xref: /netbsd-src/sys/nfs/nfs_serv.c (revision 4817a0b0b8fe9612e8ebe21a9bf2d97b95038a97)
1 /*	$NetBSD: nfs_serv.c,v 1.152 2010/11/30 10:30:03 dholland Exp $	*/
2 
3 /*
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)nfs_serv.c	8.8 (Berkeley) 7/31/95
35  */
36 
37 /*
38  * nfs version 2 and 3 server calls to vnode ops
39  * - these routines generally have 3 phases
40  *   1 - break down and validate rpc request in mbuf list
41  *   2 - do the vnode ops for the request
42  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
43  *   3 - build the rpc reply in an mbuf list
44  *   nb:
45  *	- do not mix the phases, since the nfsm_?? macros can return failures
46  *	  on a bad rpc or similar and do not do any vrele() or vput()'s
47  *
48  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
49  *	error number iff error != 0 whereas
50  *	returning an error from the server function implies a fatal error
51  *	such as a badly constructed rpc request that should be dropped without
52  *	a reply.
53  *	For Version 3, nfsm_reply() does not return for the error case, since
54  *	most version 3 rpcs return more than the status for error cases.
55  */
56 
57 #include <sys/cdefs.h>
58 __KERNEL_RCSID(0, "$NetBSD: nfs_serv.c,v 1.152 2010/11/30 10:30:03 dholland Exp $");
59 
60 #include <sys/param.h>
61 #include <sys/systm.h>
62 #include <sys/proc.h>
63 #include <sys/file.h>
64 #include <sys/namei.h>
65 #include <sys/vnode.h>
66 #include <sys/mount.h>
67 #include <sys/socket.h>
68 #include <sys/socketvar.h>
69 #include <sys/mbuf.h>
70 #include <sys/dirent.h>
71 #include <sys/stat.h>
72 #include <sys/kernel.h>
73 #include <sys/hash.h>
74 #include <sys/kauth.h>
75 #include <sys/module.h>
76 #include <sys/syscall.h>
77 #include <sys/syscallargs.h>
78 #include <sys/syscallvar.h>
79 
80 #include <uvm/uvm.h>
81 
82 #include <nfs/nfsproto.h>
83 #include <nfs/rpcv2.h>
84 #include <nfs/nfs.h>
85 #include <nfs/xdr_subs.h>
86 #include <nfs/nfsm_subs.h>
87 #include <nfs/nfs_var.h>
88 
89 MODULE(MODULE_CLASS_MISC, nfsserver, "nfs");
90 
91 /* Global vars */
92 extern u_int32_t nfs_xdrneg1;
93 extern u_int32_t nfs_false, nfs_true;
94 extern const enum vtype nv3tov_type[8];
95 extern struct nfsstats nfsstats;
96 extern const nfstype nfsv2_type[9];
97 extern const nfstype nfsv3_type[9];
98 int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
99 bool nfsd_use_loan = true;	/* use page-loan for READ OP */
100 
101 #define	nqsrv_getl(vp, rw)	/* nothing */
102 
103 static const struct syscall_package nfsserver_syscalls[] = {
104 	{ SYS_nfssvc, 0, (sy_call_t *)sys_nfssvc },
105 	{ 0, 0, NULL },
106 };
107 
108 static int
109 nfsserver_modcmd(modcmd_t cmd, void *arg)
110 {
111 	extern struct vfs_hooks nfs_export_hooks;	/* XXX */
112 	int error;
113 
114 	switch (cmd) {
115 	case MODULE_CMD_INIT:
116 		error = syscall_establish(NULL, nfsserver_syscalls);
117 		if (error != 0) {
118 			return error;
119 		}
120 		nfs_init();	/* XXX for monolithic kernel */
121 		netexport_init();
122 		nfsrv_initcache();	/* Init the server request cache */
123 		nfsrv_init(0);		/* Init server data structures */
124 		vfs_hooks_attach(&nfs_export_hooks);
125 		nfs_timer_srvinit(nfsrv_timer);
126 		return 0;
127 	case MODULE_CMD_FINI:
128 		error = syscall_disestablish(NULL, nfsserver_syscalls);
129 		if (error != 0) {
130 			return error;
131 		}
132 		/*
133 		 * Kill export list before detaching VFS hooks, so we
134 		 * we don't leak state due to a concurrent umount().
135 		 */
136 		netexport_fini();
137 		vfs_hooks_detach(&nfs_export_hooks);
138 
139 		/* Kill timer before server goes away. */
140 		nfs_timer_srvfini();
141 		nfsrv_fini();
142 
143 		/* Server uses server cache, so kill cache last. */
144 		nfsrv_finicache();
145 		return 0;
146 	default:
147 		return ENOTTY;
148 	}
149 }
150 
151 /*
152  * nfs v3 access service
153  */
154 int
155 nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
156 {
157 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
158 	struct mbuf *nam = nfsd->nd_nam;
159 	char *dpos = nfsd->nd_dpos;
160 	kauth_cred_t cred = nfsd->nd_cr;
161 	struct vnode *vp;
162 	nfsrvfh_t nsfh;
163 	u_int32_t *tl;
164 	int32_t t1;
165 	char *bpos;
166 	int error = 0, rdonly, cache = 0, getret;
167 	char *cp2;
168 	struct mbuf *mb, *mreq;
169 	struct vattr va;
170 	u_long inmode, testmode, outmode;
171 	u_quad_t frev;
172 
173 	nfsm_srvmtofh(&nsfh);
174 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
175 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
176 	    (nfsd->nd_flag & ND_KERBAUTH), false);
177 	if (error) {
178 		nfsm_reply(NFSX_UNSIGNED);
179 		nfsm_srvpostop_attr(1, (struct vattr *)0);
180 		return (0);
181 	}
182 	inmode = fxdr_unsigned(u_int32_t, *tl);
183 	outmode = 0;
184 	if ((inmode & NFSV3ACCESS_READ) &&
185 	    nfsrv_access(vp, VREAD, cred, rdonly, lwp, 0) == 0)
186 		outmode |= NFSV3ACCESS_READ;
187 	if (vp->v_type != VDIR) {
188 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
189 		if (testmode &&
190 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
191 			outmode |= testmode;
192 		if ((inmode & NFSV3ACCESS_EXECUTE) &&
193 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
194 			outmode |= NFSV3ACCESS_EXECUTE;
195 	} else {
196 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
197 		    NFSV3ACCESS_DELETE);
198 		if (testmode &&
199 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
200 			outmode |= testmode;
201 		if ((inmode & NFSV3ACCESS_LOOKUP) &&
202 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
203 			outmode |= NFSV3ACCESS_LOOKUP;
204 	}
205 	getret = VOP_GETATTR(vp, &va, cred);
206 	vput(vp);
207 	nfsm_reply(NFSX_POSTOPATTR(1) + NFSX_UNSIGNED);
208 	nfsm_srvpostop_attr(getret, &va);
209 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
210 	*tl = txdr_unsigned(outmode);
211 	nfsm_srvdone;
212 }
213 
214 /*
215  * nfs getattr service
216  */
217 int
218 nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
219 {
220 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
221 	struct mbuf *nam = nfsd->nd_nam;
222 	char *dpos = nfsd->nd_dpos;
223 	kauth_cred_t cred = nfsd->nd_cr;
224 	struct nfs_fattr *fp;
225 	struct vattr va;
226 	struct vnode *vp;
227 	nfsrvfh_t nsfh;
228 	u_int32_t *tl;
229 	int32_t t1;
230 	char *bpos;
231 	int error = 0, rdonly, cache = 0;
232 	char *cp2;
233 	struct mbuf *mb, *mreq;
234 	u_quad_t frev;
235 
236 	nfsm_srvmtofh(&nsfh);
237 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
238 	    (nfsd->nd_flag & ND_KERBAUTH), false);
239 	if (error) {
240 		nfsm_reply(0);
241 		return (0);
242 	}
243 	nqsrv_getl(vp, ND_READ);
244 	error = VOP_GETATTR(vp, &va, cred);
245 	vput(vp);
246 	nfsm_reply(NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
247 	if (error)
248 		return (0);
249 	nfsm_build(fp, struct nfs_fattr *, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
250 	nfsm_srvfillattr(&va, fp);
251 	nfsm_srvdone;
252 }
253 
254 /*
255  * nfs setattr service
256  */
257 int
258 nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
259 {
260 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
261 	struct mbuf *nam = nfsd->nd_nam;
262 	char *dpos = nfsd->nd_dpos;
263 	kauth_cred_t cred = nfsd->nd_cr;
264 	struct vattr va, preat;
265 	struct nfsv2_sattr *sp;
266 	struct nfs_fattr *fp;
267 	struct vnode *vp;
268 	nfsrvfh_t nsfh;
269 	u_int32_t *tl;
270 	int32_t t1;
271 	char *bpos;
272 	int error = 0, rdonly, cache = 0, preat_ret = 1, postat_ret = 1;
273 	int v3 = (nfsd->nd_flag & ND_NFSV3), gcheck = 0;
274 	char *cp2;
275 	struct mbuf *mb, *mreq;
276 	u_quad_t frev;
277 	struct timespec guard;
278 
279 	memset(&guard, 0, sizeof guard);	/* XXX gcc */
280 
281 	nfsm_srvmtofh(&nsfh);
282 	vattr_null(&va);
283 	if (v3) {
284 		nfsm_srvsattr(&va);
285 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
286 		gcheck = fxdr_unsigned(int, *tl);
287 		if (gcheck) {
288 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
289 			fxdr_nfsv3time(tl, &guard);
290 		}
291 	} else {
292 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
293 		/*
294 		 * Nah nah nah nah na nah
295 		 * There is a bug in the Sun client that puts 0xffff in the mode
296 		 * field of sattr when it should put in 0xffffffff. The u_short
297 		 * doesn't sign extend.
298 		 * --> check the low order 2 bytes for 0xffff
299 		 */
300 		if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
301 			va.va_mode = nfstov_mode(sp->sa_mode);
302 		if (sp->sa_uid != nfs_xdrneg1)
303 			va.va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
304 		if (sp->sa_gid != nfs_xdrneg1)
305 			va.va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
306 		if (sp->sa_size != nfs_xdrneg1)
307 			va.va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
308 		if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
309 #ifdef notyet
310 			fxdr_nfsv2time(&sp->sa_atime, &va.va_atime);
311 #else
312 			va.va_atime.tv_sec =
313 				fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
314 			va.va_atime.tv_nsec = 0;
315 #endif
316 		}
317 		if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
318 			fxdr_nfsv2time(&sp->sa_mtime, &va.va_mtime);
319 
320 	}
321 
322 	/*
323 	 * Now that we have all the fields, lets do it.
324 	 */
325 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
326 	    (nfsd->nd_flag & ND_KERBAUTH), false);
327 	if (error) {
328 		nfsm_reply(2 * NFSX_UNSIGNED);
329 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
330 		return (0);
331 	}
332 	nqsrv_getl(vp, ND_WRITE);
333 	if (v3) {
334 		error = preat_ret = VOP_GETATTR(vp, &preat, cred);
335 		if (!error && gcheck &&
336 			(preat.va_ctime.tv_sec != guard.tv_sec ||
337 			 preat.va_ctime.tv_nsec != guard.tv_nsec))
338 			error = NFSERR_NOT_SYNC;
339 		if (error) {
340 			vput(vp);
341 			nfsm_reply(NFSX_WCCDATA(v3));
342 			nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
343 			return (0);
344 		}
345 	}
346 
347 	/*
348 	 * If the size is being changed write acces is required, otherwise
349 	 * just check for a read only file system.
350 	 */
351 	if (va.va_size == ((u_quad_t)((quad_t) -1))) {
352 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
353 			error = EROFS;
354 			goto out;
355 		}
356 	} else {
357 		if (vp->v_type == VDIR) {
358 			error = EISDIR;
359 			goto out;
360 		} else if ((error = nfsrv_access(vp, VWRITE, cred, rdonly,
361 			lwp, 0)) != 0)
362 			goto out;
363 	}
364 	error = VOP_SETATTR(vp, &va, cred);
365 	postat_ret = VOP_GETATTR(vp, &va, cred);
366 	if (!error)
367 		error = postat_ret;
368 out:
369 	vput(vp);
370 	nfsm_reply(NFSX_WCCORFATTR(v3));
371 	if (v3) {
372 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
373 		return (0);
374 	} else {
375 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
376 		nfsm_srvfillattr(&va, fp);
377 	}
378 	nfsm_srvdone;
379 }
380 
381 /*
382  * nfs lookup rpc
383  */
384 int
385 nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
386 {
387 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
388 	struct mbuf *nam = nfsd->nd_nam;
389 	char *dpos = nfsd->nd_dpos;
390 	kauth_cred_t cred = nfsd->nd_cr;
391 	struct nfs_fattr *fp;
392 	struct nameidata nd, ind, *ndp = &nd;
393 	struct pathbuf *ipb = NULL;
394 	struct vnode *vp, *dirp;
395 	nfsrvfh_t nsfh;
396 	char *cp;
397 	u_int32_t *tl;
398 	int32_t t1;
399 	char *bpos;
400 	int error = 0, cache = 0, dirattr_ret = 1;
401 	uint32_t len;
402 	int v3 = (nfsd->nd_flag & ND_NFSV3), pubflag;
403 	char *cp2;
404 	struct mbuf *mb, *mreq;
405 	struct vattr va, dirattr;
406 	u_quad_t frev;
407 
408 	nfsm_srvmtofh(&nsfh);
409 	nfsm_srvnamesiz(len);
410 
411 	pubflag = nfs_ispublicfh(&nsfh);
412 
413 	nd.ni_cnd.cn_cred = cred;
414 	nd.ni_cnd.cn_nameiop = LOOKUP;
415 	nd.ni_cnd.cn_flags = LOCKLEAF | SAVESTART;
416 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
417 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), pubflag);
418 
419 	if (!error && pubflag) {
420 		if (nd.ni_vp->v_type == VDIR && nfs_pub.np_index != NULL &&
421 		    (ipb = pathbuf_create(nfs_pub.np_index)) != NULL) {
422 			/*
423 			 * Setup call to lookup() to see if we can find
424 			 * the index file. Arguably, this doesn't belong
425 			 * in a kernel.. Ugh.
426 			 */
427 			ind = nd;
428 			VOP_UNLOCK(nd.ni_vp);
429 			ind.ni_pathbuf = ipb;
430 			ind.ni_pathlen = strlen(nfs_pub.np_index);
431 			ind.ni_pnbuf = NULL;
432 			ind.ni_cnd.cn_nameptr = NULL;
433 			ind.ni_startdir = nd.ni_vp;
434 			vref(ind.ni_startdir);
435 			error = lookup_for_nfsd_index(&ind);
436 			if (!error) {
437 				/*
438 				 * Found an index file. Get rid of
439 				 * the old references.
440 				 */
441 				if (dirp)
442 					vrele(dirp);
443 				dirp = nd.ni_vp;
444 				vrele(nd.ni_startdir);
445 				ndp = &ind;
446 			} else
447 				error = 0;
448 		}
449 		/*
450 		 * If the public filehandle was used, check that this lookup
451 		 * didn't result in a filehandle outside the publicly exported
452 		 * filesystem.
453 		 */
454 
455 		if (!error && ndp->ni_vp->v_mount != nfs_pub.np_mount) {
456 			vput(nd.ni_vp);
457 			error = EPERM;
458 		}
459 	}
460 
461 	if (dirp) {
462 		if (v3)
463 			dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred);
464 		vrele(dirp);
465 	}
466 
467 	if (error) {
468 		nfsm_reply(NFSX_POSTOPATTR(v3));
469 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
470 		return (0);
471 	}
472 
473 	nqsrv_getl(ndp->ni_startdir, ND_READ);
474 	pathbuf_destroy(nd.ni_pathbuf);
475 	if (ipb != NULL) {
476 		pathbuf_destroy(ipb);
477 	}
478 	vp = ndp->ni_vp;
479 	error = nfsrv_composefh(vp, &nsfh, v3);
480 	if (!error)
481 		error = VOP_GETATTR(vp, &va, cred);
482 	vput(vp);
483 	vrele(ndp->ni_startdir);
484 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPORFATTR(v3) +
485 	    NFSX_POSTOPATTR(v3));
486 	if (error) {
487 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
488 		return (0);
489 	}
490 	nfsm_srvfhtom(&nsfh, v3);
491 	if (v3) {
492 		nfsm_srvpostop_attr(0, &va);
493 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
494 	} else {
495 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
496 		nfsm_srvfillattr(&va, fp);
497 	}
498 	nfsm_srvdone;
499 }
500 
501 /*
502  * nfs readlink service
503  */
504 int
505 nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
506 {
507 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
508 	struct mbuf *nam = nfsd->nd_nam;
509 	char *dpos = nfsd->nd_dpos;
510 	kauth_cred_t cred = nfsd->nd_cr;
511 	struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
512 	struct iovec *ivp = iv;
513 	struct mbuf *mp;
514 	u_int32_t *tl;
515 	int32_t t1;
516 	char *bpos;
517 	int error = 0, rdonly, cache = 0, i, padlen, getret;
518 	uint32_t len;
519 	int v3 = (nfsd->nd_flag & ND_NFSV3);
520 	char *cp2;
521 	struct mbuf *mb, *mp2 = NULL, *mp3 = NULL, *mreq;
522 	struct vnode *vp;
523 	struct vattr attr;
524 	nfsrvfh_t nsfh;
525 	struct uio io, *uiop = &io;
526 	u_quad_t frev;
527 
528 	nfsm_srvmtofh(&nsfh);
529 	len = 0;
530 	i = 0;
531 	while (len < NFS_MAXPATHLEN) {
532 		mp = m_get(M_WAIT, MT_DATA);
533 		MCLAIM(mp, &nfs_mowner);
534 		m_clget(mp, M_WAIT);
535 		mp->m_len = NFSMSIZ(mp);
536 		if (len == 0)
537 			mp3 = mp2 = mp;
538 		else {
539 			mp2->m_next = mp;
540 			mp2 = mp;
541 		}
542 		if ((len+mp->m_len) > NFS_MAXPATHLEN) {
543 			mp->m_len = NFS_MAXPATHLEN-len;
544 			len = NFS_MAXPATHLEN;
545 		} else
546 			len += mp->m_len;
547 		ivp->iov_base = mtod(mp, void *);
548 		ivp->iov_len = mp->m_len;
549 		i++;
550 		ivp++;
551 	}
552 	uiop->uio_iov = iv;
553 	uiop->uio_iovcnt = i;
554 	uiop->uio_offset = 0;
555 	uiop->uio_resid = len;
556 	uiop->uio_rw = UIO_READ;
557 	UIO_SETUP_SYSSPACE(uiop);
558 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
559 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
560 	if (error) {
561 		m_freem(mp3);
562 		nfsm_reply(2 * NFSX_UNSIGNED);
563 		nfsm_srvpostop_attr(1, (struct vattr *)0);
564 		return (0);
565 	}
566 	if (vp->v_type != VLNK) {
567 		if (v3)
568 			error = EINVAL;
569 		else
570 			error = ENXIO;
571 		goto out;
572 	}
573 	nqsrv_getl(vp, ND_READ);
574 	error = VOP_READLINK(vp, uiop, cred);
575 out:
576 	getret = VOP_GETATTR(vp, &attr, cred);
577 	vput(vp);
578 	if (error)
579 		m_freem(mp3);
580 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_UNSIGNED);
581 	if (v3) {
582 		nfsm_srvpostop_attr(getret, &attr);
583 		if (error)
584 			return (0);
585 	}
586 	len -= uiop->uio_resid;
587 	padlen = nfsm_padlen(len);
588 	if (uiop->uio_resid || padlen)
589 		nfs_zeropad(mp3, uiop->uio_resid, padlen);
590 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
591 	*tl = txdr_unsigned(len);
592 	mb->m_next = mp3;
593 	nfsm_srvdone;
594 }
595 
596 /*
597  * nfs read service
598  */
599 int
600 nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
601 {
602 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
603 	struct mbuf *nam = nfsd->nd_nam;
604 	char *dpos = nfsd->nd_dpos;
605 	kauth_cred_t cred = nfsd->nd_cr;
606 	struct mbuf *m;
607 	struct nfs_fattr *fp;
608 	u_int32_t *tl;
609 	int32_t t1;
610 	int i;
611 	char *bpos;
612 	int error = 0, rdonly, cache = 0, getret;
613 	int v3 = (nfsd->nd_flag & ND_NFSV3);
614 	uint32_t reqlen, len, cnt, left;
615 	int padlen;
616 	char *cp2;
617 	struct mbuf *mb, *mreq;
618 	struct vnode *vp;
619 	nfsrvfh_t nsfh;
620 	struct uio io, *uiop = &io;
621 	struct vattr va;
622 	off_t off;
623 	u_quad_t frev;
624 
625 	nfsm_srvmtofh(&nsfh);
626 	if (v3) {
627 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
628 		off = fxdr_hyper(tl);
629 	} else {
630 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
631 		off = (off_t)fxdr_unsigned(u_int32_t, *tl);
632 	}
633 	nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
634 	reqlen = fxdr_unsigned(uint32_t, *tl);
635 	reqlen = MIN(reqlen, NFS_SRVMAXDATA(nfsd));
636 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
637 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
638 	if (error) {
639 		nfsm_reply(2 * NFSX_UNSIGNED);
640 		nfsm_srvpostop_attr(1, (struct vattr *)0);
641 		return (0);
642 	}
643 	if (vp->v_type != VREG) {
644 		if (v3)
645 			error = EINVAL;
646 		else
647 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
648 	}
649 	if (!error) {
650 	    nqsrv_getl(vp, ND_READ);
651 	    if ((error = nfsrv_access(vp, VREAD, cred, rdonly, lwp, 1)) != 0)
652 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 1);
653 	}
654 	getret = VOP_GETATTR(vp, &va, cred);
655 	if (!error)
656 		error = getret;
657 	if (error) {
658 		vput(vp);
659 		nfsm_reply(NFSX_POSTOPATTR(v3));
660 		nfsm_srvpostop_attr(getret, &va);
661 		return (0);
662 	}
663 	if (off >= va.va_size)
664 		cnt = 0;
665 	else if ((off + reqlen) > va.va_size)
666 		cnt = va.va_size - off;
667 	else
668 		cnt = reqlen;
669 	nfsm_reply(NFSX_POSTOPORFATTR(v3) + 3 * NFSX_UNSIGNED+nfsm_rndup(cnt));
670 	if (v3) {
671 		nfsm_build(tl, u_int32_t *, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
672 		*tl++ = nfs_true;
673 		fp = (struct nfs_fattr *)tl;
674 		tl += (NFSX_V3FATTR / sizeof (u_int32_t));
675 	} else {
676 		nfsm_build(tl, u_int32_t *, NFSX_V2FATTR + NFSX_UNSIGNED);
677 		fp = (struct nfs_fattr *)tl;
678 		tl += (NFSX_V2FATTR / sizeof (u_int32_t));
679 	}
680 	len = left = cnt;
681 	if (cnt > 0) {
682 		if (nfsd_use_loan) {
683 			struct vm_page **pgpp;
684 			voff_t pgoff = trunc_page(off);
685 			int npages;
686 			vaddr_t lva;
687 
688 			npages = (round_page(off + cnt) - pgoff) >> PAGE_SHIFT;
689 			KASSERT(npages <= M_EXT_MAXPAGES); /* XXX */
690 
691 			/* allocate kva for mbuf data */
692 			lva = sokvaalloc(npages << PAGE_SHIFT, slp->ns_so);
693 			if (lva == 0) {
694 				/* fall back to VOP_READ */
695 				goto loan_fail;
696 			}
697 
698 			/* allocate mbuf */
699 			m = m_get(M_WAIT, MT_DATA);
700 			MCLAIM(m, &nfs_mowner);
701 			pgpp = m->m_ext.ext_pgs;
702 
703 			/* loan pages */
704 			error = uvm_loanuobjpages(&vp->v_uobj, pgoff, npages,
705 			    pgpp);
706 			if (error) {
707 				sokvafree(lva, npages << PAGE_SHIFT);
708 				m_free(m);
709 				if (error == EBUSY)
710 					goto loan_fail;
711 				goto read_error;
712 			}
713 
714 			/* associate kva to mbuf */
715 			MEXTADD(m, (void *)(lva + ((vaddr_t)off & PAGE_MASK)),
716 			    cnt, M_MBUF, soloanfree, slp->ns_so);
717 			m->m_flags |= M_EXT_PAGES | M_EXT_ROMAP;
718 			m->m_len = cnt;
719 
720 			/* map pages */
721 			for (i = 0; i < npages; i++) {
722 				pmap_kenter_pa(lva, VM_PAGE_TO_PHYS(pgpp[i]),
723 				    VM_PROT_READ, 0);
724 				lva += PAGE_SIZE;
725 			}
726 
727 			pmap_update(pmap_kernel());
728 
729 			mb->m_next = m;
730 			mb = m;
731 			error = 0;
732 			uiop->uio_resid = 0;
733 		} else {
734 			struct iovec *iv;
735 			struct iovec *iv2;
736 			struct mbuf *m2;
737 			int siz;
738 loan_fail:
739 			/*
740 			 * Generate the mbuf list with the uio_iov ref. to it.
741 			 */
742 			i = 0;
743 			m = m2 = mb;
744 			while (left > 0) {
745 				siz = min(M_TRAILINGSPACE(m), left);
746 				if (siz > 0) {
747 					left -= siz;
748 					i++;
749 				}
750 				if (left > 0) {
751 					m = m_get(M_WAIT, MT_DATA);
752 					MCLAIM(m, &nfs_mowner);
753 					m_clget(m, M_WAIT);
754 					m->m_len = 0;
755 					m2->m_next = m;
756 					m2 = m;
757 				}
758 			}
759 			iv = malloc(i * sizeof(struct iovec), M_TEMP, M_WAITOK);
760 			uiop->uio_iov = iv2 = iv;
761 			m = mb;
762 			left = cnt;
763 			i = 0;
764 			while (left > 0) {
765 				if (m == NULL)
766 					panic("nfsrv_read iov");
767 				siz = min(M_TRAILINGSPACE(m), left);
768 				if (siz > 0) {
769 					iv->iov_base = mtod(m, char *) +
770 					    m->m_len;
771 					iv->iov_len = siz;
772 					m->m_len += siz;
773 					left -= siz;
774 					iv++;
775 					i++;
776 				}
777 				m = m->m_next;
778 			}
779 			uiop->uio_iovcnt = i;
780 			uiop->uio_offset = off;
781 			uiop->uio_resid = cnt;
782 			uiop->uio_rw = UIO_READ;
783 			UIO_SETUP_SYSSPACE(uiop);
784 			error = VOP_READ(vp, uiop, IO_NODELOCKED, cred);
785 			free((void *)iv2, M_TEMP);
786 		}
787 read_error:
788 		if (error || (getret = VOP_GETATTR(vp, &va, cred)) != 0){
789 			if (!error)
790 				error = getret;
791 			m_freem(mreq);
792 			vput(vp);
793 			nfsm_reply(NFSX_POSTOPATTR(v3));
794 			nfsm_srvpostop_attr(getret, &va);
795 			return (0);
796 		}
797 	} else {
798 		uiop->uio_resid = 0;
799 	}
800 	vput(vp);
801 	nfsm_srvfillattr(&va, fp);
802 	len -= uiop->uio_resid;
803 	padlen = nfsm_padlen(len);
804 	if (uiop->uio_resid || padlen)
805 		nfs_zeropad(mb, uiop->uio_resid, padlen);
806 	if (v3) {
807 		/* count */
808 		*tl++ = txdr_unsigned(len);
809 		/* eof */
810 		if (off + len >= va.va_size)
811 			*tl++ = nfs_true;
812 		else
813 			*tl++ = nfs_false;
814 	}
815 	*tl = txdr_unsigned(len);
816 	nfsm_srvdone;
817 }
818 
819 /*
820  * nfs write service
821  */
822 int
823 nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
824 {
825 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
826 	struct mbuf *nam = nfsd->nd_nam;
827 	char *dpos = nfsd->nd_dpos;
828 	kauth_cred_t cred = nfsd->nd_cr;
829 	struct iovec *ivp;
830 	int i, cnt;
831 	struct mbuf *mp;
832 	struct nfs_fattr *fp;
833 	struct iovec *iv;
834 	struct vattr va, forat;
835 	u_int32_t *tl;
836 	int32_t t1;
837 	char *bpos;
838 	int error = 0, rdonly, cache = 0, len, forat_ret = 1;
839 	int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
840 	int stable = NFSV3WRITE_FILESYNC;
841 	int v3 = (nfsd->nd_flag & ND_NFSV3);
842 	char *cp2;
843 	struct mbuf *mb, *mreq;
844 	struct vnode *vp;
845 	nfsrvfh_t nsfh;
846 	struct uio io, *uiop = &io;
847 	off_t off;
848 	u_quad_t frev;
849 
850 	if (mrep == NULL) {
851 		*mrq = NULL;
852 		return (0);
853 	}
854 	nfsm_srvmtofh(&nsfh);
855 	if (v3) {
856 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
857 		off = fxdr_hyper(tl);
858 		tl += 3;
859 		stable = fxdr_unsigned(int, *tl++);
860 	} else {
861 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
862 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
863 		tl += 2;
864 	}
865 	retlen = len = fxdr_unsigned(int32_t, *tl);
866 	cnt = i = 0;
867 
868 	/*
869 	 * For NFS Version 2, it is not obvious what a write of zero length
870 	 * should do, but I might as well be consistent with Version 3,
871 	 * which is to return ok so long as there are no permission problems.
872 	 */
873 	if (len > 0) {
874 		zeroing = 1;
875 		mp = mrep;
876 		while (mp) {
877 			if (mp == md) {
878 				zeroing = 0;
879 				adjust = dpos - mtod(mp, char *);
880 				mp->m_len -= adjust;
881 				if (mp->m_len > 0 && adjust > 0)
882 					NFSMADV(mp, adjust);
883 			}
884 			if (zeroing)
885 				mp->m_len = 0;
886 			else if (mp->m_len > 0) {
887 				i += mp->m_len;
888 				if (i > len) {
889 					mp->m_len -= (i - len);
890 					zeroing	= 1;
891 				}
892 				if (mp->m_len > 0)
893 					cnt++;
894 			}
895 			mp = mp->m_next;
896 		}
897 	}
898 	if (len > NFS_MAXDATA || len < 0 || i < len) {
899 		error = EIO;
900 		nfsm_reply(2 * NFSX_UNSIGNED);
901 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
902 		return (0);
903 	}
904 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
905 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
906 	if (error) {
907 		nfsm_reply(2 * NFSX_UNSIGNED);
908 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
909 		return (0);
910 	}
911 	if (v3)
912 		forat_ret = VOP_GETATTR(vp, &forat, cred);
913 	if (vp->v_type != VREG) {
914 		if (v3)
915 			error = EINVAL;
916 		else
917 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
918 	}
919 	if (!error) {
920 		nqsrv_getl(vp, ND_WRITE);
921 		error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
922 	}
923 	if (error) {
924 		vput(vp);
925 		nfsm_reply(NFSX_WCCDATA(v3));
926 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
927 		return (0);
928 	}
929 
930 	if (len > 0) {
931 		ivp = malloc(cnt * sizeof (struct iovec), M_TEMP, M_WAITOK);
932 		uiop->uio_iov = iv = ivp;
933 		uiop->uio_iovcnt = cnt;
934 		mp = mrep;
935 		while (mp) {
936 			if (mp->m_len > 0) {
937 				ivp->iov_base = mtod(mp, void *);
938 				ivp->iov_len = mp->m_len;
939 				ivp++;
940 			}
941 			mp = mp->m_next;
942 		}
943 
944 		/*
945 		 * XXX
946 		 * The IO_METASYNC flag indicates that all metadata (and not
947 		 * just enough to ensure data integrity) must be written to
948 		 * stable storage synchronously.
949 		 * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
950 		 */
951 		if (stable == NFSV3WRITE_UNSTABLE)
952 			ioflags = IO_NODELOCKED;
953 		else if (stable == NFSV3WRITE_DATASYNC)
954 			ioflags = (IO_SYNC | IO_NODELOCKED);
955 		else
956 			ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
957 		uiop->uio_resid = len;
958 		uiop->uio_rw = UIO_WRITE;
959 		uiop->uio_offset = off;
960 		UIO_SETUP_SYSSPACE(uiop);
961 		error = VOP_WRITE(vp, uiop, ioflags, cred);
962 		nfsstats.srvvop_writes++;
963 		free(iv, M_TEMP);
964 	}
965 	aftat_ret = VOP_GETATTR(vp, &va, cred);
966 	vput(vp);
967 	if (!error)
968 		error = aftat_ret;
969 	nfsm_reply(NFSX_PREOPATTR(v3) + NFSX_POSTOPORFATTR(v3) +
970 		2 * NFSX_UNSIGNED + NFSX_WRITEVERF(v3));
971 	if (v3) {
972 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
973 		if (error)
974 			return (0);
975 		nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
976 		*tl++ = txdr_unsigned(retlen);
977 		if (stable == NFSV3WRITE_UNSTABLE)
978 			*tl++ = txdr_unsigned(stable);
979 		else
980 			*tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
981 		/*
982 		 * Actually, there is no need to txdr these fields,
983 		 * but it may make the values more human readable,
984 		 * for debugging purposes.
985 		 */
986 		*tl++ = txdr_unsigned(boottime.tv_sec);
987 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
988 	} else {
989 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
990 		nfsm_srvfillattr(&va, fp);
991 	}
992 	nfsm_srvdone;
993 }
994 
995 /*
996  * XXX elad: the original NFSW_SAMECRED() macro also made sure the
997  *	     two nd_flag fields of the descriptors contained
998  *	     ND_KERBAUTH.
999  */
1000 static int
1001 nfsrv_samecred(kauth_cred_t cred1, kauth_cred_t cred2)
1002 {
1003 	int i, do_ngroups;
1004 
1005 	if (kauth_cred_geteuid(cred1) != kauth_cred_geteuid(cred2))
1006 		return (0);
1007 	if (kauth_cred_ngroups(cred1) != kauth_cred_ngroups(cred2))
1008 		return (0);
1009 	do_ngroups = kauth_cred_ngroups(cred1);
1010 	for (i = 0; i < do_ngroups; i++)
1011 		if (kauth_cred_group(cred1, i) !=
1012 		    kauth_cred_group(cred2, i))
1013 			return (0);
1014 
1015 	return (1);
1016 }
1017 
1018 static struct nfsrvw_delayhash *
1019 nfsrv_nwdelayhash(struct nfssvc_sock *slp, const nfsrvfh_t *nsfh)
1020 {
1021 	uint32_t hash;
1022 
1023 	hash = hash32_buf(NFSRVFH_DATA(nsfh), NFSRVFH_SIZE(nsfh),
1024 	    HASH32_BUF_INIT);
1025 	return &slp->ns_wdelayhashtbl[hash % NFS_WDELAYHASHSIZ];
1026 }
1027 
1028 /*
1029  * NFS write service with write gathering support. Called when
1030  * nfsrvw_procrastinate > 0.
1031  * See: Chet Juszczak, "Improving the Write Performance of an NFS Server",
1032  * in Proc. of the Winter 1994 Usenix Conference, pg. 247-259, San Franscisco,
1033  * Jan. 1994.
1034  */
1035 int
1036 nfsrv_writegather(struct nfsrv_descript **ndp, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1037 {
1038 	struct timeval now;
1039 	struct iovec *ivp;
1040 	struct mbuf *mp;
1041 	struct nfsrv_descript *wp, *nfsd, *owp, *swp;
1042 	struct nfs_fattr *fp;
1043 	int i = 0;
1044 	struct iovec *iov;
1045 	struct nfsrvw_delayhash *wpp;
1046 	kauth_cred_t cred;
1047 	struct vattr va, forat;
1048 	u_int32_t *tl;
1049 	int32_t t1;
1050 	char *bpos, *dpos;
1051 	int error = 0, rdonly, cache = 0, len = 0, forat_ret = 1;
1052 	int ioflags, aftat_ret = 1, adjust, v3, zeroing;
1053 	char *cp2;
1054 	struct mbuf *mb, *mreq, *mrep, *md;
1055 	struct vnode *vp;
1056 	struct uio io, *uiop = &io;
1057 	u_quad_t frev, cur_usec;
1058 
1059 	*mrq = NULL;
1060 	if (*ndp) {
1061 	    nfsd = *ndp;
1062 	    *ndp = NULL;
1063 	    mrep = nfsd->nd_mrep;
1064 	    md = nfsd->nd_md;
1065 	    dpos = nfsd->nd_dpos;
1066 	    cred = nfsd->nd_cr;
1067 	    v3 = (nfsd->nd_flag & ND_NFSV3);
1068 	    LIST_INIT(&nfsd->nd_coalesce);
1069 	    nfsd->nd_mreq = NULL;
1070 	    nfsd->nd_stable = NFSV3WRITE_FILESYNC;
1071 	    getmicrotime(&now);
1072 	    cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1073 	    nfsd->nd_time = cur_usec + nfsrvw_procrastinate;
1074 
1075 	    /*
1076 	     * Now, get the write header..
1077 	     */
1078 	    nfsm_srvmtofh(&nfsd->nd_fh);
1079 	    if (v3) {
1080 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1081 		nfsd->nd_off = fxdr_hyper(tl);
1082 		tl += 3;
1083 		nfsd->nd_stable = fxdr_unsigned(int, *tl++);
1084 	    } else {
1085 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1086 		nfsd->nd_off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1087 		tl += 2;
1088 	    }
1089 	    len = fxdr_unsigned(int32_t, *tl);
1090 	    nfsd->nd_len = len;
1091 	    nfsd->nd_eoff = nfsd->nd_off + len;
1092 
1093 	    /*
1094 	     * Trim the header out of the mbuf list and trim off any trailing
1095 	     * junk so that the mbuf list has only the write data.
1096 	     */
1097 	    zeroing = 1;
1098 	    i = 0;
1099 	    mp = mrep;
1100 	    while (mp) {
1101 		if (mp == md) {
1102 		    zeroing = 0;
1103 		    adjust = dpos - mtod(mp, char *);
1104 		    mp->m_len -= adjust;
1105 		    if (mp->m_len > 0 && adjust > 0)
1106 			NFSMADV(mp, adjust);
1107 		}
1108 		if (zeroing)
1109 		    mp->m_len = 0;
1110 		else {
1111 		    i += mp->m_len;
1112 		    if (i > len) {
1113 			mp->m_len -= (i - len);
1114 			zeroing = 1;
1115 		    }
1116 		}
1117 		mp = mp->m_next;
1118 	    }
1119 	    if (len > NFS_MAXDATA || len < 0  || i < len) {
1120 nfsmout:
1121 		m_freem(mrep);
1122 		error = EIO;
1123 		nfsm_writereply(2 * NFSX_UNSIGNED, v3);
1124 		if (v3)
1125 		    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1126 		nfsd->nd_mreq = mreq;
1127 		nfsd->nd_mrep = NULL;
1128 		nfsd->nd_time = 0;
1129 	    }
1130 
1131 	    /*
1132 	     * Add this entry to the hash and time queues.
1133 	     */
1134 	    owp = NULL;
1135 	    mutex_enter(&nfsd_lock);
1136 	    wp = LIST_FIRST(&slp->ns_tq);
1137 	    while (wp && wp->nd_time < nfsd->nd_time) {
1138 		owp = wp;
1139 		wp = LIST_NEXT(wp, nd_tq);
1140 	    }
1141 	    if (owp) {
1142 		LIST_INSERT_AFTER(owp, nfsd, nd_tq);
1143 	    } else {
1144 		LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1145 	    }
1146 	    if (nfsd->nd_mrep) {
1147 		wpp = nfsrv_nwdelayhash(slp, &nfsd->nd_fh);
1148 		owp = NULL;
1149 		wp = LIST_FIRST(wpp);
1150 		while (wp && nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1151 		    owp = wp;
1152 		    wp = LIST_NEXT(wp, nd_hash);
1153 		}
1154 		while (wp && wp->nd_off < nfsd->nd_off &&
1155 		    !nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1156 		    owp = wp;
1157 		    wp = LIST_NEXT(wp, nd_hash);
1158 		}
1159 		if (owp) {
1160 		    LIST_INSERT_AFTER(owp, nfsd, nd_hash);
1161 
1162 		    /*
1163 		     * Search the hash list for overlapping entries and
1164 		     * coalesce.
1165 		     */
1166 		    for(; nfsd && NFSW_CONTIG(owp, nfsd); nfsd = wp) {
1167 			wp = LIST_NEXT(nfsd, nd_hash);
1168 			if (nfsrv_samecred(owp->nd_cr, nfsd->nd_cr))
1169 			    nfsrvw_coalesce(owp, nfsd);
1170 		    }
1171 		} else {
1172 		    LIST_INSERT_HEAD(wpp, nfsd, nd_hash);
1173 		}
1174 	    }
1175 	    mutex_exit(&nfsd_lock);
1176 	}
1177 
1178 	/*
1179 	 * Now, do VOP_WRITE()s for any one(s) that need to be done now
1180 	 * and generate the associated reply mbuf list(s).
1181 	 */
1182 loop1:
1183 	getmicrotime(&now);
1184 	cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1185 	mutex_enter(&nfsd_lock);
1186 	for (nfsd = LIST_FIRST(&slp->ns_tq); nfsd; nfsd = owp) {
1187 		owp = LIST_NEXT(nfsd, nd_tq);
1188 		if (nfsd->nd_time > cur_usec)
1189 		    break;
1190 		if (nfsd->nd_mreq)
1191 		    continue;
1192 		LIST_REMOVE(nfsd, nd_tq);
1193 		LIST_REMOVE(nfsd, nd_hash);
1194 		mutex_exit(&nfsd_lock);
1195 
1196 		mrep = nfsd->nd_mrep;
1197 		nfsd->nd_mrep = NULL;
1198 		cred = nfsd->nd_cr;
1199 		v3 = (nfsd->nd_flag & ND_NFSV3);
1200 		forat_ret = aftat_ret = 1;
1201 		error = nfsrv_fhtovp(&nfsd->nd_fh, 1, &vp, cred, slp,
1202 		    nfsd->nd_nam, &rdonly, (nfsd->nd_flag & ND_KERBAUTH),
1203 		    false);
1204 		if (!error) {
1205 		    if (v3)
1206 			forat_ret = VOP_GETATTR(vp, &forat, cred);
1207 		    if (vp->v_type != VREG) {
1208 			if (v3)
1209 			    error = EINVAL;
1210 			else
1211 			    error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1212 		    }
1213 		} else
1214 		    vp = NULL;
1215 		if (!error) {
1216 		    nqsrv_getl(vp, ND_WRITE);
1217 		    error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
1218 		}
1219 
1220 		if (nfsd->nd_stable == NFSV3WRITE_UNSTABLE)
1221 		    ioflags = IO_NODELOCKED;
1222 		else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC)
1223 		    ioflags = (IO_SYNC | IO_NODELOCKED);
1224 		else
1225 		    ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1226 		uiop->uio_rw = UIO_WRITE;
1227 		uiop->uio_offset = nfsd->nd_off;
1228 		uiop->uio_resid = nfsd->nd_eoff - nfsd->nd_off;
1229 		UIO_SETUP_SYSSPACE(uiop);
1230 		if (uiop->uio_resid > 0) {
1231 		    mp = mrep;
1232 		    i = 0;
1233 		    while (mp) {
1234 			if (mp->m_len > 0)
1235 			    i++;
1236 			mp = mp->m_next;
1237 		    }
1238 		    uiop->uio_iovcnt = i;
1239 		    iov = malloc(i * sizeof (struct iovec), M_TEMP, M_WAITOK);
1240 		    uiop->uio_iov = ivp = iov;
1241 		    mp = mrep;
1242 		    while (mp) {
1243 			if (mp->m_len > 0) {
1244 			    ivp->iov_base = mtod(mp, void *);
1245 			    ivp->iov_len = mp->m_len;
1246 			    ivp++;
1247 			}
1248 			mp = mp->m_next;
1249 		    }
1250 		    if (!error) {
1251 			error = VOP_WRITE(vp, uiop, ioflags, cred);
1252 			nfsstats.srvvop_writes++;
1253 		    }
1254 		    free((void *)iov, M_TEMP);
1255 		}
1256 		m_freem(mrep);
1257 		if (vp) {
1258 		    aftat_ret = VOP_GETATTR(vp, &va, cred);
1259 		    vput(vp);
1260 		}
1261 
1262 		/*
1263 		 * Loop around generating replies for all write rpcs that have
1264 		 * now been completed.
1265 		 */
1266 		swp = nfsd;
1267 		do {
1268 		    if (error) {
1269 			nfsm_writereply(NFSX_WCCDATA(v3), v3);
1270 			if (v3) {
1271 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1272 			}
1273 		    } else {
1274 			nfsm_writereply(NFSX_PREOPATTR(v3) +
1275 			    NFSX_POSTOPORFATTR(v3) + 2 * NFSX_UNSIGNED +
1276 			    NFSX_WRITEVERF(v3), v3);
1277 			if (v3) {
1278 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1279 			    nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1280 			    *tl++ = txdr_unsigned(nfsd->nd_len);
1281 			    *tl++ = txdr_unsigned(swp->nd_stable);
1282 			    /*
1283 			     * Actually, there is no need to txdr these fields,
1284 			     * but it may make the values more human readable,
1285 			     * for debugging purposes.
1286 			     */
1287 			    *tl++ = txdr_unsigned(boottime.tv_sec);
1288 			    *tl = txdr_unsigned(boottime.tv_nsec / 1000);
1289 			} else {
1290 			    nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1291 			    nfsm_srvfillattr(&va, fp);
1292 			}
1293 		    }
1294 		    nfsd->nd_mreq = mreq;
1295 		    if (nfsd->nd_mrep)
1296 			panic("nfsrv_write: nd_mrep not free");
1297 
1298 		    /*
1299 		     * Done. Put it at the head of the timer queue so that
1300 		     * the final phase can return the reply.
1301 		     */
1302 		    mutex_enter(&nfsd_lock);
1303 		    if (nfsd != swp) {
1304 			nfsd->nd_time = 0;
1305 			LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1306 		    }
1307 		    nfsd = LIST_FIRST(&swp->nd_coalesce);
1308 		    if (nfsd) {
1309 			LIST_REMOVE(nfsd, nd_tq);
1310 		    }
1311 		    mutex_exit(&nfsd_lock);
1312 		} while (nfsd);
1313 		swp->nd_time = 0;
1314 
1315 		mutex_enter(&nfsd_lock);
1316 		LIST_INSERT_HEAD(&slp->ns_tq, swp, nd_tq);
1317 		mutex_exit(&nfsd_lock);
1318 		goto loop1;
1319 	}
1320 	mutex_exit(&nfsd_lock);
1321 	nfs_timer_start();
1322 
1323 	/*
1324 	 * Search for a reply to return.
1325 	 */
1326 	mutex_enter(&nfsd_lock);
1327 	LIST_FOREACH(nfsd, &slp->ns_tq, nd_tq) {
1328 		if (nfsd->nd_mreq) {
1329 		    LIST_REMOVE(nfsd, nd_tq);
1330 		    *mrq = nfsd->nd_mreq;
1331 		    *ndp = nfsd;
1332 		    break;
1333 		}
1334 	}
1335 	mutex_exit(&nfsd_lock);
1336 	return (0);
1337 }
1338 
1339 /*
1340  * Coalesce the write request nfsd into owp. To do this we must:
1341  * - remove nfsd from the queues
1342  * - merge nfsd->nd_mrep into owp->nd_mrep
1343  * - update the nd_eoff and nd_stable for owp
1344  * - put nfsd on owp's nd_coalesce list
1345  * NB: Must be called at splsoftclock().
1346  */
1347 void
1348 nfsrvw_coalesce(struct nfsrv_descript *owp, struct nfsrv_descript *nfsd)
1349 {
1350         int overlap;
1351         struct mbuf *mp;
1352 	struct nfsrv_descript *m;
1353 
1354 	KASSERT(mutex_owned(&nfsd_lock));
1355 
1356         LIST_REMOVE(nfsd, nd_hash);
1357         LIST_REMOVE(nfsd, nd_tq);
1358         if (owp->nd_eoff < nfsd->nd_eoff) {
1359             overlap = owp->nd_eoff - nfsd->nd_off;
1360             if (overlap < 0)
1361                 panic("nfsrv_coalesce: bad off");
1362             if (overlap > 0)
1363                 m_adj(nfsd->nd_mrep, overlap);
1364             mp = owp->nd_mrep;
1365             while (mp->m_next)
1366                 mp = mp->m_next;
1367             mp->m_next = nfsd->nd_mrep;
1368             owp->nd_eoff = nfsd->nd_eoff;
1369         } else
1370             m_freem(nfsd->nd_mrep);
1371         nfsd->nd_mrep = NULL;
1372         if (nfsd->nd_stable == NFSV3WRITE_FILESYNC)
1373             owp->nd_stable = NFSV3WRITE_FILESYNC;
1374         else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC &&
1375             owp->nd_stable == NFSV3WRITE_UNSTABLE)
1376             owp->nd_stable = NFSV3WRITE_DATASYNC;
1377         LIST_INSERT_HEAD(&owp->nd_coalesce, nfsd, nd_tq);
1378  	/*
1379  	 * nfsd might hold coalesce elements! Move them to owp.
1380  	 * Otherwise, requests may be lost and clients will be stuck.
1381  	 */
1382 	while ((m = LIST_FIRST(&nfsd->nd_coalesce)) != NULL) {
1383 		LIST_REMOVE(m, nd_tq);
1384 		LIST_INSERT_HEAD(&owp->nd_coalesce, m, nd_tq);
1385 	}
1386 }
1387 
1388 /*
1389  * nfs create service
1390  * now does a truncate to 0 length via. setattr if it already exists
1391  */
1392 int
1393 nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1394 {
1395 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1396 	struct mbuf *nam = nfsd->nd_nam;
1397 	char *dpos = nfsd->nd_dpos;
1398 	kauth_cred_t cred = nfsd->nd_cr;
1399 	struct nfs_fattr *fp;
1400 	struct vattr va, dirfor, diraft;
1401 	struct nfsv2_sattr *sp;
1402 	u_int32_t *tl;
1403 	struct nameidata nd;
1404 	char *cp;
1405 	int32_t t1;
1406 	char *bpos;
1407 	int error = 0, cache = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
1408 	int rdev = 0, abort = 0;
1409 	int v3 = (nfsd->nd_flag & ND_NFSV3), how, exclusive_flag = 0;
1410 	char *cp2;
1411 	struct mbuf *mb, *mreq;
1412 	struct vnode *vp = NULL, *dirp = NULL;
1413 	nfsrvfh_t nsfh;
1414 	u_quad_t frev, tempsize;
1415 	u_char cverf[NFSX_V3CREATEVERF];
1416 
1417 	nd.ni_cnd.cn_nameiop = 0;
1418 	nfsm_srvmtofh(&nsfh);
1419 	nfsm_srvnamesiz(len);
1420 	nd.ni_cnd.cn_cred = cred;
1421 	nd.ni_cnd.cn_nameiop = CREATE;
1422 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1423 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1424 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1425 	if (dirp && v3) {
1426 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1427 	}
1428 	if (error) {
1429 		nfsm_reply(NFSX_WCCDATA(v3));
1430 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1431 		if (dirp)
1432 			vrele(dirp);
1433 		if (nd.ni_pathbuf != NULL) {
1434 			pathbuf_destroy(nd.ni_pathbuf);
1435 			nd.ni_pathbuf = NULL;
1436 		}
1437 		return (0);
1438 	}
1439 	abort = 1;
1440 	vattr_null(&va);
1441 	if (v3) {
1442 		va.va_mode = 0;
1443 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1444 		how = fxdr_unsigned(int, *tl);
1445 		switch (how) {
1446 		case NFSV3CREATE_GUARDED:
1447 			if (nd.ni_vp) {
1448 				error = EEXIST;
1449 				break;
1450 			}
1451 		case NFSV3CREATE_UNCHECKED:
1452 			nfsm_srvsattr(&va);
1453 			break;
1454 		case NFSV3CREATE_EXCLUSIVE:
1455 			nfsm_dissect(cp, void *, NFSX_V3CREATEVERF);
1456 			memcpy(cverf, cp, NFSX_V3CREATEVERF);
1457 			exclusive_flag = 1;
1458 			break;
1459 		};
1460 		va.va_type = VREG;
1461 	} else {
1462 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1463 		va.va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1464 		if (va.va_type == VNON)
1465 			va.va_type = VREG;
1466 		va.va_mode = nfstov_mode(sp->sa_mode);
1467 		switch (va.va_type) {
1468 		case VREG:
1469 			tsize = fxdr_unsigned(int32_t, sp->sa_size);
1470 			if (tsize != -1)
1471 				va.va_size = (u_quad_t)tsize;
1472 			break;
1473 		case VCHR:
1474 		case VBLK:
1475 		case VFIFO:
1476 			rdev = fxdr_unsigned(int32_t, sp->sa_size);
1477 			break;
1478 		default:
1479 			break;
1480 		};
1481 	}
1482 
1483 	/*
1484 	 * Iff doesn't exist, create it
1485 	 * otherwise just truncate to 0 length
1486 	 *   should I set the mode too ??
1487 	 */
1488 	if (nd.ni_vp == NULL) {
1489 		if (va.va_type == VREG || va.va_type == VSOCK) {
1490 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1491 			error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1492 			if (!error) {
1493 				if (exclusive_flag) {
1494 					exclusive_flag = 0;
1495 					vattr_null(&va);
1496 					/*
1497 					 * XXX
1498 					 * assuming NFSX_V3CREATEVERF
1499 					 * == sizeof(nfstime3)
1500 					 */
1501 					fxdr_nfsv3time(cverf, &va.va_atime);
1502 					error = VOP_SETATTR(nd.ni_vp, &va,
1503 						cred);
1504 				}
1505 			}
1506 		} else if (va.va_type == VCHR || va.va_type == VBLK ||
1507 			va.va_type == VFIFO) {
1508 			if (va.va_type == VCHR && rdev == 0xffffffff)
1509 				va.va_type = VFIFO;
1510 			if (va.va_type != VFIFO &&
1511 			    (error = kauth_authorize_system(cred,
1512 			    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1513 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1514 				vput(nd.ni_dvp);
1515 				abort = 0;
1516 				nfsm_reply(0);
1517 				if (nd.ni_pathbuf != NULL) {
1518 					pathbuf_destroy(nd.ni_pathbuf);
1519 					nd.ni_pathbuf = NULL;
1520 				}
1521 				return (error);
1522 			} else
1523 				va.va_rdev = (dev_t)rdev;
1524 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1525 			error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd,
1526 			    &va);
1527 			if (error) {
1528 				nfsm_reply(0);
1529 			}
1530 			if (nd.ni_cnd.cn_flags & ISSYMLINK) {
1531 				vput(nd.ni_vp);
1532 				vrele(nd.ni_dvp);
1533 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1534 				if (nd.ni_pathbuf != NULL) {
1535 					pathbuf_destroy(nd.ni_pathbuf);
1536 					nd.ni_pathbuf = NULL;
1537 				}
1538 				error = EINVAL;
1539 				abort = 0;
1540 				nfsm_reply(0);
1541 			}
1542 		} else {
1543 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1544 			if (nd.ni_pathbuf != NULL) {
1545 				pathbuf_destroy(nd.ni_pathbuf);
1546 				nd.ni_pathbuf = NULL;
1547 			}
1548 			vput(nd.ni_dvp);
1549 			error = ENXIO;
1550 			abort = 0;
1551 		}
1552 		vp = nd.ni_vp;
1553 	} else {
1554 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1555 		if (nd.ni_pathbuf != NULL) {
1556 			pathbuf_destroy(nd.ni_pathbuf);
1557 			nd.ni_pathbuf = NULL;
1558 		}
1559 		vp = nd.ni_vp;
1560 		if (nd.ni_dvp == vp)
1561 			vrele(nd.ni_dvp);
1562 		else
1563 			vput(nd.ni_dvp);
1564 		abort = 0;
1565 		if (!error && va.va_size != -1) {
1566 			error = nfsrv_access(vp, VWRITE, cred,
1567 			    (nd.ni_cnd.cn_flags & RDONLY), lwp, 0);
1568 			if (!error) {
1569 				nqsrv_getl(vp, ND_WRITE);
1570 				tempsize = va.va_size;
1571 				vattr_null(&va);
1572 				va.va_size = tempsize;
1573 				error = VOP_SETATTR(vp, &va, cred);
1574 			}
1575 		}
1576 		if (error)
1577 			vput(vp);
1578 	}
1579 	if (!error) {
1580 		error = nfsrv_composefh(vp, &nsfh, v3);
1581 		if (!error)
1582 			error = VOP_GETATTR(vp, &va, cred);
1583 		vput(vp);
1584 	}
1585 	if (v3) {
1586 		if (exclusive_flag && !error) {
1587 			/*
1588 			 * XXX assuming NFSX_V3CREATEVERF == sizeof(nfstime3)
1589 			 */
1590 			char oldverf[NFSX_V3CREATEVERF];
1591 
1592 			txdr_nfsv3time(&va.va_atime, oldverf);
1593 			if (memcmp(cverf, oldverf, NFSX_V3CREATEVERF))
1594 				error = EEXIST;
1595 		}
1596 		if (dirp) {
1597 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1598 		}
1599 	}
1600 	if (dirp) {
1601 		vrele(dirp);
1602 		dirp = NULL;
1603 	}
1604 	if (nd.ni_pathbuf != NULL) {
1605 		pathbuf_destroy(nd.ni_pathbuf);
1606 		nd.ni_pathbuf = NULL;
1607 	}
1608 	abort = 0;
1609 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_FATTR(v3) + NFSX_WCCDATA(v3));
1610 	if (v3) {
1611 		if (!error) {
1612 			nfsm_srvpostop_fh(&nsfh);
1613 			nfsm_srvpostop_attr(0, &va);
1614 		}
1615 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1616 	} else {
1617 		nfsm_srvfhtom(&nsfh, v3);
1618 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1619 		nfsm_srvfillattr(&va, fp);
1620 	}
1621 	return (0);
1622 nfsmout:
1623 	if (dirp)
1624 		vrele(dirp);
1625 	if (abort) {
1626 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1627 		if (nd.ni_dvp == nd.ni_vp)
1628 			vrele(nd.ni_dvp);
1629 		else
1630 			vput(nd.ni_dvp);
1631 		if (nd.ni_vp)
1632 			vput(nd.ni_vp);
1633 	}
1634 	if (nd.ni_pathbuf != NULL) {
1635 		pathbuf_destroy(nd.ni_pathbuf);
1636 		nd.ni_pathbuf = NULL;
1637 	}
1638 	return (error);
1639 }
1640 
1641 /*
1642  * nfs v3 mknod service
1643  */
1644 int
1645 nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1646 {
1647 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1648 	struct mbuf *nam = nfsd->nd_nam;
1649 	char *dpos = nfsd->nd_dpos;
1650 	kauth_cred_t cred = nfsd->nd_cr;
1651 	struct vattr va, dirfor, diraft;
1652 	u_int32_t *tl;
1653 	struct nameidata nd;
1654 	int32_t t1;
1655 	char *bpos;
1656 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1657 	int abort = 0;
1658 	u_int32_t major, minor;
1659 	enum vtype vtyp;
1660 	char *cp2;
1661 	struct mbuf *mb, *mreq;
1662 	struct vnode *vp, *dirp = (struct vnode *)0;
1663 	nfsrvfh_t nsfh;
1664 	u_quad_t frev;
1665 
1666 	nd.ni_cnd.cn_nameiop = 0;
1667 	nfsm_srvmtofh(&nsfh);
1668 	nfsm_srvnamesiz(len);
1669 	nd.ni_cnd.cn_cred = cred;
1670 	nd.ni_cnd.cn_nameiop = CREATE;
1671 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1672 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1673 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1674 	if (dirp)
1675 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1676 	if (error) {
1677 		nfsm_reply(NFSX_WCCDATA(1));
1678 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1679 		if (dirp)
1680 			vrele(dirp);
1681 		if (nd.ni_pathbuf != NULL) {
1682 			pathbuf_destroy(nd.ni_pathbuf);
1683 			nd.ni_pathbuf = NULL;
1684 		}
1685 		return (0);
1686 	}
1687 	abort = 1;
1688 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1689 	vtyp = nfsv3tov_type(*tl);
1690 	if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1691 		error = NFSERR_BADTYPE;
1692 		goto abort;
1693 	}
1694 	vattr_null(&va);
1695 	va.va_mode = 0;
1696 	nfsm_srvsattr(&va);
1697 	if (vtyp == VCHR || vtyp == VBLK) {
1698 		dev_t rdev;
1699 
1700 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1701 		major = fxdr_unsigned(u_int32_t, *tl++);
1702 		minor = fxdr_unsigned(u_int32_t, *tl);
1703 		rdev = makedev(major, minor);
1704 		if (major(rdev) != major || minor(rdev) != minor) {
1705 			error = EINVAL;
1706 			goto abort;
1707 		}
1708 		va.va_rdev = rdev;
1709 	}
1710 
1711 	/*
1712 	 * Iff doesn't exist, create it.
1713 	 */
1714 	if (nd.ni_vp) {
1715 		error = EEXIST;
1716 abort:
1717 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1718 		if (nd.ni_dvp == nd.ni_vp)
1719 			vrele(nd.ni_dvp);
1720 		else
1721 			vput(nd.ni_dvp);
1722 		if (nd.ni_vp)
1723 			vput(nd.ni_vp);
1724 		if (nd.ni_pathbuf != NULL) {
1725 			pathbuf_destroy(nd.ni_pathbuf);
1726 			nd.ni_pathbuf = NULL;
1727 		}
1728 		goto out;
1729 	}
1730 	va.va_type = vtyp;
1731 	if (vtyp == VSOCK) {
1732 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1733 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1734 	} else {
1735 		if (va.va_type != VFIFO &&
1736 		    (error = kauth_authorize_system(cred,
1737 		    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1738 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1739 			vput(nd.ni_dvp);
1740 			goto out;
1741 		}
1742 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1743 		error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1744 		if (error)
1745 			goto out;
1746 		if (nd.ni_cnd.cn_flags & ISSYMLINK) {
1747 			vput(nd.ni_vp);
1748 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1749 			error = EINVAL;
1750 		}
1751 	}
1752 out:
1753 	vp = nd.ni_vp;
1754 	if (!error) {
1755 		error = nfsrv_composefh(vp, &nsfh, true);
1756 		if (!error)
1757 			error = VOP_GETATTR(vp, &va, cred);
1758 		vput(vp);
1759 	}
1760 	if (dirp) {
1761 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1762 		vrele(dirp);
1763 		dirp = NULL;
1764 	}
1765 	if (nd.ni_pathbuf != NULL) {
1766 		pathbuf_destroy(nd.ni_pathbuf);
1767 		nd.ni_pathbuf = NULL;
1768 	}
1769 	abort = 0;
1770 	nfsm_reply(NFSX_SRVFH(&nsfh, true) + NFSX_POSTOPATTR(1) +
1771 	    NFSX_WCCDATA(1));
1772 	if (!error) {
1773 		nfsm_srvpostop_fh(&nsfh);
1774 		nfsm_srvpostop_attr(0, &va);
1775 	}
1776 	nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1777 	return (0);
1778 nfsmout:
1779 	if (abort) {
1780 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1781 		if (nd.ni_dvp == nd.ni_vp)
1782 			vrele(nd.ni_dvp);
1783 		else
1784 			vput(nd.ni_dvp);
1785 		if (nd.ni_vp)
1786 			vput(nd.ni_vp);
1787 	}
1788 	if (nd.ni_pathbuf != NULL) {
1789 		pathbuf_destroy(nd.ni_pathbuf);
1790 		nd.ni_pathbuf = NULL;
1791 	}
1792 	if (dirp)
1793 		vrele(dirp);
1794 	return (error);
1795 }
1796 
1797 /*
1798  * nfs remove service
1799  */
1800 int
1801 nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1802 {
1803 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1804 	struct mbuf *nam = nfsd->nd_nam;
1805 	char *dpos = nfsd->nd_dpos;
1806 	kauth_cred_t cred = nfsd->nd_cr;
1807 	struct nameidata nd;
1808 	u_int32_t *tl;
1809 	int32_t t1;
1810 	char *bpos;
1811 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1812 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1813 	char *cp2;
1814 	struct mbuf *mb, *mreq;
1815 	struct vnode *vp, *dirp;
1816 	struct vattr dirfor, diraft;
1817 	nfsrvfh_t nsfh;
1818 	u_quad_t frev;
1819 
1820 #ifndef nolint
1821 	vp = (struct vnode *)0;
1822 #endif
1823 	nfsm_srvmtofh(&nsfh);
1824 	nfsm_srvnamesiz(len);
1825 	nd.ni_cnd.cn_cred = cred;
1826 	nd.ni_cnd.cn_nameiop = DELETE;
1827 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1828 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1829 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1830 	if (dirp && v3) {
1831 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1832 	}
1833 	if (!error) {
1834 		vp = nd.ni_vp;
1835 		if (vp->v_type == VDIR) {
1836 			error = EPERM;
1837 			goto out;
1838 		}
1839 		/*
1840 		 * The root of a mounted filesystem cannot be deleted.
1841 		 */
1842 		if (vp->v_vflag & VV_ROOT) {
1843 			error = EBUSY;
1844 		}
1845 out:
1846 		if (!error) {
1847 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1848 			nqsrv_getl(vp, ND_WRITE);
1849 			error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1850 		} else {
1851 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1852 			if (nd.ni_dvp == vp)
1853 				vrele(nd.ni_dvp);
1854 			else
1855 				vput(nd.ni_dvp);
1856 			vput(vp);
1857 		}
1858 	}
1859 	if (nd.ni_pathbuf != NULL) {
1860 		pathbuf_destroy(nd.ni_pathbuf);
1861 		nd.ni_pathbuf = NULL;
1862 	}
1863 	if (dirp) {
1864 		if (v3) {
1865 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1866 		}
1867 		vrele(dirp);
1868 	}
1869 	nfsm_reply(NFSX_WCCDATA(v3));
1870 	if (v3) {
1871 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1872 		return (0);
1873 	}
1874 	nfsm_srvdone;
1875 }
1876 
1877 /*
1878  * nfs rename service
1879  */
1880 int
1881 nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1882 {
1883 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1884 	struct mbuf *nam = nfsd->nd_nam;
1885 	char *dpos = nfsd->nd_dpos;
1886 	kauth_cred_t cred = nfsd->nd_cr;
1887 	u_int32_t *tl;
1888 	int32_t t1;
1889 	char *bpos;
1890 	int error = 0, cache = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1891 	uint32_t len, len2;
1892 	int tdirfor_ret = 1, tdiraft_ret = 1;
1893 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1894 	char *cp2;
1895 	struct mbuf *mb, *mreq;
1896 	struct nameidata fromnd, tond;
1897 	struct vnode *fvp, *tvp, *tdvp;
1898 	struct vnode *fdirp = NULL, *tdirp = NULL;
1899 	struct mount *localfs = NULL;
1900 	struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
1901 	nfsrvfh_t fnsfh, tnsfh;
1902 	u_quad_t frev;
1903 	uid_t saved_uid;
1904 	uint32_t saveflag;
1905 
1906 #ifndef nolint
1907 	fvp = (struct vnode *)0;
1908 #endif
1909 	fromnd.ni_cnd.cn_nameiop = 0;
1910 	tond.ni_cnd.cn_nameiop = 0;
1911 	nfsm_srvmtofh(&fnsfh);
1912 	nfsm_srvnamesiz(len);
1913 	/*
1914 	 * Remember our original uid so that we can reset cr_uid before
1915 	 * the second nfs_namei() call, in case it is remapped.
1916 	 */
1917 	saved_uid = kauth_cred_geteuid(cred);
1918 	fromnd.ni_cnd.cn_cred = cred;
1919 	fromnd.ni_cnd.cn_nameiop = DELETE;
1920 	fromnd.ni_cnd.cn_flags = LOCKPARENT | SAVESTART | INRENAME;
1921 	error = nfs_namei(&fromnd, &fnsfh, len, slp, nam, &md,
1922 		&dpos, &fdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1923 	if (fdirp && v3) {
1924 		fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor, cred);
1925 	}
1926 	if (error) {
1927 		nfsm_reply(2 * NFSX_WCCDATA(v3));
1928 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1929 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1930 		if (fdirp)
1931 			vrele(fdirp);
1932 		pathbuf_destroy(fromnd.ni_pathbuf);
1933 		return (0);
1934 	}
1935 	if (fromnd.ni_dvp != fromnd.ni_vp) {
1936 		VOP_UNLOCK(fromnd.ni_dvp);
1937 	}
1938 	fvp = fromnd.ni_vp;
1939 
1940 	localfs = fvp->v_mount;
1941 	error = VFS_RENAMELOCK_ENTER(localfs);
1942 	if (error) {
1943 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1944 		vrele(fromnd.ni_dvp);
1945 		vrele(fvp);
1946 		goto out1;
1947 	}
1948 
1949 	/* Copied, regrettably, from vfs_syscalls.c (q.v.) */
1950 	vrele(fvp);
1951 	if ((fromnd.ni_cnd.cn_namelen == 1 &&
1952 	     fromnd.ni_cnd.cn_nameptr[0] == '.') ||
1953 	    (fromnd.ni_cnd.cn_namelen == 2 &&
1954 	     fromnd.ni_cnd.cn_nameptr[0] == '.' &&
1955 	     fromnd.ni_cnd.cn_nameptr[1] == '.')) {
1956 		error = EINVAL;
1957 		VFS_RENAMELOCK_EXIT(localfs);
1958 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1959 		vrele(fromnd.ni_dvp);
1960 		goto out1;
1961 	}
1962 	saveflag = fromnd.ni_cnd.cn_flags & SAVESTART;
1963 	fromnd.ni_cnd.cn_flags &= ~SAVESTART;
1964 	vn_lock(fromnd.ni_dvp, LK_EXCLUSIVE | LK_RETRY);
1965 	error = relookup(fromnd.ni_dvp, &fromnd.ni_vp, &fromnd.ni_cnd);
1966 	fromnd.ni_cnd.cn_flags |= saveflag;
1967 	if (error) {
1968 		VOP_UNLOCK(fromnd.ni_dvp);
1969 		VFS_RENAMELOCK_EXIT(localfs);
1970 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1971 		vrele(fromnd.ni_dvp);
1972 		goto out1;
1973 	}
1974 	VOP_UNLOCK(fromnd.ni_vp);
1975 	if (fromnd.ni_dvp != fromnd.ni_vp)
1976 		VOP_UNLOCK(fromnd.ni_dvp);
1977 	fvp = fromnd.ni_vp;
1978 
1979 	nfsm_srvmtofh(&tnsfh);
1980 	if (v3) {
1981 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
1982 		len2 = fxdr_unsigned(uint32_t, *tl);
1983 		/* len2 will be checked by nfs_namei */
1984 	}
1985 	else {
1986 		/* NFSv2 */
1987 		nfsm_strsiz(len2, NFS_MAXNAMLEN);
1988 	}
1989 	kauth_cred_seteuid(cred, saved_uid);
1990 	tond.ni_cnd.cn_cred = cred;
1991 	tond.ni_cnd.cn_nameiop = RENAME;
1992 	tond.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | NOCACHE |
1993 	    SAVESTART | INRENAME;
1994 	error = nfs_namei(&tond, &tnsfh, len2, slp, nam, &md,
1995 		&dpos, &tdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1996 	if (tdirp && v3) {
1997 		tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor, cred);
1998 	}
1999 	if (error) {
2000 		VFS_RENAMELOCK_EXIT(localfs);
2001 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2002 		vrele(fromnd.ni_dvp);
2003 		vrele(fvp);
2004 		goto out1;
2005 	}
2006 	tdvp = tond.ni_dvp;
2007 	tvp = tond.ni_vp;
2008 	if (tvp != NULL) {
2009 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
2010 			if (v3)
2011 				error = EEXIST;
2012 			else
2013 				error = EISDIR;
2014 			goto out;
2015 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
2016 			if (v3)
2017 				error = EEXIST;
2018 			else
2019 				error = ENOTDIR;
2020 			goto out;
2021 		}
2022 		if (tvp->v_type == VDIR && tvp->v_mountedhere) {
2023 			if (v3)
2024 				error = EXDEV;
2025 			else
2026 				error = ENOTEMPTY;
2027 			goto out;
2028 		}
2029 	}
2030 	if (fvp->v_type == VDIR && fvp->v_mountedhere) {
2031 		if (v3)
2032 			error = EXDEV;
2033 		else
2034 			error = ENOTEMPTY;
2035 		goto out;
2036 	}
2037 	if (fvp->v_mount != tdvp->v_mount) {
2038 		if (v3)
2039 			error = EXDEV;
2040 		else
2041 			error = ENOTEMPTY;
2042 		goto out;
2043 	}
2044 	if (fvp == tdvp) {
2045 		if (v3)
2046 			error = EINVAL;
2047 		else
2048 			error = ENOTEMPTY;
2049 	}
2050 	/*
2051 	 * If source is the same as the destination (that is the
2052 	 * same vnode with the same name in the same directory),
2053 	 * then there is nothing to do.
2054 	 */
2055 	if (fvp == tvp && fromnd.ni_dvp == tdvp &&
2056 	    fromnd.ni_cnd.cn_namelen == tond.ni_cnd.cn_namelen &&
2057 	    !memcmp(fromnd.ni_cnd.cn_nameptr, tond.ni_cnd.cn_nameptr,
2058 	      fromnd.ni_cnd.cn_namelen))
2059 		error = -1;
2060 out:
2061 	if (!error) {
2062 		nqsrv_getl(fromnd.ni_dvp, ND_WRITE);
2063 		nqsrv_getl(tdvp, ND_WRITE);
2064 		if (tvp) {
2065 			nqsrv_getl(tvp, ND_WRITE);
2066 		}
2067 		error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
2068 				   tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
2069 		VFS_RENAMELOCK_EXIT(localfs);
2070 	} else {
2071 		VOP_ABORTOP(tond.ni_dvp, &tond.ni_cnd);
2072 		if (tdvp == tvp)
2073 			vrele(tdvp);
2074 		else
2075 			vput(tdvp);
2076 		if (tvp)
2077 			vput(tvp);
2078 		VFS_RENAMELOCK_EXIT(localfs);
2079 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2080 		vrele(fromnd.ni_dvp);
2081 		vrele(fvp);
2082 		if (error == -1)
2083 			error = 0;
2084 	}
2085 	vrele(tond.ni_startdir);
2086 	pathbuf_destroy(tond.ni_pathbuf);
2087 	tond.ni_cnd.cn_nameiop = 0;
2088 out1:
2089 	if (fdirp) {
2090 		if (v3) {
2091 			fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred);
2092 		}
2093 		vrele(fdirp);
2094 		fdirp = NULL;
2095 	}
2096 	if (tdirp) {
2097 		if (v3) {
2098 			tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred);
2099 		}
2100 		vrele(tdirp);
2101 		tdirp = NULL;
2102 	}
2103 	vrele(fromnd.ni_startdir);
2104 	pathbuf_destroy(fromnd.ni_pathbuf);
2105 	fromnd.ni_cnd.cn_nameiop = 0;
2106 	localfs = NULL;
2107 	nfsm_reply(2 * NFSX_WCCDATA(v3));
2108 	if (v3) {
2109 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
2110 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
2111 	}
2112 	return (0);
2113 
2114 nfsmout:
2115 	if (fdirp)
2116 		vrele(fdirp);
2117 #ifdef notdef
2118 	if (tdirp)
2119 		vrele(tdirp);
2120 #endif
2121 	if (tond.ni_cnd.cn_nameiop) {
2122 		vrele(tond.ni_startdir);
2123 		pathbuf_destroy(tond.ni_pathbuf);
2124 	}
2125 	if (localfs) {
2126 		VFS_RENAMELOCK_EXIT(localfs);
2127 	}
2128 	if (fromnd.ni_cnd.cn_nameiop) {
2129 		vrele(fromnd.ni_startdir);
2130 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2131 		pathbuf_destroy(fromnd.ni_pathbuf);
2132 		vrele(fromnd.ni_dvp);
2133 		vrele(fvp);
2134 	}
2135 	return (error);
2136 }
2137 
2138 /*
2139  * nfs link service
2140  */
2141 int
2142 nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2143 {
2144 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2145 	struct mbuf *nam = nfsd->nd_nam;
2146 	char *dpos = nfsd->nd_dpos;
2147 	kauth_cred_t cred = nfsd->nd_cr;
2148 	struct nameidata nd;
2149 	u_int32_t *tl;
2150 	int32_t t1;
2151 	char *bpos;
2152 	int error = 0, rdonly, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2153 	int getret = 1, v3 = (nfsd->nd_flag & ND_NFSV3);
2154 	char *cp2;
2155 	struct mbuf *mb, *mreq;
2156 	struct vnode *vp, *xp, *dirp = (struct vnode *)0;
2157 	struct vattr dirfor, diraft, at;
2158 	nfsrvfh_t nsfh, dnsfh;
2159 	u_quad_t frev;
2160 
2161 	nfsm_srvmtofh(&nsfh);
2162 	nfsm_srvmtofh(&dnsfh);
2163 	nfsm_srvnamesiz(len);
2164 	error = nfsrv_fhtovp(&nsfh, false, &vp, cred, slp, nam,
2165 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2166 	if (error) {
2167 		nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2168 		nfsm_srvpostop_attr(getret, &at);
2169 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2170 		return (0);
2171 	}
2172 	if (vp->v_type == VDIR) {
2173 		error = EPERM;
2174 		goto out1;
2175 	}
2176 	nd.ni_cnd.cn_cred = cred;
2177 	nd.ni_cnd.cn_nameiop = CREATE;
2178 	nd.ni_cnd.cn_flags = LOCKPARENT;
2179 	error = nfs_namei(&nd, &dnsfh, len, slp, nam, &md, &dpos,
2180 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2181 	if (dirp && v3) {
2182 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2183 	}
2184 	if (error)
2185 		goto out1;
2186 	xp = nd.ni_vp;
2187 	if (xp != NULL) {
2188 		error = EEXIST;
2189 		goto out;
2190 	}
2191 	xp = nd.ni_dvp;
2192 	if (vp->v_mount != xp->v_mount)
2193 		error = EXDEV;
2194 out:
2195 	if (!error) {
2196 		nqsrv_getl(vp, ND_WRITE);
2197 		nqsrv_getl(xp, ND_WRITE);
2198 		error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
2199 	} else {
2200 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2201 		if (nd.ni_dvp == nd.ni_vp)
2202 			vrele(nd.ni_dvp);
2203 		else
2204 			vput(nd.ni_dvp);
2205 		if (nd.ni_vp)
2206 			vrele(nd.ni_vp);
2207 	}
2208 out1:
2209 	if (v3)
2210 		getret = VOP_GETATTR(vp, &at, cred);
2211 	if (dirp) {
2212 		if (v3) {
2213 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2214 		}
2215 		vrele(dirp);
2216 	}
2217 	vrele(vp);
2218 	pathbuf_destroy(nd.ni_pathbuf);
2219 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2220 	if (v3) {
2221 		nfsm_srvpostop_attr(getret, &at);
2222 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2223 		return (0);
2224 	}
2225 	nfsm_srvdone;
2226 }
2227 
2228 /*
2229  * nfs symbolic link service
2230  */
2231 int
2232 nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2233 {
2234 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2235 	struct mbuf *nam = nfsd->nd_nam;
2236 	char *dpos = nfsd->nd_dpos;
2237 	kauth_cred_t cred = nfsd->nd_cr;
2238 	struct vattr va, dirfor, diraft;
2239 	struct nameidata nd;
2240 	u_int32_t *tl;
2241 	int32_t t1;
2242 	struct nfsv2_sattr *sp;
2243 	char *bpos, *pathcp = NULL, *cp2;
2244 	struct uio io;
2245 	struct iovec iv;
2246 	int error = 0, cache = 0, dirfor_ret = 1, diraft_ret = 1, abort = 0;
2247 	uint32_t len, len2;
2248 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2249 	struct mbuf *mb, *mreq;
2250 	struct vnode *dirp = (struct vnode *)0;
2251 	nfsrvfh_t nsfh;
2252 	u_quad_t frev;
2253 
2254 	nd.ni_cnd.cn_nameiop = 0;
2255 	nfsm_srvmtofh(&nsfh);
2256 	nfsm_srvnamesiz(len);
2257 	nd.ni_cnd.cn_cred = cred;
2258 	nd.ni_cnd.cn_nameiop = CREATE;
2259 	nd.ni_cnd.cn_flags = LOCKPARENT;
2260 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2261 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2262 	if (dirp && v3) {
2263 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2264 	}
2265 	if (error)
2266 		goto out;
2267 	abort = 1;
2268 	vattr_null(&va);
2269 	va.va_type = VLNK;
2270 	if (v3) {
2271 		va.va_mode = 0;
2272 		nfsm_srvsattr(&va);
2273 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
2274 		len2 = fxdr_unsigned(uint32_t, *tl);
2275 		if (len2 > PATH_MAX) {
2276 			/* XXX should check _PC_NO_TRUNC */
2277 			error = ENAMETOOLONG;
2278 			goto abortop;
2279 		}
2280 	}
2281 	else {
2282 		/* NFSv2 */
2283 		nfsm_strsiz(len2, NFS_MAXPATHLEN);
2284 	}
2285 	pathcp = malloc(len2 + 1, M_TEMP, M_WAITOK);
2286 	iv.iov_base = pathcp;
2287 	iv.iov_len = len2;
2288 	io.uio_resid = len2;
2289 	io.uio_offset = 0;
2290 	io.uio_iov = &iv;
2291 	io.uio_iovcnt = 1;
2292 	io.uio_rw = UIO_READ;
2293 	UIO_SETUP_SYSSPACE(&io);
2294 	nfsm_mtouio(&io, len2);
2295 	if (!v3) {
2296 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
2297 		va.va_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
2298 	}
2299 	*(pathcp + len2) = '\0';
2300 	if (nd.ni_vp) {
2301 		error = EEXIST;
2302 abortop:
2303 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2304 		if (nd.ni_dvp == nd.ni_vp)
2305 			vrele(nd.ni_dvp);
2306 		else
2307 			vput(nd.ni_dvp);
2308 		if (nd.ni_vp)
2309 			vrele(nd.ni_vp);
2310 		goto out;
2311 	}
2312 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2313 	error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va, pathcp);
2314 	if (!error) {
2315 	    if (v3) {
2316 		error = nfsrv_composefh(nd.ni_vp, &nsfh, v3);
2317 		if (!error)
2318 		    error = VOP_GETATTR(nd.ni_vp, &va, cred);
2319 		vput(nd.ni_vp);
2320 	    } else {
2321 		vput(nd.ni_vp);
2322 	    }
2323 	}
2324 out:
2325 	if (pathcp)
2326 		free(pathcp, M_TEMP);
2327 	if (dirp) {
2328 		if (v3) {
2329 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2330 		}
2331 		vrele(dirp);
2332 		dirp = NULL;
2333 	}
2334 	pathbuf_destroy(nd.ni_pathbuf);
2335 	abort = 0;
2336 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2337 	    NFSX_WCCDATA(v3));
2338 	if (v3) {
2339 		if (!error) {
2340 			nfsm_srvpostop_fh(&nsfh);
2341 			nfsm_srvpostop_attr(0, &va);
2342 		}
2343 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2344 	}
2345 	return (0);
2346 nfsmout:
2347 	if (abort) {
2348 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2349 		if (nd.ni_dvp == nd.ni_vp)
2350 			vrele(nd.ni_dvp);
2351 		else
2352 			vput(nd.ni_dvp);
2353 		if (nd.ni_vp)
2354 			vrele(nd.ni_vp);
2355 		pathbuf_destroy(nd.ni_pathbuf);
2356 	}
2357 	if (dirp)
2358 		vrele(dirp);
2359 	if (pathcp)
2360 		free(pathcp, M_TEMP);
2361 	return (error);
2362 }
2363 
2364 /*
2365  * nfs mkdir service
2366  */
2367 int
2368 nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2369 {
2370 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2371 	struct mbuf *nam = nfsd->nd_nam;
2372 	char *dpos = nfsd->nd_dpos;
2373 	kauth_cred_t cred = nfsd->nd_cr;
2374 	struct vattr va, dirfor, diraft;
2375 	struct nfs_fattr *fp;
2376 	struct nameidata nd;
2377 	char *cp;
2378 	u_int32_t *tl;
2379 	int32_t t1;
2380 	char *bpos;
2381 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2382 	int abort = 0;
2383 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2384 	char *cp2;
2385 	struct mbuf *mb, *mreq;
2386 	struct vnode *vp, *dirp = (struct vnode *)0;
2387 	nfsrvfh_t nsfh;
2388 	u_quad_t frev;
2389 
2390 	nfsm_srvmtofh(&nsfh);
2391 	nfsm_srvnamesiz(len);
2392 	nd.ni_cnd.cn_cred = cred;
2393 	nd.ni_cnd.cn_nameiop = CREATE;
2394 	nd.ni_cnd.cn_flags = LOCKPARENT;
2395 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2396 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2397 	if (dirp && v3) {
2398 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2399 	}
2400 	if (error) {
2401 		if (nd.ni_pathbuf != NULL) {
2402 			pathbuf_destroy(nd.ni_pathbuf);
2403 		}
2404 		nfsm_reply(NFSX_WCCDATA(v3));
2405 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2406 		if (dirp)
2407 			vrele(dirp);
2408 		return (0);
2409 	}
2410 	abort = 1;
2411 	vattr_null(&va);
2412 	if (v3) {
2413 		va.va_mode = 0;
2414 		nfsm_srvsattr(&va);
2415 	} else {
2416 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
2417 		va.va_mode = nfstov_mode(*tl++);
2418 	}
2419 	va.va_type = VDIR;
2420 	vp = nd.ni_vp;
2421 	if (vp != NULL) {
2422 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2423 		if (nd.ni_dvp == vp)
2424 			vrele(nd.ni_dvp);
2425 		else
2426 			vput(nd.ni_dvp);
2427 		vrele(vp);
2428 		error = EEXIST;
2429 		goto out;
2430 	}
2431 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2432 	error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
2433 	if (!error) {
2434 		vp = nd.ni_vp;
2435 		error = nfsrv_composefh(vp, &nsfh, v3);
2436 		if (!error)
2437 			error = VOP_GETATTR(vp, &va, cred);
2438 		vput(vp);
2439 	}
2440 out:
2441 	if (dirp) {
2442 		if (v3) {
2443 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2444 		}
2445 		vrele(dirp);
2446 		dirp = NULL;
2447 	}
2448 	pathbuf_destroy(nd.ni_pathbuf);
2449 	abort = 0;
2450 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2451 	    NFSX_WCCDATA(v3));
2452 	if (v3) {
2453 		if (!error) {
2454 			nfsm_srvpostop_fh(&nsfh);
2455 			nfsm_srvpostop_attr(0, &va);
2456 		}
2457 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2458 	} else {
2459 		nfsm_srvfhtom(&nsfh, v3);
2460 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
2461 		nfsm_srvfillattr(&va, fp);
2462 	}
2463 	return (0);
2464 nfsmout:
2465 	if (abort) {
2466 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2467 		if (nd.ni_dvp == nd.ni_vp)
2468 			vrele(nd.ni_dvp);
2469 		else
2470 			vput(nd.ni_dvp);
2471 		if (nd.ni_vp)
2472 			vrele(nd.ni_vp);
2473 		pathbuf_destroy(nd.ni_pathbuf);
2474 	}
2475 	if (dirp)
2476 		vrele(dirp);
2477 	return (error);
2478 }
2479 
2480 /*
2481  * nfs rmdir service
2482  */
2483 int
2484 nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2485 {
2486 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2487 	struct mbuf *nam = nfsd->nd_nam;
2488 	char *dpos = nfsd->nd_dpos;
2489 	kauth_cred_t cred = nfsd->nd_cr;
2490 	u_int32_t *tl;
2491 	int32_t t1;
2492 	char *bpos;
2493 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2494 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2495 	char *cp2;
2496 	struct mbuf *mb, *mreq;
2497 	struct vnode *vp, *dirp = (struct vnode *)0;
2498 	struct vattr dirfor, diraft;
2499 	nfsrvfh_t nsfh;
2500 	struct nameidata nd;
2501 	u_quad_t frev;
2502 
2503 	nfsm_srvmtofh(&nsfh);
2504 	nfsm_srvnamesiz(len);
2505 	nd.ni_cnd.cn_cred = cred;
2506 	nd.ni_cnd.cn_nameiop = DELETE;
2507 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
2508 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2509 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2510 	if (dirp && v3) {
2511 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2512 	}
2513 	if (error) {
2514 		if (nd.ni_pathbuf != NULL) {
2515 			pathbuf_destroy(nd.ni_pathbuf);
2516 		}
2517 		nfsm_reply(NFSX_WCCDATA(v3));
2518 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2519 		if (dirp)
2520 			vrele(dirp);
2521 		return (0);
2522 	}
2523 	vp = nd.ni_vp;
2524 	if (vp->v_type != VDIR) {
2525 		error = ENOTDIR;
2526 		goto out;
2527 	}
2528 	/*
2529 	 * No rmdir "." please.
2530 	 */
2531 	if (nd.ni_dvp == vp) {
2532 		error = EINVAL;
2533 		goto out;
2534 	}
2535 	/*
2536 	 * The root of a mounted filesystem cannot be deleted.
2537 	 */
2538 	if (vp->v_vflag & VV_ROOT)
2539 		error = EBUSY;
2540 out:
2541 	if (!error) {
2542 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
2543 		nqsrv_getl(vp, ND_WRITE);
2544 		error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
2545 	} else {
2546 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2547 		if (nd.ni_dvp == nd.ni_vp)
2548 			vrele(nd.ni_dvp);
2549 		else
2550 			vput(nd.ni_dvp);
2551 		vput(vp);
2552 	}
2553 	pathbuf_destroy(nd.ni_pathbuf);
2554 	if (dirp) {
2555 		if (v3) {
2556 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2557 		}
2558 		vrele(dirp);
2559 	}
2560 	nfsm_reply(NFSX_WCCDATA(v3));
2561 	if (v3) {
2562 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2563 		return (0);
2564 	}
2565 	nfsm_srvdone;
2566 }
2567 
2568 /*
2569  * nfs readdir service
2570  * - mallocs what it thinks is enough to read
2571  *	count rounded up to a multiple of NFS_SRVDIRBLKSIZ <= NFS_MAXREADDIR
2572  * - calls VOP_READDIR()
2573  * - loops around building the reply
2574  *	if the output generated exceeds count break out of loop
2575  *	The nfsm_clget macro is used here so that the reply will be packed
2576  *	tightly in mbuf clusters.
2577  * - it only knows that it has encountered eof when the VOP_READDIR()
2578  *	reads nothing
2579  * - as such one readdir rpc will return eof false although you are there
2580  *	and then the next will return eof
2581  * - it trims out records with d_fileno == 0
2582  *	this doesn't matter for Unix clients, but they might confuse clients
2583  *	for other os'.
2584  * - it trims out records with d_type == DT_WHT
2585  *	these cannot be seen through NFS (unless we extend the protocol)
2586  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2587  *	than requested, but this may not apply to all filesystems. For
2588  *	example, client NFS does not { although it is never remote mounted
2589  *	anyhow }
2590  *     The alternate call nfsrv_readdirplus() does lookups as well.
2591  * PS: The NFS protocol spec. does not clarify what the "count" byte
2592  *	argument is a count of.. just name strings and file id's or the
2593  *	entire reply rpc or ...
2594  *	I tried just file name and id sizes and it confused the Sun client,
2595  *	so I am using the full rpc size now. The "paranoia.." comment refers
2596  *	to including the status longwords that are not a part of the dir.
2597  *	"entry" structures, but are in the rpc.
2598  */
2599 
2600 #define	NFS_SRVDIRBLKSIZ	1024
2601 
2602 struct flrep {
2603 	nfsuint64 fl_off;
2604 	u_int32_t fl_postopok;
2605 	struct nfs_fattr fl_fattr; /* XXX: must be of fattr3 size */
2606 	u_int32_t fl_fhok;
2607 	u_int32_t fl_fhsize;
2608 	/* handle comes here, filled in dynamically */
2609 };
2610 
2611 int
2612 nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2613 {
2614 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2615 	struct mbuf *nam = nfsd->nd_nam;
2616 	char *dpos = nfsd->nd_dpos;
2617 	kauth_cred_t cred = nfsd->nd_cr;
2618 	char *bp, *be;
2619 	struct mbuf *mp;
2620 	struct dirent *dp;
2621 	char *cp;
2622 	u_int32_t *tl;
2623 	int32_t t1;
2624 	char *bpos;
2625 	struct mbuf *mb, *mreq, *mp2;
2626 	char *cpos, *cend, *cp2, *rbuf;
2627 	struct vnode *vp;
2628 	struct vattr at;
2629 	nfsrvfh_t nsfh;
2630 	struct uio io;
2631 	struct iovec iv;
2632 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2633 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, ncookies;
2634 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2635 	u_quad_t frev, off, toff, verf;
2636 	off_t *cookies = NULL, *cookiep;
2637 	nfsuint64 jar;
2638 
2639 	nfsm_srvmtofh(&nsfh);
2640 	if (v3) {
2641 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2642 		toff = fxdr_hyper(tl);
2643 		tl += 2;
2644 		verf = fxdr_hyper(tl);
2645 		tl += 2;
2646 	} else {
2647 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2648 		toff = fxdr_unsigned(u_quad_t, *tl++);
2649 	}
2650 	off = toff;
2651 	cnt = fxdr_unsigned(int, *tl);
2652 	siz = ((cnt + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2653 	xfer = NFS_SRVMAXDATA(nfsd);
2654 	if (siz > xfer)
2655 		siz = xfer;
2656 	fullsiz = siz;
2657 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2658 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2659 	if (!error && vp->v_type != VDIR) {
2660 		error = ENOTDIR;
2661 		vput(vp);
2662 	}
2663 	if (error) {
2664 		nfsm_reply(NFSX_UNSIGNED);
2665 		nfsm_srvpostop_attr(getret, &at);
2666 		return (0);
2667 	}
2668 	nqsrv_getl(vp, ND_READ);
2669 	if (v3) {
2670 		error = getret = VOP_GETATTR(vp, &at, cred);
2671 #ifdef NFS3_STRICTVERF
2672 		/*
2673 		 * XXX This check is too strict for Solaris 2.5 clients.
2674 		 */
2675 		if (!error && toff && verf != at.va_filerev)
2676 			error = NFSERR_BAD_COOKIE;
2677 #endif
2678 	}
2679 	if (!error)
2680 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2681 	if (error) {
2682 		vput(vp);
2683 		nfsm_reply(NFSX_POSTOPATTR(v3));
2684 		nfsm_srvpostop_attr(getret, &at);
2685 		return (0);
2686 	}
2687 	VOP_UNLOCK(vp);
2688 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2689 again:
2690 	iv.iov_base = rbuf;
2691 	iv.iov_len = fullsiz;
2692 	io.uio_iov = &iv;
2693 	io.uio_iovcnt = 1;
2694 	io.uio_offset = (off_t)off;
2695 	io.uio_resid = fullsiz;
2696 	io.uio_rw = UIO_READ;
2697 	UIO_SETUP_SYSSPACE(&io);
2698 	eofflag = 0;
2699 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2700 
2701 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2702 
2703 	off = (off_t)io.uio_offset;
2704 	if (!cookies && !error)
2705 		error = NFSERR_PERM;
2706 	if (v3) {
2707 		getret = VOP_GETATTR(vp, &at, cred);
2708 		if (!error)
2709 			error = getret;
2710 	}
2711 
2712 	VOP_UNLOCK(vp);
2713 	if (error) {
2714 		vrele(vp);
2715 		free((void *)rbuf, M_TEMP);
2716 		if (cookies)
2717 			free((void *)cookies, M_TEMP);
2718 		nfsm_reply(NFSX_POSTOPATTR(v3));
2719 		nfsm_srvpostop_attr(getret, &at);
2720 		return (0);
2721 	}
2722 	if (io.uio_resid) {
2723 		siz -= io.uio_resid;
2724 
2725 		/*
2726 		 * If nothing read, return eof
2727 		 * rpc reply
2728 		 */
2729 		if (siz == 0) {
2730 			vrele(vp);
2731 			nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) +
2732 				2 * NFSX_UNSIGNED);
2733 			if (v3) {
2734 				nfsm_srvpostop_attr(getret, &at);
2735 				nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
2736 				txdr_hyper(at.va_filerev, tl);
2737 				tl += 2;
2738 			} else
2739 				nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2740 			*tl++ = nfs_false;
2741 			*tl = nfs_true;
2742 			free((void *)rbuf, M_TEMP);
2743 			free((void *)cookies, M_TEMP);
2744 			return (0);
2745 		}
2746 	}
2747 
2748 	/*
2749 	 * Check for degenerate cases of nothing useful read.
2750 	 * If so go try again
2751 	 */
2752 	cpos = rbuf;
2753 	cend = rbuf + siz;
2754 	dp = (struct dirent *)cpos;
2755 	cookiep = cookies;
2756 
2757 	while (cpos < cend && ncookies > 0 &&
2758 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
2759 		cpos += dp->d_reclen;
2760 		dp = (struct dirent *)cpos;
2761 		cookiep++;
2762 		ncookies--;
2763 	}
2764 	if (cpos >= cend || ncookies == 0) {
2765 		toff = off;
2766 		siz = fullsiz;
2767 		free(cookies, M_TEMP);
2768 		cookies = NULL;
2769 		goto again;
2770 	}
2771 
2772 	len = 3 * NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
2773 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) + siz);
2774 	if (v3) {
2775 		nfsm_srvpostop_attr(getret, &at);
2776 		nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2777 		txdr_hyper(at.va_filerev, tl);
2778 	}
2779 	mp = mp2 = mb;
2780 	bp = bpos;
2781 	be = bp + M_TRAILINGSPACE(mp);
2782 
2783 	/* Loop through the records and build reply */
2784 	while (cpos < cend && ncookies > 0) {
2785 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
2786 			nlen = dp->d_namlen;
2787 			rem = nfsm_rndup(nlen)-nlen;
2788 			len += (4 * NFSX_UNSIGNED + nlen + rem);
2789 			if (v3)
2790 				len += 2 * NFSX_UNSIGNED;
2791 			if (len > cnt) {
2792 				eofflag = 0;
2793 				break;
2794 			}
2795 			/*
2796 			 * Build the directory record xdr from
2797 			 * the dirent entry.
2798 			 */
2799 			nfsm_clget;
2800 			*tl = nfs_true;
2801 			bp += NFSX_UNSIGNED;
2802 			if (v3) {
2803 				nfsm_clget;
2804 				*tl = txdr_unsigned(dp->d_fileno >> 32);
2805 				bp += NFSX_UNSIGNED;
2806 			}
2807 			nfsm_clget;
2808 			*tl = txdr_unsigned(dp->d_fileno);
2809 			bp += NFSX_UNSIGNED;
2810 			nfsm_clget;
2811 			*tl = txdr_unsigned(nlen);
2812 			bp += NFSX_UNSIGNED;
2813 
2814 			/* And loop around copying the name */
2815 			xfer = nlen;
2816 			cp = dp->d_name;
2817 			while (xfer > 0) {
2818 				nfsm_clget;
2819 				if ((bp+xfer) > be)
2820 					tsiz = be-bp;
2821 				else
2822 					tsiz = xfer;
2823 				memcpy(bp, cp, tsiz);
2824 				bp += tsiz;
2825 				xfer -= tsiz;
2826 				if (xfer > 0)
2827 					cp += tsiz;
2828 			}
2829 			/* And null pad to an int32_t boundary */
2830 			for (i = 0; i < rem; i++)
2831 				*bp++ = '\0';
2832 			nfsm_clget;
2833 
2834 			/* Finish off the record */
2835 			txdr_hyper(*cookiep, &jar);
2836 			if (v3) {
2837 				*tl = jar.nfsuquad[0];
2838 				bp += NFSX_UNSIGNED;
2839 				nfsm_clget;
2840 			}
2841 			*tl = jar.nfsuquad[1];
2842 			bp += NFSX_UNSIGNED;
2843 		}
2844 		cpos += dp->d_reclen;
2845 		dp = (struct dirent *)cpos;
2846 		cookiep++;
2847 		ncookies--;
2848 	}
2849 	vrele(vp);
2850 	nfsm_clget;
2851 	*tl = nfs_false;
2852 	bp += NFSX_UNSIGNED;
2853 	nfsm_clget;
2854 	if (eofflag)
2855 		*tl = nfs_true;
2856 	else
2857 		*tl = nfs_false;
2858 	bp += NFSX_UNSIGNED;
2859 	if (mp != mb) {
2860 		if (bp < be)
2861 			mp->m_len = bp - mtod(mp, char *);
2862 	} else
2863 		mp->m_len += bp - bpos;
2864 	free((void *)rbuf, M_TEMP);
2865 	free((void *)cookies, M_TEMP);
2866 	nfsm_srvdone;
2867 }
2868 
2869 int
2870 nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2871 {
2872 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2873 	struct mbuf *nam = nfsd->nd_nam;
2874 	char *dpos = nfsd->nd_dpos;
2875 	kauth_cred_t cred = nfsd->nd_cr;
2876 	char *bp, *be;
2877 	struct mbuf *mp;
2878 	struct dirent *dp;
2879 	char *cp;
2880 	u_int32_t *tl;
2881 	int32_t t1;
2882 	char *bpos;
2883 	struct mbuf *mb, *mreq, *mp2;
2884 	char *cpos, *cend, *cp2, *rbuf;
2885 	struct vnode *vp, *nvp;
2886 	struct flrep fl;
2887 	nfsrvfh_t nsfh;
2888 	struct uio io;
2889 	struct iovec iv;
2890 	struct vattr va, at, *vap = &va;
2891 	struct nfs_fattr *fp;
2892 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2893 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, dirlen, ncookies;
2894 	u_quad_t frev, off, toff, verf;
2895 	off_t *cookies = NULL, *cookiep;
2896 
2897 	nfsm_srvmtofh(&nsfh);
2898 	nfsm_dissect(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2899 	toff = fxdr_hyper(tl);
2900 	tl += 2;
2901 	verf = fxdr_hyper(tl);
2902 	tl += 2;
2903 	siz = fxdr_unsigned(int, *tl++);
2904 	cnt = fxdr_unsigned(int, *tl);
2905 	off = toff;
2906 	siz = ((siz + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2907 	xfer = NFS_SRVMAXDATA(nfsd);
2908 	if (siz > xfer)
2909 		siz = xfer;
2910 	fullsiz = siz;
2911 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2912 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2913 	if (!error && vp->v_type != VDIR) {
2914 		error = ENOTDIR;
2915 		vput(vp);
2916 	}
2917 	if (error) {
2918 		nfsm_reply(NFSX_UNSIGNED);
2919 		nfsm_srvpostop_attr(getret, &at);
2920 		return (0);
2921 	}
2922 	error = getret = VOP_GETATTR(vp, &at, cred);
2923 #ifdef NFS3_STRICTVERF
2924 	/*
2925 	 * XXX This check is too strict for Solaris 2.5 clients.
2926 	 */
2927 	if (!error && toff && verf != at.va_filerev)
2928 		error = NFSERR_BAD_COOKIE;
2929 #endif
2930 	if (!error) {
2931 		nqsrv_getl(vp, ND_READ);
2932 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2933 	}
2934 	if (error) {
2935 		vput(vp);
2936 		nfsm_reply(NFSX_V3POSTOPATTR);
2937 		nfsm_srvpostop_attr(getret, &at);
2938 		return (0);
2939 	}
2940 	VOP_UNLOCK(vp);
2941 
2942 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2943 again:
2944 	iv.iov_base = rbuf;
2945 	iv.iov_len = fullsiz;
2946 	io.uio_iov = &iv;
2947 	io.uio_iovcnt = 1;
2948 	io.uio_offset = (off_t)off;
2949 	io.uio_resid = fullsiz;
2950 	io.uio_rw = UIO_READ;
2951 	UIO_SETUP_SYSSPACE(&io);
2952 	eofflag = 0;
2953 
2954 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2955 
2956 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2957 
2958 	off = (u_quad_t)io.uio_offset;
2959 	getret = VOP_GETATTR(vp, &at, cred);
2960 
2961 	VOP_UNLOCK(vp);
2962 
2963 	/*
2964 	 * If the VGET operation doesn't work for this filesystem,
2965 	 * we can't support readdirplus. Returning NOTSUPP should
2966 	 * make clients fall back to plain readdir.
2967 	 * There's no need to check for VPTOFH as well, we wouldn't
2968 	 * even be here otherwise.
2969 	 */
2970 	if (!getret) {
2971 		if ((getret = VFS_VGET(vp->v_mount, at.va_fileid, &nvp)))
2972 			getret = (getret == EOPNOTSUPP) ?
2973 				NFSERR_NOTSUPP : NFSERR_IO;
2974 		else
2975 			vput(nvp);
2976 	}
2977 
2978 	if (!cookies && !error)
2979 		error = NFSERR_PERM;
2980 	if (!error)
2981 		error = getret;
2982 	if (error) {
2983 		vrele(vp);
2984 		if (cookies)
2985 			free((void *)cookies, M_TEMP);
2986 		free((void *)rbuf, M_TEMP);
2987 		nfsm_reply(NFSX_V3POSTOPATTR);
2988 		nfsm_srvpostop_attr(getret, &at);
2989 		return (0);
2990 	}
2991 	if (io.uio_resid) {
2992 		siz -= io.uio_resid;
2993 
2994 		/*
2995 		 * If nothing read, return eof
2996 		 * rpc reply
2997 		 */
2998 		if (siz == 0) {
2999 			vrele(vp);
3000 			nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
3001 				2 * NFSX_UNSIGNED);
3002 			nfsm_srvpostop_attr(getret, &at);
3003 			nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
3004 			txdr_hyper(at.va_filerev, tl);
3005 			tl += 2;
3006 			*tl++ = nfs_false;
3007 			*tl = nfs_true;
3008 			free((void *)cookies, M_TEMP);
3009 			free((void *)rbuf, M_TEMP);
3010 			return (0);
3011 		}
3012 	}
3013 
3014 	/*
3015 	 * Check for degenerate cases of nothing useful read.
3016 	 * If so go try again
3017 	 */
3018 	cpos = rbuf;
3019 	cend = rbuf + siz;
3020 	dp = (struct dirent *)cpos;
3021 	cookiep = cookies;
3022 
3023 	while (cpos < cend && ncookies > 0 &&
3024 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
3025 		cpos += dp->d_reclen;
3026 		dp = (struct dirent *)cpos;
3027 		cookiep++;
3028 		ncookies--;
3029 	}
3030 	if (cpos >= cend || ncookies == 0) {
3031 		toff = off;
3032 		siz = fullsiz;
3033 		free(cookies, M_TEMP);
3034 		cookies = NULL;
3035 		goto again;
3036 	}
3037 
3038 	dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF + 2 * NFSX_UNSIGNED;
3039 	nfsm_reply(cnt);
3040 	nfsm_srvpostop_attr(getret, &at);
3041 	nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3042 	txdr_hyper(at.va_filerev, tl);
3043 	mp = mp2 = mb;
3044 	bp = bpos;
3045 	be = bp + M_TRAILINGSPACE(mp);
3046 
3047 	/* Loop through the records and build reply */
3048 	while (cpos < cend && ncookies > 0) {
3049 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
3050 			nfsrvfh_t nnsfh;
3051 
3052 			nlen = dp->d_namlen;
3053 			rem = nfsm_rndup(nlen)-nlen;
3054 
3055 			/*
3056 			 * For readdir_and_lookup get the vnode using
3057 			 * the file number.
3058 			 */
3059 			if (VFS_VGET(vp->v_mount, dp->d_fileno, &nvp))
3060 				goto invalid;
3061 			if (nfsrv_composefh(nvp, &nnsfh, true)) {
3062 				vput(nvp);
3063 				goto invalid;
3064 			}
3065 			if (VOP_GETATTR(nvp, vap, cred)) {
3066 				vput(nvp);
3067 				goto invalid;
3068 			}
3069 			vput(nvp);
3070 
3071 			/*
3072 			 * If either the dircount or maxcount will be
3073 			 * exceeded, get out now. Both of these lengths
3074 			 * are calculated conservatively, including all
3075 			 * XDR overheads.
3076 			 */
3077 			len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
3078 				NFSX_V3POSTOPATTR);
3079 			dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
3080 			if (len > cnt || dirlen > fullsiz) {
3081 				eofflag = 0;
3082 				break;
3083 			}
3084 
3085 			/*
3086 			 * Build the directory record xdr from
3087 			 * the dirent entry.
3088 			 */
3089 			fp = (struct nfs_fattr *)&fl.fl_fattr;
3090 			nfsm_srvfillattr(vap, fp);
3091 			fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
3092 			fl.fl_fhok = nfs_true;
3093 			fl.fl_postopok = nfs_true;
3094 			txdr_hyper(*cookiep, fl.fl_off.nfsuquad);
3095 
3096 			nfsm_clget;
3097 			*tl = nfs_true;
3098 			bp += NFSX_UNSIGNED;
3099 			nfsm_clget;
3100 			*tl = txdr_unsigned(dp->d_fileno >> 32);
3101 			bp += NFSX_UNSIGNED;
3102 			nfsm_clget;
3103 			*tl = txdr_unsigned(dp->d_fileno);
3104 			bp += NFSX_UNSIGNED;
3105 			nfsm_clget;
3106 			*tl = txdr_unsigned(nlen);
3107 			bp += NFSX_UNSIGNED;
3108 
3109 			/* And loop around copying the name */
3110 			xfer = nlen;
3111 			cp = dp->d_name;
3112 			while (xfer > 0) {
3113 				nfsm_clget;
3114 				if ((bp + xfer) > be)
3115 					tsiz = be - bp;
3116 				else
3117 					tsiz = xfer;
3118 				memcpy(bp, cp, tsiz);
3119 				bp += tsiz;
3120 				xfer -= tsiz;
3121 				if (xfer > 0)
3122 					cp += tsiz;
3123 			}
3124 			/* And null pad to an int32_t boundary */
3125 			for (i = 0; i < rem; i++)
3126 				*bp++ = '\0';
3127 
3128 			/*
3129 			 * Now copy the flrep structure out.
3130 			 */
3131 			xfer = sizeof(struct flrep);
3132 			cp = (void *)&fl;
3133 			while (xfer > 0) {
3134 				nfsm_clget;
3135 				if ((bp + xfer) > be)
3136 					tsiz = be - bp;
3137 				else
3138 					tsiz = xfer;
3139 				memcpy(bp, cp, tsiz);
3140 				bp += tsiz;
3141 				xfer -= tsiz;
3142 				if (xfer > 0)
3143 					cp += tsiz;
3144 			}
3145 
3146 			/*
3147 			 * ... and filehandle.
3148 			 */
3149 			xfer = NFSRVFH_SIZE(&nnsfh);
3150 			cp = NFSRVFH_DATA(&nnsfh);
3151 			while (xfer > 0) {
3152 				nfsm_clget;
3153 				if ((bp + xfer) > be)
3154 					tsiz = be - bp;
3155 				else
3156 					tsiz = xfer;
3157 				memcpy(bp, cp, tsiz);
3158 				bp += tsiz;
3159 				xfer -= tsiz;
3160 				if (xfer > 0)
3161 					cp += tsiz;
3162 			}
3163 		}
3164 invalid:
3165 		cpos += dp->d_reclen;
3166 		dp = (struct dirent *)cpos;
3167 		cookiep++;
3168 		ncookies--;
3169 	}
3170 	vrele(vp);
3171 	nfsm_clget;
3172 	*tl = nfs_false;
3173 	bp += NFSX_UNSIGNED;
3174 	nfsm_clget;
3175 	if (eofflag)
3176 		*tl = nfs_true;
3177 	else
3178 		*tl = nfs_false;
3179 	bp += NFSX_UNSIGNED;
3180 	if (mp != mb) {
3181 		if (bp < be)
3182 			mp->m_len = bp - mtod(mp, char *);
3183 	} else
3184 		mp->m_len += bp - bpos;
3185 	free((void *)cookies, M_TEMP);
3186 	free((void *)rbuf, M_TEMP);
3187 	nfsm_srvdone;
3188 }
3189 
3190 /*
3191  * nfs commit service
3192  */
3193 int
3194 nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3195 {
3196 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3197 	struct mbuf *nam = nfsd->nd_nam;
3198 	char *dpos = nfsd->nd_dpos;
3199 	kauth_cred_t cred = nfsd->nd_cr;
3200 	struct vattr bfor, aft;
3201 	struct vnode *vp;
3202 	nfsrvfh_t nsfh;
3203 	u_int32_t *tl;
3204 	int32_t t1;
3205 	char *bpos;
3206 	int error = 0, rdonly, for_ret = 1, aft_ret = 1, cache = 0;
3207 	uint32_t cnt;
3208 	char *cp2;
3209 	struct mbuf *mb, *mreq;
3210 	u_quad_t frev, off, end;
3211 
3212 	nfsm_srvmtofh(&nsfh);
3213 	nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3214 
3215 	off = fxdr_hyper(tl);
3216 	tl += 2;
3217 	cnt = fxdr_unsigned(uint32_t, *tl);
3218 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3219 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3220 	if (error) {
3221 		nfsm_reply(2 * NFSX_UNSIGNED);
3222 		nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3223 		return (0);
3224 	}
3225 	for_ret = VOP_GETATTR(vp, &bfor, cred);
3226 	end = (cnt > 0) ? off + cnt : vp->v_size;
3227 	if (end < off || end > vp->v_size)
3228 		end = vp->v_size;
3229 	if (off < vp->v_size)
3230 		error = VOP_FSYNC(vp, cred, FSYNC_WAIT, off, end);
3231 	/* else error == 0, from nfsrv_fhtovp() */
3232 	aft_ret = VOP_GETATTR(vp, &aft, cred);
3233 	vput(vp);
3234 	nfsm_reply(NFSX_V3WCCDATA + NFSX_V3WRITEVERF);
3235 	nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3236 	if (!error) {
3237 		nfsm_build(tl, u_int32_t *, NFSX_V3WRITEVERF);
3238 		*tl++ = txdr_unsigned(boottime.tv_sec);
3239 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
3240 	} else {
3241 		return (0);
3242 	}
3243 	nfsm_srvdone;
3244 }
3245 
3246 /*
3247  * nfs statfs service
3248  */
3249 int
3250 nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3251 {
3252 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3253 	struct mbuf *nam = nfsd->nd_nam;
3254 	char *dpos = nfsd->nd_dpos;
3255 	kauth_cred_t cred = nfsd->nd_cr;
3256 	struct statvfs *sf = NULL;
3257 	struct nfs_statfs *sfp;
3258 	u_int32_t *tl;
3259 	int32_t t1;
3260 	char *bpos;
3261 	int error = 0, rdonly, cache = 0, getret = 1;
3262 	int v3 = (nfsd->nd_flag & ND_NFSV3);
3263 	char *cp2;
3264 	struct mbuf *mb, *mreq;
3265 	struct vnode *vp;
3266 	struct vattr at;
3267 	nfsrvfh_t nsfh;
3268 	u_quad_t frev, tval;
3269 
3270 	nfsm_srvmtofh(&nsfh);
3271 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3272 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3273 	if (error) {
3274 		nfsm_reply(NFSX_UNSIGNED);
3275 		nfsm_srvpostop_attr(getret, &at);
3276 		return (0);
3277 	}
3278 	sf = malloc(sizeof(*sf), M_TEMP, M_WAITOK);
3279 	error = VFS_STATVFS(vp->v_mount, sf);
3280 	getret = VOP_GETATTR(vp, &at, cred);
3281 	vput(vp);
3282 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_STATFS(v3));
3283 	if (v3)
3284 		nfsm_srvpostop_attr(getret, &at);
3285 	if (error) {
3286 		free(sf, M_TEMP);
3287 		return (0);
3288 	}
3289 	nfsm_build(sfp, struct nfs_statfs *, NFSX_STATFS(v3));
3290 	if (v3) {
3291 		tval = (u_quad_t)((quad_t)sf->f_blocks * (quad_t)sf->f_frsize);
3292 		txdr_hyper(tval, &sfp->sf_tbytes);
3293 		tval = (u_quad_t)((quad_t)sf->f_bfree * (quad_t)sf->f_frsize);
3294 		txdr_hyper(tval, &sfp->sf_fbytes);
3295 		tval = (u_quad_t)((quad_t)sf->f_bavail * (quad_t)sf->f_frsize);
3296 		txdr_hyper(tval, &sfp->sf_abytes);
3297 		tval = (u_quad_t)sf->f_files;
3298 		txdr_hyper(tval, &sfp->sf_tfiles);
3299 		tval = (u_quad_t)sf->f_ffree;
3300 		txdr_hyper(tval, &sfp->sf_ffiles);
3301 		txdr_hyper(tval, &sfp->sf_afiles);
3302 		sfp->sf_invarsec = 0;
3303 	} else {
3304 		sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
3305 		sfp->sf_bsize = txdr_unsigned(sf->f_frsize);
3306 		sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
3307 		sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
3308 		sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
3309 	}
3310 nfsmout:
3311 	if (sf)
3312 	    free(sf, M_TEMP);
3313 	return error;
3314 }
3315 
3316 /*
3317  * nfs fsinfo service
3318  */
3319 int
3320 nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3321 {
3322 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3323 	struct mbuf *nam = nfsd->nd_nam;
3324 	char *dpos = nfsd->nd_dpos;
3325 	kauth_cred_t cred = nfsd->nd_cr;
3326 	u_int32_t *tl;
3327 	struct nfsv3_fsinfo *sip;
3328 	int32_t t1;
3329 	char *bpos;
3330 	int error = 0, rdonly, cache = 0, getret = 1;
3331 	uint32_t maxdata;
3332 	char *cp2;
3333 	struct mbuf *mb, *mreq;
3334 	struct vnode *vp;
3335 	struct vattr at;
3336 	nfsrvfh_t nsfh;
3337 	u_quad_t frev, maxfsize;
3338 	struct statvfs *sb;
3339 
3340 	nfsm_srvmtofh(&nsfh);
3341 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3342 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3343 	if (error) {
3344 		nfsm_reply(NFSX_UNSIGNED);
3345 		nfsm_srvpostop_attr(getret, &at);
3346 		return (0);
3347 	}
3348 
3349 	/* XXX Try to make a guess on the max file size. */
3350 	sb = malloc(sizeof(*sb), M_TEMP, M_WAITOK);
3351 	VFS_STATVFS(vp->v_mount, sb);
3352 	maxfsize = (u_quad_t)0x80000000 * sb->f_frsize - 1;
3353 	free(sb, M_TEMP);
3354 
3355 	getret = VOP_GETATTR(vp, &at, cred);
3356 	vput(vp);
3357 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3FSINFO);
3358 	nfsm_srvpostop_attr(getret, &at);
3359 	nfsm_build(sip, struct nfsv3_fsinfo *, NFSX_V3FSINFO);
3360 
3361 	/*
3362 	 * XXX
3363 	 * There should be file system VFS OP(s) to get this information.
3364 	 * For now, assume ufs.
3365 	 */
3366 	if (slp->ns_so->so_type == SOCK_DGRAM)
3367 		maxdata = NFS_MAXDGRAMDATA;
3368 	else
3369 		maxdata = NFS_MAXDATA;
3370 	sip->fs_rtmax = txdr_unsigned(maxdata);
3371 	sip->fs_rtpref = txdr_unsigned(maxdata);
3372 	sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
3373 	sip->fs_wtmax = txdr_unsigned(maxdata);
3374 	sip->fs_wtpref = txdr_unsigned(maxdata);
3375 	sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
3376 	sip->fs_dtpref = txdr_unsigned(maxdata);
3377 	txdr_hyper(maxfsize, &sip->fs_maxfilesize);
3378 	sip->fs_timedelta.nfsv3_sec = 0;
3379 	sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
3380 	sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
3381 		NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
3382 		NFSV3FSINFO_CANSETTIME);
3383 	nfsm_srvdone;
3384 }
3385 
3386 /*
3387  * nfs pathconf service
3388  */
3389 int
3390 nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3391 {
3392 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3393 	struct mbuf *nam = nfsd->nd_nam;
3394 	char *dpos = nfsd->nd_dpos;
3395 	kauth_cred_t cred = nfsd->nd_cr;
3396 	u_int32_t *tl;
3397 	struct nfsv3_pathconf *pc;
3398 	int32_t t1;
3399 	char *bpos;
3400 	int error = 0, rdonly, cache = 0, getret = 1;
3401 	register_t linkmax, namemax, chownres, notrunc;
3402 	char *cp2;
3403 	struct mbuf *mb, *mreq;
3404 	struct vnode *vp;
3405 	struct vattr at;
3406 	nfsrvfh_t nsfh;
3407 	u_quad_t frev;
3408 
3409 	nfsm_srvmtofh(&nsfh);
3410 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3411 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3412 	if (error) {
3413 		nfsm_reply(NFSX_UNSIGNED);
3414 		nfsm_srvpostop_attr(getret, &at);
3415 		return (0);
3416 	}
3417 	error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
3418 	if (!error)
3419 		error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
3420 	if (!error)
3421 		error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
3422 	if (!error)
3423 		error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
3424 	getret = VOP_GETATTR(vp, &at, cred);
3425 	vput(vp);
3426 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3PATHCONF);
3427 	nfsm_srvpostop_attr(getret, &at);
3428 	if (error)
3429 		return (0);
3430 	nfsm_build(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
3431 
3432 	pc->pc_linkmax = txdr_unsigned(linkmax);
3433 	pc->pc_namemax = txdr_unsigned(namemax);
3434 	pc->pc_notrunc = txdr_unsigned(notrunc);
3435 	pc->pc_chownrestricted = txdr_unsigned(chownres);
3436 
3437 	/*
3438 	 * These should probably be supported by VOP_PATHCONF(), but
3439 	 * until msdosfs is exportable (why would you want to?), the
3440 	 * Unix defaults should be ok.
3441 	 */
3442 	pc->pc_caseinsensitive = nfs_false;
3443 	pc->pc_casepreserving = nfs_true;
3444 	nfsm_srvdone;
3445 }
3446 
3447 /*
3448  * Null operation, used by clients to ping server
3449  */
3450 /* ARGSUSED */
3451 int
3452 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3453     struct lwp *lwp, struct mbuf **mrq)
3454 {
3455 	struct mbuf *mrep = nfsd->nd_mrep;
3456 	char *bpos;
3457 	int error = NFSERR_RETVOID, cache = 0;
3458 	struct mbuf *mb, *mreq;
3459 	u_quad_t frev;
3460 
3461 	nfsm_reply(0);
3462 nfsmout:
3463 	return (0);
3464 }
3465 
3466 /*
3467  * No operation, used for obsolete procedures
3468  */
3469 /* ARGSUSED */
3470 int
3471 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3472     struct lwp *lwp, struct mbuf **mrq)
3473 {
3474 	struct mbuf *mrep = nfsd->nd_mrep;
3475 	char *bpos;
3476 	int error, cache = 0;
3477 	struct mbuf *mb, *mreq;
3478 	u_quad_t frev;
3479 
3480 	if (nfsd->nd_repstat)
3481 		error = nfsd->nd_repstat;
3482 	else
3483 		error = EPROCUNAVAIL;
3484 	nfsm_reply(0);
3485 nfsmout:
3486 	return (0);
3487 }
3488 
3489 /*
3490  * Perform access checking for vnodes obtained from file handles that would
3491  * refer to files already opened by a Unix client. You cannot just use
3492  * vn_writechk() and VOP_ACCESS() for two reasons.
3493  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
3494  * 2 - The owner is to be given access irrespective of mode bits for some
3495  *     operations, so that processes that chmod after opening a file don't
3496  *     break. I don't like this because it opens a security hole, but since
3497  *     the nfs server opens a security hole the size of a barn door anyhow,
3498  *     what the heck.
3499  *
3500  * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
3501  * will return EPERM instead of EACCESS. EPERM is always an error.
3502  */
3503 int
3504 nfsrv_access(struct vnode *vp, int flags, kauth_cred_t cred, int rdonly, struct lwp *lwp, int override)
3505 {
3506 	struct vattr vattr;
3507 	int error;
3508 	if (flags & VWRITE) {
3509 		/* Just vn_writechk() changed to check rdonly */
3510 		/*
3511 		 * Disallow write attempts on read-only file systems;
3512 		 * unless the file is a socket or a block or character
3513 		 * device resident on the file system.
3514 		 */
3515 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
3516 			switch (vp->v_type) {
3517 			case VREG:
3518 			case VDIR:
3519 			case VLNK:
3520 				return (EROFS);
3521 			default:
3522 				break;
3523 			}
3524 		}
3525 
3526 		/*
3527 		 * If the vnode is in use as a process's text,
3528 		 * we can't allow writing.
3529 		 */
3530 		if (vp->v_iflag & VI_TEXT)
3531 			return (ETXTBSY);
3532 	}
3533 	error = VOP_GETATTR(vp, &vattr, cred);
3534 	if (error)
3535 		return (error);
3536 	error = VOP_ACCESS(vp, flags, cred);
3537 	/*
3538 	 * Allow certain operations for the owner (reads and writes
3539 	 * on files that are already open).
3540 	 */
3541 	if (override && error == EACCES && kauth_cred_geteuid(cred) == vattr.va_uid)
3542 		error = 0;
3543 	return error;
3544 }
3545