xref: /netbsd-src/sys/nfs/nfs_serv.c (revision 9aa0541bdf64142d9a27c2cf274394d60182818f)
1 /*	$NetBSD: nfs_serv.c,v 1.160 2011/08/08 16:04:07 dholland Exp $	*/
2 
3 /*
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)nfs_serv.c	8.8 (Berkeley) 7/31/95
35  */
36 
37 /*
38  * nfs version 2 and 3 server calls to vnode ops
39  * - these routines generally have 3 phases
40  *   1 - break down and validate rpc request in mbuf list
41  *   2 - do the vnode ops for the request
42  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
43  *   3 - build the rpc reply in an mbuf list
44  *   nb:
45  *	- do not mix the phases, since the nfsm_?? macros can return failures
46  *	  on a bad rpc or similar and do not do any vrele() or vput()'s
47  *
48  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
49  *	error number iff error != 0 whereas
50  *	returning an error from the server function implies a fatal error
51  *	such as a badly constructed rpc request that should be dropped without
52  *	a reply.
53  *	For Version 3, nfsm_reply() does not return for the error case, since
54  *	most version 3 rpcs return more than the status for error cases.
55  */
56 
57 #include <sys/cdefs.h>
58 __KERNEL_RCSID(0, "$NetBSD: nfs_serv.c,v 1.160 2011/08/08 16:04:07 dholland Exp $");
59 
60 #include <sys/param.h>
61 #include <sys/systm.h>
62 #include <sys/proc.h>
63 #include <sys/file.h>
64 #include <sys/namei.h>
65 #include <sys/vnode.h>
66 #include <sys/mount.h>
67 #include <sys/socket.h>
68 #include <sys/socketvar.h>
69 #include <sys/mbuf.h>
70 #include <sys/dirent.h>
71 #include <sys/stat.h>
72 #include <sys/kernel.h>
73 #include <sys/hash.h>
74 #include <sys/kauth.h>
75 #include <sys/module.h>
76 #include <sys/syscall.h>
77 #include <sys/syscallargs.h>
78 #include <sys/syscallvar.h>
79 
80 #include <uvm/uvm.h>
81 
82 #include <nfs/nfsproto.h>
83 #include <nfs/rpcv2.h>
84 #include <nfs/nfs.h>
85 #include <nfs/xdr_subs.h>
86 #include <nfs/nfsm_subs.h>
87 #include <nfs/nfs_var.h>
88 
89 MODULE(MODULE_CLASS_MISC, nfsserver, "nfs");
90 
91 /* Global vars */
92 extern u_int32_t nfs_xdrneg1;
93 extern u_int32_t nfs_false, nfs_true;
94 extern const enum vtype nv3tov_type[8];
95 extern struct nfsstats nfsstats;
96 extern const nfstype nfsv2_type[9];
97 extern const nfstype nfsv3_type[9];
98 int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
99 bool nfsd_use_loan = true;	/* use page-loan for READ OP */
100 
101 #define	nqsrv_getl(vp, rw)	/* nothing */
102 
103 static const struct syscall_package nfsserver_syscalls[] = {
104 	{ SYS_nfssvc, 0, (sy_call_t *)sys_nfssvc },
105 	{ 0, 0, NULL },
106 };
107 
108 static int
109 nfsserver_modcmd(modcmd_t cmd, void *arg)
110 {
111 	extern struct vfs_hooks nfs_export_hooks;	/* XXX */
112 	int error;
113 
114 	switch (cmd) {
115 	case MODULE_CMD_INIT:
116 		error = syscall_establish(NULL, nfsserver_syscalls);
117 		if (error != 0) {
118 			return error;
119 		}
120 		nfs_init();	/* XXX for monolithic kernel */
121 		netexport_init();
122 		nfsrv_initcache();	/* Init the server request cache */
123 		nfsrv_init(0);		/* Init server data structures */
124 		vfs_hooks_attach(&nfs_export_hooks);
125 		nfs_timer_srvinit(nfsrv_timer);
126 		return 0;
127 	case MODULE_CMD_FINI:
128 		error = syscall_disestablish(NULL, nfsserver_syscalls);
129 		if (error != 0) {
130 			return error;
131 		}
132 		/*
133 		 * Kill export list before detaching VFS hooks, so we
134 		 * we don't leak state due to a concurrent umount().
135 		 */
136 		netexport_fini();
137 		vfs_hooks_detach(&nfs_export_hooks);
138 
139 		/* Kill timer before server goes away. */
140 		nfs_timer_srvfini();
141 		nfsrv_fini();
142 
143 		/* Server uses server cache, so kill cache last. */
144 		nfsrv_finicache();
145 		return 0;
146 	default:
147 		return ENOTTY;
148 	}
149 }
150 
151 /*
152  * nfs v3 access service
153  */
154 int
155 nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
156 {
157 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
158 	struct mbuf *nam = nfsd->nd_nam;
159 	char *dpos = nfsd->nd_dpos;
160 	kauth_cred_t cred = nfsd->nd_cr;
161 	struct vnode *vp;
162 	nfsrvfh_t nsfh;
163 	u_int32_t *tl;
164 	int32_t t1;
165 	char *bpos;
166 	int error = 0, rdonly, cache = 0, getret;
167 	char *cp2;
168 	struct mbuf *mb, *mreq;
169 	struct vattr va;
170 	u_long inmode, testmode, outmode;
171 	u_quad_t frev;
172 
173 	nfsm_srvmtofh(&nsfh);
174 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
175 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
176 	    (nfsd->nd_flag & ND_KERBAUTH), false);
177 	if (error) {
178 		nfsm_reply(NFSX_UNSIGNED);
179 		nfsm_srvpostop_attr(1, (struct vattr *)0);
180 		return (0);
181 	}
182 	inmode = fxdr_unsigned(u_int32_t, *tl);
183 	outmode = 0;
184 	if ((inmode & NFSV3ACCESS_READ) &&
185 	    nfsrv_access(vp, VREAD, cred, rdonly, lwp, 0) == 0)
186 		outmode |= NFSV3ACCESS_READ;
187 	if (vp->v_type != VDIR) {
188 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
189 		if (testmode &&
190 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
191 			outmode |= testmode;
192 		if ((inmode & NFSV3ACCESS_EXECUTE) &&
193 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
194 			outmode |= NFSV3ACCESS_EXECUTE;
195 	} else {
196 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
197 		    NFSV3ACCESS_DELETE);
198 		if (testmode &&
199 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
200 			outmode |= testmode;
201 		if ((inmode & NFSV3ACCESS_LOOKUP) &&
202 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
203 			outmode |= NFSV3ACCESS_LOOKUP;
204 	}
205 	getret = VOP_GETATTR(vp, &va, cred);
206 	vput(vp);
207 	nfsm_reply(NFSX_POSTOPATTR(1) + NFSX_UNSIGNED);
208 	nfsm_srvpostop_attr(getret, &va);
209 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
210 	*tl = txdr_unsigned(outmode);
211 	nfsm_srvdone;
212 }
213 
214 /*
215  * nfs getattr service
216  */
217 int
218 nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
219 {
220 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
221 	struct mbuf *nam = nfsd->nd_nam;
222 	char *dpos = nfsd->nd_dpos;
223 	kauth_cred_t cred = nfsd->nd_cr;
224 	struct nfs_fattr *fp;
225 	struct vattr va;
226 	struct vnode *vp;
227 	nfsrvfh_t nsfh;
228 	u_int32_t *tl;
229 	int32_t t1;
230 	char *bpos;
231 	int error = 0, rdonly, cache = 0;
232 	char *cp2;
233 	struct mbuf *mb, *mreq;
234 	u_quad_t frev;
235 
236 	nfsm_srvmtofh(&nsfh);
237 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
238 	    (nfsd->nd_flag & ND_KERBAUTH), false);
239 	if (error) {
240 		nfsm_reply(0);
241 		return (0);
242 	}
243 	nqsrv_getl(vp, ND_READ);
244 	error = VOP_GETATTR(vp, &va, cred);
245 	vput(vp);
246 	nfsm_reply(NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
247 	if (error)
248 		return (0);
249 	nfsm_build(fp, struct nfs_fattr *, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
250 	nfsm_srvfillattr(&va, fp);
251 	nfsm_srvdone;
252 }
253 
254 /*
255  * nfs setattr service
256  */
257 int
258 nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
259 {
260 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
261 	struct mbuf *nam = nfsd->nd_nam;
262 	char *dpos = nfsd->nd_dpos;
263 	kauth_cred_t cred = nfsd->nd_cr;
264 	struct vattr va, preat;
265 	struct nfsv2_sattr *sp;
266 	struct nfs_fattr *fp;
267 	struct vnode *vp;
268 	nfsrvfh_t nsfh;
269 	u_int32_t *tl;
270 	int32_t t1;
271 	char *bpos;
272 	int error = 0, rdonly, cache = 0, preat_ret = 1, postat_ret = 1;
273 	int v3 = (nfsd->nd_flag & ND_NFSV3), gcheck = 0;
274 	char *cp2;
275 	struct mbuf *mb, *mreq;
276 	u_quad_t frev;
277 	struct timespec guard;
278 
279 	memset(&guard, 0, sizeof guard);	/* XXX gcc */
280 
281 	nfsm_srvmtofh(&nsfh);
282 	vattr_null(&va);
283 	if (v3) {
284 		nfsm_srvsattr(&va);
285 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
286 		gcheck = fxdr_unsigned(int, *tl);
287 		if (gcheck) {
288 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
289 			fxdr_nfsv3time(tl, &guard);
290 		}
291 	} else {
292 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
293 		/*
294 		 * Nah nah nah nah na nah
295 		 * There is a bug in the Sun client that puts 0xffff in the mode
296 		 * field of sattr when it should put in 0xffffffff. The u_short
297 		 * doesn't sign extend.
298 		 * --> check the low order 2 bytes for 0xffff
299 		 */
300 		if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
301 			va.va_mode = nfstov_mode(sp->sa_mode);
302 		if (sp->sa_uid != nfs_xdrneg1)
303 			va.va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
304 		if (sp->sa_gid != nfs_xdrneg1)
305 			va.va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
306 		if (sp->sa_size != nfs_xdrneg1)
307 			va.va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
308 		if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
309 #ifdef notyet
310 			fxdr_nfsv2time(&sp->sa_atime, &va.va_atime);
311 #else
312 			va.va_atime.tv_sec =
313 				fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
314 			va.va_atime.tv_nsec = 0;
315 #endif
316 		}
317 		if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
318 			fxdr_nfsv2time(&sp->sa_mtime, &va.va_mtime);
319 
320 	}
321 
322 	/*
323 	 * Now that we have all the fields, lets do it.
324 	 */
325 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
326 	    (nfsd->nd_flag & ND_KERBAUTH), false);
327 	if (error) {
328 		nfsm_reply(2 * NFSX_UNSIGNED);
329 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
330 		return (0);
331 	}
332 	nqsrv_getl(vp, ND_WRITE);
333 	if (v3) {
334 		error = preat_ret = VOP_GETATTR(vp, &preat, cred);
335 		if (!error && gcheck &&
336 			(preat.va_ctime.tv_sec != guard.tv_sec ||
337 			 preat.va_ctime.tv_nsec != guard.tv_nsec))
338 			error = NFSERR_NOT_SYNC;
339 		if (error) {
340 			vput(vp);
341 			nfsm_reply(NFSX_WCCDATA(v3));
342 			nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
343 			return (0);
344 		}
345 	}
346 
347 	/*
348 	 * If the size is being changed write acces is required, otherwise
349 	 * just check for a read only file system.
350 	 */
351 	if (va.va_size == ((u_quad_t)((quad_t) -1))) {
352 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
353 			error = EROFS;
354 			goto out;
355 		}
356 	} else {
357 		if (vp->v_type == VDIR) {
358 			error = EISDIR;
359 			goto out;
360 		} else if ((error = nfsrv_access(vp, VWRITE, cred, rdonly,
361 			lwp, 0)) != 0)
362 			goto out;
363 	}
364 	error = VOP_SETATTR(vp, &va, cred);
365 	postat_ret = VOP_GETATTR(vp, &va, cred);
366 	if (!error)
367 		error = postat_ret;
368 out:
369 	vput(vp);
370 	nfsm_reply(NFSX_WCCORFATTR(v3));
371 	if (v3) {
372 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
373 		return (0);
374 	} else {
375 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
376 		nfsm_srvfillattr(&va, fp);
377 	}
378 	nfsm_srvdone;
379 }
380 
381 /*
382  * nfs lookup rpc
383  */
384 int
385 nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
386 {
387 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
388 	struct mbuf *nam = nfsd->nd_nam;
389 	char *dpos = nfsd->nd_dpos;
390 	kauth_cred_t cred = nfsd->nd_cr;
391 	struct nfs_fattr *fp;
392 	struct nameidata nd, ind, *ndp = &nd;
393 	struct pathbuf *ipb = NULL;
394 	struct vnode *vp, *dirp;
395 	nfsrvfh_t nsfh;
396 	char *cp;
397 	u_int32_t *tl;
398 	int32_t t1;
399 	char *bpos;
400 	int error = 0, cache = 0, dirattr_ret = 1;
401 	uint32_t len;
402 	int v3 = (nfsd->nd_flag & ND_NFSV3), pubflag;
403 	char *cp2;
404 	struct mbuf *mb, *mreq;
405 	struct vattr va, dirattr;
406 	u_quad_t frev;
407 
408 	nfsm_srvmtofh(&nsfh);
409 	nfsm_srvnamesiz(len);
410 
411 	pubflag = nfs_ispublicfh(&nsfh);
412 
413 	nd.ni_cnd.cn_cred = cred;
414 	nd.ni_cnd.cn_nameiop = LOOKUP;
415 	nd.ni_cnd.cn_flags = LOCKLEAF;
416 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
417 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), pubflag);
418 
419 	if (!error && pubflag) {
420 		if (nd.ni_vp->v_type == VDIR && nfs_pub.np_index != NULL &&
421 		    (ipb = pathbuf_create(nfs_pub.np_index)) != NULL) {
422 			/*
423 			 * Setup call to lookup() to see if we can find
424 			 * the index file. Arguably, this doesn't belong
425 			 * in a kernel.. Ugh.
426 			 */
427 			ind = nd;
428 			VOP_UNLOCK(nd.ni_vp);
429 			ind.ni_pathbuf = ipb;
430 
431 			error = lookup_for_nfsd_index(&ind, nd.ni_vp);
432 			if (!error) {
433 				/*
434 				 * Found an index file. Get rid of
435 				 * the old references.
436 				 */
437 				if (dirp)
438 					vrele(dirp);
439 				dirp = nd.ni_vp;
440 				ndp = &ind;
441 			} else
442 				error = 0;
443 		}
444 		/*
445 		 * If the public filehandle was used, check that this lookup
446 		 * didn't result in a filehandle outside the publicly exported
447 		 * filesystem.
448 		 */
449 
450 		if (!error && ndp->ni_vp->v_mount != nfs_pub.np_mount) {
451 			vput(nd.ni_vp);
452 			error = EPERM;
453 		}
454 	}
455 
456 	if (dirp) {
457 		if (v3)
458 			dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred);
459 		vrele(dirp);
460 	}
461 
462 	if (error) {
463 		if (nd.ni_pathbuf != NULL) {
464 			pathbuf_destroy(nd.ni_pathbuf);
465 		}
466 		if (ipb != NULL) {
467 			pathbuf_destroy(ipb);
468 		}
469 		nfsm_reply(NFSX_POSTOPATTR(v3));
470 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
471 		return (0);
472 	}
473 
474 	nqsrv_getl(ndp->ni_startdir, ND_READ);
475 	pathbuf_destroy(nd.ni_pathbuf);
476 	if (ipb != NULL) {
477 		pathbuf_destroy(ipb);
478 	}
479 	vp = ndp->ni_vp;
480 	error = nfsrv_composefh(vp, &nsfh, v3);
481 	if (!error)
482 		error = VOP_GETATTR(vp, &va, cred);
483 	vput(vp);
484 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPORFATTR(v3) +
485 	    NFSX_POSTOPATTR(v3));
486 	if (error) {
487 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
488 		return (0);
489 	}
490 	nfsm_srvfhtom(&nsfh, v3);
491 	if (v3) {
492 		nfsm_srvpostop_attr(0, &va);
493 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
494 	} else {
495 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
496 		nfsm_srvfillattr(&va, fp);
497 	}
498 	nfsm_srvdone;
499 }
500 
501 /*
502  * nfs readlink service
503  */
504 int
505 nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
506 {
507 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
508 	struct mbuf *nam = nfsd->nd_nam;
509 	char *dpos = nfsd->nd_dpos;
510 	kauth_cred_t cred = nfsd->nd_cr;
511 	struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
512 	struct iovec *ivp = iv;
513 	struct mbuf *mp;
514 	u_int32_t *tl;
515 	int32_t t1;
516 	char *bpos;
517 	int error = 0, rdonly, cache = 0, i, padlen, getret;
518 	uint32_t len;
519 	int v3 = (nfsd->nd_flag & ND_NFSV3);
520 	char *cp2;
521 	struct mbuf *mb, *mp2 = NULL, *mp3 = NULL, *mreq;
522 	struct vnode *vp;
523 	struct vattr attr;
524 	nfsrvfh_t nsfh;
525 	struct uio io, *uiop = &io;
526 	u_quad_t frev;
527 
528 	nfsm_srvmtofh(&nsfh);
529 	len = 0;
530 	i = 0;
531 	while (len < NFS_MAXPATHLEN) {
532 		mp = m_get(M_WAIT, MT_DATA);
533 		MCLAIM(mp, &nfs_mowner);
534 		m_clget(mp, M_WAIT);
535 		mp->m_len = NFSMSIZ(mp);
536 		if (len == 0)
537 			mp3 = mp2 = mp;
538 		else {
539 			mp2->m_next = mp;
540 			mp2 = mp;
541 		}
542 		if ((len+mp->m_len) > NFS_MAXPATHLEN) {
543 			mp->m_len = NFS_MAXPATHLEN-len;
544 			len = NFS_MAXPATHLEN;
545 		} else
546 			len += mp->m_len;
547 		ivp->iov_base = mtod(mp, void *);
548 		ivp->iov_len = mp->m_len;
549 		i++;
550 		ivp++;
551 	}
552 	uiop->uio_iov = iv;
553 	uiop->uio_iovcnt = i;
554 	uiop->uio_offset = 0;
555 	uiop->uio_resid = len;
556 	uiop->uio_rw = UIO_READ;
557 	UIO_SETUP_SYSSPACE(uiop);
558 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
559 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
560 	if (error) {
561 		m_freem(mp3);
562 		nfsm_reply(2 * NFSX_UNSIGNED);
563 		nfsm_srvpostop_attr(1, (struct vattr *)0);
564 		return (0);
565 	}
566 	if (vp->v_type != VLNK) {
567 		if (v3)
568 			error = EINVAL;
569 		else
570 			error = ENXIO;
571 		goto out;
572 	}
573 	nqsrv_getl(vp, ND_READ);
574 	error = VOP_READLINK(vp, uiop, cred);
575 out:
576 	getret = VOP_GETATTR(vp, &attr, cred);
577 	vput(vp);
578 	if (error)
579 		m_freem(mp3);
580 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_UNSIGNED);
581 	if (v3) {
582 		nfsm_srvpostop_attr(getret, &attr);
583 		if (error)
584 			return (0);
585 	}
586 	len -= uiop->uio_resid;
587 	padlen = nfsm_padlen(len);
588 	if (uiop->uio_resid || padlen)
589 		nfs_zeropad(mp3, uiop->uio_resid, padlen);
590 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
591 	*tl = txdr_unsigned(len);
592 	mb->m_next = mp3;
593 	nfsm_srvdone;
594 }
595 
596 /*
597  * nfs read service
598  */
599 int
600 nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
601 {
602 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
603 	struct mbuf *nam = nfsd->nd_nam;
604 	char *dpos = nfsd->nd_dpos;
605 	kauth_cred_t cred = nfsd->nd_cr;
606 	struct mbuf *m;
607 	struct nfs_fattr *fp;
608 	u_int32_t *tl;
609 	int32_t t1;
610 	int i;
611 	char *bpos;
612 	int error = 0, rdonly, cache = 0, getret;
613 	int v3 = (nfsd->nd_flag & ND_NFSV3);
614 	uint32_t reqlen, len, cnt, left;
615 	int padlen;
616 	char *cp2;
617 	struct mbuf *mb, *mreq;
618 	struct vnode *vp;
619 	nfsrvfh_t nsfh;
620 	struct uio io, *uiop = &io;
621 	struct vattr va;
622 	off_t off;
623 	u_quad_t frev;
624 
625 	nfsm_srvmtofh(&nsfh);
626 	if (v3) {
627 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
628 		off = fxdr_hyper(tl);
629 	} else {
630 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
631 		off = (off_t)fxdr_unsigned(u_int32_t, *tl);
632 	}
633 	nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
634 	reqlen = fxdr_unsigned(uint32_t, *tl);
635 	reqlen = MIN(reqlen, NFS_SRVMAXDATA(nfsd));
636 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
637 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
638 	if (error) {
639 		nfsm_reply(2 * NFSX_UNSIGNED);
640 		nfsm_srvpostop_attr(1, (struct vattr *)0);
641 		return (0);
642 	}
643 	if (vp->v_type != VREG) {
644 		if (v3)
645 			error = EINVAL;
646 		else
647 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
648 	}
649 	if (!error) {
650 	    nqsrv_getl(vp, ND_READ);
651 	    if ((error = nfsrv_access(vp, VREAD, cred, rdonly, lwp, 1)) != 0)
652 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 1);
653 	}
654 	getret = VOP_GETATTR(vp, &va, cred);
655 	if (!error)
656 		error = getret;
657 	if (error) {
658 		vput(vp);
659 		nfsm_reply(NFSX_POSTOPATTR(v3));
660 		nfsm_srvpostop_attr(getret, &va);
661 		return (0);
662 	}
663 	if (off >= va.va_size)
664 		cnt = 0;
665 	else if ((off + reqlen) > va.va_size)
666 		cnt = va.va_size - off;
667 	else
668 		cnt = reqlen;
669 	nfsm_reply(NFSX_POSTOPORFATTR(v3) + 3 * NFSX_UNSIGNED+nfsm_rndup(cnt));
670 	if (v3) {
671 		nfsm_build(tl, u_int32_t *, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
672 		*tl++ = nfs_true;
673 		fp = (struct nfs_fattr *)tl;
674 		tl += (NFSX_V3FATTR / sizeof (u_int32_t));
675 	} else {
676 		nfsm_build(tl, u_int32_t *, NFSX_V2FATTR + NFSX_UNSIGNED);
677 		fp = (struct nfs_fattr *)tl;
678 		tl += (NFSX_V2FATTR / sizeof (u_int32_t));
679 	}
680 	len = left = cnt;
681 	if (cnt > 0) {
682 		if (nfsd_use_loan) {
683 			struct vm_page **pgpp;
684 			voff_t pgoff = trunc_page(off);
685 			int npages;
686 			vaddr_t lva;
687 
688 			npages = (round_page(off + cnt) - pgoff) >> PAGE_SHIFT;
689 			KASSERT(npages <= M_EXT_MAXPAGES); /* XXX */
690 
691 			/* allocate kva for mbuf data */
692 			lva = sokvaalloc(npages << PAGE_SHIFT, slp->ns_so);
693 			if (lva == 0) {
694 				/* fall back to VOP_READ */
695 				goto loan_fail;
696 			}
697 
698 			/* allocate mbuf */
699 			m = m_get(M_WAIT, MT_DATA);
700 			MCLAIM(m, &nfs_mowner);
701 			pgpp = m->m_ext.ext_pgs;
702 
703 			/* loan pages */
704 			error = uvm_loanuobjpages(&vp->v_uobj, pgoff, npages,
705 			    pgpp);
706 			if (error) {
707 				sokvafree(lva, npages << PAGE_SHIFT);
708 				m_free(m);
709 				if (error == EBUSY)
710 					goto loan_fail;
711 				goto read_error;
712 			}
713 
714 			/* associate kva to mbuf */
715 			MEXTADD(m, (void *)(lva + ((vaddr_t)off & PAGE_MASK)),
716 			    cnt, M_MBUF, soloanfree, slp->ns_so);
717 			m->m_flags |= M_EXT_PAGES | M_EXT_ROMAP;
718 			m->m_len = cnt;
719 
720 			/* map pages */
721 			for (i = 0; i < npages; i++) {
722 				pmap_kenter_pa(lva, VM_PAGE_TO_PHYS(pgpp[i]),
723 				    VM_PROT_READ, 0);
724 				lva += PAGE_SIZE;
725 			}
726 
727 			pmap_update(pmap_kernel());
728 
729 			mb->m_next = m;
730 			mb = m;
731 			error = 0;
732 			uiop->uio_resid = 0;
733 		} else {
734 			struct iovec *iv;
735 			struct iovec *iv2;
736 			struct mbuf *m2;
737 			int siz;
738 loan_fail:
739 			/*
740 			 * Generate the mbuf list with the uio_iov ref. to it.
741 			 */
742 			i = 0;
743 			m = m2 = mb;
744 			while (left > 0) {
745 				siz = min(M_TRAILINGSPACE(m), left);
746 				if (siz > 0) {
747 					left -= siz;
748 					i++;
749 				}
750 				if (left > 0) {
751 					m = m_get(M_WAIT, MT_DATA);
752 					MCLAIM(m, &nfs_mowner);
753 					m_clget(m, M_WAIT);
754 					m->m_len = 0;
755 					m2->m_next = m;
756 					m2 = m;
757 				}
758 			}
759 			iv = malloc(i * sizeof(struct iovec), M_TEMP, M_WAITOK);
760 			uiop->uio_iov = iv2 = iv;
761 			m = mb;
762 			left = cnt;
763 			i = 0;
764 			while (left > 0) {
765 				if (m == NULL)
766 					panic("nfsrv_read iov");
767 				siz = min(M_TRAILINGSPACE(m), left);
768 				if (siz > 0) {
769 					iv->iov_base = mtod(m, char *) +
770 					    m->m_len;
771 					iv->iov_len = siz;
772 					m->m_len += siz;
773 					left -= siz;
774 					iv++;
775 					i++;
776 				}
777 				m = m->m_next;
778 			}
779 			uiop->uio_iovcnt = i;
780 			uiop->uio_offset = off;
781 			uiop->uio_resid = cnt;
782 			uiop->uio_rw = UIO_READ;
783 			UIO_SETUP_SYSSPACE(uiop);
784 			error = VOP_READ(vp, uiop, IO_NODELOCKED, cred);
785 			free((void *)iv2, M_TEMP);
786 		}
787 read_error:
788 		if (error || (getret = VOP_GETATTR(vp, &va, cred)) != 0){
789 			if (!error)
790 				error = getret;
791 			m_freem(mreq);
792 			vput(vp);
793 			nfsm_reply(NFSX_POSTOPATTR(v3));
794 			nfsm_srvpostop_attr(getret, &va);
795 			return (0);
796 		}
797 	} else {
798 		uiop->uio_resid = 0;
799 	}
800 	vput(vp);
801 	nfsm_srvfillattr(&va, fp);
802 	len -= uiop->uio_resid;
803 	padlen = nfsm_padlen(len);
804 	if (uiop->uio_resid || padlen)
805 		nfs_zeropad(mb, uiop->uio_resid, padlen);
806 	if (v3) {
807 		/* count */
808 		*tl++ = txdr_unsigned(len);
809 		/* eof */
810 		if (off + len >= va.va_size)
811 			*tl++ = nfs_true;
812 		else
813 			*tl++ = nfs_false;
814 	}
815 	*tl = txdr_unsigned(len);
816 	nfsm_srvdone;
817 }
818 
819 /*
820  * nfs write service
821  */
822 int
823 nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
824 {
825 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
826 	struct mbuf *nam = nfsd->nd_nam;
827 	char *dpos = nfsd->nd_dpos;
828 	kauth_cred_t cred = nfsd->nd_cr;
829 	struct iovec *ivp;
830 	int i, cnt;
831 	struct mbuf *mp;
832 	struct nfs_fattr *fp;
833 	struct iovec *iv;
834 	struct vattr va, forat;
835 	u_int32_t *tl;
836 	int32_t t1;
837 	char *bpos;
838 	int error = 0, rdonly, cache = 0, len, forat_ret = 1;
839 	int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
840 	int stable = NFSV3WRITE_FILESYNC;
841 	int v3 = (nfsd->nd_flag & ND_NFSV3);
842 	char *cp2;
843 	struct mbuf *mb, *mreq;
844 	struct vnode *vp;
845 	nfsrvfh_t nsfh;
846 	struct uio io, *uiop = &io;
847 	off_t off;
848 	u_quad_t frev;
849 
850 	if (mrep == NULL) {
851 		*mrq = NULL;
852 		return (0);
853 	}
854 	nfsm_srvmtofh(&nsfh);
855 	if (v3) {
856 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
857 		off = fxdr_hyper(tl);
858 		tl += 3;
859 		stable = fxdr_unsigned(int, *tl++);
860 	} else {
861 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
862 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
863 		tl += 2;
864 	}
865 	retlen = len = fxdr_unsigned(int32_t, *tl);
866 	cnt = i = 0;
867 
868 	/*
869 	 * For NFS Version 2, it is not obvious what a write of zero length
870 	 * should do, but I might as well be consistent with Version 3,
871 	 * which is to return ok so long as there are no permission problems.
872 	 */
873 	if (len > 0) {
874 		zeroing = 1;
875 		mp = mrep;
876 		while (mp) {
877 			if (mp == md) {
878 				zeroing = 0;
879 				adjust = dpos - mtod(mp, char *);
880 				mp->m_len -= adjust;
881 				if (mp->m_len > 0 && adjust > 0)
882 					NFSMADV(mp, adjust);
883 			}
884 			if (zeroing)
885 				mp->m_len = 0;
886 			else if (mp->m_len > 0) {
887 				i += mp->m_len;
888 				if (i > len) {
889 					mp->m_len -= (i - len);
890 					zeroing	= 1;
891 				}
892 				if (mp->m_len > 0)
893 					cnt++;
894 			}
895 			mp = mp->m_next;
896 		}
897 	}
898 	if (len > NFS_MAXDATA || len < 0 || i < len) {
899 		error = EIO;
900 		nfsm_reply(2 * NFSX_UNSIGNED);
901 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
902 		return (0);
903 	}
904 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
905 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
906 	if (error) {
907 		nfsm_reply(2 * NFSX_UNSIGNED);
908 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
909 		return (0);
910 	}
911 	if (v3)
912 		forat_ret = VOP_GETATTR(vp, &forat, cred);
913 	if (vp->v_type != VREG) {
914 		if (v3)
915 			error = EINVAL;
916 		else
917 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
918 	}
919 	if (!error) {
920 		nqsrv_getl(vp, ND_WRITE);
921 		error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
922 	}
923 	if (error) {
924 		vput(vp);
925 		nfsm_reply(NFSX_WCCDATA(v3));
926 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
927 		return (0);
928 	}
929 
930 	if (len > 0) {
931 		ivp = malloc(cnt * sizeof (struct iovec), M_TEMP, M_WAITOK);
932 		uiop->uio_iov = iv = ivp;
933 		uiop->uio_iovcnt = cnt;
934 		mp = mrep;
935 		while (mp) {
936 			if (mp->m_len > 0) {
937 				ivp->iov_base = mtod(mp, void *);
938 				ivp->iov_len = mp->m_len;
939 				ivp++;
940 			}
941 			mp = mp->m_next;
942 		}
943 
944 		/*
945 		 * XXX
946 		 * The IO_METASYNC flag indicates that all metadata (and not
947 		 * just enough to ensure data integrity) must be written to
948 		 * stable storage synchronously.
949 		 * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
950 		 */
951 		if (stable == NFSV3WRITE_UNSTABLE)
952 			ioflags = IO_NODELOCKED;
953 		else if (stable == NFSV3WRITE_DATASYNC)
954 			ioflags = (IO_SYNC | IO_NODELOCKED);
955 		else
956 			ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
957 		uiop->uio_resid = len;
958 		uiop->uio_rw = UIO_WRITE;
959 		uiop->uio_offset = off;
960 		UIO_SETUP_SYSSPACE(uiop);
961 		error = VOP_WRITE(vp, uiop, ioflags, cred);
962 		nfsstats.srvvop_writes++;
963 		free(iv, M_TEMP);
964 	}
965 	aftat_ret = VOP_GETATTR(vp, &va, cred);
966 	vput(vp);
967 	if (!error)
968 		error = aftat_ret;
969 	nfsm_reply(NFSX_PREOPATTR(v3) + NFSX_POSTOPORFATTR(v3) +
970 		2 * NFSX_UNSIGNED + NFSX_WRITEVERF(v3));
971 	if (v3) {
972 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
973 		if (error)
974 			return (0);
975 		nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
976 		*tl++ = txdr_unsigned(retlen);
977 		if (stable == NFSV3WRITE_UNSTABLE)
978 			*tl++ = txdr_unsigned(stable);
979 		else
980 			*tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
981 		/*
982 		 * Actually, there is no need to txdr these fields,
983 		 * but it may make the values more human readable,
984 		 * for debugging purposes.
985 		 */
986 		*tl++ = txdr_unsigned(boottime.tv_sec);
987 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
988 	} else {
989 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
990 		nfsm_srvfillattr(&va, fp);
991 	}
992 	nfsm_srvdone;
993 }
994 
995 /*
996  * XXX elad: the original NFSW_SAMECRED() macro also made sure the
997  *	     two nd_flag fields of the descriptors contained
998  *	     ND_KERBAUTH.
999  */
1000 static int
1001 nfsrv_samecred(kauth_cred_t cred1, kauth_cred_t cred2)
1002 {
1003 	int i, do_ngroups;
1004 
1005 	if (kauth_cred_geteuid(cred1) != kauth_cred_geteuid(cred2))
1006 		return (0);
1007 	if (kauth_cred_ngroups(cred1) != kauth_cred_ngroups(cred2))
1008 		return (0);
1009 	do_ngroups = kauth_cred_ngroups(cred1);
1010 	for (i = 0; i < do_ngroups; i++)
1011 		if (kauth_cred_group(cred1, i) !=
1012 		    kauth_cred_group(cred2, i))
1013 			return (0);
1014 
1015 	return (1);
1016 }
1017 
1018 static struct nfsrvw_delayhash *
1019 nfsrv_nwdelayhash(struct nfssvc_sock *slp, const nfsrvfh_t *nsfh)
1020 {
1021 	uint32_t hash;
1022 
1023 	hash = hash32_buf(NFSRVFH_DATA(nsfh), NFSRVFH_SIZE(nsfh),
1024 	    HASH32_BUF_INIT);
1025 	return &slp->ns_wdelayhashtbl[hash % NFS_WDELAYHASHSIZ];
1026 }
1027 
1028 /*
1029  * NFS write service with write gathering support. Called when
1030  * nfsrvw_procrastinate > 0.
1031  * See: Chet Juszczak, "Improving the Write Performance of an NFS Server",
1032  * in Proc. of the Winter 1994 Usenix Conference, pg. 247-259, San Franscisco,
1033  * Jan. 1994.
1034  */
1035 int
1036 nfsrv_writegather(struct nfsrv_descript **ndp, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1037 {
1038 	struct timeval now;
1039 	struct iovec *ivp;
1040 	struct mbuf *mp;
1041 	struct nfsrv_descript *wp, *nfsd, *owp, *swp;
1042 	struct nfs_fattr *fp;
1043 	int i = 0;
1044 	struct iovec *iov;
1045 	struct nfsrvw_delayhash *wpp;
1046 	kauth_cred_t cred;
1047 	struct vattr va, forat;
1048 	u_int32_t *tl;
1049 	int32_t t1;
1050 	char *bpos, *dpos;
1051 	int error = 0, rdonly, cache = 0, len = 0, forat_ret = 1;
1052 	int ioflags, aftat_ret = 1, adjust, v3, zeroing;
1053 	char *cp2;
1054 	struct mbuf *mb, *mreq, *mrep, *md;
1055 	struct vnode *vp;
1056 	struct uio io, *uiop = &io;
1057 	u_quad_t frev, cur_usec;
1058 
1059 	*mrq = NULL;
1060 	if (*ndp) {
1061 	    nfsd = *ndp;
1062 	    *ndp = NULL;
1063 	    mrep = nfsd->nd_mrep;
1064 	    md = nfsd->nd_md;
1065 	    dpos = nfsd->nd_dpos;
1066 	    cred = nfsd->nd_cr;
1067 	    v3 = (nfsd->nd_flag & ND_NFSV3);
1068 	    LIST_INIT(&nfsd->nd_coalesce);
1069 	    nfsd->nd_mreq = NULL;
1070 	    nfsd->nd_stable = NFSV3WRITE_FILESYNC;
1071 	    getmicrotime(&now);
1072 	    cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1073 	    nfsd->nd_time = cur_usec + nfsrvw_procrastinate;
1074 
1075 	    /*
1076 	     * Now, get the write header..
1077 	     */
1078 	    nfsm_srvmtofh(&nfsd->nd_fh);
1079 	    if (v3) {
1080 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1081 		nfsd->nd_off = fxdr_hyper(tl);
1082 		tl += 3;
1083 		nfsd->nd_stable = fxdr_unsigned(int, *tl++);
1084 	    } else {
1085 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1086 		nfsd->nd_off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1087 		tl += 2;
1088 	    }
1089 	    len = fxdr_unsigned(int32_t, *tl);
1090 	    nfsd->nd_len = len;
1091 	    nfsd->nd_eoff = nfsd->nd_off + len;
1092 
1093 	    /*
1094 	     * Trim the header out of the mbuf list and trim off any trailing
1095 	     * junk so that the mbuf list has only the write data.
1096 	     */
1097 	    zeroing = 1;
1098 	    i = 0;
1099 	    mp = mrep;
1100 	    while (mp) {
1101 		if (mp == md) {
1102 		    zeroing = 0;
1103 		    adjust = dpos - mtod(mp, char *);
1104 		    mp->m_len -= adjust;
1105 		    if (mp->m_len > 0 && adjust > 0)
1106 			NFSMADV(mp, adjust);
1107 		}
1108 		if (zeroing)
1109 		    mp->m_len = 0;
1110 		else {
1111 		    i += mp->m_len;
1112 		    if (i > len) {
1113 			mp->m_len -= (i - len);
1114 			zeroing = 1;
1115 		    }
1116 		}
1117 		mp = mp->m_next;
1118 	    }
1119 	    if (len > NFS_MAXDATA || len < 0  || i < len) {
1120 nfsmout:
1121 		m_freem(mrep);
1122 		error = EIO;
1123 		nfsm_writereply(2 * NFSX_UNSIGNED, v3);
1124 		if (v3)
1125 		    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1126 		nfsd->nd_mreq = mreq;
1127 		nfsd->nd_mrep = NULL;
1128 		nfsd->nd_time = 0;
1129 	    }
1130 
1131 	    /*
1132 	     * Add this entry to the hash and time queues.
1133 	     */
1134 	    owp = NULL;
1135 	    mutex_enter(&nfsd_lock);
1136 	    wp = LIST_FIRST(&slp->ns_tq);
1137 	    while (wp && wp->nd_time < nfsd->nd_time) {
1138 		owp = wp;
1139 		wp = LIST_NEXT(wp, nd_tq);
1140 	    }
1141 	    if (owp) {
1142 		LIST_INSERT_AFTER(owp, nfsd, nd_tq);
1143 	    } else {
1144 		LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1145 	    }
1146 	    if (nfsd->nd_mrep) {
1147 		wpp = nfsrv_nwdelayhash(slp, &nfsd->nd_fh);
1148 		owp = NULL;
1149 		wp = LIST_FIRST(wpp);
1150 		while (wp && nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1151 		    owp = wp;
1152 		    wp = LIST_NEXT(wp, nd_hash);
1153 		}
1154 		while (wp && wp->nd_off < nfsd->nd_off &&
1155 		    !nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1156 		    owp = wp;
1157 		    wp = LIST_NEXT(wp, nd_hash);
1158 		}
1159 		if (owp) {
1160 		    LIST_INSERT_AFTER(owp, nfsd, nd_hash);
1161 
1162 		    /*
1163 		     * Search the hash list for overlapping entries and
1164 		     * coalesce.
1165 		     */
1166 		    for(; nfsd && NFSW_CONTIG(owp, nfsd); nfsd = wp) {
1167 			wp = LIST_NEXT(nfsd, nd_hash);
1168 			if (nfsrv_samecred(owp->nd_cr, nfsd->nd_cr))
1169 			    nfsrvw_coalesce(owp, nfsd);
1170 		    }
1171 		} else {
1172 		    LIST_INSERT_HEAD(wpp, nfsd, nd_hash);
1173 		}
1174 	    }
1175 	    mutex_exit(&nfsd_lock);
1176 	}
1177 
1178 	/*
1179 	 * Now, do VOP_WRITE()s for any one(s) that need to be done now
1180 	 * and generate the associated reply mbuf list(s).
1181 	 */
1182 loop1:
1183 	getmicrotime(&now);
1184 	cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1185 	mutex_enter(&nfsd_lock);
1186 	for (nfsd = LIST_FIRST(&slp->ns_tq); nfsd; nfsd = owp) {
1187 		owp = LIST_NEXT(nfsd, nd_tq);
1188 		if (nfsd->nd_time > cur_usec)
1189 		    break;
1190 		if (nfsd->nd_mreq)
1191 		    continue;
1192 		LIST_REMOVE(nfsd, nd_tq);
1193 		LIST_REMOVE(nfsd, nd_hash);
1194 		mutex_exit(&nfsd_lock);
1195 
1196 		mrep = nfsd->nd_mrep;
1197 		nfsd->nd_mrep = NULL;
1198 		cred = nfsd->nd_cr;
1199 		v3 = (nfsd->nd_flag & ND_NFSV3);
1200 		forat_ret = aftat_ret = 1;
1201 		error = nfsrv_fhtovp(&nfsd->nd_fh, 1, &vp, cred, slp,
1202 		    nfsd->nd_nam, &rdonly, (nfsd->nd_flag & ND_KERBAUTH),
1203 		    false);
1204 		if (!error) {
1205 		    if (v3)
1206 			forat_ret = VOP_GETATTR(vp, &forat, cred);
1207 		    if (vp->v_type != VREG) {
1208 			if (v3)
1209 			    error = EINVAL;
1210 			else
1211 			    error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1212 		    }
1213 		} else
1214 		    vp = NULL;
1215 		if (!error) {
1216 		    nqsrv_getl(vp, ND_WRITE);
1217 		    error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
1218 		}
1219 
1220 		if (nfsd->nd_stable == NFSV3WRITE_UNSTABLE)
1221 		    ioflags = IO_NODELOCKED;
1222 		else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC)
1223 		    ioflags = (IO_SYNC | IO_NODELOCKED);
1224 		else
1225 		    ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1226 		uiop->uio_rw = UIO_WRITE;
1227 		uiop->uio_offset = nfsd->nd_off;
1228 		uiop->uio_resid = nfsd->nd_eoff - nfsd->nd_off;
1229 		UIO_SETUP_SYSSPACE(uiop);
1230 		if (uiop->uio_resid > 0) {
1231 		    mp = mrep;
1232 		    i = 0;
1233 		    while (mp) {
1234 			if (mp->m_len > 0)
1235 			    i++;
1236 			mp = mp->m_next;
1237 		    }
1238 		    uiop->uio_iovcnt = i;
1239 		    iov = malloc(i * sizeof (struct iovec), M_TEMP, M_WAITOK);
1240 		    uiop->uio_iov = ivp = iov;
1241 		    mp = mrep;
1242 		    while (mp) {
1243 			if (mp->m_len > 0) {
1244 			    ivp->iov_base = mtod(mp, void *);
1245 			    ivp->iov_len = mp->m_len;
1246 			    ivp++;
1247 			}
1248 			mp = mp->m_next;
1249 		    }
1250 		    if (!error) {
1251 			error = VOP_WRITE(vp, uiop, ioflags, cred);
1252 			nfsstats.srvvop_writes++;
1253 		    }
1254 		    free((void *)iov, M_TEMP);
1255 		}
1256 		m_freem(mrep);
1257 		if (vp) {
1258 		    aftat_ret = VOP_GETATTR(vp, &va, cred);
1259 		    vput(vp);
1260 		}
1261 
1262 		/*
1263 		 * Loop around generating replies for all write rpcs that have
1264 		 * now been completed.
1265 		 */
1266 		swp = nfsd;
1267 		do {
1268 		    if (error) {
1269 			nfsm_writereply(NFSX_WCCDATA(v3), v3);
1270 			if (v3) {
1271 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1272 			}
1273 		    } else {
1274 			nfsm_writereply(NFSX_PREOPATTR(v3) +
1275 			    NFSX_POSTOPORFATTR(v3) + 2 * NFSX_UNSIGNED +
1276 			    NFSX_WRITEVERF(v3), v3);
1277 			if (v3) {
1278 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1279 			    nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1280 			    *tl++ = txdr_unsigned(nfsd->nd_len);
1281 			    *tl++ = txdr_unsigned(swp->nd_stable);
1282 			    /*
1283 			     * Actually, there is no need to txdr these fields,
1284 			     * but it may make the values more human readable,
1285 			     * for debugging purposes.
1286 			     */
1287 			    *tl++ = txdr_unsigned(boottime.tv_sec);
1288 			    *tl = txdr_unsigned(boottime.tv_nsec / 1000);
1289 			} else {
1290 			    nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1291 			    nfsm_srvfillattr(&va, fp);
1292 			}
1293 		    }
1294 		    nfsd->nd_mreq = mreq;
1295 		    if (nfsd->nd_mrep)
1296 			panic("nfsrv_write: nd_mrep not free");
1297 
1298 		    /*
1299 		     * Done. Put it at the head of the timer queue so that
1300 		     * the final phase can return the reply.
1301 		     */
1302 		    mutex_enter(&nfsd_lock);
1303 		    if (nfsd != swp) {
1304 			nfsd->nd_time = 0;
1305 			LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1306 		    }
1307 		    nfsd = LIST_FIRST(&swp->nd_coalesce);
1308 		    if (nfsd) {
1309 			LIST_REMOVE(nfsd, nd_tq);
1310 		    }
1311 		    mutex_exit(&nfsd_lock);
1312 		} while (nfsd);
1313 		swp->nd_time = 0;
1314 
1315 		mutex_enter(&nfsd_lock);
1316 		LIST_INSERT_HEAD(&slp->ns_tq, swp, nd_tq);
1317 		mutex_exit(&nfsd_lock);
1318 		goto loop1;
1319 	}
1320 	mutex_exit(&nfsd_lock);
1321 	nfs_timer_start();
1322 
1323 	/*
1324 	 * Search for a reply to return.
1325 	 */
1326 	mutex_enter(&nfsd_lock);
1327 	LIST_FOREACH(nfsd, &slp->ns_tq, nd_tq) {
1328 		if (nfsd->nd_mreq) {
1329 		    LIST_REMOVE(nfsd, nd_tq);
1330 		    *mrq = nfsd->nd_mreq;
1331 		    *ndp = nfsd;
1332 		    break;
1333 		}
1334 	}
1335 	mutex_exit(&nfsd_lock);
1336 	return (0);
1337 }
1338 
1339 /*
1340  * Coalesce the write request nfsd into owp. To do this we must:
1341  * - remove nfsd from the queues
1342  * - merge nfsd->nd_mrep into owp->nd_mrep
1343  * - update the nd_eoff and nd_stable for owp
1344  * - put nfsd on owp's nd_coalesce list
1345  * NB: Must be called at splsoftclock().
1346  */
1347 void
1348 nfsrvw_coalesce(struct nfsrv_descript *owp, struct nfsrv_descript *nfsd)
1349 {
1350         int overlap;
1351         struct mbuf *mp;
1352 	struct nfsrv_descript *m;
1353 
1354 	KASSERT(mutex_owned(&nfsd_lock));
1355 
1356         LIST_REMOVE(nfsd, nd_hash);
1357         LIST_REMOVE(nfsd, nd_tq);
1358         if (owp->nd_eoff < nfsd->nd_eoff) {
1359             overlap = owp->nd_eoff - nfsd->nd_off;
1360             if (overlap < 0)
1361                 panic("nfsrv_coalesce: bad off");
1362             if (overlap > 0)
1363                 m_adj(nfsd->nd_mrep, overlap);
1364             mp = owp->nd_mrep;
1365             while (mp->m_next)
1366                 mp = mp->m_next;
1367             mp->m_next = nfsd->nd_mrep;
1368             owp->nd_eoff = nfsd->nd_eoff;
1369         } else
1370             m_freem(nfsd->nd_mrep);
1371         nfsd->nd_mrep = NULL;
1372         if (nfsd->nd_stable == NFSV3WRITE_FILESYNC)
1373             owp->nd_stable = NFSV3WRITE_FILESYNC;
1374         else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC &&
1375             owp->nd_stable == NFSV3WRITE_UNSTABLE)
1376             owp->nd_stable = NFSV3WRITE_DATASYNC;
1377         LIST_INSERT_HEAD(&owp->nd_coalesce, nfsd, nd_tq);
1378  	/*
1379  	 * nfsd might hold coalesce elements! Move them to owp.
1380  	 * Otherwise, requests may be lost and clients will be stuck.
1381  	 */
1382 	while ((m = LIST_FIRST(&nfsd->nd_coalesce)) != NULL) {
1383 		LIST_REMOVE(m, nd_tq);
1384 		LIST_INSERT_HEAD(&owp->nd_coalesce, m, nd_tq);
1385 	}
1386 }
1387 
1388 /*
1389  * nfs create service
1390  * now does a truncate to 0 length via. setattr if it already exists
1391  */
1392 int
1393 nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1394 {
1395 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1396 	struct mbuf *nam = nfsd->nd_nam;
1397 	char *dpos = nfsd->nd_dpos;
1398 	kauth_cred_t cred = nfsd->nd_cr;
1399 	struct nfs_fattr *fp;
1400 	struct vattr va, dirfor, diraft;
1401 	struct nfsv2_sattr *sp;
1402 	u_int32_t *tl;
1403 	struct nameidata nd;
1404 	char *cp;
1405 	int32_t t1;
1406 	char *bpos;
1407 	int error = 0, cache = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
1408 	int rdev = 0, abort = 0;
1409 	int v3 = (nfsd->nd_flag & ND_NFSV3), how, exclusive_flag = 0;
1410 	char *cp2;
1411 	struct mbuf *mb, *mreq;
1412 	struct vnode *vp = NULL, *dirp = NULL;
1413 	nfsrvfh_t nsfh;
1414 	u_quad_t frev, tempsize;
1415 	u_char cverf[NFSX_V3CREATEVERF];
1416 
1417 	nd.ni_cnd.cn_nameiop = 0;
1418 	nfsm_srvmtofh(&nsfh);
1419 	nfsm_srvnamesiz(len);
1420 	nd.ni_cnd.cn_cred = cred;
1421 	nd.ni_cnd.cn_nameiop = CREATE;
1422 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1423 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1424 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1425 	if (dirp && v3) {
1426 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1427 	}
1428 	if (error) {
1429 		nfsm_reply(NFSX_WCCDATA(v3));
1430 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1431 		if (dirp)
1432 			vrele(dirp);
1433 		if (nd.ni_pathbuf != NULL) {
1434 			pathbuf_destroy(nd.ni_pathbuf);
1435 			nd.ni_pathbuf = NULL;
1436 		}
1437 		return (0);
1438 	}
1439 	abort = 1;
1440 	vattr_null(&va);
1441 	if (v3) {
1442 		va.va_mode = 0;
1443 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1444 		how = fxdr_unsigned(int, *tl);
1445 		switch (how) {
1446 		case NFSV3CREATE_GUARDED:
1447 			if (nd.ni_vp) {
1448 				error = EEXIST;
1449 				break;
1450 			}
1451 		case NFSV3CREATE_UNCHECKED:
1452 			nfsm_srvsattr(&va);
1453 			break;
1454 		case NFSV3CREATE_EXCLUSIVE:
1455 			nfsm_dissect(cp, void *, NFSX_V3CREATEVERF);
1456 			memcpy(cverf, cp, NFSX_V3CREATEVERF);
1457 			exclusive_flag = 1;
1458 			break;
1459 		};
1460 		va.va_type = VREG;
1461 	} else {
1462 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1463 		va.va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1464 		if (va.va_type == VNON)
1465 			va.va_type = VREG;
1466 		va.va_mode = nfstov_mode(sp->sa_mode);
1467 		switch (va.va_type) {
1468 		case VREG:
1469 			tsize = fxdr_unsigned(int32_t, sp->sa_size);
1470 			if (tsize != -1)
1471 				va.va_size = (u_quad_t)tsize;
1472 			break;
1473 		case VCHR:
1474 		case VBLK:
1475 		case VFIFO:
1476 			rdev = fxdr_unsigned(int32_t, sp->sa_size);
1477 			break;
1478 		default:
1479 			break;
1480 		};
1481 	}
1482 
1483 	/*
1484 	 * Iff doesn't exist, create it
1485 	 * otherwise just truncate to 0 length
1486 	 *   should I set the mode too ??
1487 	 */
1488 	if (nd.ni_vp == NULL) {
1489 		if (va.va_type == VREG || va.va_type == VSOCK) {
1490 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1491 			error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1492 			if (!error) {
1493 				if (exclusive_flag) {
1494 					exclusive_flag = 0;
1495 					vattr_null(&va);
1496 					/*
1497 					 * XXX
1498 					 * assuming NFSX_V3CREATEVERF
1499 					 * == sizeof(nfstime3)
1500 					 */
1501 					fxdr_nfsv3time(cverf, &va.va_atime);
1502 					error = VOP_SETATTR(nd.ni_vp, &va,
1503 						cred);
1504 				}
1505 			}
1506 		} else if (va.va_type == VCHR || va.va_type == VBLK ||
1507 			va.va_type == VFIFO) {
1508 			if (va.va_type == VCHR && rdev == 0xffffffff)
1509 				va.va_type = VFIFO;
1510 			if (va.va_type != VFIFO &&
1511 			    (error = kauth_authorize_system(cred,
1512 			    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1513 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1514 				vput(nd.ni_dvp);
1515 				abort = 0;
1516 				nfsm_reply(0);
1517 				if (nd.ni_pathbuf != NULL) {
1518 					pathbuf_destroy(nd.ni_pathbuf);
1519 					nd.ni_pathbuf = NULL;
1520 				}
1521 				return (error);
1522 			} else
1523 				va.va_rdev = (dev_t)rdev;
1524 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1525 			error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd,
1526 			    &va);
1527 			if (error) {
1528 				nfsm_reply(0);
1529 			}
1530 		} else {
1531 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1532 			if (nd.ni_pathbuf != NULL) {
1533 				pathbuf_destroy(nd.ni_pathbuf);
1534 				nd.ni_pathbuf = NULL;
1535 			}
1536 			vput(nd.ni_dvp);
1537 			error = ENXIO;
1538 			abort = 0;
1539 		}
1540 		vp = nd.ni_vp;
1541 	} else {
1542 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1543 		if (nd.ni_pathbuf != NULL) {
1544 			pathbuf_destroy(nd.ni_pathbuf);
1545 			nd.ni_pathbuf = NULL;
1546 		}
1547 		vp = nd.ni_vp;
1548 		if (nd.ni_dvp == vp)
1549 			vrele(nd.ni_dvp);
1550 		else
1551 			vput(nd.ni_dvp);
1552 		abort = 0;
1553 		if (!error && va.va_size != -1) {
1554 			error = nfsrv_access(vp, VWRITE, cred,
1555 			    (nd.ni_cnd.cn_flags & RDONLY), lwp, 0);
1556 			if (!error) {
1557 				nqsrv_getl(vp, ND_WRITE);
1558 				tempsize = va.va_size;
1559 				vattr_null(&va);
1560 				va.va_size = tempsize;
1561 				error = VOP_SETATTR(vp, &va, cred);
1562 			}
1563 		}
1564 		if (error)
1565 			vput(vp);
1566 	}
1567 	if (!error) {
1568 		error = nfsrv_composefh(vp, &nsfh, v3);
1569 		if (!error)
1570 			error = VOP_GETATTR(vp, &va, cred);
1571 		vput(vp);
1572 	}
1573 	if (v3) {
1574 		if (exclusive_flag && !error) {
1575 			/*
1576 			 * XXX assuming NFSX_V3CREATEVERF == sizeof(nfstime3)
1577 			 */
1578 			char oldverf[NFSX_V3CREATEVERF];
1579 
1580 			txdr_nfsv3time(&va.va_atime, oldverf);
1581 			if (memcmp(cverf, oldverf, NFSX_V3CREATEVERF))
1582 				error = EEXIST;
1583 		}
1584 		if (dirp) {
1585 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1586 		}
1587 	}
1588 	if (dirp) {
1589 		vrele(dirp);
1590 		dirp = NULL;
1591 	}
1592 	if (nd.ni_pathbuf != NULL) {
1593 		pathbuf_destroy(nd.ni_pathbuf);
1594 		nd.ni_pathbuf = NULL;
1595 	}
1596 	abort = 0;
1597 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_FATTR(v3) + NFSX_WCCDATA(v3));
1598 	if (v3) {
1599 		if (!error) {
1600 			nfsm_srvpostop_fh(&nsfh);
1601 			nfsm_srvpostop_attr(0, &va);
1602 		}
1603 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1604 	} else {
1605 		nfsm_srvfhtom(&nsfh, v3);
1606 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1607 		nfsm_srvfillattr(&va, fp);
1608 	}
1609 	return (0);
1610 nfsmout:
1611 	if (dirp)
1612 		vrele(dirp);
1613 	if (abort) {
1614 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1615 		if (nd.ni_dvp == nd.ni_vp)
1616 			vrele(nd.ni_dvp);
1617 		else
1618 			vput(nd.ni_dvp);
1619 		if (nd.ni_vp)
1620 			vput(nd.ni_vp);
1621 	}
1622 	if (nd.ni_pathbuf != NULL) {
1623 		pathbuf_destroy(nd.ni_pathbuf);
1624 		nd.ni_pathbuf = NULL;
1625 	}
1626 	return (error);
1627 }
1628 
1629 /*
1630  * nfs v3 mknod service
1631  */
1632 int
1633 nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1634 {
1635 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1636 	struct mbuf *nam = nfsd->nd_nam;
1637 	char *dpos = nfsd->nd_dpos;
1638 	kauth_cred_t cred = nfsd->nd_cr;
1639 	struct vattr va, dirfor, diraft;
1640 	u_int32_t *tl;
1641 	struct nameidata nd;
1642 	int32_t t1;
1643 	char *bpos;
1644 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1645 	int abort = 0;
1646 	u_int32_t major, minor;
1647 	enum vtype vtyp;
1648 	char *cp2;
1649 	struct mbuf *mb, *mreq;
1650 	struct vnode *vp, *dirp = (struct vnode *)0;
1651 	nfsrvfh_t nsfh;
1652 	u_quad_t frev;
1653 
1654 	nd.ni_cnd.cn_nameiop = 0;
1655 	nfsm_srvmtofh(&nsfh);
1656 	nfsm_srvnamesiz(len);
1657 	nd.ni_cnd.cn_cred = cred;
1658 	nd.ni_cnd.cn_nameiop = CREATE;
1659 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1660 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1661 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1662 	if (dirp)
1663 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1664 	if (error) {
1665 		nfsm_reply(NFSX_WCCDATA(1));
1666 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1667 		if (dirp)
1668 			vrele(dirp);
1669 		if (nd.ni_pathbuf != NULL) {
1670 			pathbuf_destroy(nd.ni_pathbuf);
1671 			nd.ni_pathbuf = NULL;
1672 		}
1673 		return (0);
1674 	}
1675 	abort = 1;
1676 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1677 	vtyp = nfsv3tov_type(*tl);
1678 	if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1679 		error = NFSERR_BADTYPE;
1680 		goto abort;
1681 	}
1682 	vattr_null(&va);
1683 	va.va_mode = 0;
1684 	nfsm_srvsattr(&va);
1685 	if (vtyp == VCHR || vtyp == VBLK) {
1686 		dev_t rdev;
1687 
1688 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1689 		major = fxdr_unsigned(u_int32_t, *tl++);
1690 		minor = fxdr_unsigned(u_int32_t, *tl);
1691 		rdev = makedev(major, minor);
1692 		if (major(rdev) != major || minor(rdev) != minor) {
1693 			error = EINVAL;
1694 			goto abort;
1695 		}
1696 		va.va_rdev = rdev;
1697 	}
1698 
1699 	/*
1700 	 * Iff doesn't exist, create it.
1701 	 */
1702 	if (nd.ni_vp) {
1703 		error = EEXIST;
1704 abort:
1705 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1706 		if (nd.ni_dvp == nd.ni_vp)
1707 			vrele(nd.ni_dvp);
1708 		else
1709 			vput(nd.ni_dvp);
1710 		if (nd.ni_vp)
1711 			vput(nd.ni_vp);
1712 		if (nd.ni_pathbuf != NULL) {
1713 			pathbuf_destroy(nd.ni_pathbuf);
1714 			nd.ni_pathbuf = NULL;
1715 		}
1716 		goto out;
1717 	}
1718 	va.va_type = vtyp;
1719 	if (vtyp == VSOCK) {
1720 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1721 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1722 	} else {
1723 		if (va.va_type != VFIFO &&
1724 		    (error = kauth_authorize_system(cred,
1725 		    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1726 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1727 			vput(nd.ni_dvp);
1728 			goto out;
1729 		}
1730 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1731 		error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1732 		if (error)
1733 			goto out;
1734 	}
1735 out:
1736 	vp = nd.ni_vp;
1737 	if (!error) {
1738 		error = nfsrv_composefh(vp, &nsfh, true);
1739 		if (!error)
1740 			error = VOP_GETATTR(vp, &va, cred);
1741 		vput(vp);
1742 	}
1743 	if (dirp) {
1744 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1745 		vrele(dirp);
1746 		dirp = NULL;
1747 	}
1748 	if (nd.ni_pathbuf != NULL) {
1749 		pathbuf_destroy(nd.ni_pathbuf);
1750 		nd.ni_pathbuf = NULL;
1751 	}
1752 	abort = 0;
1753 	nfsm_reply(NFSX_SRVFH(&nsfh, true) + NFSX_POSTOPATTR(1) +
1754 	    NFSX_WCCDATA(1));
1755 	if (!error) {
1756 		nfsm_srvpostop_fh(&nsfh);
1757 		nfsm_srvpostop_attr(0, &va);
1758 	}
1759 	nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1760 	return (0);
1761 nfsmout:
1762 	if (abort) {
1763 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1764 		if (nd.ni_dvp == nd.ni_vp)
1765 			vrele(nd.ni_dvp);
1766 		else
1767 			vput(nd.ni_dvp);
1768 		if (nd.ni_vp)
1769 			vput(nd.ni_vp);
1770 	}
1771 	if (nd.ni_pathbuf != NULL) {
1772 		pathbuf_destroy(nd.ni_pathbuf);
1773 		nd.ni_pathbuf = NULL;
1774 	}
1775 	if (dirp)
1776 		vrele(dirp);
1777 	return (error);
1778 }
1779 
1780 /*
1781  * nfs remove service
1782  */
1783 int
1784 nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1785 {
1786 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1787 	struct mbuf *nam = nfsd->nd_nam;
1788 	char *dpos = nfsd->nd_dpos;
1789 	kauth_cred_t cred = nfsd->nd_cr;
1790 	struct nameidata nd;
1791 	u_int32_t *tl;
1792 	int32_t t1;
1793 	char *bpos;
1794 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1795 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1796 	char *cp2;
1797 	struct mbuf *mb, *mreq;
1798 	struct vnode *vp, *dirp;
1799 	struct vattr dirfor, diraft;
1800 	nfsrvfh_t nsfh;
1801 	u_quad_t frev;
1802 
1803 #ifndef nolint
1804 	vp = (struct vnode *)0;
1805 #endif
1806 	nfsm_srvmtofh(&nsfh);
1807 	nfsm_srvnamesiz(len);
1808 	nd.ni_cnd.cn_cred = cred;
1809 	nd.ni_cnd.cn_nameiop = DELETE;
1810 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1811 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1812 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1813 	if (dirp && v3) {
1814 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1815 	}
1816 	if (!error) {
1817 		vp = nd.ni_vp;
1818 		if (vp->v_type == VDIR) {
1819 			error = EPERM;
1820 			goto out;
1821 		}
1822 		/*
1823 		 * The root of a mounted filesystem cannot be deleted.
1824 		 */
1825 		if (vp->v_vflag & VV_ROOT) {
1826 			error = EBUSY;
1827 		}
1828 out:
1829 		if (!error) {
1830 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1831 			nqsrv_getl(vp, ND_WRITE);
1832 			error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1833 		} else {
1834 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1835 			if (nd.ni_dvp == vp)
1836 				vrele(nd.ni_dvp);
1837 			else
1838 				vput(nd.ni_dvp);
1839 			vput(vp);
1840 		}
1841 	}
1842 	if (nd.ni_pathbuf != NULL) {
1843 		pathbuf_destroy(nd.ni_pathbuf);
1844 		nd.ni_pathbuf = NULL;
1845 	}
1846 	if (dirp) {
1847 		if (v3) {
1848 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1849 		}
1850 		vrele(dirp);
1851 	}
1852 	nfsm_reply(NFSX_WCCDATA(v3));
1853 	if (v3) {
1854 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1855 		return (0);
1856 	}
1857 	nfsm_srvdone;
1858 }
1859 
1860 /*
1861  * nfs rename service
1862  */
1863 int
1864 nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1865 {
1866 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1867 	struct mbuf *nam = nfsd->nd_nam;
1868 	char *dpos = nfsd->nd_dpos;
1869 	kauth_cred_t cred = nfsd->nd_cr;
1870 	u_int32_t *tl;
1871 	int32_t t1;
1872 	char *bpos;
1873 	int error = 0, cache = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1874 	uint32_t len, len2;
1875 	int tdirfor_ret = 1, tdiraft_ret = 1;
1876 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1877 	char *cp2;
1878 	struct mbuf *mb, *mreq;
1879 	struct nameidata fromnd, tond;
1880 	struct vnode *fvp, *tvp, *tdvp;
1881 	struct vnode *fdirp = NULL, *tdirp = NULL;
1882 	struct mount *localfs = NULL;
1883 	struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
1884 	nfsrvfh_t fnsfh, tnsfh;
1885 	u_quad_t frev;
1886 	uid_t saved_uid;
1887 
1888 #ifndef nolint
1889 	fvp = (struct vnode *)0;
1890 #endif
1891 	fromnd.ni_cnd.cn_nameiop = 0;
1892 	tond.ni_cnd.cn_nameiop = 0;
1893 	nfsm_srvmtofh(&fnsfh);
1894 	nfsm_srvnamesiz(len);
1895 	/*
1896 	 * Remember our original uid so that we can reset cr_uid before
1897 	 * the second nfs_namei() call, in case it is remapped.
1898 	 */
1899 	saved_uid = kauth_cred_geteuid(cred);
1900 	fromnd.ni_cnd.cn_cred = cred;
1901 	fromnd.ni_cnd.cn_nameiop = DELETE;
1902 	fromnd.ni_cnd.cn_flags = LOCKPARENT | INRENAME;
1903 	error = nfs_namei(&fromnd, &fnsfh, len, slp, nam, &md,
1904 		&dpos, &fdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1905 	if (fdirp && v3) {
1906 		fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor, cred);
1907 	}
1908 	if (error) {
1909 		nfsm_reply(2 * NFSX_WCCDATA(v3));
1910 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1911 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1912 		if (fdirp)
1913 			vrele(fdirp);
1914 		if (fromnd.ni_pathbuf != NULL) {
1915 			pathbuf_destroy(fromnd.ni_pathbuf);
1916 		}
1917 		return (0);
1918 	}
1919 	if (fromnd.ni_dvp != fromnd.ni_vp) {
1920 		VOP_UNLOCK(fromnd.ni_dvp);
1921 	}
1922 	fvp = fromnd.ni_vp;
1923 
1924 	localfs = fvp->v_mount;
1925 	error = VFS_RENAMELOCK_ENTER(localfs);
1926 	if (error) {
1927 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1928 		vrele(fromnd.ni_dvp);
1929 		vrele(fvp);
1930 		goto out1;
1931 	}
1932 
1933 	/* Copied, regrettably, from vfs_syscalls.c (q.v.) */
1934 	vrele(fvp);
1935 	if ((fromnd.ni_cnd.cn_namelen == 1 &&
1936 	     fromnd.ni_cnd.cn_nameptr[0] == '.') ||
1937 	    (fromnd.ni_cnd.cn_namelen == 2 &&
1938 	     fromnd.ni_cnd.cn_nameptr[0] == '.' &&
1939 	     fromnd.ni_cnd.cn_nameptr[1] == '.')) {
1940 		error = EINVAL;
1941 		VFS_RENAMELOCK_EXIT(localfs);
1942 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1943 		vrele(fromnd.ni_dvp);
1944 		goto out1;
1945 	}
1946 	vn_lock(fromnd.ni_dvp, LK_EXCLUSIVE | LK_RETRY);
1947 	error = relookup(fromnd.ni_dvp, &fromnd.ni_vp, &fromnd.ni_cnd, 0);
1948 	if (error) {
1949 		VOP_UNLOCK(fromnd.ni_dvp);
1950 		VFS_RENAMELOCK_EXIT(localfs);
1951 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1952 		vrele(fromnd.ni_dvp);
1953 		goto out1;
1954 	}
1955 	VOP_UNLOCK(fromnd.ni_vp);
1956 	if (fromnd.ni_dvp != fromnd.ni_vp)
1957 		VOP_UNLOCK(fromnd.ni_dvp);
1958 	fvp = fromnd.ni_vp;
1959 
1960 	nfsm_srvmtofh(&tnsfh);
1961 	if (v3) {
1962 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
1963 		len2 = fxdr_unsigned(uint32_t, *tl);
1964 		/* len2 will be checked by nfs_namei */
1965 	}
1966 	else {
1967 		/* NFSv2 */
1968 		nfsm_strsiz(len2, NFS_MAXNAMLEN);
1969 	}
1970 	kauth_cred_seteuid(cred, saved_uid);
1971 	tond.ni_cnd.cn_cred = cred;
1972 	tond.ni_cnd.cn_nameiop = RENAME;
1973 	tond.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | NOCACHE | INRENAME;
1974 	error = nfs_namei(&tond, &tnsfh, len2, slp, nam, &md,
1975 		&dpos, &tdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1976 	if (tdirp && v3) {
1977 		tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor, cred);
1978 	}
1979 	if (error) {
1980 		VFS_RENAMELOCK_EXIT(localfs);
1981 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1982 		vrele(fromnd.ni_dvp);
1983 		vrele(fvp);
1984 		goto out1;
1985 	}
1986 	tdvp = tond.ni_dvp;
1987 	tvp = tond.ni_vp;
1988 	if (tvp != NULL) {
1989 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
1990 			if (v3)
1991 				error = EEXIST;
1992 			else
1993 				error = EISDIR;
1994 			goto out;
1995 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
1996 			if (v3)
1997 				error = EEXIST;
1998 			else
1999 				error = ENOTDIR;
2000 			goto out;
2001 		}
2002 		if (tvp->v_type == VDIR && tvp->v_mountedhere) {
2003 			if (v3)
2004 				error = EXDEV;
2005 			else
2006 				error = ENOTEMPTY;
2007 			goto out;
2008 		}
2009 	}
2010 	if (fvp->v_type == VDIR && fvp->v_mountedhere) {
2011 		if (v3)
2012 			error = EXDEV;
2013 		else
2014 			error = ENOTEMPTY;
2015 		goto out;
2016 	}
2017 	if (fvp->v_mount != tdvp->v_mount) {
2018 		if (v3)
2019 			error = EXDEV;
2020 		else
2021 			error = ENOTEMPTY;
2022 		goto out;
2023 	}
2024 	if (fvp == tdvp) {
2025 		if (v3)
2026 			error = EINVAL;
2027 		else
2028 			error = ENOTEMPTY;
2029 	}
2030 	/*
2031 	 * If source is the same as the destination (that is the
2032 	 * same vnode with the same name in the same directory),
2033 	 * then there is nothing to do.
2034 	 */
2035 	if (fvp == tvp && fromnd.ni_dvp == tdvp &&
2036 	    fromnd.ni_cnd.cn_namelen == tond.ni_cnd.cn_namelen &&
2037 	    !memcmp(fromnd.ni_cnd.cn_nameptr, tond.ni_cnd.cn_nameptr,
2038 	      fromnd.ni_cnd.cn_namelen))
2039 		error = -1;
2040 out:
2041 	if (!error) {
2042 		nqsrv_getl(fromnd.ni_dvp, ND_WRITE);
2043 		nqsrv_getl(tdvp, ND_WRITE);
2044 		if (tvp) {
2045 			nqsrv_getl(tvp, ND_WRITE);
2046 		}
2047 		error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
2048 				   tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
2049 		VFS_RENAMELOCK_EXIT(localfs);
2050 	} else {
2051 		VOP_ABORTOP(tond.ni_dvp, &tond.ni_cnd);
2052 		if (tdvp == tvp)
2053 			vrele(tdvp);
2054 		else
2055 			vput(tdvp);
2056 		if (tvp)
2057 			vput(tvp);
2058 		VFS_RENAMELOCK_EXIT(localfs);
2059 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2060 		vrele(fromnd.ni_dvp);
2061 		vrele(fvp);
2062 		if (error == -1)
2063 			error = 0;
2064 	}
2065 	if (tond.ni_pathbuf != NULL) {
2066 		pathbuf_destroy(tond.ni_pathbuf);
2067 		tond.ni_pathbuf = NULL;
2068 	}
2069 	tond.ni_cnd.cn_nameiop = 0;
2070 out1:
2071 	if (fdirp) {
2072 		if (v3) {
2073 			fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred);
2074 		}
2075 		vrele(fdirp);
2076 		fdirp = NULL;
2077 	}
2078 	if (tdirp) {
2079 		if (v3) {
2080 			tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred);
2081 		}
2082 		vrele(tdirp);
2083 		tdirp = NULL;
2084 	}
2085 	pathbuf_destroy(fromnd.ni_pathbuf);
2086 	fromnd.ni_pathbuf = NULL;
2087 	fromnd.ni_cnd.cn_nameiop = 0;
2088 	localfs = NULL;
2089 	nfsm_reply(2 * NFSX_WCCDATA(v3));
2090 	if (v3) {
2091 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
2092 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
2093 	}
2094 	return (0);
2095 
2096 nfsmout:
2097 	if (fdirp)
2098 		vrele(fdirp);
2099 #ifdef notdef
2100 	if (tdirp)
2101 		vrele(tdirp);
2102 #endif
2103 	if (tond.ni_cnd.cn_nameiop) {
2104 		if (tond.ni_pathbuf != NULL) {
2105 			pathbuf_destroy(tond.ni_pathbuf);
2106 			tond.ni_pathbuf = NULL;
2107 		}
2108 	}
2109 	if (localfs) {
2110 		VFS_RENAMELOCK_EXIT(localfs);
2111 	}
2112 	if (fromnd.ni_cnd.cn_nameiop) {
2113 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2114 		if (fromnd.ni_pathbuf != NULL) {
2115 			pathbuf_destroy(fromnd.ni_pathbuf);
2116 			fromnd.ni_pathbuf = NULL;
2117 		}
2118 		vrele(fromnd.ni_dvp);
2119 		vrele(fvp);
2120 	}
2121 	return (error);
2122 }
2123 
2124 /*
2125  * nfs link service
2126  */
2127 int
2128 nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2129 {
2130 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2131 	struct mbuf *nam = nfsd->nd_nam;
2132 	char *dpos = nfsd->nd_dpos;
2133 	kauth_cred_t cred = nfsd->nd_cr;
2134 	struct nameidata nd;
2135 	u_int32_t *tl;
2136 	int32_t t1;
2137 	char *bpos;
2138 	int error = 0, rdonly, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2139 	int getret = 1, v3 = (nfsd->nd_flag & ND_NFSV3);
2140 	char *cp2;
2141 	struct mbuf *mb, *mreq;
2142 	struct vnode *vp, *xp, *dirp = (struct vnode *)0;
2143 	struct vattr dirfor, diraft, at;
2144 	nfsrvfh_t nsfh, dnsfh;
2145 	u_quad_t frev;
2146 
2147 	nfsm_srvmtofh(&nsfh);
2148 	nfsm_srvmtofh(&dnsfh);
2149 	nfsm_srvnamesiz(len);
2150 	error = nfsrv_fhtovp(&nsfh, false, &vp, cred, slp, nam,
2151 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2152 	if (error) {
2153 		nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2154 		nfsm_srvpostop_attr(getret, &at);
2155 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2156 		return (0);
2157 	}
2158 	if (vp->v_type == VDIR) {
2159 		error = EPERM;
2160 		goto out1;
2161 	}
2162 	nd.ni_cnd.cn_cred = cred;
2163 	nd.ni_cnd.cn_nameiop = CREATE;
2164 	nd.ni_cnd.cn_flags = LOCKPARENT;
2165 	error = nfs_namei(&nd, &dnsfh, len, slp, nam, &md, &dpos,
2166 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2167 	if (dirp && v3) {
2168 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2169 	}
2170 	if (error)
2171 		goto out1;
2172 	xp = nd.ni_vp;
2173 	if (xp != NULL) {
2174 		error = EEXIST;
2175 		goto out;
2176 	}
2177 	xp = nd.ni_dvp;
2178 	if (vp->v_mount != xp->v_mount)
2179 		error = EXDEV;
2180 out:
2181 	if (!error) {
2182 		nqsrv_getl(vp, ND_WRITE);
2183 		nqsrv_getl(xp, ND_WRITE);
2184 		error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
2185 	} else {
2186 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2187 		if (nd.ni_dvp == nd.ni_vp)
2188 			vrele(nd.ni_dvp);
2189 		else
2190 			vput(nd.ni_dvp);
2191 		if (nd.ni_vp)
2192 			vrele(nd.ni_vp);
2193 	}
2194 out1:
2195 	if (v3)
2196 		getret = VOP_GETATTR(vp, &at, cred);
2197 	if (dirp) {
2198 		if (v3) {
2199 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2200 		}
2201 		vrele(dirp);
2202 	}
2203 	vrele(vp);
2204 	if (nd.ni_pathbuf != NULL) {
2205 		pathbuf_destroy(nd.ni_pathbuf);
2206 		nd.ni_pathbuf = NULL;
2207 	}
2208 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2209 	if (v3) {
2210 		nfsm_srvpostop_attr(getret, &at);
2211 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2212 		return (0);
2213 	}
2214 	nfsm_srvdone;
2215 }
2216 
2217 /*
2218  * nfs symbolic link service
2219  */
2220 int
2221 nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2222 {
2223 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2224 	struct mbuf *nam = nfsd->nd_nam;
2225 	char *dpos = nfsd->nd_dpos;
2226 	kauth_cred_t cred = nfsd->nd_cr;
2227 	struct vattr va, dirfor, diraft;
2228 	struct nameidata nd;
2229 	u_int32_t *tl;
2230 	int32_t t1;
2231 	struct nfsv2_sattr *sp;
2232 	char *bpos, *pathcp = NULL, *cp2;
2233 	struct uio io;
2234 	struct iovec iv;
2235 	int error = 0, cache = 0, dirfor_ret = 1, diraft_ret = 1, abort = 0;
2236 	uint32_t len, len2;
2237 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2238 	struct mbuf *mb, *mreq;
2239 	struct vnode *dirp = (struct vnode *)0;
2240 	nfsrvfh_t nsfh;
2241 	u_quad_t frev;
2242 
2243 	nd.ni_cnd.cn_nameiop = 0;
2244 	nfsm_srvmtofh(&nsfh);
2245 	nfsm_srvnamesiz(len);
2246 	nd.ni_cnd.cn_cred = cred;
2247 	nd.ni_cnd.cn_nameiop = CREATE;
2248 	nd.ni_cnd.cn_flags = LOCKPARENT;
2249 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2250 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2251 	if (dirp && v3) {
2252 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2253 	}
2254 	if (error)
2255 		goto out;
2256 	abort = 1;
2257 	vattr_null(&va);
2258 	va.va_type = VLNK;
2259 	if (v3) {
2260 		va.va_mode = 0;
2261 		nfsm_srvsattr(&va);
2262 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
2263 		len2 = fxdr_unsigned(uint32_t, *tl);
2264 		if (len2 > PATH_MAX) {
2265 			/* XXX should check _PC_NO_TRUNC */
2266 			error = ENAMETOOLONG;
2267 			goto abortop;
2268 		}
2269 	}
2270 	else {
2271 		/* NFSv2 */
2272 		nfsm_strsiz(len2, NFS_MAXPATHLEN);
2273 	}
2274 	pathcp = malloc(len2 + 1, M_TEMP, M_WAITOK);
2275 	iv.iov_base = pathcp;
2276 	iv.iov_len = len2;
2277 	io.uio_resid = len2;
2278 	io.uio_offset = 0;
2279 	io.uio_iov = &iv;
2280 	io.uio_iovcnt = 1;
2281 	io.uio_rw = UIO_READ;
2282 	UIO_SETUP_SYSSPACE(&io);
2283 	nfsm_mtouio(&io, len2);
2284 	if (!v3) {
2285 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
2286 		va.va_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
2287 	}
2288 	*(pathcp + len2) = '\0';
2289 	if (nd.ni_vp) {
2290 		error = EEXIST;
2291 abortop:
2292 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2293 		if (nd.ni_dvp == nd.ni_vp)
2294 			vrele(nd.ni_dvp);
2295 		else
2296 			vput(nd.ni_dvp);
2297 		if (nd.ni_vp)
2298 			vrele(nd.ni_vp);
2299 		goto out;
2300 	}
2301 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2302 	error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va, pathcp);
2303 	if (!error) {
2304 	    if (v3) {
2305 		error = nfsrv_composefh(nd.ni_vp, &nsfh, v3);
2306 		if (!error)
2307 		    error = VOP_GETATTR(nd.ni_vp, &va, cred);
2308 		vput(nd.ni_vp);
2309 	    } else {
2310 		vput(nd.ni_vp);
2311 	    }
2312 	}
2313 out:
2314 	if (pathcp)
2315 		free(pathcp, M_TEMP);
2316 	if (dirp) {
2317 		if (v3) {
2318 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2319 		}
2320 		vrele(dirp);
2321 		dirp = NULL;
2322 	}
2323 	if (nd.ni_pathbuf != NULL) {
2324 		pathbuf_destroy(nd.ni_pathbuf);
2325 		nd.ni_pathbuf = NULL;
2326 	}
2327 	abort = 0;
2328 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2329 	    NFSX_WCCDATA(v3));
2330 	if (v3) {
2331 		if (!error) {
2332 			nfsm_srvpostop_fh(&nsfh);
2333 			nfsm_srvpostop_attr(0, &va);
2334 		}
2335 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2336 	}
2337 	return (0);
2338 nfsmout:
2339 	if (abort) {
2340 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2341 		if (nd.ni_dvp == nd.ni_vp)
2342 			vrele(nd.ni_dvp);
2343 		else
2344 			vput(nd.ni_dvp);
2345 		if (nd.ni_vp)
2346 			vrele(nd.ni_vp);
2347 		if (nd.ni_pathbuf != NULL) {
2348 			pathbuf_destroy(nd.ni_pathbuf);
2349 			nd.ni_pathbuf = NULL;
2350 		}
2351 	}
2352 	if (dirp)
2353 		vrele(dirp);
2354 	if (pathcp)
2355 		free(pathcp, M_TEMP);
2356 	return (error);
2357 }
2358 
2359 /*
2360  * nfs mkdir service
2361  */
2362 int
2363 nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2364 {
2365 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2366 	struct mbuf *nam = nfsd->nd_nam;
2367 	char *dpos = nfsd->nd_dpos;
2368 	kauth_cred_t cred = nfsd->nd_cr;
2369 	struct vattr va, dirfor, diraft;
2370 	struct nfs_fattr *fp;
2371 	struct nameidata nd;
2372 	char *cp;
2373 	u_int32_t *tl;
2374 	int32_t t1;
2375 	char *bpos;
2376 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2377 	int abort = 0;
2378 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2379 	char *cp2;
2380 	struct mbuf *mb, *mreq;
2381 	struct vnode *vp, *dirp = (struct vnode *)0;
2382 	nfsrvfh_t nsfh;
2383 	u_quad_t frev;
2384 
2385 	nfsm_srvmtofh(&nsfh);
2386 	nfsm_srvnamesiz(len);
2387 	nd.ni_cnd.cn_cred = cred;
2388 	nd.ni_cnd.cn_nameiop = CREATE;
2389 	nd.ni_cnd.cn_flags = LOCKPARENT;
2390 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2391 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2392 	if (dirp && v3) {
2393 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2394 	}
2395 	if (error) {
2396 		if (nd.ni_pathbuf != NULL) {
2397 			pathbuf_destroy(nd.ni_pathbuf);
2398 			nd.ni_pathbuf = NULL;
2399 		}
2400 		nfsm_reply(NFSX_WCCDATA(v3));
2401 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2402 		if (dirp)
2403 			vrele(dirp);
2404 		return (0);
2405 	}
2406 	abort = 1;
2407 	vattr_null(&va);
2408 	if (v3) {
2409 		va.va_mode = 0;
2410 		nfsm_srvsattr(&va);
2411 	} else {
2412 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
2413 		va.va_mode = nfstov_mode(*tl++);
2414 	}
2415 	va.va_type = VDIR;
2416 	vp = nd.ni_vp;
2417 	if (vp != NULL) {
2418 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2419 		if (nd.ni_dvp == vp)
2420 			vrele(nd.ni_dvp);
2421 		else
2422 			vput(nd.ni_dvp);
2423 		vrele(vp);
2424 		error = EEXIST;
2425 		goto out;
2426 	}
2427 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2428 	error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
2429 	if (!error) {
2430 		vp = nd.ni_vp;
2431 		error = nfsrv_composefh(vp, &nsfh, v3);
2432 		if (!error)
2433 			error = VOP_GETATTR(vp, &va, cred);
2434 		vput(vp);
2435 	}
2436 out:
2437 	if (dirp) {
2438 		if (v3) {
2439 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2440 		}
2441 		vrele(dirp);
2442 		dirp = NULL;
2443 	}
2444 	if (nd.ni_pathbuf != NULL) {
2445 		pathbuf_destroy(nd.ni_pathbuf);
2446 		nd.ni_pathbuf = NULL;
2447 	}
2448 	abort = 0;
2449 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2450 	    NFSX_WCCDATA(v3));
2451 	if (v3) {
2452 		if (!error) {
2453 			nfsm_srvpostop_fh(&nsfh);
2454 			nfsm_srvpostop_attr(0, &va);
2455 		}
2456 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2457 	} else {
2458 		nfsm_srvfhtom(&nsfh, v3);
2459 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
2460 		nfsm_srvfillattr(&va, fp);
2461 	}
2462 	return (0);
2463 nfsmout:
2464 	if (abort) {
2465 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2466 		if (nd.ni_dvp == nd.ni_vp)
2467 			vrele(nd.ni_dvp);
2468 		else
2469 			vput(nd.ni_dvp);
2470 		if (nd.ni_vp)
2471 			vrele(nd.ni_vp);
2472 		if (nd.ni_pathbuf != NULL) {
2473 			pathbuf_destroy(nd.ni_pathbuf);
2474 			nd.ni_pathbuf = NULL;
2475 		}
2476 	}
2477 	if (dirp)
2478 		vrele(dirp);
2479 	return (error);
2480 }
2481 
2482 /*
2483  * nfs rmdir service
2484  */
2485 int
2486 nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2487 {
2488 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2489 	struct mbuf *nam = nfsd->nd_nam;
2490 	char *dpos = nfsd->nd_dpos;
2491 	kauth_cred_t cred = nfsd->nd_cr;
2492 	u_int32_t *tl;
2493 	int32_t t1;
2494 	char *bpos;
2495 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2496 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2497 	char *cp2;
2498 	struct mbuf *mb, *mreq;
2499 	struct vnode *vp, *dirp = (struct vnode *)0;
2500 	struct vattr dirfor, diraft;
2501 	nfsrvfh_t nsfh;
2502 	struct nameidata nd;
2503 	u_quad_t frev;
2504 
2505 	nfsm_srvmtofh(&nsfh);
2506 	nfsm_srvnamesiz(len);
2507 	nd.ni_cnd.cn_cred = cred;
2508 	nd.ni_cnd.cn_nameiop = DELETE;
2509 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
2510 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2511 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2512 	if (dirp && v3) {
2513 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2514 	}
2515 	if (error) {
2516 		if (nd.ni_pathbuf != NULL) {
2517 			pathbuf_destroy(nd.ni_pathbuf);
2518 			nd.ni_pathbuf = NULL;
2519 		}
2520 		nfsm_reply(NFSX_WCCDATA(v3));
2521 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2522 		if (dirp)
2523 			vrele(dirp);
2524 		return (0);
2525 	}
2526 	vp = nd.ni_vp;
2527 	if (vp->v_type != VDIR) {
2528 		error = ENOTDIR;
2529 		goto out;
2530 	}
2531 	/*
2532 	 * No rmdir "." please.
2533 	 */
2534 	if (nd.ni_dvp == vp) {
2535 		error = EINVAL;
2536 		goto out;
2537 	}
2538 	/*
2539 	 * The root of a mounted filesystem cannot be deleted.
2540 	 */
2541 	if (vp->v_vflag & VV_ROOT)
2542 		error = EBUSY;
2543 out:
2544 	if (!error) {
2545 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
2546 		nqsrv_getl(vp, ND_WRITE);
2547 		error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
2548 	} else {
2549 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2550 		if (nd.ni_dvp == nd.ni_vp)
2551 			vrele(nd.ni_dvp);
2552 		else
2553 			vput(nd.ni_dvp);
2554 		vput(vp);
2555 	}
2556 	if (nd.ni_pathbuf != NULL) {
2557 		pathbuf_destroy(nd.ni_pathbuf);
2558 		nd.ni_pathbuf = NULL;
2559 	}
2560 	if (dirp) {
2561 		if (v3) {
2562 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2563 		}
2564 		vrele(dirp);
2565 	}
2566 	nfsm_reply(NFSX_WCCDATA(v3));
2567 	if (v3) {
2568 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2569 		return (0);
2570 	}
2571 	nfsm_srvdone;
2572 }
2573 
2574 /*
2575  * nfs readdir service
2576  * - mallocs what it thinks is enough to read
2577  *	count rounded up to a multiple of NFS_SRVDIRBLKSIZ <= NFS_MAXREADDIR
2578  * - calls VOP_READDIR()
2579  * - loops around building the reply
2580  *	if the output generated exceeds count break out of loop
2581  *	The nfsm_clget macro is used here so that the reply will be packed
2582  *	tightly in mbuf clusters.
2583  * - it only knows that it has encountered eof when the VOP_READDIR()
2584  *	reads nothing
2585  * - as such one readdir rpc will return eof false although you are there
2586  *	and then the next will return eof
2587  * - it trims out records with d_fileno == 0
2588  *	this doesn't matter for Unix clients, but they might confuse clients
2589  *	for other os'.
2590  * - it trims out records with d_type == DT_WHT
2591  *	these cannot be seen through NFS (unless we extend the protocol)
2592  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2593  *	than requested, but this may not apply to all filesystems. For
2594  *	example, client NFS does not { although it is never remote mounted
2595  *	anyhow }
2596  *     The alternate call nfsrv_readdirplus() does lookups as well.
2597  * PS: The NFS protocol spec. does not clarify what the "count" byte
2598  *	argument is a count of.. just name strings and file id's or the
2599  *	entire reply rpc or ...
2600  *	I tried just file name and id sizes and it confused the Sun client,
2601  *	so I am using the full rpc size now. The "paranoia.." comment refers
2602  *	to including the status longwords that are not a part of the dir.
2603  *	"entry" structures, but are in the rpc.
2604  */
2605 
2606 #define	NFS_SRVDIRBLKSIZ	1024
2607 
2608 struct flrep {
2609 	nfsuint64 fl_off;
2610 	u_int32_t fl_postopok;
2611 	struct nfs_fattr fl_fattr; /* XXX: must be of fattr3 size */
2612 	u_int32_t fl_fhok;
2613 	u_int32_t fl_fhsize;
2614 	/* handle comes here, filled in dynamically */
2615 };
2616 
2617 int
2618 nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2619 {
2620 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2621 	struct mbuf *nam = nfsd->nd_nam;
2622 	char *dpos = nfsd->nd_dpos;
2623 	kauth_cred_t cred = nfsd->nd_cr;
2624 	char *bp, *be;
2625 	struct mbuf *mp;
2626 	struct dirent *dp;
2627 	char *cp;
2628 	u_int32_t *tl;
2629 	int32_t t1;
2630 	char *bpos;
2631 	struct mbuf *mb, *mreq, *mp2;
2632 	char *cpos, *cend, *cp2, *rbuf;
2633 	struct vnode *vp;
2634 	struct vattr at;
2635 	nfsrvfh_t nsfh;
2636 	struct uio io;
2637 	struct iovec iv;
2638 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2639 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, ncookies;
2640 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2641 	u_quad_t frev, off, toff, verf;
2642 	off_t *cookies = NULL, *cookiep;
2643 	nfsuint64 jar;
2644 
2645 	nfsm_srvmtofh(&nsfh);
2646 	if (v3) {
2647 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2648 		toff = fxdr_hyper(tl);
2649 		tl += 2;
2650 		verf = fxdr_hyper(tl);
2651 		tl += 2;
2652 	} else {
2653 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2654 		toff = fxdr_unsigned(u_quad_t, *tl++);
2655 	}
2656 	off = toff;
2657 	cnt = fxdr_unsigned(int, *tl);
2658 	siz = ((cnt + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2659 	xfer = NFS_SRVMAXDATA(nfsd);
2660 	if (siz > xfer)
2661 		siz = xfer;
2662 	fullsiz = siz;
2663 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2664 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2665 	if (!error && vp->v_type != VDIR) {
2666 		error = ENOTDIR;
2667 		vput(vp);
2668 	}
2669 	if (error) {
2670 		nfsm_reply(NFSX_UNSIGNED);
2671 		nfsm_srvpostop_attr(getret, &at);
2672 		return (0);
2673 	}
2674 	nqsrv_getl(vp, ND_READ);
2675 	if (v3) {
2676 		error = getret = VOP_GETATTR(vp, &at, cred);
2677 #ifdef NFS3_STRICTVERF
2678 		/*
2679 		 * XXX This check is too strict for Solaris 2.5 clients.
2680 		 */
2681 		if (!error && toff && verf != at.va_filerev)
2682 			error = NFSERR_BAD_COOKIE;
2683 #endif
2684 	}
2685 	if (!error)
2686 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2687 	if (error) {
2688 		vput(vp);
2689 		nfsm_reply(NFSX_POSTOPATTR(v3));
2690 		nfsm_srvpostop_attr(getret, &at);
2691 		return (0);
2692 	}
2693 	VOP_UNLOCK(vp);
2694 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2695 again:
2696 	iv.iov_base = rbuf;
2697 	iv.iov_len = fullsiz;
2698 	io.uio_iov = &iv;
2699 	io.uio_iovcnt = 1;
2700 	io.uio_offset = (off_t)off;
2701 	io.uio_resid = fullsiz;
2702 	io.uio_rw = UIO_READ;
2703 	UIO_SETUP_SYSSPACE(&io);
2704 	eofflag = 0;
2705 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2706 
2707 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2708 
2709 	off = (off_t)io.uio_offset;
2710 	if (!cookies && !error)
2711 		error = NFSERR_PERM;
2712 	if (v3) {
2713 		getret = VOP_GETATTR(vp, &at, cred);
2714 		if (!error)
2715 			error = getret;
2716 	}
2717 
2718 	VOP_UNLOCK(vp);
2719 	if (error) {
2720 		vrele(vp);
2721 		free((void *)rbuf, M_TEMP);
2722 		if (cookies)
2723 			free((void *)cookies, M_TEMP);
2724 		nfsm_reply(NFSX_POSTOPATTR(v3));
2725 		nfsm_srvpostop_attr(getret, &at);
2726 		return (0);
2727 	}
2728 	if (io.uio_resid) {
2729 		siz -= io.uio_resid;
2730 
2731 		/*
2732 		 * If nothing read, return eof
2733 		 * rpc reply
2734 		 */
2735 		if (siz == 0) {
2736 			vrele(vp);
2737 			nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) +
2738 				2 * NFSX_UNSIGNED);
2739 			if (v3) {
2740 				nfsm_srvpostop_attr(getret, &at);
2741 				nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
2742 				txdr_hyper(at.va_filerev, tl);
2743 				tl += 2;
2744 			} else
2745 				nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2746 			*tl++ = nfs_false;
2747 			*tl = nfs_true;
2748 			free((void *)rbuf, M_TEMP);
2749 			free((void *)cookies, M_TEMP);
2750 			return (0);
2751 		}
2752 	}
2753 
2754 	/*
2755 	 * Check for degenerate cases of nothing useful read.
2756 	 * If so go try again
2757 	 */
2758 	cpos = rbuf;
2759 	cend = rbuf + siz;
2760 	dp = (struct dirent *)cpos;
2761 	cookiep = cookies;
2762 
2763 	while (cpos < cend && ncookies > 0 &&
2764 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
2765 		cpos += dp->d_reclen;
2766 		dp = (struct dirent *)cpos;
2767 		cookiep++;
2768 		ncookies--;
2769 	}
2770 	if (cpos >= cend || ncookies == 0) {
2771 		toff = off;
2772 		siz = fullsiz;
2773 		free(cookies, M_TEMP);
2774 		cookies = NULL;
2775 		goto again;
2776 	}
2777 
2778 	len = 3 * NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
2779 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) + siz);
2780 	if (v3) {
2781 		nfsm_srvpostop_attr(getret, &at);
2782 		nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2783 		txdr_hyper(at.va_filerev, tl);
2784 	}
2785 	mp = mp2 = mb;
2786 	bp = bpos;
2787 	be = bp + M_TRAILINGSPACE(mp);
2788 
2789 	/* Loop through the records and build reply */
2790 	while (cpos < cend && ncookies > 0) {
2791 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
2792 			nlen = dp->d_namlen;
2793 			rem = nfsm_rndup(nlen)-nlen;
2794 			len += (4 * NFSX_UNSIGNED + nlen + rem);
2795 			if (v3)
2796 				len += 2 * NFSX_UNSIGNED;
2797 			if (len > cnt) {
2798 				eofflag = 0;
2799 				break;
2800 			}
2801 			/*
2802 			 * Build the directory record xdr from
2803 			 * the dirent entry.
2804 			 */
2805 			nfsm_clget;
2806 			*tl = nfs_true;
2807 			bp += NFSX_UNSIGNED;
2808 			if (v3) {
2809 				nfsm_clget;
2810 				*tl = txdr_unsigned(dp->d_fileno >> 32);
2811 				bp += NFSX_UNSIGNED;
2812 			}
2813 			nfsm_clget;
2814 			*tl = txdr_unsigned(dp->d_fileno);
2815 			bp += NFSX_UNSIGNED;
2816 			nfsm_clget;
2817 			*tl = txdr_unsigned(nlen);
2818 			bp += NFSX_UNSIGNED;
2819 
2820 			/* And loop around copying the name */
2821 			xfer = nlen;
2822 			cp = dp->d_name;
2823 			while (xfer > 0) {
2824 				nfsm_clget;
2825 				if ((bp+xfer) > be)
2826 					tsiz = be-bp;
2827 				else
2828 					tsiz = xfer;
2829 				memcpy(bp, cp, tsiz);
2830 				bp += tsiz;
2831 				xfer -= tsiz;
2832 				if (xfer > 0)
2833 					cp += tsiz;
2834 			}
2835 			/* And null pad to an int32_t boundary */
2836 			for (i = 0; i < rem; i++)
2837 				*bp++ = '\0';
2838 			nfsm_clget;
2839 
2840 			/* Finish off the record */
2841 			txdr_hyper(*cookiep, &jar);
2842 			if (v3) {
2843 				*tl = jar.nfsuquad[0];
2844 				bp += NFSX_UNSIGNED;
2845 				nfsm_clget;
2846 			}
2847 			*tl = jar.nfsuquad[1];
2848 			bp += NFSX_UNSIGNED;
2849 		}
2850 		cpos += dp->d_reclen;
2851 		dp = (struct dirent *)cpos;
2852 		cookiep++;
2853 		ncookies--;
2854 	}
2855 	vrele(vp);
2856 	nfsm_clget;
2857 	*tl = nfs_false;
2858 	bp += NFSX_UNSIGNED;
2859 	nfsm_clget;
2860 	if (eofflag)
2861 		*tl = nfs_true;
2862 	else
2863 		*tl = nfs_false;
2864 	bp += NFSX_UNSIGNED;
2865 	if (mp != mb) {
2866 		if (bp < be)
2867 			mp->m_len = bp - mtod(mp, char *);
2868 	} else
2869 		mp->m_len += bp - bpos;
2870 	free((void *)rbuf, M_TEMP);
2871 	free((void *)cookies, M_TEMP);
2872 	nfsm_srvdone;
2873 }
2874 
2875 int
2876 nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2877 {
2878 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2879 	struct mbuf *nam = nfsd->nd_nam;
2880 	char *dpos = nfsd->nd_dpos;
2881 	kauth_cred_t cred = nfsd->nd_cr;
2882 	char *bp, *be;
2883 	struct mbuf *mp;
2884 	struct dirent *dp;
2885 	char *cp;
2886 	u_int32_t *tl;
2887 	int32_t t1;
2888 	char *bpos;
2889 	struct mbuf *mb, *mreq, *mp2;
2890 	char *cpos, *cend, *cp2, *rbuf;
2891 	struct vnode *vp, *nvp;
2892 	struct flrep fl;
2893 	nfsrvfh_t nsfh;
2894 	struct uio io;
2895 	struct iovec iv;
2896 	struct vattr va, at, *vap = &va;
2897 	struct nfs_fattr *fp;
2898 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2899 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, dirlen, ncookies;
2900 	u_quad_t frev, off, toff, verf;
2901 	off_t *cookies = NULL, *cookiep;
2902 
2903 	nfsm_srvmtofh(&nsfh);
2904 	nfsm_dissect(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2905 	toff = fxdr_hyper(tl);
2906 	tl += 2;
2907 	verf = fxdr_hyper(tl);
2908 	tl += 2;
2909 	siz = fxdr_unsigned(int, *tl++);
2910 	cnt = fxdr_unsigned(int, *tl);
2911 	off = toff;
2912 	siz = ((siz + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2913 	xfer = NFS_SRVMAXDATA(nfsd);
2914 	if (siz > xfer)
2915 		siz = xfer;
2916 	fullsiz = siz;
2917 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2918 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2919 	if (!error && vp->v_type != VDIR) {
2920 		error = ENOTDIR;
2921 		vput(vp);
2922 	}
2923 	if (error) {
2924 		nfsm_reply(NFSX_UNSIGNED);
2925 		nfsm_srvpostop_attr(getret, &at);
2926 		return (0);
2927 	}
2928 	error = getret = VOP_GETATTR(vp, &at, cred);
2929 #ifdef NFS3_STRICTVERF
2930 	/*
2931 	 * XXX This check is too strict for Solaris 2.5 clients.
2932 	 */
2933 	if (!error && toff && verf != at.va_filerev)
2934 		error = NFSERR_BAD_COOKIE;
2935 #endif
2936 	if (!error) {
2937 		nqsrv_getl(vp, ND_READ);
2938 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2939 	}
2940 	if (error) {
2941 		vput(vp);
2942 		nfsm_reply(NFSX_V3POSTOPATTR);
2943 		nfsm_srvpostop_attr(getret, &at);
2944 		return (0);
2945 	}
2946 	VOP_UNLOCK(vp);
2947 
2948 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2949 again:
2950 	iv.iov_base = rbuf;
2951 	iv.iov_len = fullsiz;
2952 	io.uio_iov = &iv;
2953 	io.uio_iovcnt = 1;
2954 	io.uio_offset = (off_t)off;
2955 	io.uio_resid = fullsiz;
2956 	io.uio_rw = UIO_READ;
2957 	UIO_SETUP_SYSSPACE(&io);
2958 	eofflag = 0;
2959 
2960 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2961 
2962 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2963 
2964 	off = (u_quad_t)io.uio_offset;
2965 	getret = VOP_GETATTR(vp, &at, cred);
2966 
2967 	VOP_UNLOCK(vp);
2968 
2969 	/*
2970 	 * If the VGET operation doesn't work for this filesystem,
2971 	 * we can't support readdirplus. Returning NOTSUPP should
2972 	 * make clients fall back to plain readdir.
2973 	 * There's no need to check for VPTOFH as well, we wouldn't
2974 	 * even be here otherwise.
2975 	 */
2976 	if (!getret) {
2977 		if ((getret = VFS_VGET(vp->v_mount, at.va_fileid, &nvp)))
2978 			getret = (getret == EOPNOTSUPP) ?
2979 				NFSERR_NOTSUPP : NFSERR_IO;
2980 		else
2981 			vput(nvp);
2982 	}
2983 
2984 	if (!cookies && !error)
2985 		error = NFSERR_PERM;
2986 	if (!error)
2987 		error = getret;
2988 	if (error) {
2989 		vrele(vp);
2990 		if (cookies)
2991 			free((void *)cookies, M_TEMP);
2992 		free((void *)rbuf, M_TEMP);
2993 		nfsm_reply(NFSX_V3POSTOPATTR);
2994 		nfsm_srvpostop_attr(getret, &at);
2995 		return (0);
2996 	}
2997 	if (io.uio_resid) {
2998 		siz -= io.uio_resid;
2999 
3000 		/*
3001 		 * If nothing read, return eof
3002 		 * rpc reply
3003 		 */
3004 		if (siz == 0) {
3005 			vrele(vp);
3006 			nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
3007 				2 * NFSX_UNSIGNED);
3008 			nfsm_srvpostop_attr(getret, &at);
3009 			nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
3010 			txdr_hyper(at.va_filerev, tl);
3011 			tl += 2;
3012 			*tl++ = nfs_false;
3013 			*tl = nfs_true;
3014 			free((void *)cookies, M_TEMP);
3015 			free((void *)rbuf, M_TEMP);
3016 			return (0);
3017 		}
3018 	}
3019 
3020 	/*
3021 	 * Check for degenerate cases of nothing useful read.
3022 	 * If so go try again
3023 	 */
3024 	cpos = rbuf;
3025 	cend = rbuf + siz;
3026 	dp = (struct dirent *)cpos;
3027 	cookiep = cookies;
3028 
3029 	while (cpos < cend && ncookies > 0 &&
3030 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
3031 		cpos += dp->d_reclen;
3032 		dp = (struct dirent *)cpos;
3033 		cookiep++;
3034 		ncookies--;
3035 	}
3036 	if (cpos >= cend || ncookies == 0) {
3037 		toff = off;
3038 		siz = fullsiz;
3039 		free(cookies, M_TEMP);
3040 		cookies = NULL;
3041 		goto again;
3042 	}
3043 
3044 	dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF + 2 * NFSX_UNSIGNED;
3045 	nfsm_reply(cnt);
3046 	nfsm_srvpostop_attr(getret, &at);
3047 	nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3048 	txdr_hyper(at.va_filerev, tl);
3049 	mp = mp2 = mb;
3050 	bp = bpos;
3051 	be = bp + M_TRAILINGSPACE(mp);
3052 
3053 	/* Loop through the records and build reply */
3054 	while (cpos < cend && ncookies > 0) {
3055 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
3056 			nfsrvfh_t nnsfh;
3057 
3058 			nlen = dp->d_namlen;
3059 			rem = nfsm_rndup(nlen)-nlen;
3060 
3061 			/*
3062 			 * For readdir_and_lookup get the vnode using
3063 			 * the file number.
3064 			 */
3065 			if (VFS_VGET(vp->v_mount, dp->d_fileno, &nvp))
3066 				goto invalid;
3067 			if (nfsrv_composefh(nvp, &nnsfh, true)) {
3068 				vput(nvp);
3069 				goto invalid;
3070 			}
3071 			if (VOP_GETATTR(nvp, vap, cred)) {
3072 				vput(nvp);
3073 				goto invalid;
3074 			}
3075 			vput(nvp);
3076 
3077 			/*
3078 			 * If either the dircount or maxcount will be
3079 			 * exceeded, get out now. Both of these lengths
3080 			 * are calculated conservatively, including all
3081 			 * XDR overheads.
3082 			 */
3083 			len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
3084 				NFSX_V3POSTOPATTR);
3085 			dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
3086 			if (len > cnt || dirlen > fullsiz) {
3087 				eofflag = 0;
3088 				break;
3089 			}
3090 
3091 			/*
3092 			 * Build the directory record xdr from
3093 			 * the dirent entry.
3094 			 */
3095 			fp = (struct nfs_fattr *)&fl.fl_fattr;
3096 			nfsm_srvfillattr(vap, fp);
3097 			fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
3098 			fl.fl_fhok = nfs_true;
3099 			fl.fl_postopok = nfs_true;
3100 			txdr_hyper(*cookiep, fl.fl_off.nfsuquad);
3101 
3102 			nfsm_clget;
3103 			*tl = nfs_true;
3104 			bp += NFSX_UNSIGNED;
3105 			nfsm_clget;
3106 			*tl = txdr_unsigned(dp->d_fileno >> 32);
3107 			bp += NFSX_UNSIGNED;
3108 			nfsm_clget;
3109 			*tl = txdr_unsigned(dp->d_fileno);
3110 			bp += NFSX_UNSIGNED;
3111 			nfsm_clget;
3112 			*tl = txdr_unsigned(nlen);
3113 			bp += NFSX_UNSIGNED;
3114 
3115 			/* And loop around copying the name */
3116 			xfer = nlen;
3117 			cp = dp->d_name;
3118 			while (xfer > 0) {
3119 				nfsm_clget;
3120 				if ((bp + xfer) > be)
3121 					tsiz = be - bp;
3122 				else
3123 					tsiz = xfer;
3124 				memcpy(bp, cp, tsiz);
3125 				bp += tsiz;
3126 				xfer -= tsiz;
3127 				if (xfer > 0)
3128 					cp += tsiz;
3129 			}
3130 			/* And null pad to an int32_t boundary */
3131 			for (i = 0; i < rem; i++)
3132 				*bp++ = '\0';
3133 
3134 			/*
3135 			 * Now copy the flrep structure out.
3136 			 */
3137 			xfer = sizeof(struct flrep);
3138 			cp = (void *)&fl;
3139 			while (xfer > 0) {
3140 				nfsm_clget;
3141 				if ((bp + xfer) > be)
3142 					tsiz = be - bp;
3143 				else
3144 					tsiz = xfer;
3145 				memcpy(bp, cp, tsiz);
3146 				bp += tsiz;
3147 				xfer -= tsiz;
3148 				if (xfer > 0)
3149 					cp += tsiz;
3150 			}
3151 
3152 			/*
3153 			 * ... and filehandle.
3154 			 */
3155 			xfer = NFSRVFH_SIZE(&nnsfh);
3156 			cp = NFSRVFH_DATA(&nnsfh);
3157 			while (xfer > 0) {
3158 				nfsm_clget;
3159 				if ((bp + xfer) > be)
3160 					tsiz = be - bp;
3161 				else
3162 					tsiz = xfer;
3163 				memcpy(bp, cp, tsiz);
3164 				bp += tsiz;
3165 				xfer -= tsiz;
3166 				if (xfer > 0)
3167 					cp += tsiz;
3168 			}
3169 		}
3170 invalid:
3171 		cpos += dp->d_reclen;
3172 		dp = (struct dirent *)cpos;
3173 		cookiep++;
3174 		ncookies--;
3175 	}
3176 	vrele(vp);
3177 	nfsm_clget;
3178 	*tl = nfs_false;
3179 	bp += NFSX_UNSIGNED;
3180 	nfsm_clget;
3181 	if (eofflag)
3182 		*tl = nfs_true;
3183 	else
3184 		*tl = nfs_false;
3185 	bp += NFSX_UNSIGNED;
3186 	if (mp != mb) {
3187 		if (bp < be)
3188 			mp->m_len = bp - mtod(mp, char *);
3189 	} else
3190 		mp->m_len += bp - bpos;
3191 	free((void *)cookies, M_TEMP);
3192 	free((void *)rbuf, M_TEMP);
3193 	nfsm_srvdone;
3194 }
3195 
3196 /*
3197  * nfs commit service
3198  */
3199 int
3200 nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3201 {
3202 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3203 	struct mbuf *nam = nfsd->nd_nam;
3204 	char *dpos = nfsd->nd_dpos;
3205 	kauth_cred_t cred = nfsd->nd_cr;
3206 	struct vattr bfor, aft;
3207 	struct vnode *vp;
3208 	nfsrvfh_t nsfh;
3209 	u_int32_t *tl;
3210 	int32_t t1;
3211 	char *bpos;
3212 	int error = 0, rdonly, for_ret = 1, aft_ret = 1, cache = 0;
3213 	uint32_t cnt;
3214 	char *cp2;
3215 	struct mbuf *mb, *mreq;
3216 	u_quad_t frev, off, end;
3217 
3218 	nfsm_srvmtofh(&nsfh);
3219 	nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3220 
3221 	off = fxdr_hyper(tl);
3222 	tl += 2;
3223 	cnt = fxdr_unsigned(uint32_t, *tl);
3224 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3225 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3226 	if (error) {
3227 		nfsm_reply(2 * NFSX_UNSIGNED);
3228 		nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3229 		return (0);
3230 	}
3231 	for_ret = VOP_GETATTR(vp, &bfor, cred);
3232 	end = (cnt > 0) ? off + cnt : vp->v_size;
3233 	if (end < off || end > vp->v_size)
3234 		end = vp->v_size;
3235 	if (off < vp->v_size)
3236 		error = VOP_FSYNC(vp, cred, FSYNC_WAIT, off, end);
3237 	/* else error == 0, from nfsrv_fhtovp() */
3238 	aft_ret = VOP_GETATTR(vp, &aft, cred);
3239 	vput(vp);
3240 	nfsm_reply(NFSX_V3WCCDATA + NFSX_V3WRITEVERF);
3241 	nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3242 	if (!error) {
3243 		nfsm_build(tl, u_int32_t *, NFSX_V3WRITEVERF);
3244 		*tl++ = txdr_unsigned(boottime.tv_sec);
3245 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
3246 	} else {
3247 		return (0);
3248 	}
3249 	nfsm_srvdone;
3250 }
3251 
3252 /*
3253  * nfs statfs service
3254  */
3255 int
3256 nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3257 {
3258 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3259 	struct mbuf *nam = nfsd->nd_nam;
3260 	char *dpos = nfsd->nd_dpos;
3261 	kauth_cred_t cred = nfsd->nd_cr;
3262 	struct statvfs *sf = NULL;
3263 	struct nfs_statfs *sfp;
3264 	u_int32_t *tl;
3265 	int32_t t1;
3266 	char *bpos;
3267 	int error = 0, rdonly, cache = 0, getret = 1;
3268 	int v3 = (nfsd->nd_flag & ND_NFSV3);
3269 	char *cp2;
3270 	struct mbuf *mb, *mreq;
3271 	struct vnode *vp;
3272 	struct vattr at;
3273 	nfsrvfh_t nsfh;
3274 	u_quad_t frev, tval;
3275 
3276 	nfsm_srvmtofh(&nsfh);
3277 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3278 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3279 	if (error) {
3280 		nfsm_reply(NFSX_UNSIGNED);
3281 		nfsm_srvpostop_attr(getret, &at);
3282 		return (0);
3283 	}
3284 	sf = malloc(sizeof(*sf), M_TEMP, M_WAITOK);
3285 	error = VFS_STATVFS(vp->v_mount, sf);
3286 	getret = VOP_GETATTR(vp, &at, cred);
3287 	vput(vp);
3288 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_STATFS(v3));
3289 	if (v3)
3290 		nfsm_srvpostop_attr(getret, &at);
3291 	if (error) {
3292 		free(sf, M_TEMP);
3293 		return (0);
3294 	}
3295 	nfsm_build(sfp, struct nfs_statfs *, NFSX_STATFS(v3));
3296 	if (v3) {
3297 		tval = (u_quad_t)((quad_t)sf->f_blocks * (quad_t)sf->f_frsize);
3298 		txdr_hyper(tval, &sfp->sf_tbytes);
3299 		tval = (u_quad_t)((quad_t)sf->f_bfree * (quad_t)sf->f_frsize);
3300 		txdr_hyper(tval, &sfp->sf_fbytes);
3301 		tval = (u_quad_t)((quad_t)sf->f_bavail * (quad_t)sf->f_frsize);
3302 		txdr_hyper(tval, &sfp->sf_abytes);
3303 		tval = (u_quad_t)sf->f_files;
3304 		txdr_hyper(tval, &sfp->sf_tfiles);
3305 		tval = (u_quad_t)sf->f_ffree;
3306 		txdr_hyper(tval, &sfp->sf_ffiles);
3307 		txdr_hyper(tval, &sfp->sf_afiles);
3308 		sfp->sf_invarsec = 0;
3309 	} else {
3310 		sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
3311 		sfp->sf_bsize = txdr_unsigned(sf->f_frsize);
3312 		sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
3313 		sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
3314 		sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
3315 	}
3316 nfsmout:
3317 	if (sf)
3318 	    free(sf, M_TEMP);
3319 	return error;
3320 }
3321 
3322 /*
3323  * nfs fsinfo service
3324  */
3325 int
3326 nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3327 {
3328 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3329 	struct mbuf *nam = nfsd->nd_nam;
3330 	char *dpos = nfsd->nd_dpos;
3331 	kauth_cred_t cred = nfsd->nd_cr;
3332 	u_int32_t *tl;
3333 	struct nfsv3_fsinfo *sip;
3334 	int32_t t1;
3335 	char *bpos;
3336 	int error = 0, rdonly, cache = 0, getret = 1;
3337 	uint32_t maxdata;
3338 	char *cp2;
3339 	struct mbuf *mb, *mreq;
3340 	struct vnode *vp;
3341 	struct vattr at;
3342 	nfsrvfh_t nsfh;
3343 	u_quad_t frev, maxfsize;
3344 	struct statvfs *sb;
3345 
3346 	nfsm_srvmtofh(&nsfh);
3347 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3348 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3349 	if (error) {
3350 		nfsm_reply(NFSX_UNSIGNED);
3351 		nfsm_srvpostop_attr(getret, &at);
3352 		return (0);
3353 	}
3354 
3355 	/* XXX Try to make a guess on the max file size. */
3356 	sb = malloc(sizeof(*sb), M_TEMP, M_WAITOK);
3357 	VFS_STATVFS(vp->v_mount, sb);
3358 	maxfsize = (u_quad_t)0x80000000 * sb->f_frsize - 1;
3359 	free(sb, M_TEMP);
3360 
3361 	getret = VOP_GETATTR(vp, &at, cred);
3362 	vput(vp);
3363 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3FSINFO);
3364 	nfsm_srvpostop_attr(getret, &at);
3365 	nfsm_build(sip, struct nfsv3_fsinfo *, NFSX_V3FSINFO);
3366 
3367 	/*
3368 	 * XXX
3369 	 * There should be file system VFS OP(s) to get this information.
3370 	 * For now, assume ufs.
3371 	 */
3372 	if (slp->ns_so->so_type == SOCK_DGRAM)
3373 		maxdata = NFS_MAXDGRAMDATA;
3374 	else
3375 		maxdata = NFS_MAXDATA;
3376 	sip->fs_rtmax = txdr_unsigned(maxdata);
3377 	sip->fs_rtpref = txdr_unsigned(maxdata);
3378 	sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
3379 	sip->fs_wtmax = txdr_unsigned(maxdata);
3380 	sip->fs_wtpref = txdr_unsigned(maxdata);
3381 	sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
3382 	sip->fs_dtpref = txdr_unsigned(maxdata);
3383 	txdr_hyper(maxfsize, &sip->fs_maxfilesize);
3384 	sip->fs_timedelta.nfsv3_sec = 0;
3385 	sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
3386 	sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
3387 		NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
3388 		NFSV3FSINFO_CANSETTIME);
3389 	nfsm_srvdone;
3390 }
3391 
3392 /*
3393  * nfs pathconf service
3394  */
3395 int
3396 nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3397 {
3398 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3399 	struct mbuf *nam = nfsd->nd_nam;
3400 	char *dpos = nfsd->nd_dpos;
3401 	kauth_cred_t cred = nfsd->nd_cr;
3402 	u_int32_t *tl;
3403 	struct nfsv3_pathconf *pc;
3404 	int32_t t1;
3405 	char *bpos;
3406 	int error = 0, rdonly, cache = 0, getret = 1;
3407 	register_t linkmax, namemax, chownres, notrunc;
3408 	char *cp2;
3409 	struct mbuf *mb, *mreq;
3410 	struct vnode *vp;
3411 	struct vattr at;
3412 	nfsrvfh_t nsfh;
3413 	u_quad_t frev;
3414 
3415 	nfsm_srvmtofh(&nsfh);
3416 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3417 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3418 	if (error) {
3419 		nfsm_reply(NFSX_UNSIGNED);
3420 		nfsm_srvpostop_attr(getret, &at);
3421 		return (0);
3422 	}
3423 	error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
3424 	if (!error)
3425 		error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
3426 	if (!error)
3427 		error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
3428 	if (!error)
3429 		error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
3430 	getret = VOP_GETATTR(vp, &at, cred);
3431 	vput(vp);
3432 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3PATHCONF);
3433 	nfsm_srvpostop_attr(getret, &at);
3434 	if (error)
3435 		return (0);
3436 	nfsm_build(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
3437 
3438 	pc->pc_linkmax = txdr_unsigned(linkmax);
3439 	pc->pc_namemax = txdr_unsigned(namemax);
3440 	pc->pc_notrunc = txdr_unsigned(notrunc);
3441 	pc->pc_chownrestricted = txdr_unsigned(chownres);
3442 
3443 	/*
3444 	 * These should probably be supported by VOP_PATHCONF(), but
3445 	 * until msdosfs is exportable (why would you want to?), the
3446 	 * Unix defaults should be ok.
3447 	 */
3448 	pc->pc_caseinsensitive = nfs_false;
3449 	pc->pc_casepreserving = nfs_true;
3450 	nfsm_srvdone;
3451 }
3452 
3453 /*
3454  * Null operation, used by clients to ping server
3455  */
3456 /* ARGSUSED */
3457 int
3458 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3459     struct lwp *lwp, struct mbuf **mrq)
3460 {
3461 	struct mbuf *mrep = nfsd->nd_mrep;
3462 	char *bpos;
3463 	int error = NFSERR_RETVOID, cache = 0;
3464 	struct mbuf *mb, *mreq;
3465 	u_quad_t frev;
3466 
3467 	nfsm_reply(0);
3468 nfsmout:
3469 	return (0);
3470 }
3471 
3472 /*
3473  * No operation, used for obsolete procedures
3474  */
3475 /* ARGSUSED */
3476 int
3477 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3478     struct lwp *lwp, struct mbuf **mrq)
3479 {
3480 	struct mbuf *mrep = nfsd->nd_mrep;
3481 	char *bpos;
3482 	int error, cache = 0;
3483 	struct mbuf *mb, *mreq;
3484 	u_quad_t frev;
3485 
3486 	if (nfsd->nd_repstat)
3487 		error = nfsd->nd_repstat;
3488 	else
3489 		error = EPROCUNAVAIL;
3490 	nfsm_reply(0);
3491 nfsmout:
3492 	return (0);
3493 }
3494 
3495 /*
3496  * Perform access checking for vnodes obtained from file handles that would
3497  * refer to files already opened by a Unix client. You cannot just use
3498  * vn_writechk() and VOP_ACCESS() for two reasons.
3499  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
3500  * 2 - The owner is to be given access irrespective of mode bits for some
3501  *     operations, so that processes that chmod after opening a file don't
3502  *     break. I don't like this because it opens a security hole, but since
3503  *     the nfs server opens a security hole the size of a barn door anyhow,
3504  *     what the heck.
3505  *
3506  * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
3507  * will return EPERM instead of EACCES. EPERM is always an error.
3508  */
3509 int
3510 nfsrv_access(struct vnode *vp, int flags, kauth_cred_t cred, int rdonly, struct lwp *lwp, int override)
3511 {
3512 	struct vattr vattr;
3513 	int error;
3514 	if (flags & VWRITE) {
3515 		/* Just vn_writechk() changed to check rdonly */
3516 		/*
3517 		 * Disallow write attempts on read-only file systems;
3518 		 * unless the file is a socket or a block or character
3519 		 * device resident on the file system.
3520 		 */
3521 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
3522 			switch (vp->v_type) {
3523 			case VREG:
3524 			case VDIR:
3525 			case VLNK:
3526 				return (EROFS);
3527 			default:
3528 				break;
3529 			}
3530 		}
3531 
3532 		/*
3533 		 * If the vnode is in use as a process's text,
3534 		 * we can't allow writing.
3535 		 */
3536 		if (vp->v_iflag & VI_TEXT)
3537 			return (ETXTBSY);
3538 	}
3539 	error = VOP_GETATTR(vp, &vattr, cred);
3540 	if (error)
3541 		return (error);
3542 	error = VOP_ACCESS(vp, flags, cred);
3543 	/*
3544 	 * Allow certain operations for the owner (reads and writes
3545 	 * on files that are already open).
3546 	 */
3547 	if (override && error == EACCES && kauth_cred_geteuid(cred) == vattr.va_uid)
3548 		error = 0;
3549 	return error;
3550 }
3551