xref: /netbsd-src/sys/nfs/nfs_serv.c (revision 8b0f9554ff8762542c4defc4f70e1eb76fb508fa)
1 /*	$NetBSD: nfs_serv.c,v 1.132 2007/12/04 17:42:30 yamt Exp $	*/
2 
3 /*
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)nfs_serv.c	8.8 (Berkeley) 7/31/95
35  */
36 
37 /*
38  * nfs version 2 and 3 server calls to vnode ops
39  * - these routines generally have 3 phases
40  *   1 - break down and validate rpc request in mbuf list
41  *   2 - do the vnode ops for the request
42  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
43  *   3 - build the rpc reply in an mbuf list
44  *   nb:
45  *	- do not mix the phases, since the nfsm_?? macros can return failures
46  *	  on a bad rpc or similar and do not do any vrele() or vput()'s
47  *
48  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
49  *	error number iff error != 0 whereas
50  *	returning an error from the server function implies a fatal error
51  *	such as a badly constructed rpc request that should be dropped without
52  *	a reply.
53  *	For Version 3, nfsm_reply() does not return for the error case, since
54  *	most version 3 rpcs return more than the status for error cases.
55  */
56 
57 #include <sys/cdefs.h>
58 __KERNEL_RCSID(0, "$NetBSD: nfs_serv.c,v 1.132 2007/12/04 17:42:30 yamt Exp $");
59 
60 #include <sys/param.h>
61 #include <sys/systm.h>
62 #include <sys/proc.h>
63 #include <sys/file.h>
64 #include <sys/namei.h>
65 #include <sys/vnode.h>
66 #include <sys/mount.h>
67 #include <sys/socket.h>
68 #include <sys/socketvar.h>
69 #include <sys/mbuf.h>
70 #include <sys/dirent.h>
71 #include <sys/stat.h>
72 #include <sys/kernel.h>
73 #include <sys/hash.h>
74 #include <sys/kauth.h>
75 
76 #include <uvm/uvm.h>
77 
78 #include <nfs/nfsproto.h>
79 #include <nfs/rpcv2.h>
80 #include <nfs/nfs.h>
81 #include <nfs/xdr_subs.h>
82 #include <nfs/nfsm_subs.h>
83 #include <nfs/nfs_var.h>
84 
85 /* Global vars */
86 extern u_int32_t nfs_xdrneg1;
87 extern u_int32_t nfs_false, nfs_true;
88 extern enum vtype nv3tov_type[8];
89 extern struct nfsstats nfsstats;
90 extern const nfstype nfsv2_type[9];
91 extern const nfstype nfsv3_type[9];
92 int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
93 int nfsd_use_loan = 1;	/* use page-loan for READ OP */
94 
95 #define	nqsrv_getl(vp, rw)	/* nothing */
96 
97 /*
98  * nfs v3 access service
99  */
100 int
101 nfsrv3_access(nfsd, slp, lwp, mrq)
102 	struct nfsrv_descript *nfsd;
103 	struct nfssvc_sock *slp;
104 	struct lwp *lwp;
105 	struct mbuf **mrq;
106 {
107 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
108 	struct mbuf *nam = nfsd->nd_nam;
109 	char *dpos = nfsd->nd_dpos;
110 	kauth_cred_t cred = nfsd->nd_cr;
111 	struct vnode *vp;
112 	nfsrvfh_t nsfh;
113 	u_int32_t *tl;
114 	int32_t t1;
115 	char *bpos;
116 	int error = 0, rdonly, cache = 0, getret;
117 	char *cp2;
118 	struct mbuf *mb, *mreq;
119 	struct vattr va;
120 	u_long inmode, testmode, outmode;
121 	u_quad_t frev;
122 
123 	nfsm_srvmtofh(&nsfh);
124 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
125 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
126 	    (nfsd->nd_flag & ND_KERBAUTH), false);
127 	if (error) {
128 		nfsm_reply(NFSX_UNSIGNED);
129 		nfsm_srvpostop_attr(1, (struct vattr *)0);
130 		return (0);
131 	}
132 	inmode = fxdr_unsigned(u_int32_t, *tl);
133 	outmode = 0;
134 	if ((inmode & NFSV3ACCESS_READ) &&
135 	    nfsrv_access(vp, VREAD, cred, rdonly, lwp, 0) == 0)
136 		outmode |= NFSV3ACCESS_READ;
137 	if (vp->v_type != VDIR) {
138 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
139 		if (testmode &&
140 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
141 			outmode |= testmode;
142 		if ((inmode & NFSV3ACCESS_EXECUTE) &&
143 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
144 			outmode |= NFSV3ACCESS_EXECUTE;
145 	} else {
146 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
147 		    NFSV3ACCESS_DELETE);
148 		if (testmode &&
149 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
150 			outmode |= testmode;
151 		if ((inmode & NFSV3ACCESS_LOOKUP) &&
152 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
153 			outmode |= NFSV3ACCESS_LOOKUP;
154 	}
155 	getret = VOP_GETATTR(vp, &va, cred);
156 	vput(vp);
157 	nfsm_reply(NFSX_POSTOPATTR(1) + NFSX_UNSIGNED);
158 	nfsm_srvpostop_attr(getret, &va);
159 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
160 	*tl = txdr_unsigned(outmode);
161 	nfsm_srvdone;
162 }
163 
164 /*
165  * nfs getattr service
166  */
167 int
168 nfsrv_getattr(nfsd, slp, lwp, mrq)
169 	struct nfsrv_descript *nfsd;
170 	struct nfssvc_sock *slp;
171 	struct lwp *lwp;
172 	struct mbuf **mrq;
173 {
174 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
175 	struct mbuf *nam = nfsd->nd_nam;
176 	char *dpos = nfsd->nd_dpos;
177 	kauth_cred_t cred = nfsd->nd_cr;
178 	struct nfs_fattr *fp;
179 	struct vattr va;
180 	struct vnode *vp;
181 	nfsrvfh_t nsfh;
182 	u_int32_t *tl;
183 	int32_t t1;
184 	char *bpos;
185 	int error = 0, rdonly, cache = 0;
186 	char *cp2;
187 	struct mbuf *mb, *mreq;
188 	u_quad_t frev;
189 
190 	nfsm_srvmtofh(&nsfh);
191 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
192 	    (nfsd->nd_flag & ND_KERBAUTH), false);
193 	if (error) {
194 		nfsm_reply(0);
195 		return (0);
196 	}
197 	nqsrv_getl(vp, ND_READ);
198 	error = VOP_GETATTR(vp, &va, cred);
199 	vput(vp);
200 	nfsm_reply(NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
201 	if (error)
202 		return (0);
203 	nfsm_build(fp, struct nfs_fattr *, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
204 	nfsm_srvfillattr(&va, fp);
205 	nfsm_srvdone;
206 }
207 
208 /*
209  * nfs setattr service
210  */
211 int
212 nfsrv_setattr(nfsd, slp, lwp, mrq)
213 	struct nfsrv_descript *nfsd;
214 	struct nfssvc_sock *slp;
215 	struct lwp *lwp;
216 	struct mbuf **mrq;
217 {
218 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
219 	struct mbuf *nam = nfsd->nd_nam;
220 	char *dpos = nfsd->nd_dpos;
221 	kauth_cred_t cred = nfsd->nd_cr;
222 	struct vattr va, preat;
223 	struct nfsv2_sattr *sp;
224 	struct nfs_fattr *fp;
225 	struct vnode *vp;
226 	nfsrvfh_t nsfh;
227 	u_int32_t *tl;
228 	int32_t t1;
229 	char *bpos;
230 	int error = 0, rdonly, cache = 0, preat_ret = 1, postat_ret = 1;
231 	int v3 = (nfsd->nd_flag & ND_NFSV3), gcheck = 0;
232 	char *cp2;
233 	struct mbuf *mb, *mreq;
234 	u_quad_t frev;
235 	struct timespec guard;
236 
237 	memset(&guard, 0, sizeof guard);	/* XXX gcc */
238 
239 	nfsm_srvmtofh(&nsfh);
240 	VATTR_NULL(&va);
241 	if (v3) {
242 		nfsm_srvsattr(&va);
243 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
244 		gcheck = fxdr_unsigned(int, *tl);
245 		if (gcheck) {
246 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
247 			fxdr_nfsv3time(tl, &guard);
248 		}
249 	} else {
250 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
251 		/*
252 		 * Nah nah nah nah na nah
253 		 * There is a bug in the Sun client that puts 0xffff in the mode
254 		 * field of sattr when it should put in 0xffffffff. The u_short
255 		 * doesn't sign extend.
256 		 * --> check the low order 2 bytes for 0xffff
257 		 */
258 		if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
259 			va.va_mode = nfstov_mode(sp->sa_mode);
260 		if (sp->sa_uid != nfs_xdrneg1)
261 			va.va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
262 		if (sp->sa_gid != nfs_xdrneg1)
263 			va.va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
264 		if (sp->sa_size != nfs_xdrneg1)
265 			va.va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
266 		if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
267 #ifdef notyet
268 			fxdr_nfsv2time(&sp->sa_atime, &va.va_atime);
269 #else
270 			va.va_atime.tv_sec =
271 				fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
272 			va.va_atime.tv_nsec = 0;
273 #endif
274 		}
275 		if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
276 			fxdr_nfsv2time(&sp->sa_mtime, &va.va_mtime);
277 
278 	}
279 
280 	/*
281 	 * Now that we have all the fields, lets do it.
282 	 */
283 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
284 	    (nfsd->nd_flag & ND_KERBAUTH), false);
285 	if (error) {
286 		nfsm_reply(2 * NFSX_UNSIGNED);
287 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
288 		return (0);
289 	}
290 	nqsrv_getl(vp, ND_WRITE);
291 	if (v3) {
292 		error = preat_ret = VOP_GETATTR(vp, &preat, cred);
293 		if (!error && gcheck &&
294 			(preat.va_ctime.tv_sec != guard.tv_sec ||
295 			 preat.va_ctime.tv_nsec != guard.tv_nsec))
296 			error = NFSERR_NOT_SYNC;
297 		if (error) {
298 			vput(vp);
299 			nfsm_reply(NFSX_WCCDATA(v3));
300 			nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
301 			return (0);
302 		}
303 	}
304 
305 	/*
306 	 * If the size is being changed write acces is required, otherwise
307 	 * just check for a read only file system.
308 	 */
309 	if (va.va_size == ((u_quad_t)((quad_t) -1))) {
310 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
311 			error = EROFS;
312 			goto out;
313 		}
314 	} else {
315 		if (vp->v_type == VDIR) {
316 			error = EISDIR;
317 			goto out;
318 		} else if ((error = nfsrv_access(vp, VWRITE, cred, rdonly,
319 			lwp, 0)) != 0)
320 			goto out;
321 	}
322 	error = VOP_SETATTR(vp, &va, cred);
323 	postat_ret = VOP_GETATTR(vp, &va, cred);
324 	if (!error)
325 		error = postat_ret;
326 out:
327 	vput(vp);
328 	nfsm_reply(NFSX_WCCORFATTR(v3));
329 	if (v3) {
330 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
331 		return (0);
332 	} else {
333 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
334 		nfsm_srvfillattr(&va, fp);
335 	}
336 	nfsm_srvdone;
337 }
338 
339 /*
340  * nfs lookup rpc
341  */
342 int
343 nfsrv_lookup(nfsd, slp, lwp, mrq)
344 	struct nfsrv_descript *nfsd;
345 	struct nfssvc_sock *slp;
346 	struct lwp *lwp;
347 	struct mbuf **mrq;
348 {
349 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
350 	struct mbuf *nam = nfsd->nd_nam;
351 	char *dpos = nfsd->nd_dpos;
352 	kauth_cred_t cred = nfsd->nd_cr;
353 	struct nfs_fattr *fp;
354 	struct nameidata nd, ind, *ndp = &nd;
355 	struct vnode *vp, *dirp;
356 	nfsrvfh_t nsfh;
357 	char *cp;
358 	u_int32_t *tl;
359 	int32_t t1;
360 	char *bpos;
361 	int error = 0, cache = 0, dirattr_ret = 1;
362 	uint32_t len;
363 	int v3 = (nfsd->nd_flag & ND_NFSV3), pubflag;
364 	char *cp2;
365 	struct mbuf *mb, *mreq;
366 	struct vattr va, dirattr;
367 	u_quad_t frev;
368 
369 	nfsm_srvmtofh(&nsfh);
370 	nfsm_srvnamesiz(len);
371 
372 	pubflag = nfs_ispublicfh(&nsfh);
373 
374 	nd.ni_cnd.cn_cred = cred;
375 	nd.ni_cnd.cn_nameiop = LOOKUP;
376 	nd.ni_cnd.cn_flags = LOCKLEAF | SAVESTART;
377 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
378 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), pubflag);
379 
380 	if (!error && pubflag) {
381 		if (nd.ni_vp->v_type == VDIR && nfs_pub.np_index != NULL) {
382 			/*
383 			 * Setup call to lookup() to see if we can find
384 			 * the index file. Arguably, this doesn't belong
385 			 * in a kernel.. Ugh.
386 			 */
387 			ind = nd;
388 			VOP_UNLOCK(nd.ni_vp, 0);
389 			ind.ni_pathlen = strlen(nfs_pub.np_index);
390 			ind.ni_cnd.cn_nameptr = ind.ni_cnd.cn_pnbuf =
391 			    nfs_pub.np_index;
392 			ind.ni_startdir = nd.ni_vp;
393 			VREF(ind.ni_startdir);
394 			error = lookup(&ind);
395 			if (!error) {
396 				/*
397 				 * Found an index file. Get rid of
398 				 * the old references.
399 				 */
400 				if (dirp)
401 					vrele(dirp);
402 				dirp = nd.ni_vp;
403 				vrele(nd.ni_startdir);
404 				ndp = &ind;
405 			} else
406 				error = 0;
407 		}
408 		/*
409 		 * If the public filehandle was used, check that this lookup
410 		 * didn't result in a filehandle outside the publicly exported
411 		 * filesystem.
412 		 */
413 
414 		if (!error && ndp->ni_vp->v_mount != nfs_pub.np_mount) {
415 			vput(nd.ni_vp);
416 			error = EPERM;
417 		}
418 	}
419 
420 	if (dirp) {
421 		if (v3)
422 			dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred);
423 		vrele(dirp);
424 	}
425 
426 	if (error) {
427 		nfsm_reply(NFSX_POSTOPATTR(v3));
428 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
429 		return (0);
430 	}
431 
432 	nqsrv_getl(ndp->ni_startdir, ND_READ);
433 	PNBUF_PUT(nd.ni_cnd.cn_pnbuf);
434 	vp = ndp->ni_vp;
435 	error = nfsrv_composefh(vp, &nsfh, v3);
436 	if (!error)
437 		error = VOP_GETATTR(vp, &va, cred);
438 	vput(vp);
439 	vrele(ndp->ni_startdir);
440 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPORFATTR(v3) +
441 	    NFSX_POSTOPATTR(v3));
442 	if (error) {
443 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
444 		return (0);
445 	}
446 	nfsm_srvfhtom(&nsfh, v3);
447 	if (v3) {
448 		nfsm_srvpostop_attr(0, &va);
449 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
450 	} else {
451 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
452 		nfsm_srvfillattr(&va, fp);
453 	}
454 	nfsm_srvdone;
455 }
456 
457 /*
458  * nfs readlink service
459  */
460 int
461 nfsrv_readlink(nfsd, slp, lwp, mrq)
462 	struct nfsrv_descript *nfsd;
463 	struct nfssvc_sock *slp;
464 	struct lwp *lwp;
465 	struct mbuf **mrq;
466 {
467 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
468 	struct mbuf *nam = nfsd->nd_nam;
469 	char *dpos = nfsd->nd_dpos;
470 	kauth_cred_t cred = nfsd->nd_cr;
471 	struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
472 	struct iovec *ivp = iv;
473 	struct mbuf *mp;
474 	u_int32_t *tl;
475 	int32_t t1;
476 	char *bpos;
477 	int error = 0, rdonly, cache = 0, i, padlen, getret;
478 	uint32_t len;
479 	int v3 = (nfsd->nd_flag & ND_NFSV3);
480 	char *cp2;
481 	struct mbuf *mb, *mp2 = NULL, *mp3 = NULL, *mreq;
482 	struct vnode *vp;
483 	struct vattr attr;
484 	nfsrvfh_t nsfh;
485 	struct uio io, *uiop = &io;
486 	u_quad_t frev;
487 
488 	nfsm_srvmtofh(&nsfh);
489 	len = 0;
490 	i = 0;
491 	while (len < NFS_MAXPATHLEN) {
492 		mp = m_get(M_WAIT, MT_DATA);
493 		MCLAIM(mp, &nfs_mowner);
494 		m_clget(mp, M_WAIT);
495 		mp->m_len = NFSMSIZ(mp);
496 		if (len == 0)
497 			mp3 = mp2 = mp;
498 		else {
499 			mp2->m_next = mp;
500 			mp2 = mp;
501 		}
502 		if ((len+mp->m_len) > NFS_MAXPATHLEN) {
503 			mp->m_len = NFS_MAXPATHLEN-len;
504 			len = NFS_MAXPATHLEN;
505 		} else
506 			len += mp->m_len;
507 		ivp->iov_base = mtod(mp, void *);
508 		ivp->iov_len = mp->m_len;
509 		i++;
510 		ivp++;
511 	}
512 	uiop->uio_iov = iv;
513 	uiop->uio_iovcnt = i;
514 	uiop->uio_offset = 0;
515 	uiop->uio_resid = len;
516 	uiop->uio_rw = UIO_READ;
517 	UIO_SETUP_SYSSPACE(uiop);
518 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
519 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
520 	if (error) {
521 		m_freem(mp3);
522 		nfsm_reply(2 * NFSX_UNSIGNED);
523 		nfsm_srvpostop_attr(1, (struct vattr *)0);
524 		return (0);
525 	}
526 	if (vp->v_type != VLNK) {
527 		if (v3)
528 			error = EINVAL;
529 		else
530 			error = ENXIO;
531 		goto out;
532 	}
533 	nqsrv_getl(vp, ND_READ);
534 	error = VOP_READLINK(vp, uiop, cred);
535 out:
536 	getret = VOP_GETATTR(vp, &attr, cred);
537 	vput(vp);
538 	if (error)
539 		m_freem(mp3);
540 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_UNSIGNED);
541 	if (v3) {
542 		nfsm_srvpostop_attr(getret, &attr);
543 		if (error)
544 			return (0);
545 	}
546 	len -= uiop->uio_resid;
547 	padlen = nfsm_padlen(len);
548 	if (uiop->uio_resid || padlen)
549 		nfs_zeropad(mp3, uiop->uio_resid, padlen);
550 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
551 	*tl = txdr_unsigned(len);
552 	mb->m_next = mp3;
553 	nfsm_srvdone;
554 }
555 
556 /*
557  * nfs read service
558  */
559 int
560 nfsrv_read(nfsd, slp, lwp, mrq)
561 	struct nfsrv_descript *nfsd;
562 	struct nfssvc_sock *slp;
563 	struct lwp *lwp;
564 	struct mbuf **mrq;
565 {
566 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
567 	struct mbuf *nam = nfsd->nd_nam;
568 	char *dpos = nfsd->nd_dpos;
569 	kauth_cred_t cred = nfsd->nd_cr;
570 	struct mbuf *m;
571 	struct nfs_fattr *fp;
572 	u_int32_t *tl;
573 	int32_t t1;
574 	int i;
575 	char *bpos;
576 	int error = 0, rdonly, cache = 0, getret;
577 	int v3 = (nfsd->nd_flag & ND_NFSV3);
578 	uint32_t reqlen, len, cnt, left;
579 	int padlen;
580 	char *cp2;
581 	struct mbuf *mb, *mreq;
582 	struct vnode *vp;
583 	nfsrvfh_t nsfh;
584 	struct uio io, *uiop = &io;
585 	struct vattr va;
586 	off_t off;
587 	u_quad_t frev;
588 
589 	nfsm_srvmtofh(&nsfh);
590 	if (v3) {
591 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
592 		off = fxdr_hyper(tl);
593 	} else {
594 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
595 		off = (off_t)fxdr_unsigned(u_int32_t, *tl);
596 	}
597 	nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
598 	reqlen = fxdr_unsigned(uint32_t, *tl);
599 	reqlen = MIN(reqlen, NFS_SRVMAXDATA(nfsd));
600 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
601 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
602 	if (error) {
603 		nfsm_reply(2 * NFSX_UNSIGNED);
604 		nfsm_srvpostop_attr(1, (struct vattr *)0);
605 		return (0);
606 	}
607 	if (vp->v_type != VREG) {
608 		if (v3)
609 			error = EINVAL;
610 		else
611 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
612 	}
613 	if (!error) {
614 	    nqsrv_getl(vp, ND_READ);
615 	    if ((error = nfsrv_access(vp, VREAD, cred, rdonly, lwp, 1)) != 0)
616 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 1);
617 	}
618 	getret = VOP_GETATTR(vp, &va, cred);
619 	if (!error)
620 		error = getret;
621 	if (error) {
622 		vput(vp);
623 		nfsm_reply(NFSX_POSTOPATTR(v3));
624 		nfsm_srvpostop_attr(getret, &va);
625 		return (0);
626 	}
627 	if (off >= va.va_size)
628 		cnt = 0;
629 	else if ((off + reqlen) > va.va_size)
630 		cnt = va.va_size - off;
631 	else
632 		cnt = reqlen;
633 	nfsm_reply(NFSX_POSTOPORFATTR(v3) + 3 * NFSX_UNSIGNED+nfsm_rndup(cnt));
634 	if (v3) {
635 		nfsm_build(tl, u_int32_t *, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
636 		*tl++ = nfs_true;
637 		fp = (struct nfs_fattr *)tl;
638 		tl += (NFSX_V3FATTR / sizeof (u_int32_t));
639 	} else {
640 		nfsm_build(tl, u_int32_t *, NFSX_V2FATTR + NFSX_UNSIGNED);
641 		fp = (struct nfs_fattr *)tl;
642 		tl += (NFSX_V2FATTR / sizeof (u_int32_t));
643 	}
644 	len = left = cnt;
645 	if (cnt > 0) {
646 		if (nfsd_use_loan) {
647 			struct vm_page **pgpp;
648 			voff_t pgoff = trunc_page(off);
649 			int npages;
650 			vaddr_t lva;
651 
652 			npages = (round_page(off + cnt) - pgoff) >> PAGE_SHIFT;
653 			KASSERT(npages <= M_EXT_MAXPAGES); /* XXX */
654 
655 			/* allocate kva for mbuf data */
656 			lva = sokvaalloc(npages << PAGE_SHIFT, slp->ns_so);
657 			if (lva == 0) {
658 				/* fall back to VOP_READ */
659 				goto loan_fail;
660 			}
661 
662 			/* allocate mbuf */
663 			m = m_get(M_WAIT, MT_DATA);
664 			MCLAIM(m, &nfs_mowner);
665 			pgpp = m->m_ext.ext_pgs;
666 
667 			/* loan pages */
668 			error = uvm_loanuobjpages(&vp->v_uobj, pgoff, npages,
669 			    pgpp);
670 			if (error) {
671 				sokvafree(lva, npages << PAGE_SHIFT);
672 				m_free(m);
673 				if (error == EBUSY)
674 					goto loan_fail;
675 				goto read_error;
676 			}
677 
678 			/* associate kva to mbuf */
679 			MEXTADD(m, (void *)(lva + ((vaddr_t)off & PAGE_MASK)),
680 			    cnt, M_MBUF, soloanfree, slp->ns_so);
681 			m->m_flags |= M_EXT_PAGES | M_EXT_ROMAP;
682 			m->m_len = cnt;
683 
684 			/* map pages */
685 			for (i = 0; i < npages; i++) {
686 				pmap_kenter_pa(lva, VM_PAGE_TO_PHYS(pgpp[i]),
687 				    VM_PROT_READ);
688 				lva += PAGE_SIZE;
689 			}
690 
691 			pmap_update(pmap_kernel());
692 
693 			mb->m_next = m;
694 			mb = m;
695 			error = 0;
696 			uiop->uio_resid = 0;
697 		} else {
698 			struct iovec *iv;
699 			struct iovec *iv2;
700 			struct mbuf *m2;
701 			int siz;
702 loan_fail:
703 			/*
704 			 * Generate the mbuf list with the uio_iov ref. to it.
705 			 */
706 			i = 0;
707 			m = m2 = mb;
708 			while (left > 0) {
709 				siz = min(M_TRAILINGSPACE(m), left);
710 				if (siz > 0) {
711 					left -= siz;
712 					i++;
713 				}
714 				if (left > 0) {
715 					m = m_get(M_WAIT, MT_DATA);
716 					MCLAIM(m, &nfs_mowner);
717 					m_clget(m, M_WAIT);
718 					m->m_len = 0;
719 					m2->m_next = m;
720 					m2 = m;
721 				}
722 			}
723 			iv = malloc(i * sizeof(struct iovec), M_TEMP, M_WAITOK);
724 			uiop->uio_iov = iv2 = iv;
725 			m = mb;
726 			left = cnt;
727 			i = 0;
728 			while (left > 0) {
729 				if (m == NULL)
730 					panic("nfsrv_read iov");
731 				siz = min(M_TRAILINGSPACE(m), left);
732 				if (siz > 0) {
733 					iv->iov_base = mtod(m, char *) +
734 					    m->m_len;
735 					iv->iov_len = siz;
736 					m->m_len += siz;
737 					left -= siz;
738 					iv++;
739 					i++;
740 				}
741 				m = m->m_next;
742 			}
743 			uiop->uio_iovcnt = i;
744 			uiop->uio_offset = off;
745 			uiop->uio_resid = cnt;
746 			uiop->uio_rw = UIO_READ;
747 			UIO_SETUP_SYSSPACE(uiop);
748 			error = VOP_READ(vp, uiop, IO_NODELOCKED, cred);
749 			free((void *)iv2, M_TEMP);
750 		}
751 read_error:
752 		if (error || (getret = VOP_GETATTR(vp, &va, cred)) != 0){
753 			if (!error)
754 				error = getret;
755 			m_freem(mreq);
756 			vput(vp);
757 			nfsm_reply(NFSX_POSTOPATTR(v3));
758 			nfsm_srvpostop_attr(getret, &va);
759 			return (0);
760 		}
761 	} else {
762 		uiop->uio_resid = 0;
763 	}
764 	vput(vp);
765 	nfsm_srvfillattr(&va, fp);
766 	len -= uiop->uio_resid;
767 	padlen = nfsm_padlen(len);
768 	if (uiop->uio_resid || padlen)
769 		nfs_zeropad(mb, uiop->uio_resid, padlen);
770 	if (v3) {
771 		/* count */
772 		*tl++ = txdr_unsigned(len);
773 		/* eof */
774 		if (off + len >= va.va_size)
775 			*tl++ = nfs_true;
776 		else
777 			*tl++ = nfs_false;
778 	}
779 	*tl = txdr_unsigned(len);
780 	nfsm_srvdone;
781 }
782 
783 /*
784  * nfs write service
785  */
786 int
787 nfsrv_write(nfsd, slp, lwp, mrq)
788 	struct nfsrv_descript *nfsd;
789 	struct nfssvc_sock *slp;
790 	struct lwp *lwp;
791 	struct mbuf **mrq;
792 {
793 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
794 	struct mbuf *nam = nfsd->nd_nam;
795 	char *dpos = nfsd->nd_dpos;
796 	kauth_cred_t cred = nfsd->nd_cr;
797 	struct iovec *ivp;
798 	int i, cnt;
799 	struct mbuf *mp;
800 	struct nfs_fattr *fp;
801 	struct iovec *iv;
802 	struct vattr va, forat;
803 	u_int32_t *tl;
804 	int32_t t1;
805 	char *bpos;
806 	int error = 0, rdonly, cache = 0, len, forat_ret = 1;
807 	int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
808 	int stable = NFSV3WRITE_FILESYNC;
809 	int v3 = (nfsd->nd_flag & ND_NFSV3);
810 	char *cp2;
811 	struct mbuf *mb, *mreq;
812 	struct vnode *vp;
813 	nfsrvfh_t nsfh;
814 	struct uio io, *uiop = &io;
815 	off_t off;
816 	u_quad_t frev;
817 
818 	if (mrep == NULL) {
819 		*mrq = NULL;
820 		return (0);
821 	}
822 	nfsm_srvmtofh(&nsfh);
823 	if (v3) {
824 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
825 		off = fxdr_hyper(tl);
826 		tl += 3;
827 		stable = fxdr_unsigned(int, *tl++);
828 	} else {
829 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
830 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
831 		tl += 2;
832 	}
833 	retlen = len = fxdr_unsigned(int32_t, *tl);
834 	cnt = i = 0;
835 
836 	/*
837 	 * For NFS Version 2, it is not obvious what a write of zero length
838 	 * should do, but I might as well be consistent with Version 3,
839 	 * which is to return ok so long as there are no permission problems.
840 	 */
841 	if (len > 0) {
842 		zeroing = 1;
843 		mp = mrep;
844 		while (mp) {
845 			if (mp == md) {
846 				zeroing = 0;
847 				adjust = dpos - mtod(mp, char *);
848 				mp->m_len -= adjust;
849 				if (mp->m_len > 0 && adjust > 0)
850 					NFSMADV(mp, adjust);
851 			}
852 			if (zeroing)
853 				mp->m_len = 0;
854 			else if (mp->m_len > 0) {
855 				i += mp->m_len;
856 				if (i > len) {
857 					mp->m_len -= (i - len);
858 					zeroing	= 1;
859 				}
860 				if (mp->m_len > 0)
861 					cnt++;
862 			}
863 			mp = mp->m_next;
864 		}
865 	}
866 	if (len > NFS_MAXDATA || len < 0 || i < len) {
867 		error = EIO;
868 		nfsm_reply(2 * NFSX_UNSIGNED);
869 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
870 		return (0);
871 	}
872 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
873 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
874 	if (error) {
875 		nfsm_reply(2 * NFSX_UNSIGNED);
876 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
877 		return (0);
878 	}
879 	if (v3)
880 		forat_ret = VOP_GETATTR(vp, &forat, cred);
881 	if (vp->v_type != VREG) {
882 		if (v3)
883 			error = EINVAL;
884 		else
885 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
886 	}
887 	if (!error) {
888 		nqsrv_getl(vp, ND_WRITE);
889 		error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
890 	}
891 	if (error) {
892 		vput(vp);
893 		nfsm_reply(NFSX_WCCDATA(v3));
894 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
895 		return (0);
896 	}
897 
898 	if (len > 0) {
899 		ivp = malloc(cnt * sizeof (struct iovec), M_TEMP, M_WAITOK);
900 		uiop->uio_iov = iv = ivp;
901 		uiop->uio_iovcnt = cnt;
902 		mp = mrep;
903 		while (mp) {
904 			if (mp->m_len > 0) {
905 				ivp->iov_base = mtod(mp, void *);
906 				ivp->iov_len = mp->m_len;
907 				ivp++;
908 			}
909 			mp = mp->m_next;
910 		}
911 
912 		/*
913 		 * XXX
914 		 * The IO_METASYNC flag indicates that all metadata (and not
915 		 * just enough to ensure data integrity) must be written to
916 		 * stable storage synchronously.
917 		 * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
918 		 */
919 		if (stable == NFSV3WRITE_UNSTABLE)
920 			ioflags = IO_NODELOCKED;
921 		else if (stable == NFSV3WRITE_DATASYNC)
922 			ioflags = (IO_SYNC | IO_NODELOCKED);
923 		else
924 			ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
925 		uiop->uio_resid = len;
926 		uiop->uio_rw = UIO_WRITE;
927 		uiop->uio_offset = off;
928 		UIO_SETUP_SYSSPACE(uiop);
929 		error = VOP_WRITE(vp, uiop, ioflags, cred);
930 		nfsstats.srvvop_writes++;
931 		free(iv, M_TEMP);
932 	}
933 	aftat_ret = VOP_GETATTR(vp, &va, cred);
934 	vput(vp);
935 	if (!error)
936 		error = aftat_ret;
937 	nfsm_reply(NFSX_PREOPATTR(v3) + NFSX_POSTOPORFATTR(v3) +
938 		2 * NFSX_UNSIGNED + NFSX_WRITEVERF(v3));
939 	if (v3) {
940 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
941 		if (error)
942 			return (0);
943 		nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
944 		*tl++ = txdr_unsigned(retlen);
945 		if (stable == NFSV3WRITE_UNSTABLE)
946 			*tl++ = txdr_unsigned(stable);
947 		else
948 			*tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
949 		/*
950 		 * Actually, there is no need to txdr these fields,
951 		 * but it may make the values more human readable,
952 		 * for debugging purposes.
953 		 */
954 		*tl++ = txdr_unsigned(boottime.tv_sec);
955 		*tl = txdr_unsigned(boottime.tv_usec);
956 	} else {
957 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
958 		nfsm_srvfillattr(&va, fp);
959 	}
960 	nfsm_srvdone;
961 }
962 
963 /*
964  * XXX elad: the original NFSW_SAMECRED() macro also made sure the
965  *	     two nd_flag fields of the descriptors contained
966  *	     ND_KERBAUTH.
967  */
968 static int
969 nfsrv_samecred(kauth_cred_t cred1, kauth_cred_t cred2)
970 {
971 	int i, do_ngroups;
972 
973 	if (kauth_cred_geteuid(cred1) != kauth_cred_geteuid(cred2))
974 		return (0);
975 	if (kauth_cred_ngroups(cred1) != kauth_cred_ngroups(cred2))
976 		return (0);
977 	do_ngroups = kauth_cred_ngroups(cred1);
978 	for (i = 0; i < do_ngroups; i++)
979 		if (kauth_cred_group(cred1, i) !=
980 		    kauth_cred_group(cred2, i))
981 			return (0);
982 
983 	return (1);
984 }
985 
986 static struct nfsrvw_delayhash *
987 nfsrv_nwdelayhash(struct nfssvc_sock *slp, const nfsrvfh_t *nsfh)
988 {
989 	uint32_t hash;
990 
991 	hash = hash32_buf(NFSRVFH_DATA(nsfh), NFSRVFH_SIZE(nsfh),
992 	    HASH32_BUF_INIT);
993 	return &slp->ns_wdelayhashtbl[hash % NFS_WDELAYHASHSIZ];
994 }
995 
996 /*
997  * NFS write service with write gathering support. Called when
998  * nfsrvw_procrastinate > 0.
999  * See: Chet Juszczak, "Improving the Write Performance of an NFS Server",
1000  * in Proc. of the Winter 1994 Usenix Conference, pg. 247-259, San Franscisco,
1001  * Jan. 1994.
1002  */
1003 int
1004 nfsrv_writegather(ndp, slp, lwp, mrq)
1005 	struct nfsrv_descript **ndp;
1006 	struct nfssvc_sock *slp;
1007 	struct lwp *lwp;
1008 	struct mbuf **mrq;
1009 {
1010 	struct timeval now;
1011 	struct iovec *ivp;
1012 	struct mbuf *mp;
1013 	struct nfsrv_descript *wp, *nfsd, *owp, *swp;
1014 	struct nfs_fattr *fp;
1015 	int i = 0;
1016 	struct iovec *iov;
1017 	struct nfsrvw_delayhash *wpp;
1018 	kauth_cred_t cred;
1019 	struct vattr va, forat;
1020 	u_int32_t *tl;
1021 	int32_t t1;
1022 	char *bpos, *dpos;
1023 	int error = 0, rdonly, cache = 0, len = 0, forat_ret = 1;
1024 	int ioflags, aftat_ret = 1, adjust, v3, zeroing;
1025 	char *cp2;
1026 	struct mbuf *mb, *mreq, *mrep, *md;
1027 	struct vnode *vp;
1028 	struct uio io, *uiop = &io;
1029 	u_quad_t frev, cur_usec;
1030 
1031 	*mrq = NULL;
1032 	if (*ndp) {
1033 	    nfsd = *ndp;
1034 	    *ndp = NULL;
1035 	    mrep = nfsd->nd_mrep;
1036 	    md = nfsd->nd_md;
1037 	    dpos = nfsd->nd_dpos;
1038 	    cred = nfsd->nd_cr;
1039 	    v3 = (nfsd->nd_flag & ND_NFSV3);
1040 	    LIST_INIT(&nfsd->nd_coalesce);
1041 	    nfsd->nd_mreq = NULL;
1042 	    nfsd->nd_stable = NFSV3WRITE_FILESYNC;
1043 	    getmicrotime(&now);
1044 	    cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1045 	    nfsd->nd_time = cur_usec + nfsrvw_procrastinate;
1046 
1047 	    /*
1048 	     * Now, get the write header..
1049 	     */
1050 	    nfsm_srvmtofh(&nfsd->nd_fh);
1051 	    if (v3) {
1052 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1053 		nfsd->nd_off = fxdr_hyper(tl);
1054 		tl += 3;
1055 		nfsd->nd_stable = fxdr_unsigned(int, *tl++);
1056 	    } else {
1057 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1058 		nfsd->nd_off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1059 		tl += 2;
1060 	    }
1061 	    len = fxdr_unsigned(int32_t, *tl);
1062 	    nfsd->nd_len = len;
1063 	    nfsd->nd_eoff = nfsd->nd_off + len;
1064 
1065 	    /*
1066 	     * Trim the header out of the mbuf list and trim off any trailing
1067 	     * junk so that the mbuf list has only the write data.
1068 	     */
1069 	    zeroing = 1;
1070 	    i = 0;
1071 	    mp = mrep;
1072 	    while (mp) {
1073 		if (mp == md) {
1074 		    zeroing = 0;
1075 		    adjust = dpos - mtod(mp, char *);
1076 		    mp->m_len -= adjust;
1077 		    if (mp->m_len > 0 && adjust > 0)
1078 			NFSMADV(mp, adjust);
1079 		}
1080 		if (zeroing)
1081 		    mp->m_len = 0;
1082 		else {
1083 		    i += mp->m_len;
1084 		    if (i > len) {
1085 			mp->m_len -= (i - len);
1086 			zeroing = 1;
1087 		    }
1088 		}
1089 		mp = mp->m_next;
1090 	    }
1091 	    if (len > NFS_MAXDATA || len < 0  || i < len) {
1092 nfsmout:
1093 		m_freem(mrep);
1094 		error = EIO;
1095 		nfsm_writereply(2 * NFSX_UNSIGNED, v3);
1096 		if (v3)
1097 		    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1098 		nfsd->nd_mreq = mreq;
1099 		nfsd->nd_mrep = NULL;
1100 		nfsd->nd_time = 0;
1101 	    }
1102 
1103 	    /*
1104 	     * Add this entry to the hash and time queues.
1105 	     */
1106 	    owp = NULL;
1107 	    mutex_enter(&nfsd_lock);
1108 	    wp = LIST_FIRST(&slp->ns_tq);
1109 	    while (wp && wp->nd_time < nfsd->nd_time) {
1110 		owp = wp;
1111 		wp = LIST_NEXT(wp, nd_tq);
1112 	    }
1113 	    if (owp) {
1114 		LIST_INSERT_AFTER(owp, nfsd, nd_tq);
1115 	    } else {
1116 		LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1117 	    }
1118 	    if (nfsd->nd_mrep) {
1119 		wpp = nfsrv_nwdelayhash(slp, &nfsd->nd_fh);
1120 		owp = NULL;
1121 		wp = LIST_FIRST(wpp);
1122 		while (wp && nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1123 		    owp = wp;
1124 		    wp = LIST_NEXT(wp, nd_hash);
1125 		}
1126 		while (wp && wp->nd_off < nfsd->nd_off &&
1127 		    !nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1128 		    owp = wp;
1129 		    wp = LIST_NEXT(wp, nd_hash);
1130 		}
1131 		if (owp) {
1132 		    LIST_INSERT_AFTER(owp, nfsd, nd_hash);
1133 
1134 		    /*
1135 		     * Search the hash list for overlapping entries and
1136 		     * coalesce.
1137 		     */
1138 		    for(; nfsd && NFSW_CONTIG(owp, nfsd); nfsd = wp) {
1139 			wp = LIST_NEXT(nfsd, nd_hash);
1140 			if (nfsrv_samecred(owp->nd_cr, nfsd->nd_cr))
1141 			    nfsrvw_coalesce(owp, nfsd);
1142 		    }
1143 		} else {
1144 		    LIST_INSERT_HEAD(wpp, nfsd, nd_hash);
1145 		}
1146 	    }
1147 	    mutex_exit(&nfsd_lock);
1148 	}
1149 
1150 	/*
1151 	 * Now, do VOP_WRITE()s for any one(s) that need to be done now
1152 	 * and generate the associated reply mbuf list(s).
1153 	 */
1154 loop1:
1155 	getmicrotime(&now);
1156 	cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1157 	mutex_enter(&nfsd_lock);
1158 	for (nfsd = LIST_FIRST(&slp->ns_tq); nfsd; nfsd = owp) {
1159 		owp = LIST_NEXT(nfsd, nd_tq);
1160 		if (nfsd->nd_time > cur_usec)
1161 		    break;
1162 		if (nfsd->nd_mreq)
1163 		    continue;
1164 		LIST_REMOVE(nfsd, nd_tq);
1165 		LIST_REMOVE(nfsd, nd_hash);
1166 		mutex_exit(&nfsd_lock);
1167 
1168 		mrep = nfsd->nd_mrep;
1169 		nfsd->nd_mrep = NULL;
1170 		cred = nfsd->nd_cr;
1171 		v3 = (nfsd->nd_flag & ND_NFSV3);
1172 		forat_ret = aftat_ret = 1;
1173 		error = nfsrv_fhtovp(&nfsd->nd_fh, 1, &vp, cred, slp,
1174 		    nfsd->nd_nam, &rdonly, (nfsd->nd_flag & ND_KERBAUTH),
1175 		    false);
1176 		if (!error) {
1177 		    if (v3)
1178 			forat_ret = VOP_GETATTR(vp, &forat, cred);
1179 		    if (vp->v_type != VREG) {
1180 			if (v3)
1181 			    error = EINVAL;
1182 			else
1183 			    error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1184 		    }
1185 		} else
1186 		    vp = NULL;
1187 		if (!error) {
1188 		    nqsrv_getl(vp, ND_WRITE);
1189 		    error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
1190 		}
1191 
1192 		if (nfsd->nd_stable == NFSV3WRITE_UNSTABLE)
1193 		    ioflags = IO_NODELOCKED;
1194 		else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC)
1195 		    ioflags = (IO_SYNC | IO_NODELOCKED);
1196 		else
1197 		    ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1198 		uiop->uio_rw = UIO_WRITE;
1199 		uiop->uio_offset = nfsd->nd_off;
1200 		uiop->uio_resid = nfsd->nd_eoff - nfsd->nd_off;
1201 		UIO_SETUP_SYSSPACE(uiop);
1202 		if (uiop->uio_resid > 0) {
1203 		    mp = mrep;
1204 		    i = 0;
1205 		    while (mp) {
1206 			if (mp->m_len > 0)
1207 			    i++;
1208 			mp = mp->m_next;
1209 		    }
1210 		    uiop->uio_iovcnt = i;
1211 		    iov = malloc(i * sizeof (struct iovec), M_TEMP, M_WAITOK);
1212 		    uiop->uio_iov = ivp = iov;
1213 		    mp = mrep;
1214 		    while (mp) {
1215 			if (mp->m_len > 0) {
1216 			    ivp->iov_base = mtod(mp, void *);
1217 			    ivp->iov_len = mp->m_len;
1218 			    ivp++;
1219 			}
1220 			mp = mp->m_next;
1221 		    }
1222 		    if (!error) {
1223 			error = VOP_WRITE(vp, uiop, ioflags, cred);
1224 			nfsstats.srvvop_writes++;
1225 		    }
1226 		    free((void *)iov, M_TEMP);
1227 		}
1228 		m_freem(mrep);
1229 		if (vp) {
1230 		    aftat_ret = VOP_GETATTR(vp, &va, cred);
1231 		    vput(vp);
1232 		}
1233 
1234 		/*
1235 		 * Loop around generating replies for all write rpcs that have
1236 		 * now been completed.
1237 		 */
1238 		swp = nfsd;
1239 		do {
1240 		    if (error) {
1241 			nfsm_writereply(NFSX_WCCDATA(v3), v3);
1242 			if (v3) {
1243 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1244 			}
1245 		    } else {
1246 			nfsm_writereply(NFSX_PREOPATTR(v3) +
1247 			    NFSX_POSTOPORFATTR(v3) + 2 * NFSX_UNSIGNED +
1248 			    NFSX_WRITEVERF(v3), v3);
1249 			if (v3) {
1250 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1251 			    nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1252 			    *tl++ = txdr_unsigned(nfsd->nd_len);
1253 			    *tl++ = txdr_unsigned(swp->nd_stable);
1254 			    /*
1255 			     * Actually, there is no need to txdr these fields,
1256 			     * but it may make the values more human readable,
1257 			     * for debugging purposes.
1258 			     */
1259 			    *tl++ = txdr_unsigned(boottime.tv_sec);
1260 			    *tl = txdr_unsigned(boottime.tv_usec);
1261 			} else {
1262 			    nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1263 			    nfsm_srvfillattr(&va, fp);
1264 			}
1265 		    }
1266 		    nfsd->nd_mreq = mreq;
1267 		    if (nfsd->nd_mrep)
1268 			panic("nfsrv_write: nd_mrep not free");
1269 
1270 		    /*
1271 		     * Done. Put it at the head of the timer queue so that
1272 		     * the final phase can return the reply.
1273 		     */
1274 		    mutex_enter(&nfsd_lock);
1275 		    if (nfsd != swp) {
1276 			nfsd->nd_time = 0;
1277 			LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1278 		    }
1279 		    nfsd = LIST_FIRST(&swp->nd_coalesce);
1280 		    if (nfsd) {
1281 			LIST_REMOVE(nfsd, nd_tq);
1282 		    }
1283 		    mutex_exit(&nfsd_lock);
1284 		} while (nfsd);
1285 		swp->nd_time = 0;
1286 
1287 		mutex_enter(&nfsd_lock);
1288 		LIST_INSERT_HEAD(&slp->ns_tq, swp, nd_tq);
1289 		mutex_exit(&nfsd_lock);
1290 		goto loop1;
1291 	}
1292 	mutex_exit(&nfsd_lock);
1293 	nfs_timer_start();
1294 
1295 	/*
1296 	 * Search for a reply to return.
1297 	 */
1298 	mutex_enter(&nfsd_lock);
1299 	LIST_FOREACH(nfsd, &slp->ns_tq, nd_tq) {
1300 		if (nfsd->nd_mreq) {
1301 		    LIST_REMOVE(nfsd, nd_tq);
1302 		    *mrq = nfsd->nd_mreq;
1303 		    *ndp = nfsd;
1304 		    break;
1305 		}
1306 	}
1307 	mutex_exit(&nfsd_lock);
1308 	return (0);
1309 }
1310 
1311 /*
1312  * Coalesce the write request nfsd into owp. To do this we must:
1313  * - remove nfsd from the queues
1314  * - merge nfsd->nd_mrep into owp->nd_mrep
1315  * - update the nd_eoff and nd_stable for owp
1316  * - put nfsd on owp's nd_coalesce list
1317  * NB: Must be called at splsoftclock().
1318  */
1319 void
1320 nfsrvw_coalesce(owp, nfsd)
1321         struct nfsrv_descript *owp;
1322         struct nfsrv_descript *nfsd;
1323 {
1324         int overlap;
1325         struct mbuf *mp;
1326 	struct nfsrv_descript *m;
1327 
1328 	KASSERT(mutex_owned(&nfsd_lock));
1329 
1330         LIST_REMOVE(nfsd, nd_hash);
1331         LIST_REMOVE(nfsd, nd_tq);
1332         if (owp->nd_eoff < nfsd->nd_eoff) {
1333             overlap = owp->nd_eoff - nfsd->nd_off;
1334             if (overlap < 0)
1335                 panic("nfsrv_coalesce: bad off");
1336             if (overlap > 0)
1337                 m_adj(nfsd->nd_mrep, overlap);
1338             mp = owp->nd_mrep;
1339             while (mp->m_next)
1340                 mp = mp->m_next;
1341             mp->m_next = nfsd->nd_mrep;
1342             owp->nd_eoff = nfsd->nd_eoff;
1343         } else
1344             m_freem(nfsd->nd_mrep);
1345         nfsd->nd_mrep = NULL;
1346         if (nfsd->nd_stable == NFSV3WRITE_FILESYNC)
1347             owp->nd_stable = NFSV3WRITE_FILESYNC;
1348         else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC &&
1349             owp->nd_stable == NFSV3WRITE_UNSTABLE)
1350             owp->nd_stable = NFSV3WRITE_DATASYNC;
1351         LIST_INSERT_HEAD(&owp->nd_coalesce, nfsd, nd_tq);
1352  	/*
1353  	 * nfsd might hold coalesce elements! Move them to owp.
1354  	 * Otherwise, requests may be lost and clients will be stuck.
1355  	 */
1356 	while ((m = LIST_FIRST(&nfsd->nd_coalesce)) != NULL) {
1357 		LIST_REMOVE(m, nd_tq);
1358 		LIST_INSERT_HEAD(&owp->nd_coalesce, m, nd_tq);
1359 	}
1360 }
1361 
1362 /*
1363  * nfs create service
1364  * now does a truncate to 0 length via. setattr if it already exists
1365  */
1366 int
1367 nfsrv_create(nfsd, slp, lwp, mrq)
1368 	struct nfsrv_descript *nfsd;
1369 	struct nfssvc_sock *slp;
1370 	struct lwp *lwp;
1371 	struct mbuf **mrq;
1372 {
1373 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1374 	struct mbuf *nam = nfsd->nd_nam;
1375 	char *dpos = nfsd->nd_dpos;
1376 	kauth_cred_t cred = nfsd->nd_cr;
1377 	struct nfs_fattr *fp;
1378 	struct vattr va, dirfor, diraft;
1379 	struct nfsv2_sattr *sp;
1380 	u_int32_t *tl;
1381 	struct nameidata nd;
1382 	char *cp;
1383 	int32_t t1;
1384 	char *bpos;
1385 	int error = 0, cache = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
1386 	int rdev = 0;
1387 	int v3 = (nfsd->nd_flag & ND_NFSV3), how, exclusive_flag = 0;
1388 	char *cp2;
1389 	struct mbuf *mb, *mreq;
1390 	struct vnode *vp = NULL, *dirp = NULL;
1391 	nfsrvfh_t nsfh;
1392 	u_quad_t frev, tempsize;
1393 	u_char cverf[NFSX_V3CREATEVERF];
1394 
1395 	nd.ni_cnd.cn_nameiop = 0;
1396 	nfsm_srvmtofh(&nsfh);
1397 	nfsm_srvnamesiz(len);
1398 	nd.ni_cnd.cn_cred = cred;
1399 	nd.ni_cnd.cn_nameiop = CREATE;
1400 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1401 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1402 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1403 	if (dirp && v3) {
1404 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1405 	}
1406 	if (error) {
1407 		nfsm_reply(NFSX_WCCDATA(v3));
1408 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1409 		if (dirp)
1410 			vrele(dirp);
1411 		return (0);
1412 	}
1413 	VATTR_NULL(&va);
1414 	if (v3) {
1415 		va.va_mode = 0;
1416 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1417 		how = fxdr_unsigned(int, *tl);
1418 		switch (how) {
1419 		case NFSV3CREATE_GUARDED:
1420 			if (nd.ni_vp) {
1421 				error = EEXIST;
1422 				break;
1423 			}
1424 		case NFSV3CREATE_UNCHECKED:
1425 			nfsm_srvsattr(&va);
1426 			break;
1427 		case NFSV3CREATE_EXCLUSIVE:
1428 			nfsm_dissect(cp, void *, NFSX_V3CREATEVERF);
1429 			memcpy(cverf, cp, NFSX_V3CREATEVERF);
1430 			exclusive_flag = 1;
1431 			break;
1432 		};
1433 		va.va_type = VREG;
1434 	} else {
1435 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1436 		va.va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1437 		if (va.va_type == VNON)
1438 			va.va_type = VREG;
1439 		va.va_mode = nfstov_mode(sp->sa_mode);
1440 		switch (va.va_type) {
1441 		case VREG:
1442 			tsize = fxdr_unsigned(int32_t, sp->sa_size);
1443 			if (tsize != -1)
1444 				va.va_size = (u_quad_t)tsize;
1445 			break;
1446 		case VCHR:
1447 		case VBLK:
1448 		case VFIFO:
1449 			rdev = fxdr_unsigned(int32_t, sp->sa_size);
1450 			break;
1451 		default:
1452 			break;
1453 		};
1454 	}
1455 
1456 	/*
1457 	 * Iff doesn't exist, create it
1458 	 * otherwise just truncate to 0 length
1459 	 *   should I set the mode too ??
1460 	 */
1461 	if (nd.ni_vp == NULL) {
1462 		if (va.va_type == VREG || va.va_type == VSOCK) {
1463 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1464 			error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1465 			if (!error) {
1466 				if (exclusive_flag) {
1467 					exclusive_flag = 0;
1468 					VATTR_NULL(&va);
1469 					/*
1470 					 * XXX
1471 					 * assuming NFSX_V3CREATEVERF
1472 					 * == sizeof(nfstime3)
1473 					 */
1474 					fxdr_nfsv3time(cverf, &va.va_atime);
1475 					error = VOP_SETATTR(nd.ni_vp, &va,
1476 						cred);
1477 				}
1478 			}
1479 		} else if (va.va_type == VCHR || va.va_type == VBLK ||
1480 			va.va_type == VFIFO) {
1481 			if (va.va_type == VCHR && rdev == 0xffffffff)
1482 				va.va_type = VFIFO;
1483 			if (va.va_type != VFIFO &&
1484 			    (error = kauth_authorize_generic(cred,
1485 			    KAUTH_GENERIC_ISSUSER, NULL))) {
1486 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1487 				vput(nd.ni_dvp);
1488 				nfsm_reply(0);
1489 				return (error);
1490 			} else
1491 				va.va_rdev = (dev_t)rdev;
1492 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1493 			error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd,
1494 			    &va);
1495 			if (error) {
1496 				nfsm_reply(0);
1497 			}
1498 			if (nd.ni_cnd.cn_flags & ISSYMLINK) {
1499 				vput(nd.ni_vp);
1500 				vrele(nd.ni_dvp);
1501 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1502 				error = EINVAL;
1503 				nfsm_reply(0);
1504 			}
1505 		} else {
1506 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1507 			vput(nd.ni_dvp);
1508 			error = ENXIO;
1509 		}
1510 		vp = nd.ni_vp;
1511 	} else {
1512 		vp = nd.ni_vp;
1513 		if (nd.ni_dvp == vp)
1514 			vrele(nd.ni_dvp);
1515 		else
1516 			vput(nd.ni_dvp);
1517 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1518 		if (!error && va.va_size != -1) {
1519 			error = nfsrv_access(vp, VWRITE, cred,
1520 			    (nd.ni_cnd.cn_flags & RDONLY), lwp, 0);
1521 			if (!error) {
1522 				nqsrv_getl(vp, ND_WRITE);
1523 				tempsize = va.va_size;
1524 				VATTR_NULL(&va);
1525 				va.va_size = tempsize;
1526 				error = VOP_SETATTR(vp, &va, cred);
1527 			}
1528 		}
1529 		if (error)
1530 			vput(vp);
1531 	}
1532 	if (!error) {
1533 		error = nfsrv_composefh(vp, &nsfh, v3);
1534 		if (!error)
1535 			error = VOP_GETATTR(vp, &va, cred);
1536 		vput(vp);
1537 	}
1538 	if (v3) {
1539 		if (exclusive_flag && !error) {
1540 			/*
1541 			 * XXX assuming NFSX_V3CREATEVERF == sizeof(nfstime3)
1542 			 */
1543 			char oldverf[NFSX_V3CREATEVERF];
1544 
1545 			txdr_nfsv3time(&va.va_atime, oldverf);
1546 			if (memcmp(cverf, oldverf, NFSX_V3CREATEVERF))
1547 				error = EEXIST;
1548 		}
1549 		if (dirp) {
1550 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1551 		}
1552 	}
1553 	if (dirp) {
1554 		vrele(dirp);
1555 	}
1556 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_FATTR(v3) + NFSX_WCCDATA(v3));
1557 	if (v3) {
1558 		if (!error) {
1559 			nfsm_srvpostop_fh(&nsfh);
1560 			nfsm_srvpostop_attr(0, &va);
1561 		}
1562 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1563 	} else {
1564 		nfsm_srvfhtom(&nsfh, v3);
1565 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1566 		nfsm_srvfillattr(&va, fp);
1567 	}
1568 	return (0);
1569 nfsmout:
1570 	if (dirp)
1571 		vrele(dirp);
1572 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1573 	if (nd.ni_dvp == nd.ni_vp)
1574 		vrele(nd.ni_dvp);
1575 	else
1576 		vput(nd.ni_dvp);
1577 	if (nd.ni_vp)
1578 		vput(nd.ni_vp);
1579 	return (error);
1580 }
1581 
1582 /*
1583  * nfs v3 mknod service
1584  */
1585 int
1586 nfsrv_mknod(nfsd, slp, lwp, mrq)
1587 	struct nfsrv_descript *nfsd;
1588 	struct nfssvc_sock *slp;
1589 	struct lwp *lwp;
1590 	struct mbuf **mrq;
1591 {
1592 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1593 	struct mbuf *nam = nfsd->nd_nam;
1594 	char *dpos = nfsd->nd_dpos;
1595 	kauth_cred_t cred = nfsd->nd_cr;
1596 	struct vattr va, dirfor, diraft;
1597 	u_int32_t *tl;
1598 	struct nameidata nd;
1599 	int32_t t1;
1600 	char *bpos;
1601 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1602 	u_int32_t major, minor;
1603 	enum vtype vtyp;
1604 	char *cp2;
1605 	struct mbuf *mb, *mreq;
1606 	struct vnode *vp, *dirp = (struct vnode *)0;
1607 	nfsrvfh_t nsfh;
1608 	u_quad_t frev;
1609 
1610 	nd.ni_cnd.cn_nameiop = 0;
1611 	nfsm_srvmtofh(&nsfh);
1612 	nfsm_srvnamesiz(len);
1613 	nd.ni_cnd.cn_cred = cred;
1614 	nd.ni_cnd.cn_nameiop = CREATE;
1615 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1616 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1617 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1618 	if (dirp)
1619 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1620 	if (error) {
1621 		nfsm_reply(NFSX_WCCDATA(1));
1622 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1623 		if (dirp)
1624 			vrele(dirp);
1625 		return (0);
1626 	}
1627 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1628 	vtyp = nfsv3tov_type(*tl);
1629 	if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1630 		error = NFSERR_BADTYPE;
1631 		goto abort;
1632 	}
1633 	VATTR_NULL(&va);
1634 	va.va_mode = 0;
1635 	nfsm_srvsattr(&va);
1636 	if (vtyp == VCHR || vtyp == VBLK) {
1637 		dev_t rdev;
1638 
1639 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1640 		major = fxdr_unsigned(u_int32_t, *tl++);
1641 		minor = fxdr_unsigned(u_int32_t, *tl);
1642 		rdev = makedev(major, minor);
1643 		if (major(rdev) != major || minor(rdev) != minor) {
1644 			error = EINVAL;
1645 			goto abort;
1646 		}
1647 		va.va_rdev = rdev;
1648 	}
1649 
1650 	/*
1651 	 * Iff doesn't exist, create it.
1652 	 */
1653 	if (nd.ni_vp) {
1654 		error = EEXIST;
1655 abort:
1656 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1657 		if (nd.ni_dvp == nd.ni_vp)
1658 			vrele(nd.ni_dvp);
1659 		else
1660 			vput(nd.ni_dvp);
1661 		if (nd.ni_vp)
1662 			vput(nd.ni_vp);
1663 		goto out;
1664 	}
1665 	va.va_type = vtyp;
1666 	if (vtyp == VSOCK) {
1667 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1668 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1669 	} else {
1670 		if (va.va_type != VFIFO &&
1671 		    (error = kauth_authorize_generic(cred,
1672 		    KAUTH_GENERIC_ISSUSER, NULL))) {
1673 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1674 			vput(nd.ni_dvp);
1675 			goto out;
1676 		}
1677 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1678 		error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1679 		if (error)
1680 			goto out;
1681 		if (nd.ni_cnd.cn_flags & ISSYMLINK) {
1682 			vput(nd.ni_vp);
1683 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1684 			error = EINVAL;
1685 		}
1686 	}
1687 out:
1688 	vp = nd.ni_vp;
1689 	if (!error) {
1690 		error = nfsrv_composefh(vp, &nsfh, true);
1691 		if (!error)
1692 			error = VOP_GETATTR(vp, &va, cred);
1693 		vput(vp);
1694 	}
1695 	if (dirp) {
1696 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1697 		vrele(dirp);
1698 	}
1699 	nfsm_reply(NFSX_SRVFH(&nsfh, true) + NFSX_POSTOPATTR(1) +
1700 	    NFSX_WCCDATA(1));
1701 	if (!error) {
1702 		nfsm_srvpostop_fh(&nsfh);
1703 		nfsm_srvpostop_attr(0, &va);
1704 	}
1705 	nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1706 	return (0);
1707 nfsmout:
1708 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1709 	if (nd.ni_dvp == nd.ni_vp)
1710 		vrele(nd.ni_dvp);
1711 	else
1712 		vput(nd.ni_dvp);
1713 	if (nd.ni_vp)
1714 		vput(nd.ni_vp);
1715 	if (dirp)
1716 		vrele(dirp);
1717 	return (error);
1718 }
1719 
1720 /*
1721  * nfs remove service
1722  */
1723 int
1724 nfsrv_remove(nfsd, slp, lwp, mrq)
1725 	struct nfsrv_descript *nfsd;
1726 	struct nfssvc_sock *slp;
1727 	struct lwp *lwp;
1728 	struct mbuf **mrq;
1729 {
1730 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1731 	struct mbuf *nam = nfsd->nd_nam;
1732 	char *dpos = nfsd->nd_dpos;
1733 	kauth_cred_t cred = nfsd->nd_cr;
1734 	struct nameidata nd;
1735 	u_int32_t *tl;
1736 	int32_t t1;
1737 	char *bpos;
1738 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1739 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1740 	char *cp2;
1741 	struct mbuf *mb, *mreq;
1742 	struct vnode *vp, *dirp;
1743 	struct vattr dirfor, diraft;
1744 	nfsrvfh_t nsfh;
1745 	u_quad_t frev;
1746 
1747 #ifndef nolint
1748 	vp = (struct vnode *)0;
1749 #endif
1750 	nfsm_srvmtofh(&nsfh);
1751 	nfsm_srvnamesiz(len);
1752 	nd.ni_cnd.cn_cred = cred;
1753 	nd.ni_cnd.cn_nameiop = DELETE;
1754 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1755 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1756 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1757 	if (dirp && v3) {
1758 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1759 	}
1760 	if (!error) {
1761 		vp = nd.ni_vp;
1762 		if (vp->v_type == VDIR &&
1763 		    (error = kauth_authorize_generic(cred,
1764 		    KAUTH_GENERIC_ISSUSER, NULL)) != 0)
1765 			goto out;
1766 		/*
1767 		 * The root of a mounted filesystem cannot be deleted.
1768 		 */
1769 		if (vp->v_vflag & VV_ROOT) {
1770 			error = EBUSY;
1771 			goto out;
1772 		}
1773 out:
1774 		if (!error) {
1775 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1776 			nqsrv_getl(vp, ND_WRITE);
1777 			error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1778 		} else {
1779 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1780 			if (nd.ni_dvp == vp)
1781 				vrele(nd.ni_dvp);
1782 			else
1783 				vput(nd.ni_dvp);
1784 			vput(vp);
1785 		}
1786 	}
1787 	if (dirp) {
1788 		if (v3) {
1789 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1790 		}
1791 		vrele(dirp);
1792 	}
1793 	nfsm_reply(NFSX_WCCDATA(v3));
1794 	if (v3) {
1795 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1796 		return (0);
1797 	}
1798 	nfsm_srvdone;
1799 }
1800 
1801 /*
1802  * nfs rename service
1803  */
1804 int
1805 nfsrv_rename(nfsd, slp, lwp, mrq)
1806 	struct nfsrv_descript *nfsd;
1807 	struct nfssvc_sock *slp;
1808 	struct lwp *lwp;
1809 	struct mbuf **mrq;
1810 {
1811 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1812 	struct mbuf *nam = nfsd->nd_nam;
1813 	char *dpos = nfsd->nd_dpos;
1814 	kauth_cred_t cred = nfsd->nd_cr;
1815 	u_int32_t *tl;
1816 	int32_t t1;
1817 	char *bpos;
1818 	int error = 0, cache = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1819 	uint32_t len, len2;
1820 	int tdirfor_ret = 1, tdiraft_ret = 1;
1821 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1822 	char *cp2;
1823 	struct mbuf *mb, *mreq;
1824 	struct nameidata fromnd, tond;
1825 	struct vnode *fvp, *tvp, *tdvp;
1826 	struct vnode *fdirp = NULL, *tdirp = NULL;
1827 	struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
1828 	nfsrvfh_t fnsfh, tnsfh;
1829 	u_quad_t frev;
1830 	uid_t saved_uid;
1831 
1832 #ifndef nolint
1833 	fvp = (struct vnode *)0;
1834 #endif
1835 	fromnd.ni_cnd.cn_nameiop = 0;
1836 	tond.ni_cnd.cn_nameiop = 0;
1837 	nfsm_srvmtofh(&fnsfh);
1838 	nfsm_srvnamesiz(len);
1839 	/*
1840 	 * Remember our original uid so that we can reset cr_uid before
1841 	 * the second nfs_namei() call, in case it is remapped.
1842 	 */
1843 	saved_uid = kauth_cred_geteuid(cred);
1844 	fromnd.ni_cnd.cn_cred = cred;
1845 	fromnd.ni_cnd.cn_nameiop = DELETE;
1846 	fromnd.ni_cnd.cn_flags = LOCKPARENT | SAVESTART;
1847 	error = nfs_namei(&fromnd, &fnsfh, len, slp, nam, &md,
1848 		&dpos, &fdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1849 	if (fdirp && v3) {
1850 		fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor, cred);
1851 	}
1852 	if (error) {
1853 		nfsm_reply(2 * NFSX_WCCDATA(v3));
1854 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1855 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1856 		if (fdirp)
1857 			vrele(fdirp);
1858 		return (0);
1859 	}
1860 	if (fromnd.ni_dvp != fromnd.ni_vp) {
1861 		VOP_UNLOCK(fromnd.ni_dvp, 0);
1862 	}
1863 	fvp = fromnd.ni_vp;
1864 	nfsm_srvmtofh(&tnsfh);
1865 	if (v3) {
1866 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
1867 		len2 = fxdr_unsigned(uint32_t, *tl);
1868 		/* len2 will be checked by nfs_namei */
1869 	}
1870 	else {
1871 		/* NFSv2 */
1872 		nfsm_strsiz(len2, NFS_MAXNAMLEN);
1873 	}
1874 	kauth_cred_seteuid(cred, saved_uid);
1875 	tond.ni_cnd.cn_cred = cred;
1876 	tond.ni_cnd.cn_nameiop = RENAME;
1877 	tond.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | NOCACHE | SAVESTART;
1878 	error = nfs_namei(&tond, &tnsfh, len2, slp, nam, &md,
1879 		&dpos, &tdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1880 	if (tdirp && v3) {
1881 		tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor, cred);
1882 	}
1883 	if (error) {
1884 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1885 		vrele(fromnd.ni_dvp);
1886 		vrele(fvp);
1887 		goto out1;
1888 	}
1889 	tdvp = tond.ni_dvp;
1890 	tvp = tond.ni_vp;
1891 	if (tvp != NULL) {
1892 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
1893 			if (v3)
1894 				error = EEXIST;
1895 			else
1896 				error = EISDIR;
1897 			goto out;
1898 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
1899 			if (v3)
1900 				error = EEXIST;
1901 			else
1902 				error = ENOTDIR;
1903 			goto out;
1904 		}
1905 		if (tvp->v_type == VDIR && tvp->v_mountedhere) {
1906 			if (v3)
1907 				error = EXDEV;
1908 			else
1909 				error = ENOTEMPTY;
1910 			goto out;
1911 		}
1912 	}
1913 	if (fvp->v_type == VDIR && fvp->v_mountedhere) {
1914 		if (v3)
1915 			error = EXDEV;
1916 		else
1917 			error = ENOTEMPTY;
1918 		goto out;
1919 	}
1920 	if (fvp->v_mount != tdvp->v_mount) {
1921 		if (v3)
1922 			error = EXDEV;
1923 		else
1924 			error = ENOTEMPTY;
1925 		goto out;
1926 	}
1927 	if (fvp == tdvp) {
1928 		if (v3)
1929 			error = EINVAL;
1930 		else
1931 			error = ENOTEMPTY;
1932 	}
1933 	/*
1934 	 * If source is the same as the destination (that is the
1935 	 * same vnode with the same name in the same directory),
1936 	 * then there is nothing to do.
1937 	 */
1938 	if (fvp == tvp && fromnd.ni_dvp == tdvp &&
1939 	    fromnd.ni_cnd.cn_namelen == tond.ni_cnd.cn_namelen &&
1940 	    !memcmp(fromnd.ni_cnd.cn_nameptr, tond.ni_cnd.cn_nameptr,
1941 	      fromnd.ni_cnd.cn_namelen))
1942 		error = -1;
1943 out:
1944 	if (!error) {
1945 		nqsrv_getl(fromnd.ni_dvp, ND_WRITE);
1946 		nqsrv_getl(tdvp, ND_WRITE);
1947 		if (tvp) {
1948 			nqsrv_getl(tvp, ND_WRITE);
1949 		}
1950 		error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
1951 				   tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
1952 	} else {
1953 		VOP_ABORTOP(tond.ni_dvp, &tond.ni_cnd);
1954 		if (tdvp == tvp)
1955 			vrele(tdvp);
1956 		else
1957 			vput(tdvp);
1958 		if (tvp)
1959 			vput(tvp);
1960 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1961 		vrele(fromnd.ni_dvp);
1962 		vrele(fvp);
1963 		if (error == -1)
1964 			error = 0;
1965 	}
1966 	vrele(tond.ni_startdir);
1967 	PNBUF_PUT(tond.ni_cnd.cn_pnbuf);
1968 out1:
1969 	if (fdirp) {
1970 		if (v3) {
1971 			fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred);
1972 		}
1973 		vrele(fdirp);
1974 	}
1975 	if (tdirp) {
1976 		if (v3) {
1977 			tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred);
1978 		}
1979 		vrele(tdirp);
1980 	}
1981 	vrele(fromnd.ni_startdir);
1982 	PNBUF_PUT(fromnd.ni_cnd.cn_pnbuf);
1983 	nfsm_reply(2 * NFSX_WCCDATA(v3));
1984 	if (v3) {
1985 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1986 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1987 	}
1988 	return (0);
1989 
1990 nfsmout:
1991 	if (fdirp)
1992 		vrele(fdirp);
1993 #ifdef notdef
1994 	if (tdirp)
1995 		vrele(tdirp);
1996 #endif
1997 	if (tond.ni_cnd.cn_nameiop) {
1998 		vrele(tond.ni_startdir);
1999 		PNBUF_PUT(tond.ni_cnd.cn_pnbuf);
2000 	}
2001 	if (fromnd.ni_cnd.cn_nameiop) {
2002 		vrele(fromnd.ni_startdir);
2003 		PNBUF_PUT(fromnd.ni_cnd.cn_pnbuf);
2004 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2005 		vrele(fromnd.ni_dvp);
2006 		vrele(fvp);
2007 	}
2008 	return (error);
2009 }
2010 
2011 /*
2012  * nfs link service
2013  */
2014 int
2015 nfsrv_link(nfsd, slp, lwp, mrq)
2016 	struct nfsrv_descript *nfsd;
2017 	struct nfssvc_sock *slp;
2018 	struct lwp *lwp;
2019 	struct mbuf **mrq;
2020 {
2021 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2022 	struct mbuf *nam = nfsd->nd_nam;
2023 	char *dpos = nfsd->nd_dpos;
2024 	kauth_cred_t cred = nfsd->nd_cr;
2025 	struct nameidata nd;
2026 	u_int32_t *tl;
2027 	int32_t t1;
2028 	char *bpos;
2029 	int error = 0, rdonly, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2030 	int getret = 1, v3 = (nfsd->nd_flag & ND_NFSV3);
2031 	char *cp2;
2032 	struct mbuf *mb, *mreq;
2033 	struct vnode *vp, *xp, *dirp = (struct vnode *)0;
2034 	struct vattr dirfor, diraft, at;
2035 	nfsrvfh_t nsfh, dnsfh;
2036 	u_quad_t frev;
2037 
2038 	nfsm_srvmtofh(&nsfh);
2039 	nfsm_srvmtofh(&dnsfh);
2040 	nfsm_srvnamesiz(len);
2041 	error = nfsrv_fhtovp(&nsfh, false, &vp, cred, slp, nam,
2042 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2043 	if (error) {
2044 		nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2045 		nfsm_srvpostop_attr(getret, &at);
2046 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2047 		return (0);
2048 	}
2049 	if (vp->v_type == VDIR && (error = kauth_authorize_generic(cred,
2050 	    KAUTH_GENERIC_ISSUSER, NULL)) != 0)
2051 		goto out1;
2052 	nd.ni_cnd.cn_cred = cred;
2053 	nd.ni_cnd.cn_nameiop = CREATE;
2054 	nd.ni_cnd.cn_flags = LOCKPARENT;
2055 	error = nfs_namei(&nd, &dnsfh, len, slp, nam, &md, &dpos,
2056 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2057 	if (dirp && v3) {
2058 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2059 	}
2060 	if (error)
2061 		goto out1;
2062 	xp = nd.ni_vp;
2063 	if (xp != NULL) {
2064 		error = EEXIST;
2065 		goto out;
2066 	}
2067 	xp = nd.ni_dvp;
2068 	if (vp->v_mount != xp->v_mount)
2069 		error = EXDEV;
2070 out:
2071 	if (!error) {
2072 		nqsrv_getl(vp, ND_WRITE);
2073 		nqsrv_getl(xp, ND_WRITE);
2074 		error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
2075 	} else {
2076 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2077 		if (nd.ni_dvp == nd.ni_vp)
2078 			vrele(nd.ni_dvp);
2079 		else
2080 			vput(nd.ni_dvp);
2081 		if (nd.ni_vp)
2082 			vrele(nd.ni_vp);
2083 	}
2084 out1:
2085 	if (v3)
2086 		getret = VOP_GETATTR(vp, &at, cred);
2087 	if (dirp) {
2088 		if (v3) {
2089 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2090 		}
2091 		vrele(dirp);
2092 	}
2093 	vrele(vp);
2094 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2095 	if (v3) {
2096 		nfsm_srvpostop_attr(getret, &at);
2097 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2098 		return (0);
2099 	}
2100 	nfsm_srvdone;
2101 }
2102 
2103 /*
2104  * nfs symbolic link service
2105  */
2106 int
2107 nfsrv_symlink(nfsd, slp, lwp, mrq)
2108 	struct nfsrv_descript *nfsd;
2109 	struct nfssvc_sock *slp;
2110 	struct lwp *lwp;
2111 	struct mbuf **mrq;
2112 {
2113 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2114 	struct mbuf *nam = nfsd->nd_nam;
2115 	char *dpos = nfsd->nd_dpos;
2116 	kauth_cred_t cred = nfsd->nd_cr;
2117 	struct vattr va, dirfor, diraft;
2118 	struct nameidata nd;
2119 	u_int32_t *tl;
2120 	int32_t t1;
2121 	struct nfsv2_sattr *sp;
2122 	char *bpos, *pathcp = NULL, *cp2;
2123 	struct uio io;
2124 	struct iovec iv;
2125 	int error = 0, cache = 0, dirfor_ret = 1, diraft_ret = 1;
2126 	uint32_t len, len2;
2127 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2128 	struct mbuf *mb, *mreq;
2129 	struct vnode *dirp = (struct vnode *)0;
2130 	nfsrvfh_t nsfh;
2131 	u_quad_t frev;
2132 
2133 	nd.ni_cnd.cn_nameiop = 0;
2134 	nfsm_srvmtofh(&nsfh);
2135 	nfsm_srvnamesiz(len);
2136 	nd.ni_cnd.cn_cred = cred;
2137 	nd.ni_cnd.cn_nameiop = CREATE;
2138 	nd.ni_cnd.cn_flags = LOCKPARENT;
2139 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2140 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2141 	if (dirp && v3) {
2142 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2143 	}
2144 	if (error)
2145 		goto out;
2146 	VATTR_NULL(&va);
2147 	va.va_type = VLNK;
2148 	if (v3) {
2149 		va.va_mode = 0;
2150 		nfsm_srvsattr(&va);
2151 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
2152 		len2 = fxdr_unsigned(uint32_t, *tl);
2153 		if (len2 > PATH_MAX) {
2154 			/* XXX should check _PC_NO_TRUNC */
2155 			error = ENAMETOOLONG;
2156 			goto abortop;
2157 		}
2158 	}
2159 	else {
2160 		/* NFSv2 */
2161 		nfsm_strsiz(len2, NFS_MAXPATHLEN);
2162 	}
2163 	pathcp = malloc(len2 + 1, M_TEMP, M_WAITOK);
2164 	iv.iov_base = pathcp;
2165 	iv.iov_len = len2;
2166 	io.uio_resid = len2;
2167 	io.uio_offset = 0;
2168 	io.uio_iov = &iv;
2169 	io.uio_iovcnt = 1;
2170 	io.uio_rw = UIO_READ;
2171 	UIO_SETUP_SYSSPACE(&io);
2172 	nfsm_mtouio(&io, len2);
2173 	if (!v3) {
2174 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
2175 		va.va_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
2176 	}
2177 	*(pathcp + len2) = '\0';
2178 	if (nd.ni_vp) {
2179 		error = EEXIST;
2180 abortop:
2181 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2182 		if (nd.ni_dvp == nd.ni_vp)
2183 			vrele(nd.ni_dvp);
2184 		else
2185 			vput(nd.ni_dvp);
2186 		if (nd.ni_vp)
2187 			vrele(nd.ni_vp);
2188 		goto out;
2189 	}
2190 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2191 	error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va, pathcp);
2192 	if (!error) {
2193 	    if (v3) {
2194 		error = nfsrv_composefh(nd.ni_vp, &nsfh, v3);
2195 		if (!error)
2196 		    error = VOP_GETATTR(nd.ni_vp, &va, cred);
2197 		vput(nd.ni_vp);
2198 	    } else {
2199 		vput(nd.ni_vp);
2200 	    }
2201 	}
2202 out:
2203 	if (pathcp)
2204 		free(pathcp, M_TEMP);
2205 	if (dirp) {
2206 		if (v3) {
2207 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2208 		}
2209 		vrele(dirp);
2210 	}
2211 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2212 	    NFSX_WCCDATA(v3));
2213 	if (v3) {
2214 		if (!error) {
2215 			nfsm_srvpostop_fh(&nsfh);
2216 			nfsm_srvpostop_attr(0, &va);
2217 		}
2218 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2219 	}
2220 	return (0);
2221 nfsmout:
2222 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2223 	if (nd.ni_dvp == nd.ni_vp)
2224 		vrele(nd.ni_dvp);
2225 	else
2226 		vput(nd.ni_dvp);
2227 	if (nd.ni_vp)
2228 		vrele(nd.ni_vp);
2229 	if (dirp)
2230 		vrele(dirp);
2231 	if (pathcp)
2232 		free(pathcp, M_TEMP);
2233 	return (error);
2234 }
2235 
2236 /*
2237  * nfs mkdir service
2238  */
2239 int
2240 nfsrv_mkdir(nfsd, slp, lwp, mrq)
2241 	struct nfsrv_descript *nfsd;
2242 	struct nfssvc_sock *slp;
2243 	struct lwp *lwp;
2244 	struct mbuf **mrq;
2245 {
2246 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2247 	struct mbuf *nam = nfsd->nd_nam;
2248 	char *dpos = nfsd->nd_dpos;
2249 	kauth_cred_t cred = nfsd->nd_cr;
2250 	struct vattr va, dirfor, diraft;
2251 	struct nfs_fattr *fp;
2252 	struct nameidata nd;
2253 	char *cp;
2254 	u_int32_t *tl;
2255 	int32_t t1;
2256 	char *bpos;
2257 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2258 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2259 	char *cp2;
2260 	struct mbuf *mb, *mreq;
2261 	struct vnode *vp, *dirp = (struct vnode *)0;
2262 	nfsrvfh_t nsfh;
2263 	u_quad_t frev;
2264 
2265 	nfsm_srvmtofh(&nsfh);
2266 	nfsm_srvnamesiz(len);
2267 	nd.ni_cnd.cn_cred = cred;
2268 	nd.ni_cnd.cn_nameiop = CREATE;
2269 	nd.ni_cnd.cn_flags = LOCKPARENT;
2270 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2271 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2272 	if (dirp && v3) {
2273 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2274 	}
2275 	if (error) {
2276 		nfsm_reply(NFSX_WCCDATA(v3));
2277 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2278 		if (dirp)
2279 			vrele(dirp);
2280 		return (0);
2281 	}
2282 	VATTR_NULL(&va);
2283 	if (v3) {
2284 		va.va_mode = 0;
2285 		nfsm_srvsattr(&va);
2286 	} else {
2287 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
2288 		va.va_mode = nfstov_mode(*tl++);
2289 	}
2290 	va.va_type = VDIR;
2291 	vp = nd.ni_vp;
2292 	if (vp != NULL) {
2293 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2294 		if (nd.ni_dvp == vp)
2295 			vrele(nd.ni_dvp);
2296 		else
2297 			vput(nd.ni_dvp);
2298 		vrele(vp);
2299 		error = EEXIST;
2300 		goto out;
2301 	}
2302 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2303 	error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
2304 	if (!error) {
2305 		vp = nd.ni_vp;
2306 		error = nfsrv_composefh(vp, &nsfh, v3);
2307 		if (!error)
2308 			error = VOP_GETATTR(vp, &va, cred);
2309 		vput(vp);
2310 	}
2311 out:
2312 	if (dirp) {
2313 		if (v3) {
2314 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2315 		}
2316 		vrele(dirp);
2317 	}
2318 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2319 	    NFSX_WCCDATA(v3));
2320 	if (v3) {
2321 		if (!error) {
2322 			nfsm_srvpostop_fh(&nsfh);
2323 			nfsm_srvpostop_attr(0, &va);
2324 		}
2325 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2326 	} else {
2327 		nfsm_srvfhtom(&nsfh, v3);
2328 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
2329 		nfsm_srvfillattr(&va, fp);
2330 	}
2331 	return (0);
2332 nfsmout:
2333 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2334 	if (nd.ni_dvp == nd.ni_vp)
2335 		vrele(nd.ni_dvp);
2336 	else
2337 		vput(nd.ni_dvp);
2338 	if (nd.ni_vp)
2339 		vrele(nd.ni_vp);
2340 	if (dirp)
2341 		vrele(dirp);
2342 	return (error);
2343 }
2344 
2345 /*
2346  * nfs rmdir service
2347  */
2348 int
2349 nfsrv_rmdir(nfsd, slp, lwp, mrq)
2350 	struct nfsrv_descript *nfsd;
2351 	struct nfssvc_sock *slp;
2352 	struct lwp *lwp;
2353 	struct mbuf **mrq;
2354 {
2355 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2356 	struct mbuf *nam = nfsd->nd_nam;
2357 	char *dpos = nfsd->nd_dpos;
2358 	kauth_cred_t cred = nfsd->nd_cr;
2359 	u_int32_t *tl;
2360 	int32_t t1;
2361 	char *bpos;
2362 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2363 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2364 	char *cp2;
2365 	struct mbuf *mb, *mreq;
2366 	struct vnode *vp, *dirp = (struct vnode *)0;
2367 	struct vattr dirfor, diraft;
2368 	nfsrvfh_t nsfh;
2369 	struct nameidata nd;
2370 	u_quad_t frev;
2371 
2372 	nfsm_srvmtofh(&nsfh);
2373 	nfsm_srvnamesiz(len);
2374 	nd.ni_cnd.cn_cred = cred;
2375 	nd.ni_cnd.cn_nameiop = DELETE;
2376 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
2377 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2378 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2379 	if (dirp && v3) {
2380 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2381 	}
2382 	if (error) {
2383 		nfsm_reply(NFSX_WCCDATA(v3));
2384 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2385 		if (dirp)
2386 			vrele(dirp);
2387 		return (0);
2388 	}
2389 	vp = nd.ni_vp;
2390 	if (vp->v_type != VDIR) {
2391 		error = ENOTDIR;
2392 		goto out;
2393 	}
2394 	/*
2395 	 * No rmdir "." please.
2396 	 */
2397 	if (nd.ni_dvp == vp) {
2398 		error = EINVAL;
2399 		goto out;
2400 	}
2401 	/*
2402 	 * The root of a mounted filesystem cannot be deleted.
2403 	 */
2404 	if (vp->v_vflag & VV_ROOT)
2405 		error = EBUSY;
2406 out:
2407 	if (!error) {
2408 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
2409 		nqsrv_getl(vp, ND_WRITE);
2410 		error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
2411 	} else {
2412 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2413 		if (nd.ni_dvp == nd.ni_vp)
2414 			vrele(nd.ni_dvp);
2415 		else
2416 			vput(nd.ni_dvp);
2417 		vput(vp);
2418 	}
2419 	if (dirp) {
2420 		if (v3) {
2421 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2422 		}
2423 		vrele(dirp);
2424 	}
2425 	nfsm_reply(NFSX_WCCDATA(v3));
2426 	if (v3) {
2427 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2428 		return (0);
2429 	}
2430 	nfsm_srvdone;
2431 }
2432 
2433 /*
2434  * nfs readdir service
2435  * - mallocs what it thinks is enough to read
2436  *	count rounded up to a multiple of NFS_SRVDIRBLKSIZ <= NFS_MAXREADDIR
2437  * - calls VOP_READDIR()
2438  * - loops around building the reply
2439  *	if the output generated exceeds count break out of loop
2440  *	The nfsm_clget macro is used here so that the reply will be packed
2441  *	tightly in mbuf clusters.
2442  * - it only knows that it has encountered eof when the VOP_READDIR()
2443  *	reads nothing
2444  * - as such one readdir rpc will return eof false although you are there
2445  *	and then the next will return eof
2446  * - it trims out records with d_fileno == 0
2447  *	this doesn't matter for Unix clients, but they might confuse clients
2448  *	for other os'.
2449  * - it trims out records with d_type == DT_WHT
2450  *	these cannot be seen through NFS (unless we extend the protocol)
2451  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2452  *	than requested, but this may not apply to all filesystems. For
2453  *	example, client NFS does not { although it is never remote mounted
2454  *	anyhow }
2455  *     The alternate call nfsrv_readdirplus() does lookups as well.
2456  * PS: The NFS protocol spec. does not clarify what the "count" byte
2457  *	argument is a count of.. just name strings and file id's or the
2458  *	entire reply rpc or ...
2459  *	I tried just file name and id sizes and it confused the Sun client,
2460  *	so I am using the full rpc size now. The "paranoia.." comment refers
2461  *	to including the status longwords that are not a part of the dir.
2462  *	"entry" structures, but are in the rpc.
2463  */
2464 
2465 #define	NFS_SRVDIRBLKSIZ	1024
2466 
2467 struct flrep {
2468 	nfsuint64 fl_off;
2469 	u_int32_t fl_postopok;
2470 	u_int32_t fl_fattr[NFSX_V3FATTR / sizeof (u_int32_t)];
2471 	u_int32_t fl_fhok;
2472 	u_int32_t fl_fhsize;
2473 };
2474 
2475 int
2476 nfsrv_readdir(nfsd, slp, lwp, mrq)
2477 	struct nfsrv_descript *nfsd;
2478 	struct nfssvc_sock *slp;
2479 	struct lwp *lwp;
2480 	struct mbuf **mrq;
2481 {
2482 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2483 	struct mbuf *nam = nfsd->nd_nam;
2484 	char *dpos = nfsd->nd_dpos;
2485 	kauth_cred_t cred = nfsd->nd_cr;
2486 	char *bp, *be;
2487 	struct mbuf *mp;
2488 	struct dirent *dp;
2489 	char *cp;
2490 	u_int32_t *tl;
2491 	int32_t t1;
2492 	char *bpos;
2493 	struct mbuf *mb, *mreq, *mp2;
2494 	char *cpos, *cend, *cp2, *rbuf;
2495 	struct vnode *vp;
2496 	struct vattr at;
2497 	nfsrvfh_t nsfh;
2498 	struct uio io;
2499 	struct iovec iv;
2500 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2501 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, ncookies;
2502 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2503 	u_quad_t frev, off, toff, verf;
2504 	off_t *cookies = NULL, *cookiep;
2505 	nfsuint64 jar;
2506 
2507 	nfsm_srvmtofh(&nsfh);
2508 	if (v3) {
2509 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2510 		toff = fxdr_hyper(tl);
2511 		tl += 2;
2512 		verf = fxdr_hyper(tl);
2513 		tl += 2;
2514 	} else {
2515 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2516 		toff = fxdr_unsigned(u_quad_t, *tl++);
2517 	}
2518 	off = toff;
2519 	cnt = fxdr_unsigned(int, *tl);
2520 	siz = ((cnt + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2521 	xfer = NFS_SRVMAXDATA(nfsd);
2522 	if (siz > xfer)
2523 		siz = xfer;
2524 	fullsiz = siz;
2525 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2526 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2527 	if (!error && vp->v_type != VDIR) {
2528 		error = ENOTDIR;
2529 		vput(vp);
2530 	}
2531 	if (error) {
2532 		nfsm_reply(NFSX_UNSIGNED);
2533 		nfsm_srvpostop_attr(getret, &at);
2534 		return (0);
2535 	}
2536 	nqsrv_getl(vp, ND_READ);
2537 	if (v3) {
2538 		error = getret = VOP_GETATTR(vp, &at, cred);
2539 #ifdef NFS3_STRICTVERF
2540 		/*
2541 		 * XXX This check is too strict for Solaris 2.5 clients.
2542 		 */
2543 		if (!error && toff && verf != at.va_filerev)
2544 			error = NFSERR_BAD_COOKIE;
2545 #endif
2546 	}
2547 	if (!error)
2548 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2549 	if (error) {
2550 		vput(vp);
2551 		nfsm_reply(NFSX_POSTOPATTR(v3));
2552 		nfsm_srvpostop_attr(getret, &at);
2553 		return (0);
2554 	}
2555 	VOP_UNLOCK(vp, 0);
2556 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2557 again:
2558 	iv.iov_base = rbuf;
2559 	iv.iov_len = fullsiz;
2560 	io.uio_iov = &iv;
2561 	io.uio_iovcnt = 1;
2562 	io.uio_offset = (off_t)off;
2563 	io.uio_resid = fullsiz;
2564 	io.uio_rw = UIO_READ;
2565 	UIO_SETUP_SYSSPACE(&io);
2566 	eofflag = 0;
2567 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2568 
2569 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2570 
2571 	off = (off_t)io.uio_offset;
2572 	if (!cookies && !error)
2573 		error = NFSERR_PERM;
2574 	if (v3) {
2575 		getret = VOP_GETATTR(vp, &at, cred);
2576 		if (!error)
2577 			error = getret;
2578 	}
2579 
2580 	VOP_UNLOCK(vp, 0);
2581 	if (error) {
2582 		vrele(vp);
2583 		free((void *)rbuf, M_TEMP);
2584 		if (cookies)
2585 			free((void *)cookies, M_TEMP);
2586 		nfsm_reply(NFSX_POSTOPATTR(v3));
2587 		nfsm_srvpostop_attr(getret, &at);
2588 		return (0);
2589 	}
2590 	if (io.uio_resid) {
2591 		siz -= io.uio_resid;
2592 
2593 		/*
2594 		 * If nothing read, return eof
2595 		 * rpc reply
2596 		 */
2597 		if (siz == 0) {
2598 			vrele(vp);
2599 			nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) +
2600 				2 * NFSX_UNSIGNED);
2601 			if (v3) {
2602 				nfsm_srvpostop_attr(getret, &at);
2603 				nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
2604 				txdr_hyper(at.va_filerev, tl);
2605 				tl += 2;
2606 			} else
2607 				nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2608 			*tl++ = nfs_false;
2609 			*tl = nfs_true;
2610 			free((void *)rbuf, M_TEMP);
2611 			free((void *)cookies, M_TEMP);
2612 			return (0);
2613 		}
2614 	}
2615 
2616 	/*
2617 	 * Check for degenerate cases of nothing useful read.
2618 	 * If so go try again
2619 	 */
2620 	cpos = rbuf;
2621 	cend = rbuf + siz;
2622 	dp = (struct dirent *)cpos;
2623 	cookiep = cookies;
2624 
2625 	while (cpos < cend && ncookies > 0 &&
2626 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
2627 		cpos += dp->d_reclen;
2628 		dp = (struct dirent *)cpos;
2629 		cookiep++;
2630 		ncookies--;
2631 	}
2632 	if (cpos >= cend || ncookies == 0) {
2633 		toff = off;
2634 		siz = fullsiz;
2635 		free(cookies, M_TEMP);
2636 		cookies = NULL;
2637 		goto again;
2638 	}
2639 
2640 	len = 3 * NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
2641 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) + siz);
2642 	if (v3) {
2643 		nfsm_srvpostop_attr(getret, &at);
2644 		nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2645 		txdr_hyper(at.va_filerev, tl);
2646 	}
2647 	mp = mp2 = mb;
2648 	bp = bpos;
2649 	be = bp + M_TRAILINGSPACE(mp);
2650 
2651 	/* Loop through the records and build reply */
2652 	while (cpos < cend && ncookies > 0) {
2653 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
2654 			nlen = dp->d_namlen;
2655 			rem = nfsm_rndup(nlen)-nlen;
2656 			len += (4 * NFSX_UNSIGNED + nlen + rem);
2657 			if (v3)
2658 				len += 2 * NFSX_UNSIGNED;
2659 			if (len > cnt) {
2660 				eofflag = 0;
2661 				break;
2662 			}
2663 			/*
2664 			 * Build the directory record xdr from
2665 			 * the dirent entry.
2666 			 */
2667 			nfsm_clget;
2668 			*tl = nfs_true;
2669 			bp += NFSX_UNSIGNED;
2670 			if (v3) {
2671 				nfsm_clget;
2672 				*tl = txdr_unsigned(dp->d_fileno >> 32);
2673 				bp += NFSX_UNSIGNED;
2674 			}
2675 			nfsm_clget;
2676 			*tl = txdr_unsigned(dp->d_fileno);
2677 			bp += NFSX_UNSIGNED;
2678 			nfsm_clget;
2679 			*tl = txdr_unsigned(nlen);
2680 			bp += NFSX_UNSIGNED;
2681 
2682 			/* And loop around copying the name */
2683 			xfer = nlen;
2684 			cp = dp->d_name;
2685 			while (xfer > 0) {
2686 				nfsm_clget;
2687 				if ((bp+xfer) > be)
2688 					tsiz = be-bp;
2689 				else
2690 					tsiz = xfer;
2691 				memcpy(bp, cp, tsiz);
2692 				bp += tsiz;
2693 				xfer -= tsiz;
2694 				if (xfer > 0)
2695 					cp += tsiz;
2696 			}
2697 			/* And null pad to an int32_t boundary */
2698 			for (i = 0; i < rem; i++)
2699 				*bp++ = '\0';
2700 			nfsm_clget;
2701 
2702 			/* Finish off the record */
2703 			txdr_hyper(*cookiep, &jar);
2704 			if (v3) {
2705 				*tl = jar.nfsuquad[0];
2706 				bp += NFSX_UNSIGNED;
2707 				nfsm_clget;
2708 			}
2709 			*tl = jar.nfsuquad[1];
2710 			bp += NFSX_UNSIGNED;
2711 		}
2712 		cpos += dp->d_reclen;
2713 		dp = (struct dirent *)cpos;
2714 		cookiep++;
2715 		ncookies--;
2716 	}
2717 	vrele(vp);
2718 	nfsm_clget;
2719 	*tl = nfs_false;
2720 	bp += NFSX_UNSIGNED;
2721 	nfsm_clget;
2722 	if (eofflag)
2723 		*tl = nfs_true;
2724 	else
2725 		*tl = nfs_false;
2726 	bp += NFSX_UNSIGNED;
2727 	if (mp != mb) {
2728 		if (bp < be)
2729 			mp->m_len = bp - mtod(mp, char *);
2730 	} else
2731 		mp->m_len += bp - bpos;
2732 	free((void *)rbuf, M_TEMP);
2733 	free((void *)cookies, M_TEMP);
2734 	nfsm_srvdone;
2735 }
2736 
2737 int
2738 nfsrv_readdirplus(nfsd, slp, lwp, mrq)
2739 	struct nfsrv_descript *nfsd;
2740 	struct nfssvc_sock *slp;
2741 	struct lwp *lwp;
2742 	struct mbuf **mrq;
2743 {
2744 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2745 	struct mbuf *nam = nfsd->nd_nam;
2746 	char *dpos = nfsd->nd_dpos;
2747 	kauth_cred_t cred = nfsd->nd_cr;
2748 	char *bp, *be;
2749 	struct mbuf *mp;
2750 	struct dirent *dp;
2751 	char *cp;
2752 	u_int32_t *tl;
2753 	int32_t t1;
2754 	char *bpos;
2755 	struct mbuf *mb, *mreq, *mp2;
2756 	char *cpos, *cend, *cp2, *rbuf;
2757 	struct vnode *vp, *nvp;
2758 	struct flrep fl;
2759 	nfsrvfh_t nsfh;
2760 	struct uio io;
2761 	struct iovec iv;
2762 	struct vattr va, at, *vap = &va;
2763 	struct nfs_fattr *fp;
2764 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2765 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, dirlen, ncookies;
2766 	u_quad_t frev, off, toff, verf;
2767 	off_t *cookies = NULL, *cookiep;
2768 
2769 	nfsm_srvmtofh(&nsfh);
2770 	nfsm_dissect(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2771 	toff = fxdr_hyper(tl);
2772 	tl += 2;
2773 	verf = fxdr_hyper(tl);
2774 	tl += 2;
2775 	siz = fxdr_unsigned(int, *tl++);
2776 	cnt = fxdr_unsigned(int, *tl);
2777 	off = toff;
2778 	siz = ((siz + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2779 	xfer = NFS_SRVMAXDATA(nfsd);
2780 	if (siz > xfer)
2781 		siz = xfer;
2782 	fullsiz = siz;
2783 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2784 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2785 	if (!error && vp->v_type != VDIR) {
2786 		error = ENOTDIR;
2787 		vput(vp);
2788 	}
2789 	if (error) {
2790 		nfsm_reply(NFSX_UNSIGNED);
2791 		nfsm_srvpostop_attr(getret, &at);
2792 		return (0);
2793 	}
2794 	error = getret = VOP_GETATTR(vp, &at, cred);
2795 #ifdef NFS3_STRICTVERF
2796 	/*
2797 	 * XXX This check is too strict for Solaris 2.5 clients.
2798 	 */
2799 	if (!error && toff && verf != at.va_filerev)
2800 		error = NFSERR_BAD_COOKIE;
2801 #endif
2802 	if (!error) {
2803 		nqsrv_getl(vp, ND_READ);
2804 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2805 	}
2806 	if (error) {
2807 		vput(vp);
2808 		nfsm_reply(NFSX_V3POSTOPATTR);
2809 		nfsm_srvpostop_attr(getret, &at);
2810 		return (0);
2811 	}
2812 	VOP_UNLOCK(vp, 0);
2813 
2814 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2815 again:
2816 	iv.iov_base = rbuf;
2817 	iv.iov_len = fullsiz;
2818 	io.uio_iov = &iv;
2819 	io.uio_iovcnt = 1;
2820 	io.uio_offset = (off_t)off;
2821 	io.uio_resid = fullsiz;
2822 	io.uio_rw = UIO_READ;
2823 	UIO_SETUP_SYSSPACE(&io);
2824 	eofflag = 0;
2825 
2826 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2827 
2828 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2829 
2830 	off = (u_quad_t)io.uio_offset;
2831 	getret = VOP_GETATTR(vp, &at, cred);
2832 
2833 	VOP_UNLOCK(vp, 0);
2834 
2835 	/*
2836 	 * If the VGET operation doesn't work for this filesystem,
2837 	 * we can't support readdirplus. Returning NOTSUPP should
2838 	 * make clients fall back to plain readdir.
2839 	 * There's no need to check for VPTOFH as well, we wouldn't
2840 	 * even be here otherwise.
2841 	 */
2842 	if (!getret) {
2843 		if ((getret = VFS_VGET(vp->v_mount, at.va_fileid, &nvp)))
2844 			getret = (getret == EOPNOTSUPP) ?
2845 				NFSERR_NOTSUPP : NFSERR_IO;
2846 		else
2847 			vput(nvp);
2848 	}
2849 
2850 	if (!cookies && !error)
2851 		error = NFSERR_PERM;
2852 	if (!error)
2853 		error = getret;
2854 	if (error) {
2855 		vrele(vp);
2856 		if (cookies)
2857 			free((void *)cookies, M_TEMP);
2858 		free((void *)rbuf, M_TEMP);
2859 		nfsm_reply(NFSX_V3POSTOPATTR);
2860 		nfsm_srvpostop_attr(getret, &at);
2861 		return (0);
2862 	}
2863 	if (io.uio_resid) {
2864 		siz -= io.uio_resid;
2865 
2866 		/*
2867 		 * If nothing read, return eof
2868 		 * rpc reply
2869 		 */
2870 		if (siz == 0) {
2871 			vrele(vp);
2872 			nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
2873 				2 * NFSX_UNSIGNED);
2874 			nfsm_srvpostop_attr(getret, &at);
2875 			nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
2876 			txdr_hyper(at.va_filerev, tl);
2877 			tl += 2;
2878 			*tl++ = nfs_false;
2879 			*tl = nfs_true;
2880 			free((void *)cookies, M_TEMP);
2881 			free((void *)rbuf, M_TEMP);
2882 			return (0);
2883 		}
2884 	}
2885 
2886 	/*
2887 	 * Check for degenerate cases of nothing useful read.
2888 	 * If so go try again
2889 	 */
2890 	cpos = rbuf;
2891 	cend = rbuf + siz;
2892 	dp = (struct dirent *)cpos;
2893 	cookiep = cookies;
2894 
2895 	while (cpos < cend && ncookies > 0 &&
2896 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
2897 		cpos += dp->d_reclen;
2898 		dp = (struct dirent *)cpos;
2899 		cookiep++;
2900 		ncookies--;
2901 	}
2902 	if (cpos >= cend || ncookies == 0) {
2903 		toff = off;
2904 		siz = fullsiz;
2905 		free(cookies, M_TEMP);
2906 		cookies = NULL;
2907 		goto again;
2908 	}
2909 
2910 	dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF + 2 * NFSX_UNSIGNED;
2911 	nfsm_reply(cnt);
2912 	nfsm_srvpostop_attr(getret, &at);
2913 	nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2914 	txdr_hyper(at.va_filerev, tl);
2915 	mp = mp2 = mb;
2916 	bp = bpos;
2917 	be = bp + M_TRAILINGSPACE(mp);
2918 
2919 	/* Loop through the records and build reply */
2920 	while (cpos < cend && ncookies > 0) {
2921 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
2922 			nfsrvfh_t nnsfh;
2923 
2924 			nlen = dp->d_namlen;
2925 			rem = nfsm_rndup(nlen)-nlen;
2926 
2927 			/*
2928 			 * For readdir_and_lookup get the vnode using
2929 			 * the file number.
2930 			 */
2931 			if (VFS_VGET(vp->v_mount, dp->d_fileno, &nvp))
2932 				goto invalid;
2933 			if (nfsrv_composefh(nvp, &nnsfh, true)) {
2934 				vput(nvp);
2935 				goto invalid;
2936 			}
2937 			if (VOP_GETATTR(nvp, vap, cred)) {
2938 				vput(nvp);
2939 				goto invalid;
2940 			}
2941 			vput(nvp);
2942 
2943 			/*
2944 			 * If either the dircount or maxcount will be
2945 			 * exceeded, get out now. Both of these lengths
2946 			 * are calculated conservatively, including all
2947 			 * XDR overheads.
2948 			 */
2949 			len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
2950 				NFSX_V3POSTOPATTR);
2951 			dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
2952 			if (len > cnt || dirlen > fullsiz) {
2953 				eofflag = 0;
2954 				break;
2955 			}
2956 
2957 			/*
2958 			 * Build the directory record xdr from
2959 			 * the dirent entry.
2960 			 */
2961 			fp = (struct nfs_fattr *)&fl.fl_fattr;
2962 			nfsm_srvfillattr(vap, fp);
2963 			fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
2964 			fl.fl_fhok = nfs_true;
2965 			fl.fl_postopok = nfs_true;
2966 			txdr_hyper(*cookiep, fl.fl_off.nfsuquad);
2967 
2968 			nfsm_clget;
2969 			*tl = nfs_true;
2970 			bp += NFSX_UNSIGNED;
2971 			nfsm_clget;
2972 			*tl = txdr_unsigned(dp->d_fileno >> 32);
2973 			bp += NFSX_UNSIGNED;
2974 			nfsm_clget;
2975 			*tl = txdr_unsigned(dp->d_fileno);
2976 			bp += NFSX_UNSIGNED;
2977 			nfsm_clget;
2978 			*tl = txdr_unsigned(nlen);
2979 			bp += NFSX_UNSIGNED;
2980 
2981 			/* And loop around copying the name */
2982 			xfer = nlen;
2983 			cp = dp->d_name;
2984 			while (xfer > 0) {
2985 				nfsm_clget;
2986 				if ((bp + xfer) > be)
2987 					tsiz = be - bp;
2988 				else
2989 					tsiz = xfer;
2990 				memcpy(bp, cp, tsiz);
2991 				bp += tsiz;
2992 				xfer -= tsiz;
2993 				if (xfer > 0)
2994 					cp += tsiz;
2995 			}
2996 			/* And null pad to an int32_t boundary */
2997 			for (i = 0; i < rem; i++)
2998 				*bp++ = '\0';
2999 
3000 			/*
3001 			 * Now copy the flrep structure out.
3002 			 */
3003 			xfer = sizeof(struct flrep);
3004 			cp = (void *)&fl;
3005 			while (xfer > 0) {
3006 				nfsm_clget;
3007 				if ((bp + xfer) > be)
3008 					tsiz = be - bp;
3009 				else
3010 					tsiz = xfer;
3011 				memcpy(bp, cp, tsiz);
3012 				bp += tsiz;
3013 				xfer -= tsiz;
3014 				if (xfer > 0)
3015 					cp += tsiz;
3016 			}
3017 
3018 			/*
3019 			 * ... and filehandle.
3020 			 */
3021 			xfer = NFSRVFH_SIZE(&nnsfh);
3022 			cp = NFSRVFH_DATA(&nnsfh);
3023 			while (xfer > 0) {
3024 				nfsm_clget;
3025 				if ((bp + xfer) > be)
3026 					tsiz = be - bp;
3027 				else
3028 					tsiz = xfer;
3029 				memcpy(bp, cp, tsiz);
3030 				bp += tsiz;
3031 				xfer -= tsiz;
3032 				if (xfer > 0)
3033 					cp += tsiz;
3034 			}
3035 		}
3036 invalid:
3037 		cpos += dp->d_reclen;
3038 		dp = (struct dirent *)cpos;
3039 		cookiep++;
3040 		ncookies--;
3041 	}
3042 	vrele(vp);
3043 	nfsm_clget;
3044 	*tl = nfs_false;
3045 	bp += NFSX_UNSIGNED;
3046 	nfsm_clget;
3047 	if (eofflag)
3048 		*tl = nfs_true;
3049 	else
3050 		*tl = nfs_false;
3051 	bp += NFSX_UNSIGNED;
3052 	if (mp != mb) {
3053 		if (bp < be)
3054 			mp->m_len = bp - mtod(mp, char *);
3055 	} else
3056 		mp->m_len += bp - bpos;
3057 	free((void *)cookies, M_TEMP);
3058 	free((void *)rbuf, M_TEMP);
3059 	nfsm_srvdone;
3060 }
3061 
3062 /*
3063  * nfs commit service
3064  */
3065 int
3066 nfsrv_commit(nfsd, slp, lwp, mrq)
3067 	struct nfsrv_descript *nfsd;
3068 	struct nfssvc_sock *slp;
3069 	struct lwp *lwp;
3070 	struct mbuf **mrq;
3071 {
3072 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3073 	struct mbuf *nam = nfsd->nd_nam;
3074 	char *dpos = nfsd->nd_dpos;
3075 	kauth_cred_t cred = nfsd->nd_cr;
3076 	struct vattr bfor, aft;
3077 	struct vnode *vp;
3078 	nfsrvfh_t nsfh;
3079 	u_int32_t *tl;
3080 	int32_t t1;
3081 	char *bpos;
3082 	int error = 0, rdonly, for_ret = 1, aft_ret = 1, cache = 0;
3083 	uint32_t cnt;
3084 	char *cp2;
3085 	struct mbuf *mb, *mreq;
3086 	u_quad_t frev, off, end;
3087 
3088 	nfsm_srvmtofh(&nsfh);
3089 	nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3090 
3091 	off = fxdr_hyper(tl);
3092 	tl += 2;
3093 	cnt = fxdr_unsigned(uint32_t, *tl);
3094 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3095 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3096 	if (error) {
3097 		nfsm_reply(2 * NFSX_UNSIGNED);
3098 		nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3099 		return (0);
3100 	}
3101 	for_ret = VOP_GETATTR(vp, &bfor, cred);
3102 	end = (cnt > 0) ? off + cnt : vp->v_size;
3103 	if (end < off || end > vp->v_size)
3104 		end = vp->v_size;
3105 	if (off < vp->v_size)
3106 		error = VOP_FSYNC(vp, cred, FSYNC_WAIT, off, end);
3107 	/* else error == 0, from nfsrv_fhtovp() */
3108 	aft_ret = VOP_GETATTR(vp, &aft, cred);
3109 	vput(vp);
3110 	nfsm_reply(NFSX_V3WCCDATA + NFSX_V3WRITEVERF);
3111 	nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3112 	if (!error) {
3113 		nfsm_build(tl, u_int32_t *, NFSX_V3WRITEVERF);
3114 		*tl++ = txdr_unsigned(boottime.tv_sec);
3115 		*tl = txdr_unsigned(boottime.tv_usec);
3116 	} else {
3117 		return (0);
3118 	}
3119 	nfsm_srvdone;
3120 }
3121 
3122 /*
3123  * nfs statfs service
3124  */
3125 int
3126 nfsrv_statfs(nfsd, slp, lwp, mrq)
3127 	struct nfsrv_descript *nfsd;
3128 	struct nfssvc_sock *slp;
3129 	struct lwp *lwp;
3130 	struct mbuf **mrq;
3131 {
3132 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3133 	struct mbuf *nam = nfsd->nd_nam;
3134 	char *dpos = nfsd->nd_dpos;
3135 	kauth_cred_t cred = nfsd->nd_cr;
3136 	struct statvfs *sf = NULL;
3137 	struct nfs_statfs *sfp;
3138 	u_int32_t *tl;
3139 	int32_t t1;
3140 	char *bpos;
3141 	int error = 0, rdonly, cache = 0, getret = 1;
3142 	int v3 = (nfsd->nd_flag & ND_NFSV3);
3143 	char *cp2;
3144 	struct mbuf *mb, *mreq;
3145 	struct vnode *vp;
3146 	struct vattr at;
3147 	nfsrvfh_t nsfh;
3148 	u_quad_t frev, tval;
3149 
3150 	nfsm_srvmtofh(&nsfh);
3151 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3152 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3153 	if (error) {
3154 		nfsm_reply(NFSX_UNSIGNED);
3155 		nfsm_srvpostop_attr(getret, &at);
3156 		return (0);
3157 	}
3158 	sf = malloc(sizeof(*sf), M_TEMP, M_WAITOK);
3159 	error = VFS_STATVFS(vp->v_mount, sf);
3160 	getret = VOP_GETATTR(vp, &at, cred);
3161 	vput(vp);
3162 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_STATFS(v3));
3163 	if (v3)
3164 		nfsm_srvpostop_attr(getret, &at);
3165 	if (error) {
3166 		free(sf, M_TEMP);
3167 		return (0);
3168 	}
3169 	nfsm_build(sfp, struct nfs_statfs *, NFSX_STATFS(v3));
3170 	if (v3) {
3171 		tval = (u_quad_t)((quad_t)sf->f_blocks * (quad_t)sf->f_frsize);
3172 		txdr_hyper(tval, &sfp->sf_tbytes);
3173 		tval = (u_quad_t)((quad_t)sf->f_bfree * (quad_t)sf->f_frsize);
3174 		txdr_hyper(tval, &sfp->sf_fbytes);
3175 		tval = (u_quad_t)((quad_t)sf->f_bavail * (quad_t)sf->f_frsize);
3176 		txdr_hyper(tval, &sfp->sf_abytes);
3177 		tval = (u_quad_t)sf->f_files;
3178 		txdr_hyper(tval, &sfp->sf_tfiles);
3179 		tval = (u_quad_t)sf->f_ffree;
3180 		txdr_hyper(tval, &sfp->sf_ffiles);
3181 		txdr_hyper(tval, &sfp->sf_afiles);
3182 		sfp->sf_invarsec = 0;
3183 	} else {
3184 		sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
3185 		sfp->sf_bsize = txdr_unsigned(sf->f_frsize);
3186 		sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
3187 		sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
3188 		sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
3189 	}
3190 nfsmout:
3191 	if (sf)
3192 	    free(sf, M_TEMP);
3193 	return error;
3194 }
3195 
3196 /*
3197  * nfs fsinfo service
3198  */
3199 int
3200 nfsrv_fsinfo(nfsd, slp, lwp, mrq)
3201 	struct nfsrv_descript *nfsd;
3202 	struct nfssvc_sock *slp;
3203 	struct lwp *lwp;
3204 	struct mbuf **mrq;
3205 {
3206 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3207 	struct mbuf *nam = nfsd->nd_nam;
3208 	char *dpos = nfsd->nd_dpos;
3209 	kauth_cred_t cred = nfsd->nd_cr;
3210 	u_int32_t *tl;
3211 	struct nfsv3_fsinfo *sip;
3212 	int32_t t1;
3213 	char *bpos;
3214 	int error = 0, rdonly, cache = 0, getret = 1;
3215 	uint32_t maxdata;
3216 	char *cp2;
3217 	struct mbuf *mb, *mreq;
3218 	struct vnode *vp;
3219 	struct vattr at;
3220 	nfsrvfh_t nsfh;
3221 	u_quad_t frev, maxfsize;
3222 	struct statvfs *sb;
3223 
3224 	nfsm_srvmtofh(&nsfh);
3225 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3226 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3227 	if (error) {
3228 		nfsm_reply(NFSX_UNSIGNED);
3229 		nfsm_srvpostop_attr(getret, &at);
3230 		return (0);
3231 	}
3232 
3233 	/* XXX Try to make a guess on the max file size. */
3234 	sb = malloc(sizeof(*sb), M_TEMP, M_WAITOK);
3235 	VFS_STATVFS(vp->v_mount, sb);
3236 	maxfsize = (u_quad_t)0x80000000 * sb->f_frsize - 1;
3237 	free(sb, M_TEMP);
3238 
3239 	getret = VOP_GETATTR(vp, &at, cred);
3240 	vput(vp);
3241 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3FSINFO);
3242 	nfsm_srvpostop_attr(getret, &at);
3243 	nfsm_build(sip, struct nfsv3_fsinfo *, NFSX_V3FSINFO);
3244 
3245 	/*
3246 	 * XXX
3247 	 * There should be file system VFS OP(s) to get this information.
3248 	 * For now, assume ufs.
3249 	 */
3250 	if (slp->ns_so->so_type == SOCK_DGRAM)
3251 		maxdata = NFS_MAXDGRAMDATA;
3252 	else
3253 		maxdata = NFS_MAXDATA;
3254 	sip->fs_rtmax = txdr_unsigned(maxdata);
3255 	sip->fs_rtpref = txdr_unsigned(maxdata);
3256 	sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
3257 	sip->fs_wtmax = txdr_unsigned(maxdata);
3258 	sip->fs_wtpref = txdr_unsigned(maxdata);
3259 	sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
3260 	sip->fs_dtpref = txdr_unsigned(maxdata);
3261 	txdr_hyper(maxfsize, &sip->fs_maxfilesize);
3262 	sip->fs_timedelta.nfsv3_sec = 0;
3263 	sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
3264 	sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
3265 		NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
3266 		NFSV3FSINFO_CANSETTIME);
3267 	nfsm_srvdone;
3268 }
3269 
3270 /*
3271  * nfs pathconf service
3272  */
3273 int
3274 nfsrv_pathconf(nfsd, slp, lwp, mrq)
3275 	struct nfsrv_descript *nfsd;
3276 	struct nfssvc_sock *slp;
3277 	struct lwp *lwp;
3278 	struct mbuf **mrq;
3279 {
3280 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3281 	struct mbuf *nam = nfsd->nd_nam;
3282 	char *dpos = nfsd->nd_dpos;
3283 	kauth_cred_t cred = nfsd->nd_cr;
3284 	u_int32_t *tl;
3285 	struct nfsv3_pathconf *pc;
3286 	int32_t t1;
3287 	char *bpos;
3288 	int error = 0, rdonly, cache = 0, getret = 1;
3289 	register_t linkmax, namemax, chownres, notrunc;
3290 	char *cp2;
3291 	struct mbuf *mb, *mreq;
3292 	struct vnode *vp;
3293 	struct vattr at;
3294 	nfsrvfh_t nsfh;
3295 	u_quad_t frev;
3296 
3297 	nfsm_srvmtofh(&nsfh);
3298 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3299 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3300 	if (error) {
3301 		nfsm_reply(NFSX_UNSIGNED);
3302 		nfsm_srvpostop_attr(getret, &at);
3303 		return (0);
3304 	}
3305 	error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
3306 	if (!error)
3307 		error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
3308 	if (!error)
3309 		error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
3310 	if (!error)
3311 		error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
3312 	getret = VOP_GETATTR(vp, &at, cred);
3313 	vput(vp);
3314 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3PATHCONF);
3315 	nfsm_srvpostop_attr(getret, &at);
3316 	if (error)
3317 		return (0);
3318 	nfsm_build(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
3319 
3320 	pc->pc_linkmax = txdr_unsigned(linkmax);
3321 	pc->pc_namemax = txdr_unsigned(namemax);
3322 	pc->pc_notrunc = txdr_unsigned(notrunc);
3323 	pc->pc_chownrestricted = txdr_unsigned(chownres);
3324 
3325 	/*
3326 	 * These should probably be supported by VOP_PATHCONF(), but
3327 	 * until msdosfs is exportable (why would you want to?), the
3328 	 * Unix defaults should be ok.
3329 	 */
3330 	pc->pc_caseinsensitive = nfs_false;
3331 	pc->pc_casepreserving = nfs_true;
3332 	nfsm_srvdone;
3333 }
3334 
3335 /*
3336  * Null operation, used by clients to ping server
3337  */
3338 /* ARGSUSED */
3339 int
3340 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3341     struct lwp *lwp, struct mbuf **mrq)
3342 {
3343 	struct mbuf *mrep = nfsd->nd_mrep;
3344 	char *bpos;
3345 	int error = NFSERR_RETVOID, cache = 0;
3346 	struct mbuf *mb, *mreq;
3347 	u_quad_t frev;
3348 
3349 	nfsm_reply(0);
3350 	return (0);
3351 }
3352 
3353 /*
3354  * No operation, used for obsolete procedures
3355  */
3356 /* ARGSUSED */
3357 int
3358 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3359     struct lwp *lwp, struct mbuf **mrq)
3360 {
3361 	struct mbuf *mrep = nfsd->nd_mrep;
3362 	char *bpos;
3363 	int error, cache = 0;
3364 	struct mbuf *mb, *mreq;
3365 	u_quad_t frev;
3366 
3367 	if (nfsd->nd_repstat)
3368 		error = nfsd->nd_repstat;
3369 	else
3370 		error = EPROCUNAVAIL;
3371 	nfsm_reply(0);
3372 	return (0);
3373 }
3374 
3375 /*
3376  * Perform access checking for vnodes obtained from file handles that would
3377  * refer to files already opened by a Unix client. You cannot just use
3378  * vn_writechk() and VOP_ACCESS() for two reasons.
3379  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
3380  * 2 - The owner is to be given access irrespective of mode bits for some
3381  *     operations, so that processes that chmod after opening a file don't
3382  *     break. I don't like this because it opens a security hole, but since
3383  *     the nfs server opens a security hole the size of a barn door anyhow,
3384  *     what the heck.
3385  *
3386  * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
3387  * will return EPERM instead of EACCESS. EPERM is always an error.
3388  */
3389 int
3390 nfsrv_access(vp, flags, cred, rdonly, lwp, override)
3391 	struct vnode *vp;
3392 	int flags;
3393 	kauth_cred_t cred;
3394 	int rdonly;
3395 	struct lwp *lwp;
3396 	int override;
3397 {
3398 	struct vattr vattr;
3399 	int error;
3400 	if (flags & VWRITE) {
3401 		/* Just vn_writechk() changed to check rdonly */
3402 		/*
3403 		 * Disallow write attempts on read-only file systems;
3404 		 * unless the file is a socket or a block or character
3405 		 * device resident on the file system.
3406 		 */
3407 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
3408 			switch (vp->v_type) {
3409 			case VREG:
3410 			case VDIR:
3411 			case VLNK:
3412 				return (EROFS);
3413 			default:
3414 				break;
3415 			}
3416 		}
3417 
3418 		/*
3419 		 * If the vnode is in use as a process's text,
3420 		 * we can't allow writing.
3421 		 */
3422 		if (vp->v_iflag & VI_TEXT)
3423 			return (ETXTBSY);
3424 	}
3425 	error = VOP_GETATTR(vp, &vattr, cred);
3426 	if (error)
3427 		return (error);
3428 	error = VOP_ACCESS(vp, flags, cred);
3429 	/*
3430 	 * Allow certain operations for the owner (reads and writes
3431 	 * on files that are already open).
3432 	 */
3433 	if (override && error == EACCES && kauth_cred_geteuid(cred) == vattr.va_uid)
3434 		error = 0;
3435 	return error;
3436 }
3437