks should be ordered according
136 		 * to frequency of use.
137 		 */
138 		if (MATCH("machine_arch")) {
139 			slen = VNL(MACHINE_ARCH);
140 			SUBSTITUTE("machine_arch", MACHINE_ARCH, slen);
141 		} else if (MATCH("machine")) {
142 			slen = VNL(MACHINE);
143 			SUBSTITUTE("machine", MACHINE, slen);
144 		} else if (MATCH("hostname")) {
145 			SUBSTITUTE("hostname", hostname, hostnamelen);
146 		} else if (MATCH("osrelease")) {
147 			slen = strlen(osrelease);
148 			SUBSTITUTE("osrelease", osrelease, slen);
149 		} else if (MATCH("emul")) {
150 			slen = strlen(p->p_emul->e_name);
151 			SUBSTITUTE("emul", p->p_emul->e_name, slen);
152 		} else if (MATCH("kernel_ident")) {
153 			slen = strlen(kernel_ident);
154 			SUBSTITUTE("kernel_ident", kernel_ident, slen);
155 		} else if (MATCH("domainname")) {
156 			SUBSTITUTE("domainname", domainname, domainnamelen);
157 		} else if (MATCH("ostype")) {
158 			slen = strlen(ostype);
159 			SUBSTITUTE("ostype", ostype, slen);
160 		} else if (MATCH("uid")) {
161 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
162 			    kauth_cred_geteuid(kauth_cred_get()));
163 			SUBSTITUTE("uid", idtmp, slen);
164 		} else if (MATCH("ruid")) {
165 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
166 			    kauth_cred_getuid(kauth_cred_get()));
167 			SUBSTITUTE("ruid", idtmp, slen);
168 		} else if (MATCH("gid")) {
169 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
170 			    kauth_cred_getegid(kauth_cred_get()));
171 			SUBSTITUTE("gid", idtmp, slen);
172 		} else if (MATCH("rgid")) {
173 			slen = snprintf(idtmp, sizeof(idtmp), "%u",
174 			    kauth_cred_getgid(kauth_cred_get()));
175 			SUBSTITUTE("rgid", idtmp, slen);
176 		} else {
177 			tmp[newlen++] = '@';
178 			if (termchar == VC)
179 				tmp[newlen++] = VO;
180 		}
181 	}
182 
183 	if (change) {
184 		(void)memcpy(cp, tmp, newlen);
185 		*len = newlen;
186 	}
187 	PNBUF_PUT(tmp);
188 
189 	return 0;
190 }
191 
192 #undef VNL
193 #undef VO
194 #undef VC
195 #undef MATCH
196 #undef SUBSTITUTE
197 
198 ////////////////////////////////////////////////////////////
199 
200 /*
201  * Determine the namei hash (for the namecache) for name.
202  * If *ep != NULL, hash from name to ep-1.
203  * If *ep == NULL, hash from name until the first NUL or '/', and
204  * return the location of this termination character in *ep.
205  *
206  * This function returns an equivalent hash to the MI hash32_strn().
207  * The latter isn't used because in the *ep == NULL case, determining
208  * the length of the string to the first NUL or `/' and then calling
209  * hash32_strn() involves unnecessary double-handling of the data.
210  */
211 uint32_t
212 namei_hash(const char *name, const char **ep)
213 {
214 	uint32_t	hash;
215 
216 	hash = HASH32_STR_INIT;
217 	if (*ep != NULL) {
218 		for (; name < *ep; name++)
219 			hash = hash * 33 + *(const uint8_t *)name;
220 	} else {
221 		for (; *name != '\0' && *name != '/'; name++)
222 			hash = hash * 33 + *(const uint8_t *)name;
223 		*ep = name;
224 	}
225 	return (hash + (hash >> 5));
226 }
227 
228 /*
229  * Find the end of the first path component in NAME and return its
230  * length.
231  */
232 static size_t
233 namei_getcomponent(const char *name)
234 {
235 	size_t pos;
236 
237 	pos = 0;
238 	while (name[pos] != '\0' && name[pos] != '/') {
239 		pos++;
240 	}
241 	return pos;
242 }
243 
244 ////////////////////////////////////////////////////////////
245 
246 /*
247  * Sealed abstraction for pathnames.
248  *
249  * System-call-layer level code that is going to call namei should
250  * first create a pathbuf and adjust all the bells and whistles on it
251  * as needed by context.
252  */
253 
254 struct pathbuf {
255 	char *pb_path;
256 	char *pb_pathcopy;
257 	unsigned pb_pathcopyuses;
258 };
259 
260 static struct pathbuf *
261 pathbuf_create_raw(void)
262 {
263 	struct pathbuf *pb;
264 
265 	pb = kmem_alloc(sizeof(*pb), KM_SLEEP);
266 	pb->pb_path = PNBUF_GET();
267 	if (pb->pb_path == NULL) {
268 		kmem_free(pb, sizeof(*pb));
269 		return NULL;
270 	}
271 	pb->pb_pathcopy = NULL;
272 	pb->pb_pathcopyuses = 0;
273 	return pb;
274 }
275 
276 void
277 pathbuf_destroy(struct pathbuf *pb)
278 {
279 	KASSERT(pb->pb_pathcopyuses == 0);
280 	KASSERT(pb->pb_pathcopy == NULL);
281 	PNBUF_PUT(pb->pb_path);
282 	kmem_free(pb, sizeof(*pb));
283 }
284 
285 struct pathbuf *
286 pathbuf_assimilate(char *pnbuf)
287 {
288 	struct pathbuf *pb;
289 
290 	pb = kmem_alloc(sizeof(*pb), KM_SLEEP);
291 	pb->pb_path = pnbuf;
292 	pb->pb_pathcopy = NULL;
293 	pb->pb_pathcopyuses = 0;
294 	return pb;
295 }
296 
297 struct pathbuf *
298 pathbuf_create(const char *path)
299 {
300 	struct pathbuf *pb;
301 	int error;
302 
303 	pb = pathbuf_create_raw();
304 	if (pb == NULL) {
305 		return NULL;
306 	}
307 	error = copystr(path, pb->pb_path, PATH_MAX, NULL);
308 	if (error != 0) {
309 		KASSERT(!"kernel path too long in pathbuf_create");
310 		/* make sure it's null-terminated, just in case */
311 		pb->pb_path[PATH_MAX-1] = '\0';
312 	}
313 	return pb;
314 }
315 
316 int
317 pathbuf_copyin(const char *userpath, struct pathbuf **ret)
318 {
319 	struct pathbuf *pb;
320 	int error;
321 
322 	pb = pathbuf_create_raw();
323 	if (pb == NULL) {
324 		return ENOMEM;
325 	}
326 	error = copyinstr(userpath, pb->pb_path, PATH_MAX, NULL);
327 	if (error) {
328 		pathbuf_destroy(pb);
329 		return error;
330 	}
331 	*ret = pb;
332 	return 0;
333 }
334 
335 /*
336  * XXX should not exist:
337  *   1. whether a pointer is kernel or user should be statically checkable.
338  *   2. copyin should be handled by the upper part of the syscall layer,
339  *      not in here.
340  */
341 int
342 pathbuf_maybe_copyin(const char *path, enum uio_seg seg, struct pathbuf **ret)
343 {
344 	if (seg == UIO_USERSPACE) {
345 		return pathbuf_copyin(path, ret);
346 	} else {
347 		*ret = pathbuf_create(path);
348 		if (*ret == NULL) {
349 			return ENOMEM;
350 		}
351 		return 0;
352 	}
353 }
354 
355 /*
356  * Get a copy of the path buffer as it currently exists. If this is
357  * called after namei starts the results may be arbitrary.
358  */
359 void
360 pathbuf_copystring(const struct pathbuf *pb, char *buf, size_t maxlen)
361 {
362 	strlcpy(buf, pb->pb_path, maxlen);
363 }
364 
365 /*
366  * These two functions allow access to a saved copy of the original
367  * path string. The first copy should be gotten before namei is
368  * called. Each copy that is gotten should be put back.
369  */
370 
371 const char *
372 pathbuf_stringcopy_get(struct pathbuf *pb)
373 {
374 	if (pb->pb_pathcopyuses == 0) {
375 		pb->pb_pathcopy = PNBUF_GET();
376 		strcpy(pb->pb_pathcopy, pb->pb_path);
377 	}
378 	pb->pb_pathcopyuses++;
379 	return pb->pb_pathcopy;
380 }
381 
382 void
383 pathbuf_stringcopy_put(struct pathbuf *pb, const char *str)
384 {
385 	KASSERT(str == pb->pb_pathcopy);
386 	KASSERT(pb->pb_pathcopyuses > 0);
387 	pb->pb_pathcopyuses--;
388 	if (pb->pb_pathcopyuses == 0) {
389 		PNBUF_PUT(pb->pb_pathcopy);
390 		pb->pb_pathcopy = NULL;
391 	}
392 }
393 
394 
395 ////////////////////////////////////////////////////////////
396 
397 /*
398  * namei: convert a pathname into a pointer to a (maybe-locked) vnode,
399  * and maybe also its parent directory vnode, and assorted other guff.
400  * See namei(9) for the interface documentation.
401  *
402  *
403  * The FOLLOW flag is set when symbolic links are to be followed
404  * when they occur at the end of the name translation process.
405  * Symbolic links are always followed for all other pathname
406  * components other than the last.
407  *
408  * The segflg defines whether the name is to be copied from user
409  * space or kernel space.
410  *
411  * Overall outline of namei:
412  *
413  *	copy in name
414  *	get starting directory
415  *	while (!done && !error) {
416  *		call lookup to search path.
417  *		if symbolic link, massage name in buffer and continue
418  *	}
419  */
420 
421 /*
422  * Search a pathname.
423  * This is a very central and rather complicated routine.
424  *
425  * The pathname is pointed to by ni_ptr and is of length ni_pathlen.
426  * The starting directory is passed in. The pathname is descended
427  * until done, or a symbolic link is encountered. The variable ni_more
428  * is clear if the path is completed; it is set to one if a symbolic
429  * link needing interpretation is encountered.
430  *
431  * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on
432  * whether the name is to be looked up, created, renamed, or deleted.
433  * When CREATE, RENAME, or DELETE is specified, information usable in
434  * creating, renaming, or deleting a directory entry may be calculated.
435  * If flag has LOCKPARENT or'ed into it, the parent directory is returned
436  * locked.  Otherwise the parent directory is not returned. If the target
437  * of the pathname exists and LOCKLEAF is or'ed into the flag the target
438  * is returned locked, otherwise it is returned unlocked.  When creating
439  * or renaming and LOCKPARENT is specified, the target may not be ".".
440  * When deleting and LOCKPARENT is specified, the target may be ".".
441  *
442  * Overall outline of lookup:
443  *
444  * dirloop:
445  *	identify next component of name at ndp->ni_ptr
446  *	handle degenerate case where name is null string
447  *	if .. and crossing mount points and on mounted filesys, find parent
448  *	call VOP_LOOKUP routine for next component name
449  *	    directory vnode returned in ni_dvp, locked.
450  *	    component vnode returned in ni_vp (if it exists), locked.
451  *	if result vnode is mounted on and crossing mount points,
452  *	    find mounted on vnode
453  *	if more components of name, do next level at dirloop
454  *	return the answer in ni_vp, locked if LOCKLEAF set
455  *	    if LOCKPARENT set, return locked parent in ni_dvp
456  */
457 
458 
459 /*
460  * Internal state for a namei operation.
461  *
462  * cnp is always equal to &ndp->ni_cnp.
463  */
464 struct namei_state {
465 	struct nameidata *ndp;
466 	struct componentname *cnp;
467 
468 	int docache;			/* == 0 do not cache last component */
469 	int rdonly;			/* lookup read-only flag bit */
470 	int slashes;
471 
472 	unsigned attempt_retry:1;	/* true if error allows emul retry */
473 	unsigned root_referenced:1;	/* true if ndp->ni_rootdir and
474 					     ndp->ni_erootdir were referenced */
475 };
476 
477 
478 /*
479  * Initialize the namei working state.
480  */
481 static void
482 namei_init(struct namei_state *state, struct nameidata *ndp)
483 {
484 
485 	state->ndp = ndp;
486 	state->cnp = &ndp->ni_cnd;
487 
488 	state->docache = 0;
489 	state->rdonly = 0;
490 	state->slashes = 0;
491 
492 	state->root_referenced = 0;
493 
494 	KASSERTMSG((state->cnp->cn_cred != NULL), "namei: bad cred/proc");
495 	KASSERTMSG(((state->cnp->cn_nameiop & (~OPMASK)) == 0),
496 	    "namei: nameiop contaminated with flags: %08"PRIx32,
497 	    state->cnp->cn_nameiop);
498 	KASSERTMSG(((state->cnp->cn_flags & OPMASK) == 0),
499 	    "name: flags contaminated with nameiops: %08"PRIx32,
500 	    state->cnp->cn_flags);
501 
502 	/*
503 	 * The buffer for name translation shall be the one inside the
504 	 * pathbuf.
505 	 */
506 	state->ndp->ni_pnbuf = state->ndp->ni_pathbuf->pb_path;
507 }
508 
509 /*
510  * Clean up the working namei state, leaving things ready for return
511  * from namei.
512  */
513 static void
514 namei_cleanup(struct namei_state *state)
515 {
516 	KASSERT(state->cnp == &state->ndp->ni_cnd);
517 
518 	if (state->root_referenced) {
519 		if (state->ndp->ni_rootdir != NULL)
520 			vrele(state->ndp->ni_rootdir);
521 		if (state->ndp->ni_erootdir != NULL)
522 			vrele(state->ndp->ni_erootdir);
523 	}
524 }
525 
526 //////////////////////////////
527 
528 /*
529  * Get the directory context.
530  * Initializes the rootdir and erootdir state and returns a reference
531  * to the starting dir.
532  */
533 static struct vnode *
534 namei_getstartdir(struct namei_state *state)
535 {
536 	struct nameidata *ndp = state->ndp;
537 	struct componentname *cnp = state->cnp;
538 	struct cwdinfo *cwdi;		/* pointer to cwd state */
539 	struct lwp *self = curlwp;	/* thread doing namei() */
540 	struct vnode *rootdir, *erootdir, *curdir, *startdir;
541 
542 	if (state->root_referenced) {
543 		if (state->ndp->ni_rootdir != NULL)
544 			vrele(state->ndp->ni_rootdir);
545 		if (state->ndp->ni_erootdir != NULL)
546 			vrele(state->ndp->ni_erootdir);
547 		state->root_referenced = 0;
548 	}
549 
550 	cwdi = self->l_proc->p_cwdi;
551 	rw_enter(&cwdi->cwdi_lock, RW_READER);
552 
553 	/* root dir */
554 	if (cwdi->cwdi_rdir == NULL || (cnp->cn_flags & NOCHROOT)) {
555 		rootdir = rootvnode;
556 	} else {
557 		rootdir = cwdi->cwdi_rdir;
558 	}
559 
560 	/* emulation root dir, if any */
561 	if ((cnp->cn_flags & TRYEMULROOT) == 0) {
562 		/* if we don't want it, don't fetch it */
563 		erootdir = NULL;
564 	} else if (cnp->cn_flags & EMULROOTSET) {
565 		/* explicitly set emulroot; "/../" doesn't override this */
566 		erootdir = ndp->ni_erootdir;
567 	} else if (!strncmp(ndp->ni_pnbuf, "/../", 4)) {
568 		/* explicit reference to real rootdir */
569 		erootdir = NULL;
570 	} else {
571 		/* may be null */
572 		erootdir = cwdi->cwdi_edir;
573 	}
574 
575 	/* current dir */
576 	curdir = cwdi->cwdi_cdir;
577 
578 	if (ndp->ni_pnbuf[0] != '/') {
579 		if (ndp->ni_atdir != NULL) {
580 			startdir = ndp->ni_atdir;
581 		} else {
582 			startdir = curdir;
583 		}
584 		erootdir = NULL;
585 	} else if (cnp->cn_flags & TRYEMULROOT && erootdir != NULL) {
586 		startdir = erootdir;
587 	} else {
588 		startdir = rootdir;
589 		erootdir = NULL;
590 	}
591 
592 	state->ndp->ni_rootdir = rootdir;
593 	state->ndp->ni_erootdir = erootdir;
594 
595 	/*
596 	 * Get a reference to the start dir so we can safely unlock cwdi.
597 	 *
598 	 * Must hold references to rootdir and erootdir while we're running.
599 	 * A multithreaded process may chroot during namei.
600 	 */
601 	if (startdir != NULL)
602 		vref(startdir);
603 	if (state->ndp->ni_rootdir != NULL)
604 		vref(state->ndp->ni_rootdir);
605 	if (state->ndp->ni_erootdir != NULL)
606 		vref(state->ndp->ni_erootdir);
607 	state->root_referenced = 1;
608 
609 	rw_exit(&cwdi->cwdi_lock);
610 	return startdir;
611 }
612 
613 /*
614  * Get the directory context for the nfsd case, in parallel to
615  * getstartdir. Initializes the rootdir and erootdir state and
616  * returns a reference to the passed-in starting dir.
617  */
618 static struct vnode *
619 namei_getstartdir_for_nfsd(struct namei_state *state)
620 {
621 	KASSERT(state->ndp->ni_atdir != NULL);
622 
623 	/* always use the real root, and never set an emulation root */
624 	if (rootvnode == NULL) {
625 		return NULL;
626 	}
627 	state->ndp->ni_rootdir = rootvnode;
628 	state->ndp->ni_erootdir = NULL;
629 
630 	vref(state->ndp->ni_atdir);
631 	KASSERT(! state->root_referenced);
632 	vref(state->ndp->ni_rootdir);
633 	state->root_referenced = 1;
634 	return state->ndp->ni_atdir;
635 }
636 
637 
638 /*
639  * Ktrace the namei operation.
640  */
641 static void
642 namei_ktrace(struct namei_state *state)
643 {
644 	struct nameidata *ndp = state->ndp;
645 	struct componentname *cnp = state->cnp;
646 	struct lwp *self = curlwp;	/* thread doing namei() */
647 	const char *emul_path;
648 
649 	if (ktrpoint(KTR_NAMEI)) {
650 		if (ndp->ni_erootdir != NULL) {
651 			/*
652 			 * To make any sense, the trace entry need to have the
653 			 * text of the emulation path prepended.
654 			 * Usually we can get this from the current process,
655 			 * but when called from emul_find_interp() it is only
656 			 * in the exec_package - so we get it passed in ni_next
657 			 * (this is a hack).
658 			 */
659 			if (cnp->cn_flags & EMULROOTSET)
660 				emul_path = ndp->ni_next;
661 			else
662 				emul_path = self->l_proc->p_emul->e_path;
663 			ktrnamei2(emul_path, strlen(emul_path),
664 			    ndp->ni_pnbuf, ndp->ni_pathlen);
665 		} else
666 			ktrnamei(ndp->ni_pnbuf, ndp->ni_pathlen);
667 	}
668 }
669 
670 /*
671  * Start up namei. Find the root dir and cwd, establish the starting
672  * directory for lookup, and lock it. Also calls ktrace when
673  * appropriate.
674  */
675 static int
676 namei_start(struct namei_state *state, int isnfsd,
677 	    struct vnode **startdir_ret)
678 {
679 	struct nameidata *ndp = state->ndp;
680 	struct vnode *startdir;
681 
682 	/* length includes null terminator (was originally from copyinstr) */
683 	ndp->ni_pathlen = strlen(ndp->ni_pnbuf) + 1;
684 
685 	/*
686 	 * POSIX.1 requirement: "" is not a valid file name.
687 	 */
688 	if (ndp->ni_pathlen == 1) {
689 		ndp->ni_erootdir = NULL;
690 		return ENOENT;
691 	}
692 
693 	ndp->ni_loopcnt = 0;
694 
695 	/* Get starting directory, set up root, and ktrace. */
696 	if (isnfsd) {
697 		startdir = namei_getstartdir_for_nfsd(state);
698 		/* no ktrace */
699 	} else {
700 		startdir = namei_getstartdir(state);
701 		namei_ktrace(state);
702 	}
703 
704 	if (startdir == NULL) {
705 		return ENOENT;
706 	}
707 
708 	/* NDAT may feed us with a non directory namei_getstartdir */
709 	if (startdir->v_type != VDIR) {
710 		vrele(startdir);
711 		return ENOTDIR;
712 	}
713 
714 	*startdir_ret = startdir;
715 	return 0;
716 }
717 
718 /*
719  * Check for being at a symlink that we're going to follow.
720  */
721 static inline int
722 namei_atsymlink(struct namei_state *state, struct vnode *foundobj)
723 {
724 	return (foundobj->v_type == VLNK) &&
725 		(state->cnp->cn_flags & (FOLLOW|REQUIREDIR));
726 }
727 
728 /*
729  * Follow a symlink.
730  *
731  * Updates searchdir. inhibitmagic causes magic symlinks to not be
732  * interpreted; this is used by nfsd.
733  *
734  * Unlocks foundobj on success (ugh)
735  */
736 static inline int
737 namei_follow(struct namei_state *state, int inhibitmagic,
738 	     struct vnode *searchdir, struct vnode *foundobj,
739 	     struct vnode **newsearchdir_ret)
740 {
741 	struct nameidata *ndp = state->ndp;
742 	struct componentname *cnp = state->cnp;
743 
744 	struct lwp *self = curlwp;	/* thread doing namei() */
745 	struct iovec aiov;		/* uio for reading symbolic links */
746 	struct uio auio;
747 	char *cp;			/* pointer into pathname argument */
748 	size_t linklen;
749 	int error;
750 
751 	if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
752 		return ELOOP;
753 	}
754 
755 	vn_lock(foundobj, LK_EXCLUSIVE | LK_RETRY);
756 	if (foundobj->v_mount->mnt_flag & MNT_SYMPERM) {
757 		error = VOP_ACCESS(foundobj, VEXEC, cnp->cn_cred);
758 		if (error != 0) {
759 			VOP_UNLOCK(foundobj);
760 			return error;
761 		}
762 	}
763 
764 	/* FUTURE: fix this to not use a second buffer */
765 	cp = PNBUF_GET();
766 	aiov.iov_base = cp;
767 	aiov.iov_len = MAXPATHLEN;
768 	auio.uio_iov = &aiov;
769 	auio.uio_iovcnt = 1;
770 	auio.uio_offset = 0;
771 	auio.uio_rw = UIO_READ;
772 	auio.uio_resid = MAXPATHLEN;
773 	UIO_SETUP_SYSSPACE(&auio);
774 	error = VOP_READLINK(foundobj, &auio, cnp->cn_cred);
775 	VOP_UNLOCK(foundobj);
776 	if (error) {
777 		PNBUF_PUT(cp);
778 		return error;
779 	}
780 	linklen = MAXPATHLEN - auio.uio_resid;
781 	if (linklen == 0) {
782 		PNBUF_PUT(cp);
783 		return ENOENT;
784 	}
785 
786 	/*
787 	 * Do symlink substitution, if appropriate, and
788 	 * check length for potential overflow.
789 	 *
790 	 * Inhibit symlink substitution for nfsd.
791 	 * XXX: This is how it was before; is that a bug or a feature?
792 	 */
793 	if ((!inhibitmagic && vfs_magiclinks &&
794 	     symlink_magic(self->l_proc, cp, &linklen)) ||
795 	    (linklen + ndp->ni_pathlen >= MAXPATHLEN)) {
796 		PNBUF_PUT(cp);
797 		return ENAMETOOLONG;
798 	}
799 	if (ndp->ni_pathlen > 1) {
800 		/* includes a null-terminator */
801 		memcpy(cp + linklen, ndp->ni_next, ndp->ni_pathlen);
802 	} else {
803 		cp[linklen] = '\0';
804 	}
805 	ndp->ni_pathlen += linklen;
806 	memcpy(ndp->ni_pnbuf, cp, ndp->ni_pathlen);
807 	PNBUF_PUT(cp);
808 
809 	/* we're now starting from the beginning of the buffer again */
810 	cnp->cn_nameptr = ndp->ni_pnbuf;
811 
812 	/*
813 	 * Check if root directory should replace current directory.
814 	 */
815 	if (ndp->ni_pnbuf[0] == '/') {
816 		vrele(searchdir);
817 		/* Keep absolute symbolic links inside emulation root */
818 		searchdir = ndp->ni_erootdir;
819 		if (searchdir == NULL ||
820 		    (ndp->ni_pnbuf[1] == '.'
821 		     && ndp->ni_pnbuf[2] == '.'
822 		     && ndp->ni_pnbuf[3] == '/')) {
823 			ndp->ni_erootdir = NULL;
824 			searchdir = ndp->ni_rootdir;
825 		}
826 		vref(searchdir);
827 		while (cnp->cn_nameptr[0] == '/') {
828 			cnp->cn_nameptr++;
829 			ndp->ni_pathlen--;
830 		}
831 	}
832 
833 	*newsearchdir_ret = searchdir;
834 	return 0;
835 }
836 
837 //////////////////////////////
838 
839 /*
840  * Inspect the leading path component and update the state accordingly.
841  */
842 static int
843 lookup_parsepath(struct namei_state *state)
844 {
845 	const char *cp;			/* pointer into pathname argument */
846 
847 	struct componentname *cnp = state->cnp;
848 	struct nameidata *ndp = state->ndp;
849 
850 	KASSERT(cnp == &ndp->ni_cnd);
851 
852 	/*
853 	 * Search a new directory.
854 	 *
855 	 * The last component of the filename is left accessible via
856 	 * cnp->cn_nameptr for callers that need the name. Callers needing
857 	 * the name set the SAVENAME flag. When done, they assume
858 	 * responsibility for freeing the pathname buffer.
859 	 *
860 	 * At this point, our only vnode state is that the search dir
861 	 * is held.
862 	 */
863 	cnp->cn_consume = 0;
864 	cnp->cn_namelen = namei_getcomponent(cnp->cn_nameptr);
865 	cp = cnp->cn_nameptr + cnp->cn_namelen;
866 	if (cnp->cn_namelen > KERNEL_NAME_MAX) {
867 		return ENAMETOOLONG;
868 	}
869 #ifdef NAMEI_DIAGNOSTIC
870 	{ char c = *cp;
871 	*(char *)cp = '\0';
872 	printf("{%s}: ", cnp->cn_nameptr);
873 	*(char *)cp = c; }
874 #endif /* NAMEI_DIAGNOSTIC */
875 	ndp->ni_pathlen -= cnp->cn_namelen;
876 	ndp->ni_next = cp;
877 	/*
878 	 * If this component is followed by a slash, then move the pointer to
879 	 * the next component forward, and remember that this component must be
880 	 * a directory.
881 	 */
882 	if (*cp == '/') {
883 		do {
884 			cp++;
885 		} while (*cp == '/');
886 		state->slashes = cp - ndp->ni_next;
887 		ndp->ni_pathlen -= state->slashes;
888 		ndp->ni_next = cp;
889 		cnp->cn_flags |= REQUIREDIR;
890 	} else {
891 		state->slashes = 0;
892 		cnp->cn_flags &= ~REQUIREDIR;
893 	}
894 	/*
895 	 * We do special processing on the last component, whether or not it's
896 	 * a directory.  Cache all intervening lookups, but not the final one.
897 	 */
898 	if (*cp == '\0') {
899 		if (state->docache)
900 			cnp->cn_flags |= MAKEENTRY;
901 		else
902 			cnp->cn_flags &= ~MAKEENTRY;
903 		cnp->cn_flags |= ISLASTCN;
904 	} else {
905 		cnp->cn_flags |= MAKEENTRY;
906 		cnp->cn_flags &= ~ISLASTCN;
907 	}
908 	if (cnp->cn_namelen == 2 &&
909 	    cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
910 		cnp->cn_flags |= ISDOTDOT;
911 	else
912 		cnp->cn_flags &= ~ISDOTDOT;
913 
914 	return 0;
915 }
916 
917 /*
918  * Take care of crossing a mounted-on vnode.  On error, foundobj_ret will be
919  * vrele'd, but searchdir is left alone.
920  */
921 static int
922 lookup_crossmount(struct namei_state *state,
923 		  struct vnode **searchdir_ret,
924 		  struct vnode **foundobj_ret,
925 		  bool *searchdir_locked)
926 {
927 	struct componentname *cnp = state->cnp;
928 	struct vnode *foundobj, *vp;
929 	struct vnode *searchdir;
930 	struct mount *mp;
931 	int error, lktype;
932 
933 	searchdir = *searchdir_ret;
934 	foundobj = *foundobj_ret;
935 	error = 0;
936 
937 	KASSERT((cnp->cn_flags & NOCROSSMOUNT) == 0);
938 
939 	/* First, unlock searchdir (oof). */
940 	if (*searchdir_locked) {
941 		KASSERT(searchdir != NULL);
942 		lktype = VOP_ISLOCKED(searchdir);
943 		VOP_UNLOCK(searchdir);
944 		*searchdir_locked = false;
945 	} else {
946 		lktype = LK_NONE;
947 	}
948 
949 	/*
950 	 * Do an unlocked check to see if the vnode has been mounted on; if
951 	 * so find the root of the mounted file system.
952 	 */
953 	while (foundobj->v_type == VDIR &&
954 	    (mp = foundobj->v_mountedhere) != NULL &&
955 	    (cnp->cn_flags & NOCROSSMOUNT) == 0) {
956 		KASSERTMSG(searchdir != foundobj, "same vn %p", searchdir);
957 
958 		/*
959 		 * Try the namecache first.  If that doesn't work, do
960 		 * it the hard way.
961 		 */
962 		if (cache_lookup_mount(foundobj, &vp)) {
963 			vrele(foundobj);
964 			foundobj = vp;
965 		} else {
966 			/* First get the vnode stable. */
967 			error = vn_lock(foundobj, LK_SHARED);
968 			if (error != 0) {
969 				vrele(foundobj);
970 				foundobj = NULL;
971 				break;
972 			}
973 
974 			/*
975 			 * Check to see if something is still mounted on it.
976 			 */
977 			if ((mp = foundobj->v_mountedhere) == NULL) {
978 				VOP_UNLOCK(foundobj);
979 				break;
980 			}
981 
982 			/*
983 			 * Get a reference to the mountpoint, and unlock
984 			 * foundobj.
985 			 */
986 			error = vfs_busy(mp);
987 			VOP_UNLOCK(foundobj);
988 			if (error != 0) {
989 				vrele(foundobj);
990 				foundobj = NULL;
991 				break;
992 			}
993 
994 			/*
995 			 * Now get a reference on the root vnode.
996 			 * XXX Future - maybe allow only VDIR here.
997 			 */
998 			error = VFS_ROOT(mp, LK_NONE, &vp);
999 
1000 			/*
1001 			 * If successful, enter it into the cache while
1002 			 * holding the mount busy (competing with unmount).
1003 			 */
1004 			if (error == 0) {
1005 				cache_enter_mount(foundobj, vp);
1006 			}
1007 
1008 			/* Finally, drop references to foundobj & mountpoint. */
1009 			vrele(foundobj);
1010 			vfs_unbusy(mp);
1011 			if (error) {
1012 				foundobj = NULL;
1013 				break;
1014 			}
1015 			foundobj = vp;
1016 		}
1017 
1018 		/*
1019 		 * Avoid locking vnodes from two filesystems because
1020 		 * it's prone to deadlock, e.g. when using puffs.
1021 		 * Also, it isn't a good idea to propagate slowness of
1022 		 * a filesystem up to the root directory. For now,
1023 		 * only handle the common case, where foundobj is
1024 		 * VDIR.
1025 		 *
1026 		 * In this case set searchdir to null to avoid using
1027 		 * it again. It is not correct to set searchdir ==
1028 		 * foundobj here as that will confuse the caller.
1029 		 * (See PR 40740.)
1030 		 */
1031 		if (searchdir == NULL) {
1032 			/* already been here once; do nothing further */
1033 		} else if (foundobj->v_type == VDIR) {
1034 			vrele(searchdir);
1035 			*searchdir_ret = searchdir = NULL;
1036 			lktype = LK_NONE;
1037 		}
1038 	}
1039 
1040 	/* If searchdir is still around, re-lock it. */
1041  	if (error == 0 && lktype != LK_NONE) {
1042 		vn_lock(searchdir, lktype | LK_RETRY);
1043 		*searchdir_locked = true;
1044 	}
1045 	*foundobj_ret = foundobj;
1046 	return error;
1047 }
1048 
1049 /*
1050  * Call VOP_LOOKUP for a single lookup; return a new search directory
1051  * (used when crossing mountpoints up or searching union mounts down) and
1052  * the found object, which for create operations may be NULL on success.
1053  *
1054  * Note that the new search directory may be null, which means the
1055  * searchdir was unlocked and released. This happens in the common case
1056  * when crossing a mount point downwards, in order to avoid coupling
1057  * locks between different file system volumes. Importantly, this can
1058  * happen even if the call fails. (XXX: this is gross and should be
1059  * tidied somehow.)
1060  */
1061 static int
1062 lookup_once(struct namei_state *state,
1063 	    struct vnode *searchdir,
1064 	    struct vnode **newsearchdir_ret,
1065 	    struct vnode **foundobj_ret,
1066 	    bool *newsearchdir_locked_ret)
1067 {
1068 	struct vnode *tmpvn;		/* scratch vnode */
1069 	struct vnode *foundobj;		/* result */
1070 	struct lwp *l = curlwp;
1071 	bool searchdir_locked = false;
1072 	int error, lktype;
1073 
1074 	struct componentname *cnp = state->cnp;
1075 	struct nameidata *ndp = state->ndp;
1076 
1077 	KASSERT(cnp == &ndp->ni_cnd);
1078 	*newsearchdir_ret = searchdir;
1079 
1080 	/*
1081 	 * Handle "..": two special cases.
1082 	 * 1. If at root directory (e.g. after chroot)
1083 	 *    or at absolute root directory
1084 	 *    then ignore it so can't get out.
1085 	 * 1a. If at the root of the emulation filesystem go to the real
1086 	 *    root. So "/../<path>" is always absolute.
1087 	 * 1b. If we have somehow gotten out of a jail, warn
1088 	 *    and also ignore it so we can't get farther out.
1089 	 * 2. If this vnode is the root of a mounted
1090 	 *    filesystem, then replace it with the
1091 	 *    vnode which was mounted on so we take the
1092 	 *    .. in the other file system.
1093 	 */
1094 	if (cnp->cn_flags & ISDOTDOT) {
1095 		struct proc *p = l->l_proc;
1096 
1097 		for (;;) {
1098 			if (searchdir == ndp->ni_rootdir ||
1099 			    searchdir == rootvnode) {
1100 				foundobj = searchdir;
1101 				vref(foundobj);
1102 				*foundobj_ret = foundobj;
1103 				error = 0;
1104 				goto done;
1105 			}
1106 			if (ndp->ni_rootdir != rootvnode) {
1107 				int retval;
1108 
1109 				retval = vn_isunder(searchdir, ndp->ni_rootdir, l);
1110 				if (!retval) {
1111 				    /* Oops! We got out of jail! */
1112 				    log(LOG_WARNING,
1113 					"chrooted pid %d uid %d (%s) "
1114 					"detected outside of its chroot\n",
1115 					p->p_pid, kauth_cred_geteuid(l->l_cred),
1116 					p->p_comm);
1117 				    /* Put us at the jail root. */
1118 				    vrele(searchdir);
1119 				    searchdir = NULL;
1120 				    foundobj = ndp->ni_rootdir;
1121 				    vref(foundobj);
1122 				    vref(foundobj);
1123 				    *newsearchdir_ret = foundobj;
1124 				    *foundobj_ret = foundobj;
1125 				    error = 0;
1126 				    goto done;
1127 				}
1128 			}
1129 			if ((searchdir->v_vflag & VV_ROOT) == 0 ||
1130 			    (cnp->cn_flags & NOCROSSMOUNT))
1131 				break;
1132 			tmpvn = searchdir;
1133 			searchdir = searchdir->v_mount->mnt_vnodecovered;
1134 			vref(searchdir);
1135 			vrele(tmpvn);
1136 			*newsearchdir_ret = searchdir;
1137 		}
1138 	}
1139 
1140 	/*
1141 	 * If the file system supports VOP_LOOKUP() with a shared lock, and
1142 	 * we are not making any modifications (nameiop LOOKUP) or this is
1143 	 * not the last component then get a shared lock.  Where we can't do
1144 	 * fast-forwarded lookups (for example with layered file systems)
1145 	 * then this is the fallback for reducing lock contention.
1146 	 */
1147 	if ((searchdir->v_mount->mnt_iflag & IMNT_SHRLOOKUP) != 0 &&
1148 	    (cnp->cn_nameiop == LOOKUP || (cnp->cn_flags & ISLASTCN) == 0)) {
1149 	    	lktype = LK_SHARED;
1150 	} else {
1151 		lktype = LK_EXCLUSIVE;
1152 	}
1153 
1154 	/*
1155 	 * We now have a segment name to search for, and a directory to search.
1156 	 * Our vnode state here is that "searchdir" is held.
1157 	 */
1158 unionlookup:
1159 	foundobj = NULL;
1160 	if (!searchdir_locked) {
1161 		vn_lock(searchdir, lktype | LK_RETRY);
1162 		searchdir_locked = true;
1163 	}
1164 	error = VOP_LOOKUP(searchdir, &foundobj, cnp);
1165 
1166 	if (error != 0) {
1167 		KASSERTMSG((foundobj == NULL),
1168 		    "leaf `%s' should be empty but is %p",
1169 		    cnp->cn_nameptr, foundobj);
1170 #ifdef NAMEI_DIAGNOSTIC
1171 		printf("not found\n");
1172 #endif /* NAMEI_DIAGNOSTIC */
1173 
1174 		/*
1175 		 * If ENOLCK, the file system needs us to retry the lookup
1176 		 * with an exclusive lock.  It's likely nothing was found in
1177 		 * cache and/or modifications need to be made.
1178 		 */
1179 		if (error == ENOLCK) {
1180 			KASSERT(VOP_ISLOCKED(searchdir) == LK_SHARED);
1181 			KASSERT(searchdir_locked);
1182 			if (vn_lock(searchdir, LK_UPGRADE | LK_NOWAIT)) {
1183 				VOP_UNLOCK(searchdir);
1184 				searchdir_locked = false;
1185 			}
1186 			lktype = LK_EXCLUSIVE;
1187 			goto unionlookup;
1188 		}
1189 
1190 		if ((error == ENOENT) &&
1191 		    (searchdir->v_vflag & VV_ROOT) &&
1192 		    (searchdir->v_mount->mnt_flag & MNT_UNION)) {
1193 			tmpvn = searchdir;
1194 			searchdir = searchdir->v_mount->mnt_vnodecovered;
1195 			vref(searchdir);
1196 			vput(tmpvn);
1197 			searchdir_locked = false;
1198 			*newsearchdir_ret = searchdir;
1199 			goto unionlookup;
1200 		}
1201 
1202 		if (error != EJUSTRETURN)
1203 			goto done;
1204 
1205 		/*
1206 		 * If this was not the last component, or there were trailing
1207 		 * slashes, and we are not going to create a directory,
1208 		 * then the name must exist.
1209 		 */
1210 		if ((cnp->cn_flags & (REQUIREDIR | CREATEDIR)) == REQUIREDIR) {
1211 			error = ENOENT;
1212 			goto done;
1213 		}
1214 
1215 		/*
1216 		 * If creating and at end of pathname, then can consider
1217 		 * allowing file to be created.
1218 		 */
1219 		if (state->rdonly) {
1220 			error = EROFS;
1221 			goto done;
1222 		}
1223 
1224 		/*
1225 		 * We return success and a NULL foundobj to indicate
1226 		 * that the entry doesn't currently exist, leaving a
1227 		 * pointer to the (normally, locked) directory vnode
1228 		 * as searchdir.
1229 		 */
1230 		*foundobj_ret = NULL;
1231 		error = 0;
1232 		goto done;
1233 	}
1234 #ifdef NAMEI_DIAGNOSTIC
1235 	printf("found\n");
1236 #endif /* NAMEI_DIAGNOSTIC */
1237 
1238 	/*
1239 	 * Take into account any additional components consumed by the
1240 	 * underlying filesystem.  This will include any trailing slashes after
1241 	 * the last component consumed.
1242 	 */
1243 	if (cnp->cn_consume > 0) {
1244 		ndp->ni_pathlen -= cnp->cn_consume - state->slashes;
1245 		ndp->ni_next += cnp->cn_consume - state->slashes;
1246 		cnp->cn_consume = 0;
1247 		if (ndp->ni_next[0] == '\0')
1248 			cnp->cn_flags |= ISLASTCN;
1249 	}
1250 
1251 	/* Unlock, unless the caller needs the parent locked. */
1252 	if (searchdir != NULL) {
1253 		KASSERT(searchdir_locked);
1254 		if ((cnp->cn_flags & (ISLASTCN | LOCKPARENT)) !=
1255 		    (ISLASTCN | LOCKPARENT)) {
1256 		    	VOP_UNLOCK(searchdir);
1257 		    	searchdir_locked = false;
1258 		}
1259 	} else {
1260 		KASSERT(!searchdir_locked);
1261 	}
1262 
1263 	*foundobj_ret = foundobj;
1264 	error = 0;
1265 done:
1266 	*newsearchdir_locked_ret = searchdir_locked;
1267 	return error;
1268 }
1269 
1270 /*
1271  * Parse out the first path name component that we need to to consider.
1272  *
1273  * While doing this, attempt to use the name cache to fast-forward through
1274  * as many "easy" to find components of the path as possible.
1275  *
1276  * We use the namecache's node locks to form a chain, and avoid as many
1277  * vnode references and locks as possible.  In the ideal case, only the
1278  * final vnode will have its reference count adjusted and lock taken.
1279  */
1280 static int
1281 lookup_fastforward(struct namei_state *state, struct vnode **searchdir_ret,
1282 		   struct vnode **foundobj_ret)
1283 {
1284 	struct componentname *cnp = state->cnp;
1285 	struct nameidata *ndp = state->ndp;
1286 	krwlock_t *plock;
1287 	struct vnode *foundobj, *searchdir;
1288 	int error, error2;
1289 	size_t oldpathlen;
1290 	const char *oldnameptr;
1291 	bool terminal;
1292 
1293 	/*
1294 	 * Eat as many path name components as possible before giving up and
1295 	 * letting lookup_once() handle it.  Remember the starting point in
1296 	 * case we can't get vnode references and need to roll back.
1297 	 */
1298 	plock = NULL;
1299 	searchdir = *searchdir_ret;
1300 	oldnameptr = cnp->cn_nameptr;
1301 	oldpathlen = ndp->ni_pathlen;
1302 	terminal = false;
1303 	for (;;) {
1304 		foundobj = NULL;
1305 
1306 		/*
1307 		 * Get the next component name.  There should be no slashes
1308 		 * here, and we shouldn't have looped around if we were
1309 		 * done.
1310 		 */
1311 		KASSERT(cnp->cn_nameptr[0] != '/');
1312 		KASSERT(cnp->cn_nameptr[0] != '\0');
1313 		if ((error = lookup_parsepath(state)) != 0) {
1314 			break;
1315 		}
1316 
1317 		/*
1318 		 * Can't deal with DOTDOT lookups if NOCROSSMOUNT or the
1319 		 * lookup is chrooted.
1320 		 */
1321 		if ((cnp->cn_flags & ISDOTDOT) != 0) {
1322 			if ((searchdir->v_vflag & VV_ROOT) != 0 &&
1323 			    (cnp->cn_flags & NOCROSSMOUNT)) {
1324 			    	error = EOPNOTSUPP;
1325 				break;
1326 			}
1327 			if (ndp->ni_rootdir != rootvnode) {
1328 			    	error = EOPNOTSUPP;
1329 				break;
1330 			}
1331 		}
1332 
1333 		/*
1334 		 * Can't deal with last component when modifying; this needs
1335 		 * searchdir locked and VOP_LOOKUP() called (which can and
1336 		 * does modify state, despite the name).  NB: this case means
1337 		 * terminal is never set true when LOCKPARENT.
1338 		 */
1339 		if ((cnp->cn_flags & ISLASTCN) != 0) {
1340 			if (cnp->cn_nameiop != LOOKUP ||
1341 			    (cnp->cn_flags & LOCKPARENT) != 0) {
1342 				error = EOPNOTSUPP;
1343 				break;
1344 			}
1345 		}
1346 
1347 		/*
1348 		 * Good, now look for it in cache.  cache_lookup_linked()
1349 		 * will fail if there's nothing there, or if there's no
1350 		 * ownership info for the directory, or if the user doesn't
1351 		 * have permission to look up files in this directory.
1352 		 */
1353 		if (!cache_lookup_linked(searchdir, cnp->cn_nameptr,
1354 		    cnp->cn_namelen, &foundobj, &plock, cnp->cn_cred)) {
1355 			error = EOPNOTSUPP;
1356 			break;
1357 		}
1358 		KASSERT(plock != NULL && rw_lock_held(plock));
1359 
1360 		/*
1361 		 * Scored a hit.  Negative is good too (ENOENT).  If there's
1362 		 * a '-o union' mount here, punt and let lookup_once() deal
1363 		 * with it.
1364 		 */
1365 		if (foundobj == NULL) {
1366 			if ((searchdir->v_vflag & VV_ROOT) != 0 &&
1367 			    (searchdir->v_mount->mnt_flag & MNT_UNION) != 0) {
1368 			    	error = EOPNOTSUPP;
1369 			} else {
1370 				error = ENOENT;
1371 				terminal = ((cnp->cn_flags & ISLASTCN) != 0);
1372 			}
1373 			break;
1374 		}
1375 
1376 		/*
1377 		 * Stop and get a hold on the vnode if we've encountered
1378 		 * something other than a dirctory.
1379 		 */
1380 		if (foundobj->v_type != VDIR) {
1381 			error = vcache_tryvget(foundobj);
1382 			if (error != 0) {
1383 				foundobj = NULL;
1384 				error = EOPNOTSUPP;
1385 			} else {
1386 				terminal = (foundobj->v_type != VLNK &&
1387 				    (cnp->cn_flags & ISLASTCN) != 0);
1388 			}
1389 			break;
1390 		}
1391 
1392 		/*
1393 		 * Try to cross mountpoints, bearing in mind that they can
1394 		 * be stacked.  If at any point we can't go further, stop
1395 		 * and try to get a reference on the vnode.  If we are able
1396 		 * to get a ref then lookup_crossmount() will take care of
1397 		 * it, otherwise we'll fall through to lookup_once().
1398 		 */
1399 		if (foundobj->v_mountedhere != NULL) {
1400 			while (foundobj->v_mountedhere != NULL &&
1401 			    (cnp->cn_flags & NOCROSSMOUNT) == 0 &&
1402 			    cache_cross_mount(&foundobj, &plock)) {
1403 				KASSERT(foundobj != NULL);
1404 				KASSERT(foundobj->v_type == VDIR);
1405 			}
1406 			if (foundobj->v_mountedhere != NULL) {
1407 				error = vcache_tryvget(foundobj);
1408 				if (error != 0) {
1409 					foundobj = NULL;
1410 					error = EOPNOTSUPP;
1411 				}
1412 				break;
1413 			} else {
1414 				searchdir = NULL;
1415 			}
1416 		}
1417 
1418 		/*
1419 		 * Time to stop if we found the last component & traversed
1420 		 * all mounts.
1421 		 */
1422 		if ((cnp->cn_flags & ISLASTCN) != 0) {
1423 			error = vcache_tryvget(foundobj);
1424 			if (error != 0) {
1425 				foundobj = NULL;
1426 				error = EOPNOTSUPP;
1427 			} else {
1428 				terminal = (foundobj->v_type != VLNK);
1429 			}
1430 			break;
1431 		}
1432 
1433 		/*
1434 		 * Otherwise, we're still in business.  Set the found VDIR
1435 		 * vnode as the search dir for the next component and
1436 		 * continue on to it.
1437 		 */
1438 		cnp->cn_nameptr = ndp->ni_next;
1439 		searchdir = foundobj;
1440 	}
1441 
1442 	if (terminal) {
1443 		/*
1444 		 * If we exited the loop above having successfully located
1445 		 * the last component with a zero error code, and it's not a
1446 		 * symbolic link, then the parent directory is not needed.
1447 		 * Release reference to the starting parent and make the
1448 		 * terminal parent disappear into thin air.
1449 		 */
1450 		KASSERT(plock != NULL);
1451 		rw_exit(plock);
1452 		vrele(*searchdir_ret);
1453 		*searchdir_ret = NULL;
1454 	} else if (searchdir != *searchdir_ret) {
1455 		/*
1456 		 * Otherwise we need to return the parent.  If we ended up
1457 		 * with a new search dir, ref it before dropping the
1458 		 * namecache's lock.  The lock prevents both searchdir and
1459 		 * foundobj from disappearing.  If we can't ref the new
1460 		 * searchdir, we have a bit of a problem.  Roll back the
1461 		 * fastforward to the beginning and let lookup_once() take
1462 		 * care of it.
1463 		 */
1464 		if (searchdir == NULL) {
1465 			/*
1466 			 * It's possible for searchdir to be NULL in the
1467 			 * case of a root vnode being reclaimed while
1468 			 * trying to cross a mount.
1469 			 */
1470 			error2 = EOPNOTSUPP;
1471 		} else {
1472 			error2 = vcache_tryvget(searchdir);
1473 		}
1474 		KASSERT(plock != NULL);
1475 		rw_exit(plock);
1476 		if (__predict_true(error2 == 0)) {
1477 			/* Returning new searchdir, and maybe new foundobj. */
1478 			vrele(*searchdir_ret);
1479 			*searchdir_ret = searchdir;
1480 		} else {
1481 			/* Returning nothing. */
1482 			if (foundobj != NULL) {
1483 				vrele(foundobj);
1484 				foundobj = NULL;
1485 			}
1486 			cnp->cn_nameptr = oldnameptr;
1487 			ndp->ni_pathlen = oldpathlen;
1488 			error = lookup_parsepath(state);
1489 			if (error == 0) {
1490 				error = EOPNOTSUPP;
1491 			}
1492 		}
1493 	} else if (plock != NULL) {
1494 		/* Drop any namecache lock still held. */
1495 		rw_exit(plock);
1496 	}
1497 
1498 	KASSERT(error == 0 ? foundobj != NULL : foundobj == NULL);
1499 	*foundobj_ret = foundobj;
1500 	return error;
1501 }
1502 
1503 //////////////////////////////
1504 
1505 /*
1506  * Do a complete path search from a single root directory.
1507  * (This is called up to twice if TRYEMULROOT is in effect.)
1508  */
1509 static int
1510 namei_oneroot(struct namei_state *state,
1511 	 int neverfollow, int inhibitmagic, int isnfsd)
1512 {
1513 	struct nameidata *ndp = state->ndp;
1514 	struct componentname *cnp = state->cnp;
1515 	struct vnode *searchdir, *foundobj;
1516 	bool searchdir_locked = false;
1517 	int error;
1518 
1519 	error = namei_start(state, isnfsd, &searchdir);
1520 	if (error) {
1521 		ndp->ni_dvp = NULL;
1522 		ndp->ni_vp = NULL;
1523 		return error;
1524 	}
1525 	KASSERT(searchdir->v_type == VDIR);
1526 
1527 	/*
1528 	 * Setup: break out flag bits into variables.
1529 	 */
1530 	state->docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE;
1531 	if (cnp->cn_nameiop == DELETE)
1532 		state->docache = 0;
1533 	state->rdonly = cnp->cn_flags & RDONLY;
1534 
1535 	/*
1536 	 * Keep going until we run out of path components.
1537 	 */
1538 	cnp->cn_nameptr = ndp->ni_pnbuf;
1539 
1540 	/* drop leading slashes (already used them to choose startdir) */
1541 	while (cnp->cn_nameptr[0] == '/') {
1542 		cnp->cn_nameptr++;
1543 		ndp->ni_pathlen--;
1544 	}
1545 	/* was it just "/"? */
1546 	if (cnp->cn_nameptr[0] == '\0') {
1547 		foundobj = searchdir;
1548 		searchdir = NULL;
1549 		cnp->cn_flags |= ISLASTCN;
1550 
1551 		/* bleh */
1552 		goto skiploop;
1553 	}
1554 
1555 	for (;;) {
1556 		KASSERT(searchdir != NULL);
1557 		KASSERT(!searchdir_locked);
1558 
1559 		/*
1560 		 * Parse out the first path name component that we need to
1561 		 * to consider.  While doing this, attempt to use the name
1562 		 * cache to fast-forward through as many "easy" to find
1563 		 * components of the path as possible.
1564 		 */
1565 		error = lookup_fastforward(state, &searchdir, &foundobj);
1566 
1567 		/*
1568 		 * If we didn't get a good answer from the namecache, then
1569 		 * go directly to the file system.
1570 		 */
1571 		if (error == EOPNOTSUPP) {
1572 			error = lookup_once(state, searchdir, &searchdir,
1573 			    &foundobj, &searchdir_locked);
1574 		}
1575 
1576 		/*
1577 		 * If the vnode we found is mounted on, then cross the mount
1578 		 * and get the root vnode in foundobj.  If this encounters
1579 		 * an error, it will dispose of foundobj, but searchdir is
1580 		 * untouched.
1581 		 */
1582 		if (error == 0 && foundobj != NULL &&
1583 		    foundobj->v_type == VDIR &&
1584 		    foundobj->v_mountedhere != NULL &&
1585 		    (cnp->cn_flags & NOCROSSMOUNT) == 0) {
1586 		    	error = lookup_crossmount(state, &searchdir,
1587 		    	    &foundobj, &searchdir_locked);
1588 		}
1589 
1590 		if (error) {
1591 			if (searchdir != NULL) {
1592 				if (searchdir_locked) {
1593 					searchdir_locked = false;
1594 					vput(searchdir);
1595 				} else {
1596 					vrele(searchdir);
1597 				}
1598 			}
1599 			ndp->ni_dvp = NULL;
1600 			ndp->ni_vp = NULL;
1601 			/*
1602 			 * Note that if we're doing TRYEMULROOT we can
1603 			 * retry with the normal root. Where this is
1604 			 * currently set matches previous practice,
1605 			 * but the previous practice didn't make much
1606 			 * sense and somebody should sit down and
1607 			 * figure out which cases should cause retry
1608 			 * and which shouldn't. XXX.
1609 			 */
1610 			state->attempt_retry = 1;
1611 			return (error);
1612 		}
1613 
1614 		if (foundobj == NULL) {
1615 			/*
1616 			 * Success with no object returned means we're
1617 			 * creating something and it isn't already
1618 			 * there. Break out of the main loop now so
1619 			 * the code below doesn't have to test for
1620 			 * foundobj == NULL.
1621 			 */
1622 			/* lookup_once can't have dropped the searchdir */
1623 			KASSERT(searchdir != NULL ||
1624 			    (cnp->cn_flags & ISLASTCN) != 0);
1625 			break;
1626 		}
1627 
1628 		/*
1629 		 * Check for symbolic link. If we've reached one,
1630 		 * follow it, unless we aren't supposed to. Back up
1631 		 * over any slashes that we skipped, as we will need
1632 		 * them again.
1633 		 */
1634 		if (namei_atsymlink(state, foundobj)) {
1635 			/* Don't need searchdir locked any more. */
1636 			if (searchdir_locked) {
1637 				searchdir_locked = false;
1638 				VOP_UNLOCK(searchdir);
1639 			}
1640 			ndp->ni_pathlen += state->slashes;
1641 			ndp->ni_next -= state->slashes;
1642 			if (neverfollow) {
1643 				error = EINVAL;
1644 			} else if (searchdir == NULL) {
1645 				/*
1646 				 * dholland 20160410: lookup_once only
1647 				 * drops searchdir if it crossed a
1648 				 * mount point. Therefore, if we get
1649 				 * here it means we crossed a mount
1650 				 * point to a mounted filesystem whose
1651 				 * root vnode is a symlink. In theory
1652 				 * we could continue at this point by
1653 				 * using the pre-crossing searchdir
1654 				 * (e.g. just take out an extra
1655 				 * reference on it before calling
1656 				 * lookup_once so we still have it),
1657 				 * but this will make an ugly mess and
1658 				 * it should never happen in practice
1659 				 * as only badly broken filesystems
1660 				 * have non-directory root vnodes. (I
1661 				 * have seen this sort of thing with
1662 				 * NFS occasionally but even then it
1663 				 * means something's badly wrong.)
1664 				 */
1665 				error = ENOTDIR;
1666 			} else {
1667 				/*
1668 				 * dholland 20110410: if we're at a
1669 				 * union mount it might make sense to
1670 				 * use the top of the union stack here
1671 				 * rather than the layer we found the
1672 				 * symlink in. (FUTURE)
1673 				 */
1674 				error = namei_follow(state, inhibitmagic,
1675 						     searchdir, foundobj,
1676 						     &searchdir);
1677 			}
1678 			if (error) {
1679 				KASSERT(searchdir != foundobj);
1680 				if (searchdir != NULL) {
1681 					vrele(searchdir);
1682 				}
1683 				vrele(foundobj);
1684 				ndp->ni_dvp = NULL;
1685 				ndp->ni_vp = NULL;
1686 				return error;
1687 			}
1688 			vrele(foundobj);
1689 			foundobj = NULL;
1690 
1691 			/*
1692 			 * If we followed a symlink to `/' and there
1693 			 * are no more components after the symlink,
1694 			 * we're done with the loop and what we found
1695 			 * is the searchdir.
1696 			 */
1697 			if (cnp->cn_nameptr[0] == '\0') {
1698 				KASSERT(searchdir != NULL);
1699 				foundobj = searchdir;
1700 				searchdir = NULL;
1701 				cnp->cn_flags |= ISLASTCN;
1702 				break;
1703 			}
1704 
1705 			continue;
1706 		}
1707 
1708 		/*
1709 		 * Not a symbolic link.
1710 		 *
1711 		 * Check for directory, if the component was
1712 		 * followed by a series of slashes.
1713 		 */
1714 		if ((foundobj->v_type != VDIR) &&
1715 		    (cnp->cn_flags & REQUIREDIR)) {
1716 			KASSERT(foundobj != searchdir);
1717 			if (searchdir) {
1718 				if (searchdir_locked) {
1719 					searchdir_locked = false;
1720 					vput(searchdir);
1721 				} else {
1722 					vrele(searchdir);
1723 				}
1724 			} else {
1725 				KASSERT(!searchdir_locked);
1726 			}
1727 			vrele(foundobj);
1728 			ndp->ni_dvp = NULL;
1729 			ndp->ni_vp = NULL;
1730 			state->attempt_retry = 1;
1731 			return ENOTDIR;
1732 		}
1733 
1734 		/*
1735 		 * Stop if we've reached the last component.
1736 		 */
1737 		if (cnp->cn_flags & ISLASTCN) {
1738 			break;
1739 		}
1740 
1741 		/*
1742 		 * Continue with the next component.
1743 		 */
1744 		cnp->cn_nameptr = ndp->ni_next;
1745 		if (searchdir != NULL) {
1746 			if (searchdir_locked) {
1747 				searchdir_locked = false;
1748 				vput(searchdir);
1749 			} else {
1750 				vrele(searchdir);
1751 			}
1752 		}
1753 		searchdir = foundobj;
1754 		foundobj = NULL;
1755 	}
1756 
1757 	KASSERT((cnp->cn_flags & LOCKPARENT) == 0 || searchdir == NULL ||
1758 	    VOP_ISLOCKED(searchdir) == LK_EXCLUSIVE);
1759 
1760  skiploop:
1761 
1762 	if (foundobj != NULL) {
1763 		if (foundobj == ndp->ni_erootdir) {
1764 			/*
1765 			 * We are about to return the emulation root.
1766 			 * This isn't a good idea because code might
1767 			 * repeatedly lookup ".." until the file
1768 			 * matches that returned for "/" and loop
1769 			 * forever.  So convert it to the real root.
1770 			 */
1771 			if (searchdir != NULL) {
1772 				if (searchdir_locked) {
1773 					vput(searchdir);
1774 					searchdir_locked = false;
1775 				} else {
1776 					vrele(searchdir);
1777 				}
1778 				searchdir = NULL;
1779 			}
1780 			vrele(foundobj);
1781 			foundobj = ndp->ni_rootdir;
1782 			vref(foundobj);
1783 		}
1784 
1785 		/*
1786 		 * If the caller requested the parent node (i.e. it's
1787 		 * a CREATE, DELETE, or RENAME), and we don't have one
1788 		 * (because this is the root directory, or we crossed
1789 		 * a mount point), then we must fail.
1790 		 */
1791 		if (cnp->cn_nameiop != LOOKUP &&
1792 		    (searchdir == NULL ||
1793 		     searchdir->v_mount != foundobj->v_mount)) {
1794 			if (searchdir) {
1795 				if (searchdir_locked) {
1796 					vput(searchdir);
1797 					searchdir_locked = false;
1798 				} else {
1799 					vrele(searchdir);
1800 				}
1801 				searchdir = NULL;
1802 			}
1803 			vrele(foundobj);
1804 			foundobj = NULL;
1805 			ndp->ni_dvp = NULL;
1806 			ndp->ni_vp = NULL;
1807 			state->attempt_retry = 1;
1808 
1809 			switch (cnp->cn_nameiop) {
1810 			    case CREATE:
1811 				return EEXIST;
1812 			    case DELETE:
1813 			    case RENAME:
1814 				return EBUSY;
1815 			    default:
1816 				break;
1817 			}
1818 			panic("Invalid nameiop\n");
1819 		}
1820 
1821 		/*
1822 		 * Disallow directory write attempts on read-only lookups.
1823 		 * Prefers EEXIST over EROFS for the CREATE case.
1824 		 */
1825 		if (state->rdonly &&
1826 		    (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1827 			if (searchdir) {
1828 				if (searchdir_locked) {
1829 					vput(searchdir);
1830 					searchdir_locked = false;
1831 				} else {
1832 					vrele(searchdir);
1833 				}
1834 				searchdir = NULL;
1835 			}
1836 			vrele(foundobj);
1837 			foundobj = NULL;
1838 			ndp->ni_dvp = NULL;
1839 			ndp->ni_vp = NULL;
1840 			state->attempt_retry = 1;
1841 			return EROFS;
1842 		}
1843 
1844 		/* Lock the leaf node if requested. */
1845 		if ((cnp->cn_flags & (LOCKLEAF | LOCKPARENT)) == LOCKPARENT &&
1846 		    searchdir == foundobj) {
1847 			/*
1848 			 * Note: if LOCKPARENT but not LOCKLEAF is
1849 			 * set, and searchdir == foundobj, this code
1850 			 * necessarily unlocks the parent as well as
1851 			 * the leaf. That is, just because you specify
1852 			 * LOCKPARENT doesn't mean you necessarily get
1853 			 * a locked parent vnode. The code in
1854 			 * vfs_syscalls.c, and possibly elsewhere,
1855 			 * that uses this combination "knows" this, so
1856 			 * it can't be safely changed. Feh. XXX
1857 			 */
1858 			KASSERT(searchdir_locked);
1859 		    	VOP_UNLOCK(searchdir);
1860 		    	searchdir_locked = false;
1861 		} else if ((cnp->cn_flags & LOCKLEAF) != 0 &&
1862 		    (searchdir != foundobj ||
1863 		    (cnp->cn_flags & LOCKPARENT) == 0)) {
1864 			const int lktype = (cnp->cn_flags & LOCKSHARED) != 0 ?
1865 			    LK_SHARED : LK_EXCLUSIVE;
1866 			vn_lock(foundobj, lktype | LK_RETRY);
1867 		}
1868 	}
1869 
1870 	/*
1871 	 * Done.
1872 	 */
1873 
1874 	/*
1875 	 * If LOCKPARENT is not set, the parent directory isn't returned.
1876 	 */
1877 	if ((cnp->cn_flags & LOCKPARENT) == 0 && searchdir != NULL) {
1878 		vrele(searchdir);
1879 		searchdir = NULL;
1880 	}
1881 
1882 	ndp->ni_dvp = searchdir;
1883 	ndp->ni_vp = foundobj;
1884 	return 0;
1885 }
1886 
1887 /*
1888  * Do namei; wrapper layer that handles TRYEMULROOT.
1889  */
1890 static int
1891 namei_tryemulroot(struct namei_state *state,
1892 	 int neverfollow, int inhibitmagic, int isnfsd)
1893 {
1894 	int error;
1895 
1896 	struct nameidata *ndp = state->ndp;
1897 	struct componentname *cnp = state->cnp;
1898 	const char *savepath = NULL;
1899 
1900 	KASSERT(cnp == &ndp->ni_cnd);
1901 
1902 	if (cnp->cn_flags & TRYEMULROOT) {
1903 		savepath = pathbuf_stringcopy_get(ndp->ni_pathbuf);
1904 	}
1905 
1906     emul_retry:
1907 	state->attempt_retry = 0;
1908 
1909 	error = namei_oneroot(state, neverfollow, inhibitmagic, isnfsd);
1910 	if (error) {
1911 		/*
1912 		 * Once namei has started up, the existence of ni_erootdir
1913 		 * tells us whether we're working from an emulation root.
1914 		 * The TRYEMULROOT flag isn't necessarily authoritative.
1915 		 */
1916 		if (ndp->ni_erootdir != NULL && state->attempt_retry) {
1917 			/* Retry the whole thing using the normal root */
1918 			cnp->cn_flags &= ~TRYEMULROOT;
1919 			state->attempt_retry = 0;
1920 
1921 			/* kinda gross */
1922 			strcpy(ndp->ni_pathbuf->pb_path, savepath);
1923 			pathbuf_stringcopy_put(ndp->ni_pathbuf, savepath);
1924 			savepath = NULL;
1925 
1926 			goto emul_retry;
1927 		}
1928 	}
1929 	if (savepath != NULL) {
1930 		pathbuf_stringcopy_put(ndp->ni_pathbuf, savepath);
1931 	}
1932 	return error;
1933 }
1934 
1935 /*
1936  * External interface.
1937  */
1938 int
1939 namei(struct nameidata *ndp)
1940 {
1941 	struct namei_state state;
1942 	int error;
1943 
1944 	namei_init(&state, ndp);
1945 	error = namei_tryemulroot(&state,
1946 				  0/*!neverfollow*/, 0/*!inhibitmagic*/,
1947 				  0/*isnfsd*/);
1948 	namei_cleanup(&state);
1949 
1950 	if (error) {
1951 		/* make sure no stray refs leak out */
1952 		KASSERT(ndp->ni_dvp == NULL);
1953 		KASSERT(ndp->ni_vp == NULL);
1954 	}
1955 
1956 	return error;
1957 }
1958 
1959 ////////////////////////////////////////////////////////////
1960 
1961 /*
1962  * External interface used by nfsd. This is basically different from
1963  * namei only in that it has the ability to pass in the "current
1964  * directory", and uses an extra flag "neverfollow" for which there's
1965  * no physical flag defined in namei.h. (There used to be a cut&paste
1966  * copy of about half of namei in nfsd to allow these minor
1967  * adjustments to exist.)
1968  *
1969  * XXX: the namei interface should be adjusted so nfsd can just use
1970  * ordinary namei().
1971  */
1972 int
1973 lookup_for_nfsd(struct nameidata *ndp, struct vnode *forcecwd, int neverfollow)
1974 {
1975 	struct namei_state state;
1976 	int error;
1977 
1978 	KASSERT(ndp->ni_atdir == NULL);
1979 	ndp->ni_atdir = forcecwd;
1980 
1981 	namei_init(&state, ndp);
1982 	error = namei_tryemulroot(&state,
1983 				  neverfollow, 1/*inhibitmagic*/, 1/*isnfsd*/);
1984 	namei_cleanup(&state);
1985 
1986 	if (error) {
1987 		/* make sure no stray refs leak out */
1988 		KASSERT(ndp->ni_dvp == NULL);
1989 		KASSERT(ndp->ni_vp == NULL);
1990 	}
1991 
1992 	return error;
1993 }
1994 
1995 /*
1996  * A second external interface used by nfsd. This turns out to be a
1997  * single lookup used by the WebNFS code (ha!) to get "index.html" or
1998  * equivalent when asked for a directory. It should eventually evolve
1999  * into some kind of namei_once() call; for the time being it's kind
2000  * of a mess. XXX.
2001  *
2002  * dholland 20110109: I don't think it works, and I don't think it
2003  * worked before I started hacking and slashing either, and I doubt
2004  * anyone will ever notice.
2005  */
2006 
2007 /*
2008  * Internals. This calls lookup_once() after setting up the assorted
2009  * pieces of state the way they ought to be.
2010  */
2011 static int
2012 do_lookup_for_nfsd_index(struct namei_state *state)
2013 {
2014 	int error = 0;
2015 
2016 	struct componentname *cnp = state->cnp;
2017 	struct nameidata *ndp = state->ndp;
2018 	struct vnode *startdir;
2019 	struct vnode *foundobj;
2020 	bool startdir_locked;
2021 	const char *cp;			/* pointer into pathname argument */
2022 
2023 	KASSERT(cnp == &ndp->ni_cnd);
2024 
2025 	startdir = state->ndp->ni_atdir;
2026 
2027 	cnp->cn_nameptr = ndp->ni_pnbuf;
2028 	state->docache = 1;
2029 	state->rdonly = cnp->cn_flags & RDONLY;
2030 	ndp->ni_dvp = NULL;
2031 
2032 	cnp->cn_consume = 0;
2033 	cnp->cn_namelen = namei_getcomponent(cnp->cn_nameptr);
2034 	cp = cnp->cn_nameptr + cnp->cn_namelen;
2035 	KASSERT(cnp->cn_namelen <= KERNEL_NAME_MAX);
2036 	ndp->ni_pathlen -= cnp->cn_namelen;
2037 	ndp->ni_next = cp;
2038 	state->slashes = 0;
2039 	cnp->cn_flags &= ~REQUIREDIR;
2040 	cnp->cn_flags |= MAKEENTRY|ISLASTCN;
2041 
2042 	if (cnp->cn_namelen == 2 &&
2043 	    cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
2044 		cnp->cn_flags |= ISDOTDOT;
2045 	else
2046 		cnp->cn_flags &= ~ISDOTDOT;
2047 
2048 	/*
2049 	 * Because lookup_once can change the startdir, we need our
2050 	 * own reference to it to avoid consuming the caller's.
2051 	 */
2052 	vref(startdir);
2053 	error = lookup_once(state, startdir, &startdir, &foundobj,
2054 	    &startdir_locked);
2055 
2056 	KASSERT((cnp->cn_flags & LOCKPARENT) == 0);
2057 	if (startdir_locked) {
2058 		VOP_UNLOCK(startdir);
2059 		startdir_locked = false;
2060 	}
2061 
2062 	/*
2063 	 * If the vnode we found is mounted on, then cross the mount and get
2064 	 * the root vnode in foundobj.  If this encounters an error, it will
2065 	 * dispose of foundobj, but searchdir is untouched.
2066 	 */
2067 	if (error == 0 && foundobj != NULL &&
2068 	    foundobj->v_type == VDIR &&
2069 	    foundobj->v_mountedhere != NULL &&
2070 	    (cnp->cn_flags & NOCROSSMOUNT) == 0) {
2071 		error = lookup_crossmount(state, &startdir, &foundobj,
2072 		    &startdir_locked);
2073 	}
2074 
2075 	/* Now toss startdir and see if we have an error. */
2076 	if (startdir != NULL)
2077 		vrele(startdir);
2078 	if (error)
2079 		foundobj = NULL;
2080 	else if (foundobj != NULL && (cnp->cn_flags & LOCKLEAF) != 0)
2081 		vn_lock(foundobj, LK_EXCLUSIVE | LK_RETRY);
2082 
2083 	ndp->ni_vp = foundobj;
2084 	return (error);
2085 }
2086 
2087 /*
2088  * External interface. The partitioning between this function and the
2089  * above isn't very clear - the above function exists mostly so code
2090  * that uses "state->" can be shuffled around without having to change
2091  * it to "state.".
2092  */
2093 int
2094 lookup_for_nfsd_index(struct nameidata *ndp, struct vnode *startdir)
2095 {
2096 	struct namei_state state;
2097 	int error;
2098 
2099 	KASSERT(ndp->ni_atdir == NULL);
2100 	ndp->ni_atdir = startdir;
2101 
2102 	/*
2103 	 * Note: the name sent in here (is not|should not be) allowed
2104 	 * to contain a slash.
2105 	 */
2106 	if (strlen(ndp->ni_pathbuf->pb_path) > KERNEL_NAME_MAX) {
2107 		return ENAMETOOLONG;
2108 	}
2109 	if (strchr(ndp->ni_pathbuf->pb_path, '/')) {
2110 		return EINVAL;
2111 	}
2112 
2113 	ndp->ni_pathlen = strlen(ndp->ni_pathbuf->pb_path) + 1;
2114 	ndp->ni_pnbuf = NULL;
2115 	ndp->ni_cnd.cn_nameptr = NULL;
2116 
2117 	namei_init(&state, ndp);
2118 	error = do_lookup_for_nfsd_index(&state);
2119 	namei_cleanup(&state);
2120 
2121 	return error;
2122 }
2123 
2124 ////////////////////////////////////////////////////////////
2125 
2126 /*
2127  * Reacquire a path name component.
2128  * dvp is locked on entry and exit.
2129  * *vpp is locked on exit unless it's NULL.
2130  */
2131 int
2132 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp, int dummy)
2133 {
2134 	int rdonly;			/* lookup read-only flag bit */
2135 	int error = 0;
2136 #ifdef DEBUG
2137 	size_t newlen;			/* DEBUG: check name len */
2138 	const char *cp;			/* DEBUG: check name ptr */
2139 #endif /* DEBUG */
2140 
2141 	(void)dummy;
2142 
2143 	/*
2144 	 * Setup: break out flag bits into variables.
2145 	 */
2146 	rdonly = cnp->cn_flags & RDONLY;
2147 
2148 	/*
2149 	 * Search a new directory.
2150 	 *
2151 	 * The cn_hash value is for use by vfs_cache.
2152 	 * The last component of the filename is left accessible via
2153 	 * cnp->cn_nameptr for callers that need the name. Callers needing
2154 	 * the name set the SAVENAME flag. When done, they assume
2155 	 * responsibility for freeing the pathname buffer.
2156 	 */
2157 #ifdef DEBUG
2158 #if 0
2159 	cp = NULL;
2160 	newhash = namei_hash(cnp->cn_nameptr, &cp);
2161 	if ((uint32_t)newhash != (uint32_t)cnp->cn_hash)
2162 		panic("relookup: bad hash");
2163 #endif
2164 	newlen = namei_getcomponent(cnp->cn_nameptr);
2165 	if (cnp->cn_namelen != newlen)
2166 		panic("relookup: bad len");
2167 	cp = cnp->cn_nameptr + cnp->cn_namelen;
2168 	while (*cp == '/')
2169 		cp++;
2170 	if (*cp != 0)
2171 		panic("relookup: not last component");
2172 #endif /* DEBUG */
2173 
2174 	/*
2175 	 * Check for degenerate name (e.g. / or "")
2176 	 * which is a way of talking about a directory,
2177 	 * e.g. like "/." or ".".
2178 	 */
2179 	if (cnp->cn_nameptr[0] == '\0')
2180 		panic("relookup: null name");
2181 
2182 	if (cnp->cn_flags & ISDOTDOT)
2183 		panic("relookup: lookup on dot-dot");
2184 
2185 	/*
2186 	 * We now have a segment name to search for, and a directory to search.
2187 	 */
2188 	*vpp = NULL;
2189 	error = VOP_LOOKUP(dvp, vpp, cnp);
2190 	if ((error) != 0) {
2191 		KASSERTMSG((*vpp == NULL),
2192 		    "leaf `%s' should be empty but is %p",
2193 		    cnp->cn_nameptr, *vpp);
2194 		if (error != EJUSTRETURN)
2195 			goto bad;
2196 	}
2197 
2198 	/*
2199 	 * Check for symbolic link
2200 	 */
2201 	KASSERTMSG((*vpp == NULL || (*vpp)->v_type != VLNK ||
2202 		(cnp->cn_flags & FOLLOW) == 0),
2203 	    "relookup: symlink found");
2204 
2205 	/*
2206 	 * Check for read-only lookups.
2207 	 */
2208 	if (rdonly && cnp->cn_nameiop != LOOKUP) {
2209 		error = EROFS;
2210 		if (*vpp) {
2211 			vrele(*vpp);
2212 		}
2213 		goto bad;
2214 	}
2215 	/*
2216 	 * Lock result.
2217 	 */
2218 	if (*vpp && *vpp != dvp) {
2219 		error = vn_lock(*vpp, LK_EXCLUSIVE);
2220 		if (error != 0) {
2221 			vrele(*vpp);
2222 			goto bad;
2223 		}
2224 	}
2225 	return (0);
2226 
2227 bad:
2228 	*vpp = NULL;
2229 	return (error);
2230 }
2231 
2232 /*
2233  * namei_simple - simple forms of namei.
2234  *
2235  * These are wrappers to allow the simple case callers of namei to be
2236  * left alone while everything else changes under them.
2237  */
2238 
2239 /* Flags */
2240 struct namei_simple_flags_type {
2241 	int dummy;
2242 };
2243 static const struct namei_simple_flags_type ns_nn, ns_nt, ns_fn, ns_ft;
2244 const namei_simple_flags_t NSM_NOFOLLOW_NOEMULROOT = &ns_nn;
2245 const namei_simple_flags_t NSM_NOFOLLOW_TRYEMULROOT = &ns_nt;
2246 const namei_simple_flags_t NSM_FOLLOW_NOEMULROOT = &ns_fn;
2247 const namei_simple_flags_t NSM_FOLLOW_TRYEMULROOT = &ns_ft;
2248 
2249 static
2250 int
2251 namei_simple_convert_flags(namei_simple_flags_t sflags)
2252 {
2253 	if (sflags == NSM_NOFOLLOW_NOEMULROOT)
2254 		return NOFOLLOW | 0;
2255 	if (sflags == NSM_NOFOLLOW_TRYEMULROOT)
2256 		return NOFOLLOW | TRYEMULROOT;
2257 	if (sflags == NSM_FOLLOW_NOEMULROOT)
2258 		return FOLLOW | 0;
2259 	if (sflags == NSM_FOLLOW_TRYEMULROOT)
2260 		return FOLLOW | TRYEMULROOT;
2261 	panic("namei_simple_convert_flags: bogus sflags\n");
2262 	return 0;
2263 }
2264 
2265 int
2266 namei_simple_kernel(const char *path, namei_simple_flags_t sflags,
2267 	struct vnode **vp_ret)
2268 {
2269 	return nameiat_simple_kernel(NULL, path, sflags, vp_ret);
2270 }
2271 
2272 int
2273 nameiat_simple_kernel(struct vnode *dvp, const char *path,
2274 	namei_simple_flags_t sflags, struct vnode **vp_ret)
2275 {
2276 	struct nameidata nd;
2277 	struct pathbuf *pb;
2278 	int err;
2279 
2280 	pb = pathbuf_create(path);
2281 	if (pb == NULL) {
2282 		return ENOMEM;
2283 	}
2284 
2285 	NDINIT(&nd,
2286 		LOOKUP,
2287 		namei_simple_convert_flags(sflags),
2288 		pb);
2289 
2290 	if (dvp != NULL)
2291 		NDAT(&nd, dvp);
2292 
2293 	err = namei(&nd);
2294 	if (err != 0) {
2295 		pathbuf_destroy(pb);
2296 		return err;
2297 	}
2298 	*vp_ret = nd.ni_vp;
2299 	pathbuf_destroy(pb);
2300 	return 0;
2301 }
2302 
2303 int
2304 namei_simple_user(const char *path, namei_simple_flags_t sflags,
2305 	struct vnode **vp_ret)
2306 {
2307 	return nameiat_simple_user(NULL, path, sflags, vp_ret);
2308 }
2309 
2310 int
2311 nameiat_simple_user(struct vnode *dvp, const char *path,
2312 	namei_simple_flags_t sflags, struct vnode **vp_ret)
2313 {
2314 	struct pathbuf *pb;
2315 	struct nameidata nd;
2316 	int err;
2317 
2318 	err = pathbuf_copyin(path, &pb);
2319 	if (err) {
2320 		return err;
2321 	}
2322 
2323 	NDINIT(&nd,
2324 		LOOKUP,
2325 		namei_simple_convert_flags(sflags),
2326 		pb);
2327 
2328 	if (dvp != NULL)
2329 		NDAT(&nd, dvp);
2330 
2331 	err = namei(&nd);
2332 	if (err != 0) {
2333 		pathbuf_destroy(pb);
2334 		return err;
2335 	}
2336 	*vp_ret = nd.ni_vp;
2337 	pathbuf_destroy(pb);
2338 	return 0;
2339 }
2340