xref: /netbsd-src/sys/nfs/nfs_serv.c (revision a5847cc334d9a7029f6352b847e9e8d71a0f9e0c)
1 /*	$NetBSD: nfs_serv.c,v 1.161 2011/10/30 12:00:27 hannken Exp $	*/
2 
3 /*
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)nfs_serv.c	8.8 (Berkeley) 7/31/95
35  */
36 
37 /*
38  * nfs version 2 and 3 server calls to vnode ops
39  * - these routines generally have 3 phases
40  *   1 - break down and validate rpc request in mbuf list
41  *   2 - do the vnode ops for the request
42  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
43  *   3 - build the rpc reply in an mbuf list
44  *   nb:
45  *	- do not mix the phases, since the nfsm_?? macros can return failures
46  *	  on a bad rpc or similar and do not do any vrele() or vput()'s
47  *
48  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
49  *	error number iff error != 0 whereas
50  *	returning an error from the server function implies a fatal error
51  *	such as a badly constructed rpc request that should be dropped without
52  *	a reply.
53  *	For Version 3, nfsm_reply() does not return for the error case, since
54  *	most version 3 rpcs return more than the status for error cases.
55  */
56 
57 #include <sys/cdefs.h>
58 __KERNEL_RCSID(0, "$NetBSD: nfs_serv.c,v 1.161 2011/10/30 12:00:27 hannken Exp $");
59 
60 #include <sys/param.h>
61 #include <sys/systm.h>
62 #include <sys/proc.h>
63 #include <sys/file.h>
64 #include <sys/namei.h>
65 #include <sys/vnode.h>
66 #include <sys/mount.h>
67 #include <sys/socket.h>
68 #include <sys/socketvar.h>
69 #include <sys/mbuf.h>
70 #include <sys/dirent.h>
71 #include <sys/stat.h>
72 #include <sys/kernel.h>
73 #include <sys/hash.h>
74 #include <sys/kauth.h>
75 #include <sys/module.h>
76 #include <sys/syscall.h>
77 #include <sys/syscallargs.h>
78 #include <sys/syscallvar.h>
79 
80 #include <uvm/uvm.h>
81 
82 #include <nfs/nfsproto.h>
83 #include <nfs/rpcv2.h>
84 #include <nfs/nfs.h>
85 #include <nfs/xdr_subs.h>
86 #include <nfs/nfsm_subs.h>
87 #include <nfs/nfs_var.h>
88 
89 MODULE(MODULE_CLASS_MISC, nfsserver, "nfs");
90 
91 /* Global vars */
92 extern u_int32_t nfs_xdrneg1;
93 extern u_int32_t nfs_false, nfs_true;
94 extern const enum vtype nv3tov_type[8];
95 extern struct nfsstats nfsstats;
96 extern const nfstype nfsv2_type[9];
97 extern const nfstype nfsv3_type[9];
98 int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
99 bool nfsd_use_loan = true;	/* use page-loan for READ OP */
100 
101 #define	nqsrv_getl(vp, rw)	/* nothing */
102 
103 static const struct syscall_package nfsserver_syscalls[] = {
104 	{ SYS_nfssvc, 0, (sy_call_t *)sys_nfssvc },
105 	{ 0, 0, NULL },
106 };
107 
108 static int
109 nfsserver_modcmd(modcmd_t cmd, void *arg)
110 {
111 	extern struct vfs_hooks nfs_export_hooks;	/* XXX */
112 	int error;
113 
114 	switch (cmd) {
115 	case MODULE_CMD_INIT:
116 		error = syscall_establish(NULL, nfsserver_syscalls);
117 		if (error != 0) {
118 			return error;
119 		}
120 		nfs_init();	/* XXX for monolithic kernel */
121 		netexport_init();
122 		nfsrv_initcache();	/* Init the server request cache */
123 		nfsrv_init(0);		/* Init server data structures */
124 		vfs_hooks_attach(&nfs_export_hooks);
125 		nfs_timer_srvinit(nfsrv_timer);
126 		return 0;
127 	case MODULE_CMD_FINI:
128 		error = syscall_disestablish(NULL, nfsserver_syscalls);
129 		if (error != 0) {
130 			return error;
131 		}
132 		/*
133 		 * Kill export list before detaching VFS hooks, so we
134 		 * we don't leak state due to a concurrent umount().
135 		 */
136 		netexport_fini();
137 		vfs_hooks_detach(&nfs_export_hooks);
138 
139 		/* Kill timer before server goes away. */
140 		nfs_timer_srvfini();
141 		nfsrv_fini();
142 
143 		/* Server uses server cache, so kill cache last. */
144 		nfsrv_finicache();
145 		return 0;
146 	default:
147 		return ENOTTY;
148 	}
149 }
150 
151 /*
152  * nfs v3 access service
153  */
154 int
155 nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
156 {
157 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
158 	struct mbuf *nam = nfsd->nd_nam;
159 	char *dpos = nfsd->nd_dpos;
160 	kauth_cred_t cred = nfsd->nd_cr;
161 	struct vnode *vp;
162 	nfsrvfh_t nsfh;
163 	u_int32_t *tl;
164 	int32_t t1;
165 	char *bpos;
166 	int error = 0, rdonly, cache = 0, getret;
167 	char *cp2;
168 	struct mbuf *mb, *mreq;
169 	struct vattr va;
170 	u_long inmode, testmode, outmode;
171 	u_quad_t frev;
172 
173 	nfsm_srvmtofh(&nsfh);
174 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
175 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
176 	    (nfsd->nd_flag & ND_KERBAUTH), false);
177 	if (error) {
178 		nfsm_reply(NFSX_UNSIGNED);
179 		nfsm_srvpostop_attr(1, (struct vattr *)0);
180 		return (0);
181 	}
182 	inmode = fxdr_unsigned(u_int32_t, *tl);
183 	outmode = 0;
184 	if ((inmode & NFSV3ACCESS_READ) &&
185 	    nfsrv_access(vp, VREAD, cred, rdonly, lwp, 0) == 0)
186 		outmode |= NFSV3ACCESS_READ;
187 	if (vp->v_type != VDIR) {
188 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
189 		if (testmode &&
190 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
191 			outmode |= testmode;
192 		if ((inmode & NFSV3ACCESS_EXECUTE) &&
193 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
194 			outmode |= NFSV3ACCESS_EXECUTE;
195 	} else {
196 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
197 		    NFSV3ACCESS_DELETE);
198 		if (testmode &&
199 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
200 			outmode |= testmode;
201 		if ((inmode & NFSV3ACCESS_LOOKUP) &&
202 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
203 			outmode |= NFSV3ACCESS_LOOKUP;
204 	}
205 	getret = VOP_GETATTR(vp, &va, cred);
206 	vput(vp);
207 	nfsm_reply(NFSX_POSTOPATTR(1) + NFSX_UNSIGNED);
208 	nfsm_srvpostop_attr(getret, &va);
209 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
210 	*tl = txdr_unsigned(outmode);
211 	nfsm_srvdone;
212 }
213 
214 /*
215  * nfs getattr service
216  */
217 int
218 nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
219 {
220 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
221 	struct mbuf *nam = nfsd->nd_nam;
222 	char *dpos = nfsd->nd_dpos;
223 	kauth_cred_t cred = nfsd->nd_cr;
224 	struct nfs_fattr *fp;
225 	struct vattr va;
226 	struct vnode *vp;
227 	nfsrvfh_t nsfh;
228 	u_int32_t *tl;
229 	int32_t t1;
230 	char *bpos;
231 	int error = 0, rdonly, cache = 0;
232 	char *cp2;
233 	struct mbuf *mb, *mreq;
234 	u_quad_t frev;
235 
236 	nfsm_srvmtofh(&nsfh);
237 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
238 	    (nfsd->nd_flag & ND_KERBAUTH), false);
239 	if (error) {
240 		nfsm_reply(0);
241 		return (0);
242 	}
243 	nqsrv_getl(vp, ND_READ);
244 	error = VOP_GETATTR(vp, &va, cred);
245 	vput(vp);
246 	nfsm_reply(NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
247 	if (error)
248 		return (0);
249 	nfsm_build(fp, struct nfs_fattr *, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
250 	nfsm_srvfillattr(&va, fp);
251 	nfsm_srvdone;
252 }
253 
254 /*
255  * nfs setattr service
256  */
257 int
258 nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
259 {
260 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
261 	struct mbuf *nam = nfsd->nd_nam;
262 	char *dpos = nfsd->nd_dpos;
263 	kauth_cred_t cred = nfsd->nd_cr;
264 	struct vattr va, preat;
265 	struct nfsv2_sattr *sp;
266 	struct nfs_fattr *fp;
267 	struct vnode *vp;
268 	nfsrvfh_t nsfh;
269 	u_int32_t *tl;
270 	int32_t t1;
271 	char *bpos;
272 	int error = 0, rdonly, cache = 0, preat_ret = 1, postat_ret = 1;
273 	int v3 = (nfsd->nd_flag & ND_NFSV3), gcheck = 0;
274 	char *cp2;
275 	struct mbuf *mb, *mreq;
276 	u_quad_t frev;
277 	struct timespec guard;
278 
279 	memset(&guard, 0, sizeof guard);	/* XXX gcc */
280 
281 	nfsm_srvmtofh(&nsfh);
282 	vattr_null(&va);
283 	if (v3) {
284 		nfsm_srvsattr(&va);
285 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
286 		gcheck = fxdr_unsigned(int, *tl);
287 		if (gcheck) {
288 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
289 			fxdr_nfsv3time(tl, &guard);
290 		}
291 	} else {
292 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
293 		/*
294 		 * Nah nah nah nah na nah
295 		 * There is a bug in the Sun client that puts 0xffff in the mode
296 		 * field of sattr when it should put in 0xffffffff. The u_short
297 		 * doesn't sign extend.
298 		 * --> check the low order 2 bytes for 0xffff
299 		 */
300 		if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
301 			va.va_mode = nfstov_mode(sp->sa_mode);
302 		if (sp->sa_uid != nfs_xdrneg1)
303 			va.va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
304 		if (sp->sa_gid != nfs_xdrneg1)
305 			va.va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
306 		if (sp->sa_size != nfs_xdrneg1)
307 			va.va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
308 		if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
309 #ifdef notyet
310 			fxdr_nfsv2time(&sp->sa_atime, &va.va_atime);
311 #else
312 			va.va_atime.tv_sec =
313 				fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
314 			va.va_atime.tv_nsec = 0;
315 #endif
316 		}
317 		if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
318 			fxdr_nfsv2time(&sp->sa_mtime, &va.va_mtime);
319 
320 	}
321 
322 	/*
323 	 * Now that we have all the fields, lets do it.
324 	 */
325 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
326 	    (nfsd->nd_flag & ND_KERBAUTH), false);
327 	if (error) {
328 		nfsm_reply(2 * NFSX_UNSIGNED);
329 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
330 		return (0);
331 	}
332 	nqsrv_getl(vp, ND_WRITE);
333 	if (v3) {
334 		error = preat_ret = VOP_GETATTR(vp, &preat, cred);
335 		if (!error && gcheck &&
336 			(preat.va_ctime.tv_sec != guard.tv_sec ||
337 			 preat.va_ctime.tv_nsec != guard.tv_nsec))
338 			error = NFSERR_NOT_SYNC;
339 		if (error) {
340 			vput(vp);
341 			nfsm_reply(NFSX_WCCDATA(v3));
342 			nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
343 			return (0);
344 		}
345 	}
346 
347 	/*
348 	 * If the size is being changed write acces is required, otherwise
349 	 * just check for a read only file system.
350 	 */
351 	if (va.va_size == ((u_quad_t)((quad_t) -1))) {
352 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
353 			error = EROFS;
354 			goto out;
355 		}
356 	} else {
357 		if (vp->v_type == VDIR) {
358 			error = EISDIR;
359 			goto out;
360 		} else if ((error = nfsrv_access(vp, VWRITE, cred, rdonly,
361 			lwp, 0)) != 0)
362 			goto out;
363 	}
364 	error = VOP_SETATTR(vp, &va, cred);
365 	postat_ret = VOP_GETATTR(vp, &va, cred);
366 	if (!error)
367 		error = postat_ret;
368 out:
369 	vput(vp);
370 	nfsm_reply(NFSX_WCCORFATTR(v3));
371 	if (v3) {
372 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
373 		return (0);
374 	} else {
375 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
376 		nfsm_srvfillattr(&va, fp);
377 	}
378 	nfsm_srvdone;
379 }
380 
381 /*
382  * nfs lookup rpc
383  */
384 int
385 nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
386 {
387 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
388 	struct mbuf *nam = nfsd->nd_nam;
389 	char *dpos = nfsd->nd_dpos;
390 	kauth_cred_t cred = nfsd->nd_cr;
391 	struct nfs_fattr *fp;
392 	struct nameidata nd, ind, *ndp = &nd;
393 	struct pathbuf *ipb = NULL;
394 	struct vnode *vp, *dirp;
395 	nfsrvfh_t nsfh;
396 	char *cp;
397 	u_int32_t *tl;
398 	int32_t t1;
399 	char *bpos;
400 	int error = 0, cache = 0, dirattr_ret = 1;
401 	uint32_t len;
402 	int v3 = (nfsd->nd_flag & ND_NFSV3), pubflag;
403 	char *cp2;
404 	struct mbuf *mb, *mreq;
405 	struct vattr va, dirattr;
406 	u_quad_t frev;
407 
408 	nfsm_srvmtofh(&nsfh);
409 	nfsm_srvnamesiz(len);
410 
411 	pubflag = nfs_ispublicfh(&nsfh);
412 
413 	nd.ni_cnd.cn_cred = cred;
414 	nd.ni_cnd.cn_nameiop = LOOKUP;
415 	nd.ni_cnd.cn_flags = LOCKLEAF;
416 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
417 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), pubflag);
418 
419 	if (!error && pubflag) {
420 		if (nd.ni_vp->v_type == VDIR && nfs_pub.np_index != NULL &&
421 		    (ipb = pathbuf_create(nfs_pub.np_index)) != NULL) {
422 			/*
423 			 * Setup call to lookup() to see if we can find
424 			 * the index file. Arguably, this doesn't belong
425 			 * in a kernel.. Ugh.
426 			 */
427 			ind = nd;
428 			VOP_UNLOCK(nd.ni_vp);
429 			ind.ni_pathbuf = ipb;
430 
431 			error = lookup_for_nfsd_index(&ind, nd.ni_vp);
432 			if (!error) {
433 				/*
434 				 * Found an index file. Get rid of
435 				 * the old references.
436 				 */
437 				if (dirp)
438 					vrele(dirp);
439 				dirp = nd.ni_vp;
440 				ndp = &ind;
441 			} else
442 				error = 0;
443 		}
444 		/*
445 		 * If the public filehandle was used, check that this lookup
446 		 * didn't result in a filehandle outside the publicly exported
447 		 * filesystem.
448 		 */
449 
450 		if (!error && ndp->ni_vp->v_mount != nfs_pub.np_mount) {
451 			vput(nd.ni_vp);
452 			error = EPERM;
453 		}
454 	}
455 
456 	if (dirp) {
457 		if (v3) {
458 			vn_lock(dirp, LK_SHARED | LK_RETRY);
459 			dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred);
460 			VOP_UNLOCK(dirp);
461 		}
462 		vrele(dirp);
463 	}
464 
465 	if (error) {
466 		if (nd.ni_pathbuf != NULL) {
467 			pathbuf_destroy(nd.ni_pathbuf);
468 		}
469 		if (ipb != NULL) {
470 			pathbuf_destroy(ipb);
471 		}
472 		nfsm_reply(NFSX_POSTOPATTR(v3));
473 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
474 		return (0);
475 	}
476 
477 	nqsrv_getl(ndp->ni_startdir, ND_READ);
478 	pathbuf_destroy(nd.ni_pathbuf);
479 	if (ipb != NULL) {
480 		pathbuf_destroy(ipb);
481 	}
482 	vp = ndp->ni_vp;
483 	error = nfsrv_composefh(vp, &nsfh, v3);
484 	if (!error)
485 		error = VOP_GETATTR(vp, &va, cred);
486 	vput(vp);
487 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPORFATTR(v3) +
488 	    NFSX_POSTOPATTR(v3));
489 	if (error) {
490 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
491 		return (0);
492 	}
493 	nfsm_srvfhtom(&nsfh, v3);
494 	if (v3) {
495 		nfsm_srvpostop_attr(0, &va);
496 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
497 	} else {
498 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
499 		nfsm_srvfillattr(&va, fp);
500 	}
501 	nfsm_srvdone;
502 }
503 
504 /*
505  * nfs readlink service
506  */
507 int
508 nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
509 {
510 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
511 	struct mbuf *nam = nfsd->nd_nam;
512 	char *dpos = nfsd->nd_dpos;
513 	kauth_cred_t cred = nfsd->nd_cr;
514 	struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
515 	struct iovec *ivp = iv;
516 	struct mbuf *mp;
517 	u_int32_t *tl;
518 	int32_t t1;
519 	char *bpos;
520 	int error = 0, rdonly, cache = 0, i, padlen, getret;
521 	uint32_t len;
522 	int v3 = (nfsd->nd_flag & ND_NFSV3);
523 	char *cp2;
524 	struct mbuf *mb, *mp2 = NULL, *mp3 = NULL, *mreq;
525 	struct vnode *vp;
526 	struct vattr attr;
527 	nfsrvfh_t nsfh;
528 	struct uio io, *uiop = &io;
529 	u_quad_t frev;
530 
531 	nfsm_srvmtofh(&nsfh);
532 	len = 0;
533 	i = 0;
534 	while (len < NFS_MAXPATHLEN) {
535 		mp = m_get(M_WAIT, MT_DATA);
536 		MCLAIM(mp, &nfs_mowner);
537 		m_clget(mp, M_WAIT);
538 		mp->m_len = NFSMSIZ(mp);
539 		if (len == 0)
540 			mp3 = mp2 = mp;
541 		else {
542 			mp2->m_next = mp;
543 			mp2 = mp;
544 		}
545 		if ((len+mp->m_len) > NFS_MAXPATHLEN) {
546 			mp->m_len = NFS_MAXPATHLEN-len;
547 			len = NFS_MAXPATHLEN;
548 		} else
549 			len += mp->m_len;
550 		ivp->iov_base = mtod(mp, void *);
551 		ivp->iov_len = mp->m_len;
552 		i++;
553 		ivp++;
554 	}
555 	uiop->uio_iov = iv;
556 	uiop->uio_iovcnt = i;
557 	uiop->uio_offset = 0;
558 	uiop->uio_resid = len;
559 	uiop->uio_rw = UIO_READ;
560 	UIO_SETUP_SYSSPACE(uiop);
561 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
562 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
563 	if (error) {
564 		m_freem(mp3);
565 		nfsm_reply(2 * NFSX_UNSIGNED);
566 		nfsm_srvpostop_attr(1, (struct vattr *)0);
567 		return (0);
568 	}
569 	if (vp->v_type != VLNK) {
570 		if (v3)
571 			error = EINVAL;
572 		else
573 			error = ENXIO;
574 		goto out;
575 	}
576 	nqsrv_getl(vp, ND_READ);
577 	error = VOP_READLINK(vp, uiop, cred);
578 out:
579 	getret = VOP_GETATTR(vp, &attr, cred);
580 	vput(vp);
581 	if (error)
582 		m_freem(mp3);
583 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_UNSIGNED);
584 	if (v3) {
585 		nfsm_srvpostop_attr(getret, &attr);
586 		if (error)
587 			return (0);
588 	}
589 	len -= uiop->uio_resid;
590 	padlen = nfsm_padlen(len);
591 	if (uiop->uio_resid || padlen)
592 		nfs_zeropad(mp3, uiop->uio_resid, padlen);
593 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
594 	*tl = txdr_unsigned(len);
595 	mb->m_next = mp3;
596 	nfsm_srvdone;
597 }
598 
599 /*
600  * nfs read service
601  */
602 int
603 nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
604 {
605 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
606 	struct mbuf *nam = nfsd->nd_nam;
607 	char *dpos = nfsd->nd_dpos;
608 	kauth_cred_t cred = nfsd->nd_cr;
609 	struct mbuf *m;
610 	struct nfs_fattr *fp;
611 	u_int32_t *tl;
612 	int32_t t1;
613 	int i;
614 	char *bpos;
615 	int error = 0, rdonly, cache = 0, getret;
616 	int v3 = (nfsd->nd_flag & ND_NFSV3);
617 	uint32_t reqlen, len, cnt, left;
618 	int padlen;
619 	char *cp2;
620 	struct mbuf *mb, *mreq;
621 	struct vnode *vp;
622 	nfsrvfh_t nsfh;
623 	struct uio io, *uiop = &io;
624 	struct vattr va;
625 	off_t off;
626 	u_quad_t frev;
627 
628 	nfsm_srvmtofh(&nsfh);
629 	if (v3) {
630 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
631 		off = fxdr_hyper(tl);
632 	} else {
633 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
634 		off = (off_t)fxdr_unsigned(u_int32_t, *tl);
635 	}
636 	nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
637 	reqlen = fxdr_unsigned(uint32_t, *tl);
638 	reqlen = MIN(reqlen, NFS_SRVMAXDATA(nfsd));
639 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
640 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
641 	if (error) {
642 		nfsm_reply(2 * NFSX_UNSIGNED);
643 		nfsm_srvpostop_attr(1, (struct vattr *)0);
644 		return (0);
645 	}
646 	if (vp->v_type != VREG) {
647 		if (v3)
648 			error = EINVAL;
649 		else
650 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
651 	}
652 	if (!error) {
653 	    nqsrv_getl(vp, ND_READ);
654 	    if ((error = nfsrv_access(vp, VREAD, cred, rdonly, lwp, 1)) != 0)
655 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 1);
656 	}
657 	getret = VOP_GETATTR(vp, &va, cred);
658 	if (!error)
659 		error = getret;
660 	if (error) {
661 		vput(vp);
662 		nfsm_reply(NFSX_POSTOPATTR(v3));
663 		nfsm_srvpostop_attr(getret, &va);
664 		return (0);
665 	}
666 	if (off >= va.va_size)
667 		cnt = 0;
668 	else if ((off + reqlen) > va.va_size)
669 		cnt = va.va_size - off;
670 	else
671 		cnt = reqlen;
672 	nfsm_reply(NFSX_POSTOPORFATTR(v3) + 3 * NFSX_UNSIGNED+nfsm_rndup(cnt));
673 	if (v3) {
674 		nfsm_build(tl, u_int32_t *, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
675 		*tl++ = nfs_true;
676 		fp = (struct nfs_fattr *)tl;
677 		tl += (NFSX_V3FATTR / sizeof (u_int32_t));
678 	} else {
679 		nfsm_build(tl, u_int32_t *, NFSX_V2FATTR + NFSX_UNSIGNED);
680 		fp = (struct nfs_fattr *)tl;
681 		tl += (NFSX_V2FATTR / sizeof (u_int32_t));
682 	}
683 	len = left = cnt;
684 	if (cnt > 0) {
685 		if (nfsd_use_loan) {
686 			struct vm_page **pgpp;
687 			voff_t pgoff = trunc_page(off);
688 			int npages;
689 			vaddr_t lva;
690 
691 			npages = (round_page(off + cnt) - pgoff) >> PAGE_SHIFT;
692 			KASSERT(npages <= M_EXT_MAXPAGES); /* XXX */
693 
694 			/* allocate kva for mbuf data */
695 			lva = sokvaalloc(npages << PAGE_SHIFT, slp->ns_so);
696 			if (lva == 0) {
697 				/* fall back to VOP_READ */
698 				goto loan_fail;
699 			}
700 
701 			/* allocate mbuf */
702 			m = m_get(M_WAIT, MT_DATA);
703 			MCLAIM(m, &nfs_mowner);
704 			pgpp = m->m_ext.ext_pgs;
705 
706 			/* loan pages */
707 			error = uvm_loanuobjpages(&vp->v_uobj, pgoff, npages,
708 			    pgpp);
709 			if (error) {
710 				sokvafree(lva, npages << PAGE_SHIFT);
711 				m_free(m);
712 				if (error == EBUSY)
713 					goto loan_fail;
714 				goto read_error;
715 			}
716 
717 			/* associate kva to mbuf */
718 			MEXTADD(m, (void *)(lva + ((vaddr_t)off & PAGE_MASK)),
719 			    cnt, M_MBUF, soloanfree, slp->ns_so);
720 			m->m_flags |= M_EXT_PAGES | M_EXT_ROMAP;
721 			m->m_len = cnt;
722 
723 			/* map pages */
724 			for (i = 0; i < npages; i++) {
725 				pmap_kenter_pa(lva, VM_PAGE_TO_PHYS(pgpp[i]),
726 				    VM_PROT_READ, 0);
727 				lva += PAGE_SIZE;
728 			}
729 
730 			pmap_update(pmap_kernel());
731 
732 			mb->m_next = m;
733 			mb = m;
734 			error = 0;
735 			uiop->uio_resid = 0;
736 		} else {
737 			struct iovec *iv;
738 			struct iovec *iv2;
739 			struct mbuf *m2;
740 			int siz;
741 loan_fail:
742 			/*
743 			 * Generate the mbuf list with the uio_iov ref. to it.
744 			 */
745 			i = 0;
746 			m = m2 = mb;
747 			while (left > 0) {
748 				siz = min(M_TRAILINGSPACE(m), left);
749 				if (siz > 0) {
750 					left -= siz;
751 					i++;
752 				}
753 				if (left > 0) {
754 					m = m_get(M_WAIT, MT_DATA);
755 					MCLAIM(m, &nfs_mowner);
756 					m_clget(m, M_WAIT);
757 					m->m_len = 0;
758 					m2->m_next = m;
759 					m2 = m;
760 				}
761 			}
762 			iv = malloc(i * sizeof(struct iovec), M_TEMP, M_WAITOK);
763 			uiop->uio_iov = iv2 = iv;
764 			m = mb;
765 			left = cnt;
766 			i = 0;
767 			while (left > 0) {
768 				if (m == NULL)
769 					panic("nfsrv_read iov");
770 				siz = min(M_TRAILINGSPACE(m), left);
771 				if (siz > 0) {
772 					iv->iov_base = mtod(m, char *) +
773 					    m->m_len;
774 					iv->iov_len = siz;
775 					m->m_len += siz;
776 					left -= siz;
777 					iv++;
778 					i++;
779 				}
780 				m = m->m_next;
781 			}
782 			uiop->uio_iovcnt = i;
783 			uiop->uio_offset = off;
784 			uiop->uio_resid = cnt;
785 			uiop->uio_rw = UIO_READ;
786 			UIO_SETUP_SYSSPACE(uiop);
787 			error = VOP_READ(vp, uiop, IO_NODELOCKED, cred);
788 			free((void *)iv2, M_TEMP);
789 		}
790 read_error:
791 		if (error || (getret = VOP_GETATTR(vp, &va, cred)) != 0){
792 			if (!error)
793 				error = getret;
794 			m_freem(mreq);
795 			vput(vp);
796 			nfsm_reply(NFSX_POSTOPATTR(v3));
797 			nfsm_srvpostop_attr(getret, &va);
798 			return (0);
799 		}
800 	} else {
801 		uiop->uio_resid = 0;
802 	}
803 	vput(vp);
804 	nfsm_srvfillattr(&va, fp);
805 	len -= uiop->uio_resid;
806 	padlen = nfsm_padlen(len);
807 	if (uiop->uio_resid || padlen)
808 		nfs_zeropad(mb, uiop->uio_resid, padlen);
809 	if (v3) {
810 		/* count */
811 		*tl++ = txdr_unsigned(len);
812 		/* eof */
813 		if (off + len >= va.va_size)
814 			*tl++ = nfs_true;
815 		else
816 			*tl++ = nfs_false;
817 	}
818 	*tl = txdr_unsigned(len);
819 	nfsm_srvdone;
820 }
821 
822 /*
823  * nfs write service
824  */
825 int
826 nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
827 {
828 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
829 	struct mbuf *nam = nfsd->nd_nam;
830 	char *dpos = nfsd->nd_dpos;
831 	kauth_cred_t cred = nfsd->nd_cr;
832 	struct iovec *ivp;
833 	int i, cnt;
834 	struct mbuf *mp;
835 	struct nfs_fattr *fp;
836 	struct iovec *iv;
837 	struct vattr va, forat;
838 	u_int32_t *tl;
839 	int32_t t1;
840 	char *bpos;
841 	int error = 0, rdonly, cache = 0, len, forat_ret = 1;
842 	int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
843 	int stable = NFSV3WRITE_FILESYNC;
844 	int v3 = (nfsd->nd_flag & ND_NFSV3);
845 	char *cp2;
846 	struct mbuf *mb, *mreq;
847 	struct vnode *vp;
848 	nfsrvfh_t nsfh;
849 	struct uio io, *uiop = &io;
850 	off_t off;
851 	u_quad_t frev;
852 
853 	if (mrep == NULL) {
854 		*mrq = NULL;
855 		return (0);
856 	}
857 	nfsm_srvmtofh(&nsfh);
858 	if (v3) {
859 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
860 		off = fxdr_hyper(tl);
861 		tl += 3;
862 		stable = fxdr_unsigned(int, *tl++);
863 	} else {
864 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
865 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
866 		tl += 2;
867 	}
868 	retlen = len = fxdr_unsigned(int32_t, *tl);
869 	cnt = i = 0;
870 
871 	/*
872 	 * For NFS Version 2, it is not obvious what a write of zero length
873 	 * should do, but I might as well be consistent with Version 3,
874 	 * which is to return ok so long as there are no permission problems.
875 	 */
876 	if (len > 0) {
877 		zeroing = 1;
878 		mp = mrep;
879 		while (mp) {
880 			if (mp == md) {
881 				zeroing = 0;
882 				adjust = dpos - mtod(mp, char *);
883 				mp->m_len -= adjust;
884 				if (mp->m_len > 0 && adjust > 0)
885 					NFSMADV(mp, adjust);
886 			}
887 			if (zeroing)
888 				mp->m_len = 0;
889 			else if (mp->m_len > 0) {
890 				i += mp->m_len;
891 				if (i > len) {
892 					mp->m_len -= (i - len);
893 					zeroing	= 1;
894 				}
895 				if (mp->m_len > 0)
896 					cnt++;
897 			}
898 			mp = mp->m_next;
899 		}
900 	}
901 	if (len > NFS_MAXDATA || len < 0 || i < len) {
902 		error = EIO;
903 		nfsm_reply(2 * NFSX_UNSIGNED);
904 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
905 		return (0);
906 	}
907 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
908 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
909 	if (error) {
910 		nfsm_reply(2 * NFSX_UNSIGNED);
911 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
912 		return (0);
913 	}
914 	if (v3)
915 		forat_ret = VOP_GETATTR(vp, &forat, cred);
916 	if (vp->v_type != VREG) {
917 		if (v3)
918 			error = EINVAL;
919 		else
920 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
921 	}
922 	if (!error) {
923 		nqsrv_getl(vp, ND_WRITE);
924 		error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
925 	}
926 	if (error) {
927 		vput(vp);
928 		nfsm_reply(NFSX_WCCDATA(v3));
929 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
930 		return (0);
931 	}
932 
933 	if (len > 0) {
934 		ivp = malloc(cnt * sizeof (struct iovec), M_TEMP, M_WAITOK);
935 		uiop->uio_iov = iv = ivp;
936 		uiop->uio_iovcnt = cnt;
937 		mp = mrep;
938 		while (mp) {
939 			if (mp->m_len > 0) {
940 				ivp->iov_base = mtod(mp, void *);
941 				ivp->iov_len = mp->m_len;
942 				ivp++;
943 			}
944 			mp = mp->m_next;
945 		}
946 
947 		/*
948 		 * XXX
949 		 * The IO_METASYNC flag indicates that all metadata (and not
950 		 * just enough to ensure data integrity) must be written to
951 		 * stable storage synchronously.
952 		 * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
953 		 */
954 		if (stable == NFSV3WRITE_UNSTABLE)
955 			ioflags = IO_NODELOCKED;
956 		else if (stable == NFSV3WRITE_DATASYNC)
957 			ioflags = (IO_SYNC | IO_NODELOCKED);
958 		else
959 			ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
960 		uiop->uio_resid = len;
961 		uiop->uio_rw = UIO_WRITE;
962 		uiop->uio_offset = off;
963 		UIO_SETUP_SYSSPACE(uiop);
964 		error = VOP_WRITE(vp, uiop, ioflags, cred);
965 		nfsstats.srvvop_writes++;
966 		free(iv, M_TEMP);
967 	}
968 	aftat_ret = VOP_GETATTR(vp, &va, cred);
969 	vput(vp);
970 	if (!error)
971 		error = aftat_ret;
972 	nfsm_reply(NFSX_PREOPATTR(v3) + NFSX_POSTOPORFATTR(v3) +
973 		2 * NFSX_UNSIGNED + NFSX_WRITEVERF(v3));
974 	if (v3) {
975 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
976 		if (error)
977 			return (0);
978 		nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
979 		*tl++ = txdr_unsigned(retlen);
980 		if (stable == NFSV3WRITE_UNSTABLE)
981 			*tl++ = txdr_unsigned(stable);
982 		else
983 			*tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
984 		/*
985 		 * Actually, there is no need to txdr these fields,
986 		 * but it may make the values more human readable,
987 		 * for debugging purposes.
988 		 */
989 		*tl++ = txdr_unsigned(boottime.tv_sec);
990 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
991 	} else {
992 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
993 		nfsm_srvfillattr(&va, fp);
994 	}
995 	nfsm_srvdone;
996 }
997 
998 /*
999  * XXX elad: the original NFSW_SAMECRED() macro also made sure the
1000  *	     two nd_flag fields of the descriptors contained
1001  *	     ND_KERBAUTH.
1002  */
1003 static int
1004 nfsrv_samecred(kauth_cred_t cred1, kauth_cred_t cred2)
1005 {
1006 	int i, do_ngroups;
1007 
1008 	if (kauth_cred_geteuid(cred1) != kauth_cred_geteuid(cred2))
1009 		return (0);
1010 	if (kauth_cred_ngroups(cred1) != kauth_cred_ngroups(cred2))
1011 		return (0);
1012 	do_ngroups = kauth_cred_ngroups(cred1);
1013 	for (i = 0; i < do_ngroups; i++)
1014 		if (kauth_cred_group(cred1, i) !=
1015 		    kauth_cred_group(cred2, i))
1016 			return (0);
1017 
1018 	return (1);
1019 }
1020 
1021 static struct nfsrvw_delayhash *
1022 nfsrv_nwdelayhash(struct nfssvc_sock *slp, const nfsrvfh_t *nsfh)
1023 {
1024 	uint32_t hash;
1025 
1026 	hash = hash32_buf(NFSRVFH_DATA(nsfh), NFSRVFH_SIZE(nsfh),
1027 	    HASH32_BUF_INIT);
1028 	return &slp->ns_wdelayhashtbl[hash % NFS_WDELAYHASHSIZ];
1029 }
1030 
1031 /*
1032  * NFS write service with write gathering support. Called when
1033  * nfsrvw_procrastinate > 0.
1034  * See: Chet Juszczak, "Improving the Write Performance of an NFS Server",
1035  * in Proc. of the Winter 1994 Usenix Conference, pg. 247-259, San Franscisco,
1036  * Jan. 1994.
1037  */
1038 int
1039 nfsrv_writegather(struct nfsrv_descript **ndp, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1040 {
1041 	struct timeval now;
1042 	struct iovec *ivp;
1043 	struct mbuf *mp;
1044 	struct nfsrv_descript *wp, *nfsd, *owp, *swp;
1045 	struct nfs_fattr *fp;
1046 	int i = 0;
1047 	struct iovec *iov;
1048 	struct nfsrvw_delayhash *wpp;
1049 	kauth_cred_t cred;
1050 	struct vattr va, forat;
1051 	u_int32_t *tl;
1052 	int32_t t1;
1053 	char *bpos, *dpos;
1054 	int error = 0, rdonly, cache = 0, len = 0, forat_ret = 1;
1055 	int ioflags, aftat_ret = 1, adjust, v3, zeroing;
1056 	char *cp2;
1057 	struct mbuf *mb, *mreq, *mrep, *md;
1058 	struct vnode *vp;
1059 	struct uio io, *uiop = &io;
1060 	u_quad_t frev, cur_usec;
1061 
1062 	*mrq = NULL;
1063 	if (*ndp) {
1064 	    nfsd = *ndp;
1065 	    *ndp = NULL;
1066 	    mrep = nfsd->nd_mrep;
1067 	    md = nfsd->nd_md;
1068 	    dpos = nfsd->nd_dpos;
1069 	    cred = nfsd->nd_cr;
1070 	    v3 = (nfsd->nd_flag & ND_NFSV3);
1071 	    LIST_INIT(&nfsd->nd_coalesce);
1072 	    nfsd->nd_mreq = NULL;
1073 	    nfsd->nd_stable = NFSV3WRITE_FILESYNC;
1074 	    getmicrotime(&now);
1075 	    cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1076 	    nfsd->nd_time = cur_usec + nfsrvw_procrastinate;
1077 
1078 	    /*
1079 	     * Now, get the write header..
1080 	     */
1081 	    nfsm_srvmtofh(&nfsd->nd_fh);
1082 	    if (v3) {
1083 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1084 		nfsd->nd_off = fxdr_hyper(tl);
1085 		tl += 3;
1086 		nfsd->nd_stable = fxdr_unsigned(int, *tl++);
1087 	    } else {
1088 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1089 		nfsd->nd_off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1090 		tl += 2;
1091 	    }
1092 	    len = fxdr_unsigned(int32_t, *tl);
1093 	    nfsd->nd_len = len;
1094 	    nfsd->nd_eoff = nfsd->nd_off + len;
1095 
1096 	    /*
1097 	     * Trim the header out of the mbuf list and trim off any trailing
1098 	     * junk so that the mbuf list has only the write data.
1099 	     */
1100 	    zeroing = 1;
1101 	    i = 0;
1102 	    mp = mrep;
1103 	    while (mp) {
1104 		if (mp == md) {
1105 		    zeroing = 0;
1106 		    adjust = dpos - mtod(mp, char *);
1107 		    mp->m_len -= adjust;
1108 		    if (mp->m_len > 0 && adjust > 0)
1109 			NFSMADV(mp, adjust);
1110 		}
1111 		if (zeroing)
1112 		    mp->m_len = 0;
1113 		else {
1114 		    i += mp->m_len;
1115 		    if (i > len) {
1116 			mp->m_len -= (i - len);
1117 			zeroing = 1;
1118 		    }
1119 		}
1120 		mp = mp->m_next;
1121 	    }
1122 	    if (len > NFS_MAXDATA || len < 0  || i < len) {
1123 nfsmout:
1124 		m_freem(mrep);
1125 		error = EIO;
1126 		nfsm_writereply(2 * NFSX_UNSIGNED, v3);
1127 		if (v3)
1128 		    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1129 		nfsd->nd_mreq = mreq;
1130 		nfsd->nd_mrep = NULL;
1131 		nfsd->nd_time = 0;
1132 	    }
1133 
1134 	    /*
1135 	     * Add this entry to the hash and time queues.
1136 	     */
1137 	    owp = NULL;
1138 	    mutex_enter(&nfsd_lock);
1139 	    wp = LIST_FIRST(&slp->ns_tq);
1140 	    while (wp && wp->nd_time < nfsd->nd_time) {
1141 		owp = wp;
1142 		wp = LIST_NEXT(wp, nd_tq);
1143 	    }
1144 	    if (owp) {
1145 		LIST_INSERT_AFTER(owp, nfsd, nd_tq);
1146 	    } else {
1147 		LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1148 	    }
1149 	    if (nfsd->nd_mrep) {
1150 		wpp = nfsrv_nwdelayhash(slp, &nfsd->nd_fh);
1151 		owp = NULL;
1152 		wp = LIST_FIRST(wpp);
1153 		while (wp && nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1154 		    owp = wp;
1155 		    wp = LIST_NEXT(wp, nd_hash);
1156 		}
1157 		while (wp && wp->nd_off < nfsd->nd_off &&
1158 		    !nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1159 		    owp = wp;
1160 		    wp = LIST_NEXT(wp, nd_hash);
1161 		}
1162 		if (owp) {
1163 		    LIST_INSERT_AFTER(owp, nfsd, nd_hash);
1164 
1165 		    /*
1166 		     * Search the hash list for overlapping entries and
1167 		     * coalesce.
1168 		     */
1169 		    for(; nfsd && NFSW_CONTIG(owp, nfsd); nfsd = wp) {
1170 			wp = LIST_NEXT(nfsd, nd_hash);
1171 			if (nfsrv_samecred(owp->nd_cr, nfsd->nd_cr))
1172 			    nfsrvw_coalesce(owp, nfsd);
1173 		    }
1174 		} else {
1175 		    LIST_INSERT_HEAD(wpp, nfsd, nd_hash);
1176 		}
1177 	    }
1178 	    mutex_exit(&nfsd_lock);
1179 	}
1180 
1181 	/*
1182 	 * Now, do VOP_WRITE()s for any one(s) that need to be done now
1183 	 * and generate the associated reply mbuf list(s).
1184 	 */
1185 loop1:
1186 	getmicrotime(&now);
1187 	cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1188 	mutex_enter(&nfsd_lock);
1189 	for (nfsd = LIST_FIRST(&slp->ns_tq); nfsd; nfsd = owp) {
1190 		owp = LIST_NEXT(nfsd, nd_tq);
1191 		if (nfsd->nd_time > cur_usec)
1192 		    break;
1193 		if (nfsd->nd_mreq)
1194 		    continue;
1195 		LIST_REMOVE(nfsd, nd_tq);
1196 		LIST_REMOVE(nfsd, nd_hash);
1197 		mutex_exit(&nfsd_lock);
1198 
1199 		mrep = nfsd->nd_mrep;
1200 		nfsd->nd_mrep = NULL;
1201 		cred = nfsd->nd_cr;
1202 		v3 = (nfsd->nd_flag & ND_NFSV3);
1203 		forat_ret = aftat_ret = 1;
1204 		error = nfsrv_fhtovp(&nfsd->nd_fh, 1, &vp, cred, slp,
1205 		    nfsd->nd_nam, &rdonly, (nfsd->nd_flag & ND_KERBAUTH),
1206 		    false);
1207 		if (!error) {
1208 		    if (v3)
1209 			forat_ret = VOP_GETATTR(vp, &forat, cred);
1210 		    if (vp->v_type != VREG) {
1211 			if (v3)
1212 			    error = EINVAL;
1213 			else
1214 			    error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1215 		    }
1216 		} else
1217 		    vp = NULL;
1218 		if (!error) {
1219 		    nqsrv_getl(vp, ND_WRITE);
1220 		    error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
1221 		}
1222 
1223 		if (nfsd->nd_stable == NFSV3WRITE_UNSTABLE)
1224 		    ioflags = IO_NODELOCKED;
1225 		else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC)
1226 		    ioflags = (IO_SYNC | IO_NODELOCKED);
1227 		else
1228 		    ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1229 		uiop->uio_rw = UIO_WRITE;
1230 		uiop->uio_offset = nfsd->nd_off;
1231 		uiop->uio_resid = nfsd->nd_eoff - nfsd->nd_off;
1232 		UIO_SETUP_SYSSPACE(uiop);
1233 		if (uiop->uio_resid > 0) {
1234 		    mp = mrep;
1235 		    i = 0;
1236 		    while (mp) {
1237 			if (mp->m_len > 0)
1238 			    i++;
1239 			mp = mp->m_next;
1240 		    }
1241 		    uiop->uio_iovcnt = i;
1242 		    iov = malloc(i * sizeof (struct iovec), M_TEMP, M_WAITOK);
1243 		    uiop->uio_iov = ivp = iov;
1244 		    mp = mrep;
1245 		    while (mp) {
1246 			if (mp->m_len > 0) {
1247 			    ivp->iov_base = mtod(mp, void *);
1248 			    ivp->iov_len = mp->m_len;
1249 			    ivp++;
1250 			}
1251 			mp = mp->m_next;
1252 		    }
1253 		    if (!error) {
1254 			error = VOP_WRITE(vp, uiop, ioflags, cred);
1255 			nfsstats.srvvop_writes++;
1256 		    }
1257 		    free((void *)iov, M_TEMP);
1258 		}
1259 		m_freem(mrep);
1260 		if (vp) {
1261 		    aftat_ret = VOP_GETATTR(vp, &va, cred);
1262 		    vput(vp);
1263 		}
1264 
1265 		/*
1266 		 * Loop around generating replies for all write rpcs that have
1267 		 * now been completed.
1268 		 */
1269 		swp = nfsd;
1270 		do {
1271 		    if (error) {
1272 			nfsm_writereply(NFSX_WCCDATA(v3), v3);
1273 			if (v3) {
1274 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1275 			}
1276 		    } else {
1277 			nfsm_writereply(NFSX_PREOPATTR(v3) +
1278 			    NFSX_POSTOPORFATTR(v3) + 2 * NFSX_UNSIGNED +
1279 			    NFSX_WRITEVERF(v3), v3);
1280 			if (v3) {
1281 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1282 			    nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1283 			    *tl++ = txdr_unsigned(nfsd->nd_len);
1284 			    *tl++ = txdr_unsigned(swp->nd_stable);
1285 			    /*
1286 			     * Actually, there is no need to txdr these fields,
1287 			     * but it may make the values more human readable,
1288 			     * for debugging purposes.
1289 			     */
1290 			    *tl++ = txdr_unsigned(boottime.tv_sec);
1291 			    *tl = txdr_unsigned(boottime.tv_nsec / 1000);
1292 			} else {
1293 			    nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1294 			    nfsm_srvfillattr(&va, fp);
1295 			}
1296 		    }
1297 		    nfsd->nd_mreq = mreq;
1298 		    if (nfsd->nd_mrep)
1299 			panic("nfsrv_write: nd_mrep not free");
1300 
1301 		    /*
1302 		     * Done. Put it at the head of the timer queue so that
1303 		     * the final phase can return the reply.
1304 		     */
1305 		    mutex_enter(&nfsd_lock);
1306 		    if (nfsd != swp) {
1307 			nfsd->nd_time = 0;
1308 			LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1309 		    }
1310 		    nfsd = LIST_FIRST(&swp->nd_coalesce);
1311 		    if (nfsd) {
1312 			LIST_REMOVE(nfsd, nd_tq);
1313 		    }
1314 		    mutex_exit(&nfsd_lock);
1315 		} while (nfsd);
1316 		swp->nd_time = 0;
1317 
1318 		mutex_enter(&nfsd_lock);
1319 		LIST_INSERT_HEAD(&slp->ns_tq, swp, nd_tq);
1320 		mutex_exit(&nfsd_lock);
1321 		goto loop1;
1322 	}
1323 	mutex_exit(&nfsd_lock);
1324 	nfs_timer_start();
1325 
1326 	/*
1327 	 * Search for a reply to return.
1328 	 */
1329 	mutex_enter(&nfsd_lock);
1330 	LIST_FOREACH(nfsd, &slp->ns_tq, nd_tq) {
1331 		if (nfsd->nd_mreq) {
1332 		    LIST_REMOVE(nfsd, nd_tq);
1333 		    *mrq = nfsd->nd_mreq;
1334 		    *ndp = nfsd;
1335 		    break;
1336 		}
1337 	}
1338 	mutex_exit(&nfsd_lock);
1339 	return (0);
1340 }
1341 
1342 /*
1343  * Coalesce the write request nfsd into owp. To do this we must:
1344  * - remove nfsd from the queues
1345  * - merge nfsd->nd_mrep into owp->nd_mrep
1346  * - update the nd_eoff and nd_stable for owp
1347  * - put nfsd on owp's nd_coalesce list
1348  * NB: Must be called at splsoftclock().
1349  */
1350 void
1351 nfsrvw_coalesce(struct nfsrv_descript *owp, struct nfsrv_descript *nfsd)
1352 {
1353         int overlap;
1354         struct mbuf *mp;
1355 	struct nfsrv_descript *m;
1356 
1357 	KASSERT(mutex_owned(&nfsd_lock));
1358 
1359         LIST_REMOVE(nfsd, nd_hash);
1360         LIST_REMOVE(nfsd, nd_tq);
1361         if (owp->nd_eoff < nfsd->nd_eoff) {
1362             overlap = owp->nd_eoff - nfsd->nd_off;
1363             if (overlap < 0)
1364                 panic("nfsrv_coalesce: bad off");
1365             if (overlap > 0)
1366                 m_adj(nfsd->nd_mrep, overlap);
1367             mp = owp->nd_mrep;
1368             while (mp->m_next)
1369                 mp = mp->m_next;
1370             mp->m_next = nfsd->nd_mrep;
1371             owp->nd_eoff = nfsd->nd_eoff;
1372         } else
1373             m_freem(nfsd->nd_mrep);
1374         nfsd->nd_mrep = NULL;
1375         if (nfsd->nd_stable == NFSV3WRITE_FILESYNC)
1376             owp->nd_stable = NFSV3WRITE_FILESYNC;
1377         else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC &&
1378             owp->nd_stable == NFSV3WRITE_UNSTABLE)
1379             owp->nd_stable = NFSV3WRITE_DATASYNC;
1380         LIST_INSERT_HEAD(&owp->nd_coalesce, nfsd, nd_tq);
1381  	/*
1382  	 * nfsd might hold coalesce elements! Move them to owp.
1383  	 * Otherwise, requests may be lost and clients will be stuck.
1384  	 */
1385 	while ((m = LIST_FIRST(&nfsd->nd_coalesce)) != NULL) {
1386 		LIST_REMOVE(m, nd_tq);
1387 		LIST_INSERT_HEAD(&owp->nd_coalesce, m, nd_tq);
1388 	}
1389 }
1390 
1391 /*
1392  * nfs create service
1393  * now does a truncate to 0 length via. setattr if it already exists
1394  */
1395 int
1396 nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1397 {
1398 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1399 	struct mbuf *nam = nfsd->nd_nam;
1400 	char *dpos = nfsd->nd_dpos;
1401 	kauth_cred_t cred = nfsd->nd_cr;
1402 	struct nfs_fattr *fp;
1403 	struct vattr va, dirfor, diraft;
1404 	struct nfsv2_sattr *sp;
1405 	u_int32_t *tl;
1406 	struct nameidata nd;
1407 	char *cp;
1408 	int32_t t1;
1409 	char *bpos;
1410 	int error = 0, cache = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
1411 	int rdev = 0, abort = 0;
1412 	int v3 = (nfsd->nd_flag & ND_NFSV3), how, exclusive_flag = 0;
1413 	char *cp2;
1414 	struct mbuf *mb, *mreq;
1415 	struct vnode *vp = NULL, *dirp = NULL;
1416 	nfsrvfh_t nsfh;
1417 	u_quad_t frev, tempsize;
1418 	u_char cverf[NFSX_V3CREATEVERF];
1419 
1420 	nd.ni_cnd.cn_nameiop = 0;
1421 	nfsm_srvmtofh(&nsfh);
1422 	nfsm_srvnamesiz(len);
1423 	nd.ni_cnd.cn_cred = cred;
1424 	nd.ni_cnd.cn_nameiop = CREATE;
1425 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1426 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1427 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1428 	if (dirp && v3) {
1429 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1430 	}
1431 	if (error) {
1432 		nfsm_reply(NFSX_WCCDATA(v3));
1433 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1434 		if (dirp)
1435 			vrele(dirp);
1436 		if (nd.ni_pathbuf != NULL) {
1437 			pathbuf_destroy(nd.ni_pathbuf);
1438 			nd.ni_pathbuf = NULL;
1439 		}
1440 		return (0);
1441 	}
1442 	abort = 1;
1443 	vattr_null(&va);
1444 	if (v3) {
1445 		va.va_mode = 0;
1446 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1447 		how = fxdr_unsigned(int, *tl);
1448 		switch (how) {
1449 		case NFSV3CREATE_GUARDED:
1450 			if (nd.ni_vp) {
1451 				error = EEXIST;
1452 				break;
1453 			}
1454 		case NFSV3CREATE_UNCHECKED:
1455 			nfsm_srvsattr(&va);
1456 			break;
1457 		case NFSV3CREATE_EXCLUSIVE:
1458 			nfsm_dissect(cp, void *, NFSX_V3CREATEVERF);
1459 			memcpy(cverf, cp, NFSX_V3CREATEVERF);
1460 			exclusive_flag = 1;
1461 			break;
1462 		};
1463 		va.va_type = VREG;
1464 	} else {
1465 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1466 		va.va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1467 		if (va.va_type == VNON)
1468 			va.va_type = VREG;
1469 		va.va_mode = nfstov_mode(sp->sa_mode);
1470 		switch (va.va_type) {
1471 		case VREG:
1472 			tsize = fxdr_unsigned(int32_t, sp->sa_size);
1473 			if (tsize != -1)
1474 				va.va_size = (u_quad_t)tsize;
1475 			break;
1476 		case VCHR:
1477 		case VBLK:
1478 		case VFIFO:
1479 			rdev = fxdr_unsigned(int32_t, sp->sa_size);
1480 			break;
1481 		default:
1482 			break;
1483 		};
1484 	}
1485 
1486 	/*
1487 	 * Iff doesn't exist, create it
1488 	 * otherwise just truncate to 0 length
1489 	 *   should I set the mode too ??
1490 	 */
1491 	if (nd.ni_vp == NULL) {
1492 		if (va.va_type == VREG || va.va_type == VSOCK) {
1493 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1494 			error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1495 			if (!error) {
1496 				if (exclusive_flag) {
1497 					exclusive_flag = 0;
1498 					vattr_null(&va);
1499 					/*
1500 					 * XXX
1501 					 * assuming NFSX_V3CREATEVERF
1502 					 * == sizeof(nfstime3)
1503 					 */
1504 					fxdr_nfsv3time(cverf, &va.va_atime);
1505 					error = VOP_SETATTR(nd.ni_vp, &va,
1506 						cred);
1507 				}
1508 			}
1509 		} else if (va.va_type == VCHR || va.va_type == VBLK ||
1510 			va.va_type == VFIFO) {
1511 			if (va.va_type == VCHR && rdev == 0xffffffff)
1512 				va.va_type = VFIFO;
1513 			if (va.va_type != VFIFO &&
1514 			    (error = kauth_authorize_system(cred,
1515 			    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1516 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1517 				vput(nd.ni_dvp);
1518 				abort = 0;
1519 				nfsm_reply(0);
1520 				if (nd.ni_pathbuf != NULL) {
1521 					pathbuf_destroy(nd.ni_pathbuf);
1522 					nd.ni_pathbuf = NULL;
1523 				}
1524 				return (error);
1525 			} else
1526 				va.va_rdev = (dev_t)rdev;
1527 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1528 			error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd,
1529 			    &va);
1530 			if (error) {
1531 				nfsm_reply(0);
1532 			}
1533 		} else {
1534 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1535 			if (nd.ni_pathbuf != NULL) {
1536 				pathbuf_destroy(nd.ni_pathbuf);
1537 				nd.ni_pathbuf = NULL;
1538 			}
1539 			vput(nd.ni_dvp);
1540 			error = ENXIO;
1541 			abort = 0;
1542 		}
1543 		vp = nd.ni_vp;
1544 	} else {
1545 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1546 		if (nd.ni_pathbuf != NULL) {
1547 			pathbuf_destroy(nd.ni_pathbuf);
1548 			nd.ni_pathbuf = NULL;
1549 		}
1550 		vp = nd.ni_vp;
1551 		if (nd.ni_dvp == vp)
1552 			vrele(nd.ni_dvp);
1553 		else
1554 			vput(nd.ni_dvp);
1555 		abort = 0;
1556 		if (!error && va.va_size != -1) {
1557 			error = nfsrv_access(vp, VWRITE, cred,
1558 			    (nd.ni_cnd.cn_flags & RDONLY), lwp, 0);
1559 			if (!error) {
1560 				nqsrv_getl(vp, ND_WRITE);
1561 				tempsize = va.va_size;
1562 				vattr_null(&va);
1563 				va.va_size = tempsize;
1564 				error = VOP_SETATTR(vp, &va, cred);
1565 			}
1566 		}
1567 		if (error)
1568 			vput(vp);
1569 	}
1570 	if (!error) {
1571 		error = nfsrv_composefh(vp, &nsfh, v3);
1572 		if (!error)
1573 			error = VOP_GETATTR(vp, &va, cred);
1574 		vput(vp);
1575 	}
1576 	if (v3) {
1577 		if (exclusive_flag && !error) {
1578 			/*
1579 			 * XXX assuming NFSX_V3CREATEVERF == sizeof(nfstime3)
1580 			 */
1581 			char oldverf[NFSX_V3CREATEVERF];
1582 
1583 			txdr_nfsv3time(&va.va_atime, oldverf);
1584 			if (memcmp(cverf, oldverf, NFSX_V3CREATEVERF))
1585 				error = EEXIST;
1586 		}
1587 		if (dirp) {
1588 			vn_lock(dirp, LK_SHARED | LK_RETRY);
1589 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1590 			VOP_UNLOCK(dirp);
1591 		}
1592 	}
1593 	if (dirp) {
1594 		vrele(dirp);
1595 		dirp = NULL;
1596 	}
1597 	if (nd.ni_pathbuf != NULL) {
1598 		pathbuf_destroy(nd.ni_pathbuf);
1599 		nd.ni_pathbuf = NULL;
1600 	}
1601 	abort = 0;
1602 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_FATTR(v3) + NFSX_WCCDATA(v3));
1603 	if (v3) {
1604 		if (!error) {
1605 			nfsm_srvpostop_fh(&nsfh);
1606 			nfsm_srvpostop_attr(0, &va);
1607 		}
1608 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1609 	} else {
1610 		nfsm_srvfhtom(&nsfh, v3);
1611 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1612 		nfsm_srvfillattr(&va, fp);
1613 	}
1614 	return (0);
1615 nfsmout:
1616 	if (dirp)
1617 		vrele(dirp);
1618 	if (abort) {
1619 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1620 		if (nd.ni_dvp == nd.ni_vp)
1621 			vrele(nd.ni_dvp);
1622 		else
1623 			vput(nd.ni_dvp);
1624 		if (nd.ni_vp)
1625 			vput(nd.ni_vp);
1626 	}
1627 	if (nd.ni_pathbuf != NULL) {
1628 		pathbuf_destroy(nd.ni_pathbuf);
1629 		nd.ni_pathbuf = NULL;
1630 	}
1631 	return (error);
1632 }
1633 
1634 /*
1635  * nfs v3 mknod service
1636  */
1637 int
1638 nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1639 {
1640 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1641 	struct mbuf *nam = nfsd->nd_nam;
1642 	char *dpos = nfsd->nd_dpos;
1643 	kauth_cred_t cred = nfsd->nd_cr;
1644 	struct vattr va, dirfor, diraft;
1645 	u_int32_t *tl;
1646 	struct nameidata nd;
1647 	int32_t t1;
1648 	char *bpos;
1649 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1650 	int abort = 0;
1651 	u_int32_t major, minor;
1652 	enum vtype vtyp;
1653 	char *cp2;
1654 	struct mbuf *mb, *mreq;
1655 	struct vnode *vp, *dirp = (struct vnode *)0;
1656 	nfsrvfh_t nsfh;
1657 	u_quad_t frev;
1658 
1659 	nd.ni_cnd.cn_nameiop = 0;
1660 	nfsm_srvmtofh(&nsfh);
1661 	nfsm_srvnamesiz(len);
1662 	nd.ni_cnd.cn_cred = cred;
1663 	nd.ni_cnd.cn_nameiop = CREATE;
1664 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1665 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1666 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1667 	if (dirp)
1668 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1669 	if (error) {
1670 		nfsm_reply(NFSX_WCCDATA(1));
1671 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1672 		if (dirp)
1673 			vrele(dirp);
1674 		if (nd.ni_pathbuf != NULL) {
1675 			pathbuf_destroy(nd.ni_pathbuf);
1676 			nd.ni_pathbuf = NULL;
1677 		}
1678 		return (0);
1679 	}
1680 	abort = 1;
1681 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1682 	vtyp = nfsv3tov_type(*tl);
1683 	if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1684 		error = NFSERR_BADTYPE;
1685 		goto abort;
1686 	}
1687 	vattr_null(&va);
1688 	va.va_mode = 0;
1689 	nfsm_srvsattr(&va);
1690 	if (vtyp == VCHR || vtyp == VBLK) {
1691 		dev_t rdev;
1692 
1693 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1694 		major = fxdr_unsigned(u_int32_t, *tl++);
1695 		minor = fxdr_unsigned(u_int32_t, *tl);
1696 		rdev = makedev(major, minor);
1697 		if (major(rdev) != major || minor(rdev) != minor) {
1698 			error = EINVAL;
1699 			goto abort;
1700 		}
1701 		va.va_rdev = rdev;
1702 	}
1703 
1704 	/*
1705 	 * Iff doesn't exist, create it.
1706 	 */
1707 	if (nd.ni_vp) {
1708 		error = EEXIST;
1709 abort:
1710 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1711 		if (nd.ni_dvp == nd.ni_vp)
1712 			vrele(nd.ni_dvp);
1713 		else
1714 			vput(nd.ni_dvp);
1715 		if (nd.ni_vp)
1716 			vput(nd.ni_vp);
1717 		if (nd.ni_pathbuf != NULL) {
1718 			pathbuf_destroy(nd.ni_pathbuf);
1719 			nd.ni_pathbuf = NULL;
1720 		}
1721 		goto out;
1722 	}
1723 	va.va_type = vtyp;
1724 	if (vtyp == VSOCK) {
1725 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1726 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1727 	} else {
1728 		if (va.va_type != VFIFO &&
1729 		    (error = kauth_authorize_system(cred,
1730 		    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1731 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1732 			vput(nd.ni_dvp);
1733 			goto out;
1734 		}
1735 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1736 		error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1737 		if (error)
1738 			goto out;
1739 	}
1740 out:
1741 	vp = nd.ni_vp;
1742 	if (!error) {
1743 		error = nfsrv_composefh(vp, &nsfh, true);
1744 		if (!error)
1745 			error = VOP_GETATTR(vp, &va, cred);
1746 		vput(vp);
1747 	}
1748 	if (dirp) {
1749 		vn_lock(dirp, LK_SHARED | LK_RETRY);
1750 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1751 		VOP_UNLOCK(dirp);
1752 		vrele(dirp);
1753 		dirp = NULL;
1754 	}
1755 	if (nd.ni_pathbuf != NULL) {
1756 		pathbuf_destroy(nd.ni_pathbuf);
1757 		nd.ni_pathbuf = NULL;
1758 	}
1759 	abort = 0;
1760 	nfsm_reply(NFSX_SRVFH(&nsfh, true) + NFSX_POSTOPATTR(1) +
1761 	    NFSX_WCCDATA(1));
1762 	if (!error) {
1763 		nfsm_srvpostop_fh(&nsfh);
1764 		nfsm_srvpostop_attr(0, &va);
1765 	}
1766 	nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1767 	return (0);
1768 nfsmout:
1769 	if (abort) {
1770 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1771 		if (nd.ni_dvp == nd.ni_vp)
1772 			vrele(nd.ni_dvp);
1773 		else
1774 			vput(nd.ni_dvp);
1775 		if (nd.ni_vp)
1776 			vput(nd.ni_vp);
1777 	}
1778 	if (nd.ni_pathbuf != NULL) {
1779 		pathbuf_destroy(nd.ni_pathbuf);
1780 		nd.ni_pathbuf = NULL;
1781 	}
1782 	if (dirp)
1783 		vrele(dirp);
1784 	return (error);
1785 }
1786 
1787 /*
1788  * nfs remove service
1789  */
1790 int
1791 nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1792 {
1793 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1794 	struct mbuf *nam = nfsd->nd_nam;
1795 	char *dpos = nfsd->nd_dpos;
1796 	kauth_cred_t cred = nfsd->nd_cr;
1797 	struct nameidata nd;
1798 	u_int32_t *tl;
1799 	int32_t t1;
1800 	char *bpos;
1801 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1802 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1803 	char *cp2;
1804 	struct mbuf *mb, *mreq;
1805 	struct vnode *vp, *dirp;
1806 	struct vattr dirfor, diraft;
1807 	nfsrvfh_t nsfh;
1808 	u_quad_t frev;
1809 
1810 #ifndef nolint
1811 	vp = (struct vnode *)0;
1812 #endif
1813 	nfsm_srvmtofh(&nsfh);
1814 	nfsm_srvnamesiz(len);
1815 	nd.ni_cnd.cn_cred = cred;
1816 	nd.ni_cnd.cn_nameiop = DELETE;
1817 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1818 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1819 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1820 	if (error == 0 && dirp && v3) {
1821 		if (nd.ni_dvp == nd.ni_vp)
1822 			vn_lock(dirp, LK_SHARED | LK_RETRY);
1823 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1824 		if (nd.ni_dvp == nd.ni_vp)
1825 			VOP_UNLOCK(dirp);
1826 	}
1827 	if (!error) {
1828 		vp = nd.ni_vp;
1829 		if (vp->v_type == VDIR) {
1830 			error = EPERM;
1831 			goto out;
1832 		}
1833 		/*
1834 		 * The root of a mounted filesystem cannot be deleted.
1835 		 */
1836 		if (vp->v_vflag & VV_ROOT) {
1837 			error = EBUSY;
1838 		}
1839 out:
1840 		if (!error) {
1841 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1842 			nqsrv_getl(vp, ND_WRITE);
1843 			error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1844 		} else {
1845 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1846 			if (nd.ni_dvp == vp)
1847 				vrele(nd.ni_dvp);
1848 			else
1849 				vput(nd.ni_dvp);
1850 			vput(vp);
1851 		}
1852 	}
1853 	if (nd.ni_pathbuf != NULL) {
1854 		pathbuf_destroy(nd.ni_pathbuf);
1855 		nd.ni_pathbuf = NULL;
1856 	}
1857 	if (dirp) {
1858 		if (v3) {
1859 			vn_lock(dirp, LK_SHARED | LK_RETRY);
1860 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1861 			VOP_UNLOCK(dirp);
1862 		}
1863 		vrele(dirp);
1864 	}
1865 	nfsm_reply(NFSX_WCCDATA(v3));
1866 	if (v3) {
1867 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1868 		return (0);
1869 	}
1870 	nfsm_srvdone;
1871 }
1872 
1873 /*
1874  * nfs rename service
1875  */
1876 int
1877 nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1878 {
1879 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1880 	struct mbuf *nam = nfsd->nd_nam;
1881 	char *dpos = nfsd->nd_dpos;
1882 	kauth_cred_t cred = nfsd->nd_cr;
1883 	u_int32_t *tl;
1884 	int32_t t1;
1885 	char *bpos;
1886 	int error = 0, cache = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1887 	uint32_t len, len2;
1888 	int tdirfor_ret = 1, tdiraft_ret = 1;
1889 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1890 	char *cp2;
1891 	struct mbuf *mb, *mreq;
1892 	struct nameidata fromnd, tond;
1893 	struct vnode *fvp, *tvp, *tdvp;
1894 	struct vnode *fdirp = NULL, *tdirp = NULL;
1895 	struct mount *localfs = NULL;
1896 	struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
1897 	nfsrvfh_t fnsfh, tnsfh;
1898 	u_quad_t frev;
1899 	uid_t saved_uid;
1900 
1901 #ifndef nolint
1902 	fvp = (struct vnode *)0;
1903 #endif
1904 	fromnd.ni_cnd.cn_nameiop = 0;
1905 	tond.ni_cnd.cn_nameiop = 0;
1906 	nfsm_srvmtofh(&fnsfh);
1907 	nfsm_srvnamesiz(len);
1908 	/*
1909 	 * Remember our original uid so that we can reset cr_uid before
1910 	 * the second nfs_namei() call, in case it is remapped.
1911 	 */
1912 	saved_uid = kauth_cred_geteuid(cred);
1913 	fromnd.ni_cnd.cn_cred = cred;
1914 	fromnd.ni_cnd.cn_nameiop = DELETE;
1915 	fromnd.ni_cnd.cn_flags = LOCKPARENT | INRENAME;
1916 	error = nfs_namei(&fromnd, &fnsfh, len, slp, nam, &md,
1917 		&dpos, &fdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1918 	if (error == 0 && fdirp && v3) {
1919 		if (fromnd.ni_dvp == fromnd.ni_vp)
1920 			vn_lock(fdirp, LK_SHARED | LK_RETRY);
1921 		fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor, cred);
1922 		if (fromnd.ni_dvp == fromnd.ni_vp)
1923 			VOP_UNLOCK(fdirp);
1924 	}
1925 	if (error) {
1926 		nfsm_reply(2 * NFSX_WCCDATA(v3));
1927 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1928 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1929 		if (fdirp)
1930 			vrele(fdirp);
1931 		if (fromnd.ni_pathbuf != NULL) {
1932 			pathbuf_destroy(fromnd.ni_pathbuf);
1933 		}
1934 		return (0);
1935 	}
1936 	if (fromnd.ni_dvp != fromnd.ni_vp) {
1937 		VOP_UNLOCK(fromnd.ni_dvp);
1938 	}
1939 	fvp = fromnd.ni_vp;
1940 
1941 	localfs = fvp->v_mount;
1942 	error = VFS_RENAMELOCK_ENTER(localfs);
1943 	if (error) {
1944 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1945 		vrele(fromnd.ni_dvp);
1946 		vrele(fvp);
1947 		goto out1;
1948 	}
1949 
1950 	/* Copied, regrettably, from vfs_syscalls.c (q.v.) */
1951 	vrele(fvp);
1952 	if ((fromnd.ni_cnd.cn_namelen == 1 &&
1953 	     fromnd.ni_cnd.cn_nameptr[0] == '.') ||
1954 	    (fromnd.ni_cnd.cn_namelen == 2 &&
1955 	     fromnd.ni_cnd.cn_nameptr[0] == '.' &&
1956 	     fromnd.ni_cnd.cn_nameptr[1] == '.')) {
1957 		error = EINVAL;
1958 		VFS_RENAMELOCK_EXIT(localfs);
1959 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1960 		vrele(fromnd.ni_dvp);
1961 		goto out1;
1962 	}
1963 	vn_lock(fromnd.ni_dvp, LK_EXCLUSIVE | LK_RETRY);
1964 	error = relookup(fromnd.ni_dvp, &fromnd.ni_vp, &fromnd.ni_cnd, 0);
1965 	if (error) {
1966 		VOP_UNLOCK(fromnd.ni_dvp);
1967 		VFS_RENAMELOCK_EXIT(localfs);
1968 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1969 		vrele(fromnd.ni_dvp);
1970 		goto out1;
1971 	}
1972 	VOP_UNLOCK(fromnd.ni_vp);
1973 	if (fromnd.ni_dvp != fromnd.ni_vp)
1974 		VOP_UNLOCK(fromnd.ni_dvp);
1975 	fvp = fromnd.ni_vp;
1976 
1977 	nfsm_srvmtofh(&tnsfh);
1978 	if (v3) {
1979 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
1980 		len2 = fxdr_unsigned(uint32_t, *tl);
1981 		/* len2 will be checked by nfs_namei */
1982 	}
1983 	else {
1984 		/* NFSv2 */
1985 		nfsm_strsiz(len2, NFS_MAXNAMLEN);
1986 	}
1987 	kauth_cred_seteuid(cred, saved_uid);
1988 	tond.ni_cnd.cn_cred = cred;
1989 	tond.ni_cnd.cn_nameiop = RENAME;
1990 	tond.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | NOCACHE | INRENAME;
1991 	error = nfs_namei(&tond, &tnsfh, len2, slp, nam, &md,
1992 		&dpos, &tdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1993 	if (tdirp && v3) {
1994 		tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor, cred);
1995 	}
1996 	if (error) {
1997 		VFS_RENAMELOCK_EXIT(localfs);
1998 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1999 		vrele(fromnd.ni_dvp);
2000 		vrele(fvp);
2001 		goto out1;
2002 	}
2003 	tdvp = tond.ni_dvp;
2004 	tvp = tond.ni_vp;
2005 	if (tvp != NULL) {
2006 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
2007 			if (v3)
2008 				error = EEXIST;
2009 			else
2010 				error = EISDIR;
2011 			goto out;
2012 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
2013 			if (v3)
2014 				error = EEXIST;
2015 			else
2016 				error = ENOTDIR;
2017 			goto out;
2018 		}
2019 		if (tvp->v_type == VDIR && tvp->v_mountedhere) {
2020 			if (v3)
2021 				error = EXDEV;
2022 			else
2023 				error = ENOTEMPTY;
2024 			goto out;
2025 		}
2026 	}
2027 	if (fvp->v_type == VDIR && fvp->v_mountedhere) {
2028 		if (v3)
2029 			error = EXDEV;
2030 		else
2031 			error = ENOTEMPTY;
2032 		goto out;
2033 	}
2034 	if (fvp->v_mount != tdvp->v_mount) {
2035 		if (v3)
2036 			error = EXDEV;
2037 		else
2038 			error = ENOTEMPTY;
2039 		goto out;
2040 	}
2041 	if (fvp == tdvp) {
2042 		if (v3)
2043 			error = EINVAL;
2044 		else
2045 			error = ENOTEMPTY;
2046 	}
2047 	/*
2048 	 * If source is the same as the destination (that is the
2049 	 * same vnode with the same name in the same directory),
2050 	 * then there is nothing to do.
2051 	 */
2052 	if (fvp == tvp && fromnd.ni_dvp == tdvp &&
2053 	    fromnd.ni_cnd.cn_namelen == tond.ni_cnd.cn_namelen &&
2054 	    !memcmp(fromnd.ni_cnd.cn_nameptr, tond.ni_cnd.cn_nameptr,
2055 	      fromnd.ni_cnd.cn_namelen))
2056 		error = -1;
2057 out:
2058 	if (!error) {
2059 		nqsrv_getl(fromnd.ni_dvp, ND_WRITE);
2060 		nqsrv_getl(tdvp, ND_WRITE);
2061 		if (tvp) {
2062 			nqsrv_getl(tvp, ND_WRITE);
2063 		}
2064 		error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
2065 				   tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
2066 		VFS_RENAMELOCK_EXIT(localfs);
2067 	} else {
2068 		VOP_ABORTOP(tond.ni_dvp, &tond.ni_cnd);
2069 		if (tdvp == tvp)
2070 			vrele(tdvp);
2071 		else
2072 			vput(tdvp);
2073 		if (tvp)
2074 			vput(tvp);
2075 		VFS_RENAMELOCK_EXIT(localfs);
2076 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2077 		vrele(fromnd.ni_dvp);
2078 		vrele(fvp);
2079 		if (error == -1)
2080 			error = 0;
2081 	}
2082 	if (tond.ni_pathbuf != NULL) {
2083 		pathbuf_destroy(tond.ni_pathbuf);
2084 		tond.ni_pathbuf = NULL;
2085 	}
2086 	tond.ni_cnd.cn_nameiop = 0;
2087 out1:
2088 	if (fdirp) {
2089 		if (v3) {
2090 			vn_lock(fdirp, LK_SHARED | LK_RETRY);
2091 			fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred);
2092 			VOP_UNLOCK(fdirp);
2093 		}
2094 		vrele(fdirp);
2095 		fdirp = NULL;
2096 	}
2097 	if (tdirp) {
2098 		if (v3) {
2099 			vn_lock(tdirp, LK_SHARED | LK_RETRY);
2100 			tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred);
2101 			VOP_UNLOCK(tdirp);
2102 		}
2103 		vrele(tdirp);
2104 		tdirp = NULL;
2105 	}
2106 	pathbuf_destroy(fromnd.ni_pathbuf);
2107 	fromnd.ni_pathbuf = NULL;
2108 	fromnd.ni_cnd.cn_nameiop = 0;
2109 	localfs = NULL;
2110 	nfsm_reply(2 * NFSX_WCCDATA(v3));
2111 	if (v3) {
2112 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
2113 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
2114 	}
2115 	return (0);
2116 
2117 nfsmout:
2118 	if (fdirp)
2119 		vrele(fdirp);
2120 #ifdef notdef
2121 	if (tdirp)
2122 		vrele(tdirp);
2123 #endif
2124 	if (tond.ni_cnd.cn_nameiop) {
2125 		if (tond.ni_pathbuf != NULL) {
2126 			pathbuf_destroy(tond.ni_pathbuf);
2127 			tond.ni_pathbuf = NULL;
2128 		}
2129 	}
2130 	if (localfs) {
2131 		VFS_RENAMELOCK_EXIT(localfs);
2132 	}
2133 	if (fromnd.ni_cnd.cn_nameiop) {
2134 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2135 		if (fromnd.ni_pathbuf != NULL) {
2136 			pathbuf_destroy(fromnd.ni_pathbuf);
2137 			fromnd.ni_pathbuf = NULL;
2138 		}
2139 		vrele(fromnd.ni_dvp);
2140 		vrele(fvp);
2141 	}
2142 	return (error);
2143 }
2144 
2145 /*
2146  * nfs link service
2147  */
2148 int
2149 nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2150 {
2151 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2152 	struct mbuf *nam = nfsd->nd_nam;
2153 	char *dpos = nfsd->nd_dpos;
2154 	kauth_cred_t cred = nfsd->nd_cr;
2155 	struct nameidata nd;
2156 	u_int32_t *tl;
2157 	int32_t t1;
2158 	char *bpos;
2159 	int error = 0, rdonly, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2160 	int getret = 1, v3 = (nfsd->nd_flag & ND_NFSV3);
2161 	char *cp2;
2162 	struct mbuf *mb, *mreq;
2163 	struct vnode *vp, *xp, *dirp = (struct vnode *)0;
2164 	struct vattr dirfor, diraft, at;
2165 	nfsrvfh_t nsfh, dnsfh;
2166 	u_quad_t frev;
2167 
2168 	nfsm_srvmtofh(&nsfh);
2169 	nfsm_srvmtofh(&dnsfh);
2170 	nfsm_srvnamesiz(len);
2171 	error = nfsrv_fhtovp(&nsfh, false, &vp, cred, slp, nam,
2172 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2173 	if (error) {
2174 		nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2175 		nfsm_srvpostop_attr(getret, &at);
2176 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2177 		return (0);
2178 	}
2179 	if (vp->v_type == VDIR) {
2180 		error = EPERM;
2181 		goto out1;
2182 	}
2183 	nd.ni_cnd.cn_cred = cred;
2184 	nd.ni_cnd.cn_nameiop = CREATE;
2185 	nd.ni_cnd.cn_flags = LOCKPARENT;
2186 	error = nfs_namei(&nd, &dnsfh, len, slp, nam, &md, &dpos,
2187 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2188 	if (dirp && v3) {
2189 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2190 	}
2191 	if (error)
2192 		goto out1;
2193 	xp = nd.ni_vp;
2194 	if (xp != NULL) {
2195 		error = EEXIST;
2196 		goto out;
2197 	}
2198 	xp = nd.ni_dvp;
2199 	if (vp->v_mount != xp->v_mount)
2200 		error = EXDEV;
2201 out:
2202 	if (!error) {
2203 		nqsrv_getl(vp, ND_WRITE);
2204 		nqsrv_getl(xp, ND_WRITE);
2205 		error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
2206 	} else {
2207 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2208 		if (nd.ni_dvp == nd.ni_vp)
2209 			vrele(nd.ni_dvp);
2210 		else
2211 			vput(nd.ni_dvp);
2212 		if (nd.ni_vp)
2213 			vrele(nd.ni_vp);
2214 	}
2215 out1:
2216 	if (v3) {
2217 		vn_lock(vp, LK_SHARED | LK_RETRY);
2218 		getret = VOP_GETATTR(vp, &at, cred);
2219 		VOP_UNLOCK(vp);
2220 	}
2221 	if (dirp) {
2222 		if (v3) {
2223 			vn_lock(dirp, LK_SHARED | LK_RETRY);
2224 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2225 			VOP_UNLOCK(dirp);
2226 		}
2227 		vrele(dirp);
2228 	}
2229 	vrele(vp);
2230 	if (nd.ni_pathbuf != NULL) {
2231 		pathbuf_destroy(nd.ni_pathbuf);
2232 		nd.ni_pathbuf = NULL;
2233 	}
2234 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2235 	if (v3) {
2236 		nfsm_srvpostop_attr(getret, &at);
2237 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2238 		return (0);
2239 	}
2240 	nfsm_srvdone;
2241 }
2242 
2243 /*
2244  * nfs symbolic link service
2245  */
2246 int
2247 nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2248 {
2249 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2250 	struct mbuf *nam = nfsd->nd_nam;
2251 	char *dpos = nfsd->nd_dpos;
2252 	kauth_cred_t cred = nfsd->nd_cr;
2253 	struct vattr va, dirfor, diraft;
2254 	struct nameidata nd;
2255 	u_int32_t *tl;
2256 	int32_t t1;
2257 	struct nfsv2_sattr *sp;
2258 	char *bpos, *pathcp = NULL, *cp2;
2259 	struct uio io;
2260 	struct iovec iv;
2261 	int error = 0, cache = 0, dirfor_ret = 1, diraft_ret = 1, abort = 0;
2262 	uint32_t len, len2;
2263 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2264 	struct mbuf *mb, *mreq;
2265 	struct vnode *dirp = (struct vnode *)0;
2266 	nfsrvfh_t nsfh;
2267 	u_quad_t frev;
2268 
2269 	nd.ni_cnd.cn_nameiop = 0;
2270 	nfsm_srvmtofh(&nsfh);
2271 	nfsm_srvnamesiz(len);
2272 	nd.ni_cnd.cn_cred = cred;
2273 	nd.ni_cnd.cn_nameiop = CREATE;
2274 	nd.ni_cnd.cn_flags = LOCKPARENT;
2275 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2276 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2277 	if (dirp && v3) {
2278 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2279 	}
2280 	if (error)
2281 		goto out;
2282 	abort = 1;
2283 	vattr_null(&va);
2284 	va.va_type = VLNK;
2285 	if (v3) {
2286 		va.va_mode = 0;
2287 		nfsm_srvsattr(&va);
2288 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
2289 		len2 = fxdr_unsigned(uint32_t, *tl);
2290 		if (len2 > PATH_MAX) {
2291 			/* XXX should check _PC_NO_TRUNC */
2292 			error = ENAMETOOLONG;
2293 			goto abortop;
2294 		}
2295 	}
2296 	else {
2297 		/* NFSv2 */
2298 		nfsm_strsiz(len2, NFS_MAXPATHLEN);
2299 	}
2300 	pathcp = malloc(len2 + 1, M_TEMP, M_WAITOK);
2301 	iv.iov_base = pathcp;
2302 	iv.iov_len = len2;
2303 	io.uio_resid = len2;
2304 	io.uio_offset = 0;
2305 	io.uio_iov = &iv;
2306 	io.uio_iovcnt = 1;
2307 	io.uio_rw = UIO_READ;
2308 	UIO_SETUP_SYSSPACE(&io);
2309 	nfsm_mtouio(&io, len2);
2310 	if (!v3) {
2311 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
2312 		va.va_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
2313 	}
2314 	*(pathcp + len2) = '\0';
2315 	if (nd.ni_vp) {
2316 		error = EEXIST;
2317 abortop:
2318 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2319 		if (nd.ni_dvp == nd.ni_vp)
2320 			vrele(nd.ni_dvp);
2321 		else
2322 			vput(nd.ni_dvp);
2323 		if (nd.ni_vp)
2324 			vrele(nd.ni_vp);
2325 		goto out;
2326 	}
2327 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2328 	error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va, pathcp);
2329 	if (!error) {
2330 	    if (v3) {
2331 		error = nfsrv_composefh(nd.ni_vp, &nsfh, v3);
2332 		if (!error)
2333 		    error = VOP_GETATTR(nd.ni_vp, &va, cred);
2334 		vput(nd.ni_vp);
2335 	    } else {
2336 		vput(nd.ni_vp);
2337 	    }
2338 	}
2339 out:
2340 	if (pathcp)
2341 		free(pathcp, M_TEMP);
2342 	if (dirp) {
2343 		if (v3) {
2344 			vn_lock(dirp, LK_SHARED | LK_RETRY);
2345 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2346 			VOP_UNLOCK(dirp);
2347 		}
2348 		vrele(dirp);
2349 		dirp = NULL;
2350 	}
2351 	if (nd.ni_pathbuf != NULL) {
2352 		pathbuf_destroy(nd.ni_pathbuf);
2353 		nd.ni_pathbuf = NULL;
2354 	}
2355 	abort = 0;
2356 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2357 	    NFSX_WCCDATA(v3));
2358 	if (v3) {
2359 		if (!error) {
2360 			nfsm_srvpostop_fh(&nsfh);
2361 			nfsm_srvpostop_attr(0, &va);
2362 		}
2363 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2364 	}
2365 	return (0);
2366 nfsmout:
2367 	if (abort) {
2368 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2369 		if (nd.ni_dvp == nd.ni_vp)
2370 			vrele(nd.ni_dvp);
2371 		else
2372 			vput(nd.ni_dvp);
2373 		if (nd.ni_vp)
2374 			vrele(nd.ni_vp);
2375 		if (nd.ni_pathbuf != NULL) {
2376 			pathbuf_destroy(nd.ni_pathbuf);
2377 			nd.ni_pathbuf = NULL;
2378 		}
2379 	}
2380 	if (dirp)
2381 		vrele(dirp);
2382 	if (pathcp)
2383 		free(pathcp, M_TEMP);
2384 	return (error);
2385 }
2386 
2387 /*
2388  * nfs mkdir service
2389  */
2390 int
2391 nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2392 {
2393 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2394 	struct mbuf *nam = nfsd->nd_nam;
2395 	char *dpos = nfsd->nd_dpos;
2396 	kauth_cred_t cred = nfsd->nd_cr;
2397 	struct vattr va, dirfor, diraft;
2398 	struct nfs_fattr *fp;
2399 	struct nameidata nd;
2400 	char *cp;
2401 	u_int32_t *tl;
2402 	int32_t t1;
2403 	char *bpos;
2404 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2405 	int abort = 0;
2406 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2407 	char *cp2;
2408 	struct mbuf *mb, *mreq;
2409 	struct vnode *vp, *dirp = (struct vnode *)0;
2410 	nfsrvfh_t nsfh;
2411 	u_quad_t frev;
2412 
2413 	nfsm_srvmtofh(&nsfh);
2414 	nfsm_srvnamesiz(len);
2415 	nd.ni_cnd.cn_cred = cred;
2416 	nd.ni_cnd.cn_nameiop = CREATE;
2417 	nd.ni_cnd.cn_flags = LOCKPARENT;
2418 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2419 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2420 	if (dirp && v3) {
2421 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2422 	}
2423 	if (error) {
2424 		if (nd.ni_pathbuf != NULL) {
2425 			pathbuf_destroy(nd.ni_pathbuf);
2426 			nd.ni_pathbuf = NULL;
2427 		}
2428 		nfsm_reply(NFSX_WCCDATA(v3));
2429 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2430 		if (dirp)
2431 			vrele(dirp);
2432 		return (0);
2433 	}
2434 	abort = 1;
2435 	vattr_null(&va);
2436 	if (v3) {
2437 		va.va_mode = 0;
2438 		nfsm_srvsattr(&va);
2439 	} else {
2440 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
2441 		va.va_mode = nfstov_mode(*tl++);
2442 	}
2443 	va.va_type = VDIR;
2444 	vp = nd.ni_vp;
2445 	if (vp != NULL) {
2446 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2447 		if (nd.ni_dvp == vp)
2448 			vrele(nd.ni_dvp);
2449 		else
2450 			vput(nd.ni_dvp);
2451 		vrele(vp);
2452 		error = EEXIST;
2453 		goto out;
2454 	}
2455 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2456 	error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
2457 	if (!error) {
2458 		vp = nd.ni_vp;
2459 		error = nfsrv_composefh(vp, &nsfh, v3);
2460 		if (!error)
2461 			error = VOP_GETATTR(vp, &va, cred);
2462 		vput(vp);
2463 	}
2464 out:
2465 	if (dirp) {
2466 		if (v3) {
2467 			vn_lock(dirp, LK_SHARED | LK_RETRY);
2468 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2469 			VOP_UNLOCK(dirp);
2470 		}
2471 		vrele(dirp);
2472 		dirp = NULL;
2473 	}
2474 	if (nd.ni_pathbuf != NULL) {
2475 		pathbuf_destroy(nd.ni_pathbuf);
2476 		nd.ni_pathbuf = NULL;
2477 	}
2478 	abort = 0;
2479 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2480 	    NFSX_WCCDATA(v3));
2481 	if (v3) {
2482 		if (!error) {
2483 			nfsm_srvpostop_fh(&nsfh);
2484 			nfsm_srvpostop_attr(0, &va);
2485 		}
2486 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2487 	} else {
2488 		nfsm_srvfhtom(&nsfh, v3);
2489 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
2490 		nfsm_srvfillattr(&va, fp);
2491 	}
2492 	return (0);
2493 nfsmout:
2494 	if (abort) {
2495 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2496 		if (nd.ni_dvp == nd.ni_vp)
2497 			vrele(nd.ni_dvp);
2498 		else
2499 			vput(nd.ni_dvp);
2500 		if (nd.ni_vp)
2501 			vrele(nd.ni_vp);
2502 		if (nd.ni_pathbuf != NULL) {
2503 			pathbuf_destroy(nd.ni_pathbuf);
2504 			nd.ni_pathbuf = NULL;
2505 		}
2506 	}
2507 	if (dirp)
2508 		vrele(dirp);
2509 	return (error);
2510 }
2511 
2512 /*
2513  * nfs rmdir service
2514  */
2515 int
2516 nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2517 {
2518 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2519 	struct mbuf *nam = nfsd->nd_nam;
2520 	char *dpos = nfsd->nd_dpos;
2521 	kauth_cred_t cred = nfsd->nd_cr;
2522 	u_int32_t *tl;
2523 	int32_t t1;
2524 	char *bpos;
2525 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2526 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2527 	char *cp2;
2528 	struct mbuf *mb, *mreq;
2529 	struct vnode *vp, *dirp = (struct vnode *)0;
2530 	struct vattr dirfor, diraft;
2531 	nfsrvfh_t nsfh;
2532 	struct nameidata nd;
2533 	u_quad_t frev;
2534 
2535 	nfsm_srvmtofh(&nsfh);
2536 	nfsm_srvnamesiz(len);
2537 	nd.ni_cnd.cn_cred = cred;
2538 	nd.ni_cnd.cn_nameiop = DELETE;
2539 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
2540 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2541 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2542 	if (dirp && v3) {
2543 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2544 	}
2545 	if (error) {
2546 		if (nd.ni_pathbuf != NULL) {
2547 			pathbuf_destroy(nd.ni_pathbuf);
2548 			nd.ni_pathbuf = NULL;
2549 		}
2550 		nfsm_reply(NFSX_WCCDATA(v3));
2551 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2552 		if (dirp)
2553 			vrele(dirp);
2554 		return (0);
2555 	}
2556 	vp = nd.ni_vp;
2557 	if (vp->v_type != VDIR) {
2558 		error = ENOTDIR;
2559 		goto out;
2560 	}
2561 	/*
2562 	 * No rmdir "." please.
2563 	 */
2564 	if (nd.ni_dvp == vp) {
2565 		error = EINVAL;
2566 		goto out;
2567 	}
2568 	/*
2569 	 * The root of a mounted filesystem cannot be deleted.
2570 	 */
2571 	if (vp->v_vflag & VV_ROOT)
2572 		error = EBUSY;
2573 out:
2574 	if (!error) {
2575 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
2576 		nqsrv_getl(vp, ND_WRITE);
2577 		error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
2578 	} else {
2579 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2580 		if (nd.ni_dvp == nd.ni_vp)
2581 			vrele(nd.ni_dvp);
2582 		else
2583 			vput(nd.ni_dvp);
2584 		vput(vp);
2585 	}
2586 	if (nd.ni_pathbuf != NULL) {
2587 		pathbuf_destroy(nd.ni_pathbuf);
2588 		nd.ni_pathbuf = NULL;
2589 	}
2590 	if (dirp) {
2591 		if (v3) {
2592 			vn_lock(dirp, LK_SHARED | LK_RETRY);
2593 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2594 			VOP_UNLOCK(dirp);
2595 		}
2596 		vrele(dirp);
2597 	}
2598 	nfsm_reply(NFSX_WCCDATA(v3));
2599 	if (v3) {
2600 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2601 		return (0);
2602 	}
2603 	nfsm_srvdone;
2604 }
2605 
2606 /*
2607  * nfs readdir service
2608  * - mallocs what it thinks is enough to read
2609  *	count rounded up to a multiple of NFS_SRVDIRBLKSIZ <= NFS_MAXREADDIR
2610  * - calls VOP_READDIR()
2611  * - loops around building the reply
2612  *	if the output generated exceeds count break out of loop
2613  *	The nfsm_clget macro is used here so that the reply will be packed
2614  *	tightly in mbuf clusters.
2615  * - it only knows that it has encountered eof when the VOP_READDIR()
2616  *	reads nothing
2617  * - as such one readdir rpc will return eof false although you are there
2618  *	and then the next will return eof
2619  * - it trims out records with d_fileno == 0
2620  *	this doesn't matter for Unix clients, but they might confuse clients
2621  *	for other os'.
2622  * - it trims out records with d_type == DT_WHT
2623  *	these cannot be seen through NFS (unless we extend the protocol)
2624  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2625  *	than requested, but this may not apply to all filesystems. For
2626  *	example, client NFS does not { although it is never remote mounted
2627  *	anyhow }
2628  *     The alternate call nfsrv_readdirplus() does lookups as well.
2629  * PS: The NFS protocol spec. does not clarify what the "count" byte
2630  *	argument is a count of.. just name strings and file id's or the
2631  *	entire reply rpc or ...
2632  *	I tried just file name and id sizes and it confused the Sun client,
2633  *	so I am using the full rpc size now. The "paranoia.." comment refers
2634  *	to including the status longwords that are not a part of the dir.
2635  *	"entry" structures, but are in the rpc.
2636  */
2637 
2638 #define	NFS_SRVDIRBLKSIZ	1024
2639 
2640 struct flrep {
2641 	nfsuint64 fl_off;
2642 	u_int32_t fl_postopok;
2643 	struct nfs_fattr fl_fattr; /* XXX: must be of fattr3 size */
2644 	u_int32_t fl_fhok;
2645 	u_int32_t fl_fhsize;
2646 	/* handle comes here, filled in dynamically */
2647 };
2648 
2649 int
2650 nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2651 {
2652 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2653 	struct mbuf *nam = nfsd->nd_nam;
2654 	char *dpos = nfsd->nd_dpos;
2655 	kauth_cred_t cred = nfsd->nd_cr;
2656 	char *bp, *be;
2657 	struct mbuf *mp;
2658 	struct dirent *dp;
2659 	char *cp;
2660 	u_int32_t *tl;
2661 	int32_t t1;
2662 	char *bpos;
2663 	struct mbuf *mb, *mreq, *mp2;
2664 	char *cpos, *cend, *cp2, *rbuf;
2665 	struct vnode *vp;
2666 	struct vattr at;
2667 	nfsrvfh_t nsfh;
2668 	struct uio io;
2669 	struct iovec iv;
2670 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2671 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, ncookies;
2672 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2673 	u_quad_t frev, off, toff, verf;
2674 	off_t *cookies = NULL, *cookiep;
2675 	nfsuint64 jar;
2676 
2677 	nfsm_srvmtofh(&nsfh);
2678 	if (v3) {
2679 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2680 		toff = fxdr_hyper(tl);
2681 		tl += 2;
2682 		verf = fxdr_hyper(tl);
2683 		tl += 2;
2684 	} else {
2685 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2686 		toff = fxdr_unsigned(u_quad_t, *tl++);
2687 	}
2688 	off = toff;
2689 	cnt = fxdr_unsigned(int, *tl);
2690 	siz = ((cnt + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2691 	xfer = NFS_SRVMAXDATA(nfsd);
2692 	if (siz > xfer)
2693 		siz = xfer;
2694 	fullsiz = siz;
2695 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2696 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2697 	if (!error && vp->v_type != VDIR) {
2698 		error = ENOTDIR;
2699 		vput(vp);
2700 	}
2701 	if (error) {
2702 		nfsm_reply(NFSX_UNSIGNED);
2703 		nfsm_srvpostop_attr(getret, &at);
2704 		return (0);
2705 	}
2706 	nqsrv_getl(vp, ND_READ);
2707 	if (v3) {
2708 		error = getret = VOP_GETATTR(vp, &at, cred);
2709 #ifdef NFS3_STRICTVERF
2710 		/*
2711 		 * XXX This check is too strict for Solaris 2.5 clients.
2712 		 */
2713 		if (!error && toff && verf != at.va_filerev)
2714 			error = NFSERR_BAD_COOKIE;
2715 #endif
2716 	}
2717 	if (!error)
2718 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2719 	if (error) {
2720 		vput(vp);
2721 		nfsm_reply(NFSX_POSTOPATTR(v3));
2722 		nfsm_srvpostop_attr(getret, &at);
2723 		return (0);
2724 	}
2725 	VOP_UNLOCK(vp);
2726 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2727 again:
2728 	iv.iov_base = rbuf;
2729 	iv.iov_len = fullsiz;
2730 	io.uio_iov = &iv;
2731 	io.uio_iovcnt = 1;
2732 	io.uio_offset = (off_t)off;
2733 	io.uio_resid = fullsiz;
2734 	io.uio_rw = UIO_READ;
2735 	UIO_SETUP_SYSSPACE(&io);
2736 	eofflag = 0;
2737 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2738 
2739 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2740 
2741 	off = (off_t)io.uio_offset;
2742 	if (!cookies && !error)
2743 		error = NFSERR_PERM;
2744 	if (v3) {
2745 		getret = VOP_GETATTR(vp, &at, cred);
2746 		if (!error)
2747 			error = getret;
2748 	}
2749 
2750 	VOP_UNLOCK(vp);
2751 	if (error) {
2752 		vrele(vp);
2753 		free((void *)rbuf, M_TEMP);
2754 		if (cookies)
2755 			free((void *)cookies, M_TEMP);
2756 		nfsm_reply(NFSX_POSTOPATTR(v3));
2757 		nfsm_srvpostop_attr(getret, &at);
2758 		return (0);
2759 	}
2760 	if (io.uio_resid) {
2761 		siz -= io.uio_resid;
2762 
2763 		/*
2764 		 * If nothing read, return eof
2765 		 * rpc reply
2766 		 */
2767 		if (siz == 0) {
2768 			vrele(vp);
2769 			nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) +
2770 				2 * NFSX_UNSIGNED);
2771 			if (v3) {
2772 				nfsm_srvpostop_attr(getret, &at);
2773 				nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
2774 				txdr_hyper(at.va_filerev, tl);
2775 				tl += 2;
2776 			} else
2777 				nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2778 			*tl++ = nfs_false;
2779 			*tl = nfs_true;
2780 			free((void *)rbuf, M_TEMP);
2781 			free((void *)cookies, M_TEMP);
2782 			return (0);
2783 		}
2784 	}
2785 
2786 	/*
2787 	 * Check for degenerate cases of nothing useful read.
2788 	 * If so go try again
2789 	 */
2790 	cpos = rbuf;
2791 	cend = rbuf + siz;
2792 	dp = (struct dirent *)cpos;
2793 	cookiep = cookies;
2794 
2795 	while (cpos < cend && ncookies > 0 &&
2796 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
2797 		cpos += dp->d_reclen;
2798 		dp = (struct dirent *)cpos;
2799 		cookiep++;
2800 		ncookies--;
2801 	}
2802 	if (cpos >= cend || ncookies == 0) {
2803 		toff = off;
2804 		siz = fullsiz;
2805 		free(cookies, M_TEMP);
2806 		cookies = NULL;
2807 		goto again;
2808 	}
2809 
2810 	len = 3 * NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
2811 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) + siz);
2812 	if (v3) {
2813 		nfsm_srvpostop_attr(getret, &at);
2814 		nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2815 		txdr_hyper(at.va_filerev, tl);
2816 	}
2817 	mp = mp2 = mb;
2818 	bp = bpos;
2819 	be = bp + M_TRAILINGSPACE(mp);
2820 
2821 	/* Loop through the records and build reply */
2822 	while (cpos < cend && ncookies > 0) {
2823 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
2824 			nlen = dp->d_namlen;
2825 			rem = nfsm_rndup(nlen)-nlen;
2826 			len += (4 * NFSX_UNSIGNED + nlen + rem);
2827 			if (v3)
2828 				len += 2 * NFSX_UNSIGNED;
2829 			if (len > cnt) {
2830 				eofflag = 0;
2831 				break;
2832 			}
2833 			/*
2834 			 * Build the directory record xdr from
2835 			 * the dirent entry.
2836 			 */
2837 			nfsm_clget;
2838 			*tl = nfs_true;
2839 			bp += NFSX_UNSIGNED;
2840 			if (v3) {
2841 				nfsm_clget;
2842 				*tl = txdr_unsigned(dp->d_fileno >> 32);
2843 				bp += NFSX_UNSIGNED;
2844 			}
2845 			nfsm_clget;
2846 			*tl = txdr_unsigned(dp->d_fileno);
2847 			bp += NFSX_UNSIGNED;
2848 			nfsm_clget;
2849 			*tl = txdr_unsigned(nlen);
2850 			bp += NFSX_UNSIGNED;
2851 
2852 			/* And loop around copying the name */
2853 			xfer = nlen;
2854 			cp = dp->d_name;
2855 			while (xfer > 0) {
2856 				nfsm_clget;
2857 				if ((bp+xfer) > be)
2858 					tsiz = be-bp;
2859 				else
2860 					tsiz = xfer;
2861 				memcpy(bp, cp, tsiz);
2862 				bp += tsiz;
2863 				xfer -= tsiz;
2864 				if (xfer > 0)
2865 					cp += tsiz;
2866 			}
2867 			/* And null pad to an int32_t boundary */
2868 			for (i = 0; i < rem; i++)
2869 				*bp++ = '\0';
2870 			nfsm_clget;
2871 
2872 			/* Finish off the record */
2873 			txdr_hyper(*cookiep, &jar);
2874 			if (v3) {
2875 				*tl = jar.nfsuquad[0];
2876 				bp += NFSX_UNSIGNED;
2877 				nfsm_clget;
2878 			}
2879 			*tl = jar.nfsuquad[1];
2880 			bp += NFSX_UNSIGNED;
2881 		}
2882 		cpos += dp->d_reclen;
2883 		dp = (struct dirent *)cpos;
2884 		cookiep++;
2885 		ncookies--;
2886 	}
2887 	vrele(vp);
2888 	nfsm_clget;
2889 	*tl = nfs_false;
2890 	bp += NFSX_UNSIGNED;
2891 	nfsm_clget;
2892 	if (eofflag)
2893 		*tl = nfs_true;
2894 	else
2895 		*tl = nfs_false;
2896 	bp += NFSX_UNSIGNED;
2897 	if (mp != mb) {
2898 		if (bp < be)
2899 			mp->m_len = bp - mtod(mp, char *);
2900 	} else
2901 		mp->m_len += bp - bpos;
2902 	free((void *)rbuf, M_TEMP);
2903 	free((void *)cookies, M_TEMP);
2904 	nfsm_srvdone;
2905 }
2906 
2907 int
2908 nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2909 {
2910 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2911 	struct mbuf *nam = nfsd->nd_nam;
2912 	char *dpos = nfsd->nd_dpos;
2913 	kauth_cred_t cred = nfsd->nd_cr;
2914 	char *bp, *be;
2915 	struct mbuf *mp;
2916 	struct dirent *dp;
2917 	char *cp;
2918 	u_int32_t *tl;
2919 	int32_t t1;
2920 	char *bpos;
2921 	struct mbuf *mb, *mreq, *mp2;
2922 	char *cpos, *cend, *cp2, *rbuf;
2923 	struct vnode *vp, *nvp;
2924 	struct flrep fl;
2925 	nfsrvfh_t nsfh;
2926 	struct uio io;
2927 	struct iovec iv;
2928 	struct vattr va, at, *vap = &va;
2929 	struct nfs_fattr *fp;
2930 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2931 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, dirlen, ncookies;
2932 	u_quad_t frev, off, toff, verf;
2933 	off_t *cookies = NULL, *cookiep;
2934 
2935 	nfsm_srvmtofh(&nsfh);
2936 	nfsm_dissect(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2937 	toff = fxdr_hyper(tl);
2938 	tl += 2;
2939 	verf = fxdr_hyper(tl);
2940 	tl += 2;
2941 	siz = fxdr_unsigned(int, *tl++);
2942 	cnt = fxdr_unsigned(int, *tl);
2943 	off = toff;
2944 	siz = ((siz + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2945 	xfer = NFS_SRVMAXDATA(nfsd);
2946 	if (siz > xfer)
2947 		siz = xfer;
2948 	fullsiz = siz;
2949 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2950 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2951 	if (!error && vp->v_type != VDIR) {
2952 		error = ENOTDIR;
2953 		vput(vp);
2954 	}
2955 	if (error) {
2956 		nfsm_reply(NFSX_UNSIGNED);
2957 		nfsm_srvpostop_attr(getret, &at);
2958 		return (0);
2959 	}
2960 	error = getret = VOP_GETATTR(vp, &at, cred);
2961 #ifdef NFS3_STRICTVERF
2962 	/*
2963 	 * XXX This check is too strict for Solaris 2.5 clients.
2964 	 */
2965 	if (!error && toff && verf != at.va_filerev)
2966 		error = NFSERR_BAD_COOKIE;
2967 #endif
2968 	if (!error) {
2969 		nqsrv_getl(vp, ND_READ);
2970 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2971 	}
2972 	if (error) {
2973 		vput(vp);
2974 		nfsm_reply(NFSX_V3POSTOPATTR);
2975 		nfsm_srvpostop_attr(getret, &at);
2976 		return (0);
2977 	}
2978 	VOP_UNLOCK(vp);
2979 
2980 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2981 again:
2982 	iv.iov_base = rbuf;
2983 	iv.iov_len = fullsiz;
2984 	io.uio_iov = &iv;
2985 	io.uio_iovcnt = 1;
2986 	io.uio_offset = (off_t)off;
2987 	io.uio_resid = fullsiz;
2988 	io.uio_rw = UIO_READ;
2989 	UIO_SETUP_SYSSPACE(&io);
2990 	eofflag = 0;
2991 
2992 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2993 
2994 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2995 
2996 	off = (u_quad_t)io.uio_offset;
2997 	getret = VOP_GETATTR(vp, &at, cred);
2998 
2999 	VOP_UNLOCK(vp);
3000 
3001 	/*
3002 	 * If the VGET operation doesn't work for this filesystem,
3003 	 * we can't support readdirplus. Returning NOTSUPP should
3004 	 * make clients fall back to plain readdir.
3005 	 * There's no need to check for VPTOFH as well, we wouldn't
3006 	 * even be here otherwise.
3007 	 */
3008 	if (!getret) {
3009 		if ((getret = VFS_VGET(vp->v_mount, at.va_fileid, &nvp)))
3010 			getret = (getret == EOPNOTSUPP) ?
3011 				NFSERR_NOTSUPP : NFSERR_IO;
3012 		else
3013 			vput(nvp);
3014 	}
3015 
3016 	if (!cookies && !error)
3017 		error = NFSERR_PERM;
3018 	if (!error)
3019 		error = getret;
3020 	if (error) {
3021 		vrele(vp);
3022 		if (cookies)
3023 			free((void *)cookies, M_TEMP);
3024 		free((void *)rbuf, M_TEMP);
3025 		nfsm_reply(NFSX_V3POSTOPATTR);
3026 		nfsm_srvpostop_attr(getret, &at);
3027 		return (0);
3028 	}
3029 	if (io.uio_resid) {
3030 		siz -= io.uio_resid;
3031 
3032 		/*
3033 		 * If nothing read, return eof
3034 		 * rpc reply
3035 		 */
3036 		if (siz == 0) {
3037 			vrele(vp);
3038 			nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
3039 				2 * NFSX_UNSIGNED);
3040 			nfsm_srvpostop_attr(getret, &at);
3041 			nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
3042 			txdr_hyper(at.va_filerev, tl);
3043 			tl += 2;
3044 			*tl++ = nfs_false;
3045 			*tl = nfs_true;
3046 			free((void *)cookies, M_TEMP);
3047 			free((void *)rbuf, M_TEMP);
3048 			return (0);
3049 		}
3050 	}
3051 
3052 	/*
3053 	 * Check for degenerate cases of nothing useful read.
3054 	 * If so go try again
3055 	 */
3056 	cpos = rbuf;
3057 	cend = rbuf + siz;
3058 	dp = (struct dirent *)cpos;
3059 	cookiep = cookies;
3060 
3061 	while (cpos < cend && ncookies > 0 &&
3062 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
3063 		cpos += dp->d_reclen;
3064 		dp = (struct dirent *)cpos;
3065 		cookiep++;
3066 		ncookies--;
3067 	}
3068 	if (cpos >= cend || ncookies == 0) {
3069 		toff = off;
3070 		siz = fullsiz;
3071 		free(cookies, M_TEMP);
3072 		cookies = NULL;
3073 		goto again;
3074 	}
3075 
3076 	dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF + 2 * NFSX_UNSIGNED;
3077 	nfsm_reply(cnt);
3078 	nfsm_srvpostop_attr(getret, &at);
3079 	nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3080 	txdr_hyper(at.va_filerev, tl);
3081 	mp = mp2 = mb;
3082 	bp = bpos;
3083 	be = bp + M_TRAILINGSPACE(mp);
3084 
3085 	/* Loop through the records and build reply */
3086 	while (cpos < cend && ncookies > 0) {
3087 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
3088 			nfsrvfh_t nnsfh;
3089 
3090 			nlen = dp->d_namlen;
3091 			rem = nfsm_rndup(nlen)-nlen;
3092 
3093 			/*
3094 			 * For readdir_and_lookup get the vnode using
3095 			 * the file number.
3096 			 */
3097 			if (VFS_VGET(vp->v_mount, dp->d_fileno, &nvp))
3098 				goto invalid;
3099 			if (nfsrv_composefh(nvp, &nnsfh, true)) {
3100 				vput(nvp);
3101 				goto invalid;
3102 			}
3103 			if (VOP_GETATTR(nvp, vap, cred)) {
3104 				vput(nvp);
3105 				goto invalid;
3106 			}
3107 			vput(nvp);
3108 
3109 			/*
3110 			 * If either the dircount or maxcount will be
3111 			 * exceeded, get out now. Both of these lengths
3112 			 * are calculated conservatively, including all
3113 			 * XDR overheads.
3114 			 */
3115 			len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
3116 				NFSX_V3POSTOPATTR);
3117 			dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
3118 			if (len > cnt || dirlen > fullsiz) {
3119 				eofflag = 0;
3120 				break;
3121 			}
3122 
3123 			/*
3124 			 * Build the directory record xdr from
3125 			 * the dirent entry.
3126 			 */
3127 			fp = (struct nfs_fattr *)&fl.fl_fattr;
3128 			nfsm_srvfillattr(vap, fp);
3129 			fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
3130 			fl.fl_fhok = nfs_true;
3131 			fl.fl_postopok = nfs_true;
3132 			txdr_hyper(*cookiep, fl.fl_off.nfsuquad);
3133 
3134 			nfsm_clget;
3135 			*tl = nfs_true;
3136 			bp += NFSX_UNSIGNED;
3137 			nfsm_clget;
3138 			*tl = txdr_unsigned(dp->d_fileno >> 32);
3139 			bp += NFSX_UNSIGNED;
3140 			nfsm_clget;
3141 			*tl = txdr_unsigned(dp->d_fileno);
3142 			bp += NFSX_UNSIGNED;
3143 			nfsm_clget;
3144 			*tl = txdr_unsigned(nlen);
3145 			bp += NFSX_UNSIGNED;
3146 
3147 			/* And loop around copying the name */
3148 			xfer = nlen;
3149 			cp = dp->d_name;
3150 			while (xfer > 0) {
3151 				nfsm_clget;
3152 				if ((bp + xfer) > be)
3153 					tsiz = be - bp;
3154 				else
3155 					tsiz = xfer;
3156 				memcpy(bp, cp, tsiz);
3157 				bp += tsiz;
3158 				xfer -= tsiz;
3159 				if (xfer > 0)
3160 					cp += tsiz;
3161 			}
3162 			/* And null pad to an int32_t boundary */
3163 			for (i = 0; i < rem; i++)
3164 				*bp++ = '\0';
3165 
3166 			/*
3167 			 * Now copy the flrep structure out.
3168 			 */
3169 			xfer = sizeof(struct flrep);
3170 			cp = (void *)&fl;
3171 			while (xfer > 0) {
3172 				nfsm_clget;
3173 				if ((bp + xfer) > be)
3174 					tsiz = be - bp;
3175 				else
3176 					tsiz = xfer;
3177 				memcpy(bp, cp, tsiz);
3178 				bp += tsiz;
3179 				xfer -= tsiz;
3180 				if (xfer > 0)
3181 					cp += tsiz;
3182 			}
3183 
3184 			/*
3185 			 * ... and filehandle.
3186 			 */
3187 			xfer = NFSRVFH_SIZE(&nnsfh);
3188 			cp = NFSRVFH_DATA(&nnsfh);
3189 			while (xfer > 0) {
3190 				nfsm_clget;
3191 				if ((bp + xfer) > be)
3192 					tsiz = be - bp;
3193 				else
3194 					tsiz = xfer;
3195 				memcpy(bp, cp, tsiz);
3196 				bp += tsiz;
3197 				xfer -= tsiz;
3198 				if (xfer > 0)
3199 					cp += tsiz;
3200 			}
3201 		}
3202 invalid:
3203 		cpos += dp->d_reclen;
3204 		dp = (struct dirent *)cpos;
3205 		cookiep++;
3206 		ncookies--;
3207 	}
3208 	vrele(vp);
3209 	nfsm_clget;
3210 	*tl = nfs_false;
3211 	bp += NFSX_UNSIGNED;
3212 	nfsm_clget;
3213 	if (eofflag)
3214 		*tl = nfs_true;
3215 	else
3216 		*tl = nfs_false;
3217 	bp += NFSX_UNSIGNED;
3218 	if (mp != mb) {
3219 		if (bp < be)
3220 			mp->m_len = bp - mtod(mp, char *);
3221 	} else
3222 		mp->m_len += bp - bpos;
3223 	free((void *)cookies, M_TEMP);
3224 	free((void *)rbuf, M_TEMP);
3225 	nfsm_srvdone;
3226 }
3227 
3228 /*
3229  * nfs commit service
3230  */
3231 int
3232 nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3233 {
3234 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3235 	struct mbuf *nam = nfsd->nd_nam;
3236 	char *dpos = nfsd->nd_dpos;
3237 	kauth_cred_t cred = nfsd->nd_cr;
3238 	struct vattr bfor, aft;
3239 	struct vnode *vp;
3240 	nfsrvfh_t nsfh;
3241 	u_int32_t *tl;
3242 	int32_t t1;
3243 	char *bpos;
3244 	int error = 0, rdonly, for_ret = 1, aft_ret = 1, cache = 0;
3245 	uint32_t cnt;
3246 	char *cp2;
3247 	struct mbuf *mb, *mreq;
3248 	u_quad_t frev, off, end;
3249 
3250 	nfsm_srvmtofh(&nsfh);
3251 	nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3252 
3253 	off = fxdr_hyper(tl);
3254 	tl += 2;
3255 	cnt = fxdr_unsigned(uint32_t, *tl);
3256 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3257 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3258 	if (error) {
3259 		nfsm_reply(2 * NFSX_UNSIGNED);
3260 		nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3261 		return (0);
3262 	}
3263 	for_ret = VOP_GETATTR(vp, &bfor, cred);
3264 	end = (cnt > 0) ? off + cnt : vp->v_size;
3265 	if (end < off || end > vp->v_size)
3266 		end = vp->v_size;
3267 	if (off < vp->v_size)
3268 		error = VOP_FSYNC(vp, cred, FSYNC_WAIT, off, end);
3269 	/* else error == 0, from nfsrv_fhtovp() */
3270 	aft_ret = VOP_GETATTR(vp, &aft, cred);
3271 	vput(vp);
3272 	nfsm_reply(NFSX_V3WCCDATA + NFSX_V3WRITEVERF);
3273 	nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3274 	if (!error) {
3275 		nfsm_build(tl, u_int32_t *, NFSX_V3WRITEVERF);
3276 		*tl++ = txdr_unsigned(boottime.tv_sec);
3277 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
3278 	} else {
3279 		return (0);
3280 	}
3281 	nfsm_srvdone;
3282 }
3283 
3284 /*
3285  * nfs statfs service
3286  */
3287 int
3288 nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3289 {
3290 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3291 	struct mbuf *nam = nfsd->nd_nam;
3292 	char *dpos = nfsd->nd_dpos;
3293 	kauth_cred_t cred = nfsd->nd_cr;
3294 	struct statvfs *sf = NULL;
3295 	struct nfs_statfs *sfp;
3296 	u_int32_t *tl;
3297 	int32_t t1;
3298 	char *bpos;
3299 	int error = 0, rdonly, cache = 0, getret = 1;
3300 	int v3 = (nfsd->nd_flag & ND_NFSV3);
3301 	char *cp2;
3302 	struct mbuf *mb, *mreq;
3303 	struct vnode *vp;
3304 	struct vattr at;
3305 	nfsrvfh_t nsfh;
3306 	u_quad_t frev, tval;
3307 
3308 	nfsm_srvmtofh(&nsfh);
3309 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3310 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3311 	if (error) {
3312 		nfsm_reply(NFSX_UNSIGNED);
3313 		nfsm_srvpostop_attr(getret, &at);
3314 		return (0);
3315 	}
3316 	sf = malloc(sizeof(*sf), M_TEMP, M_WAITOK);
3317 	error = VFS_STATVFS(vp->v_mount, sf);
3318 	getret = VOP_GETATTR(vp, &at, cred);
3319 	vput(vp);
3320 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_STATFS(v3));
3321 	if (v3)
3322 		nfsm_srvpostop_attr(getret, &at);
3323 	if (error) {
3324 		free(sf, M_TEMP);
3325 		return (0);
3326 	}
3327 	nfsm_build(sfp, struct nfs_statfs *, NFSX_STATFS(v3));
3328 	if (v3) {
3329 		tval = (u_quad_t)((quad_t)sf->f_blocks * (quad_t)sf->f_frsize);
3330 		txdr_hyper(tval, &sfp->sf_tbytes);
3331 		tval = (u_quad_t)((quad_t)sf->f_bfree * (quad_t)sf->f_frsize);
3332 		txdr_hyper(tval, &sfp->sf_fbytes);
3333 		tval = (u_quad_t)((quad_t)sf->f_bavail * (quad_t)sf->f_frsize);
3334 		txdr_hyper(tval, &sfp->sf_abytes);
3335 		tval = (u_quad_t)sf->f_files;
3336 		txdr_hyper(tval, &sfp->sf_tfiles);
3337 		tval = (u_quad_t)sf->f_ffree;
3338 		txdr_hyper(tval, &sfp->sf_ffiles);
3339 		txdr_hyper(tval, &sfp->sf_afiles);
3340 		sfp->sf_invarsec = 0;
3341 	} else {
3342 		sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
3343 		sfp->sf_bsize = txdr_unsigned(sf->f_frsize);
3344 		sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
3345 		sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
3346 		sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
3347 	}
3348 nfsmout:
3349 	if (sf)
3350 	    free(sf, M_TEMP);
3351 	return error;
3352 }
3353 
3354 /*
3355  * nfs fsinfo service
3356  */
3357 int
3358 nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3359 {
3360 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3361 	struct mbuf *nam = nfsd->nd_nam;
3362 	char *dpos = nfsd->nd_dpos;
3363 	kauth_cred_t cred = nfsd->nd_cr;
3364 	u_int32_t *tl;
3365 	struct nfsv3_fsinfo *sip;
3366 	int32_t t1;
3367 	char *bpos;
3368 	int error = 0, rdonly, cache = 0, getret = 1;
3369 	uint32_t maxdata;
3370 	char *cp2;
3371 	struct mbuf *mb, *mreq;
3372 	struct vnode *vp;
3373 	struct vattr at;
3374 	nfsrvfh_t nsfh;
3375 	u_quad_t frev, maxfsize;
3376 	struct statvfs *sb;
3377 
3378 	nfsm_srvmtofh(&nsfh);
3379 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3380 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3381 	if (error) {
3382 		nfsm_reply(NFSX_UNSIGNED);
3383 		nfsm_srvpostop_attr(getret, &at);
3384 		return (0);
3385 	}
3386 
3387 	/* XXX Try to make a guess on the max file size. */
3388 	sb = malloc(sizeof(*sb), M_TEMP, M_WAITOK);
3389 	VFS_STATVFS(vp->v_mount, sb);
3390 	maxfsize = (u_quad_t)0x80000000 * sb->f_frsize - 1;
3391 	free(sb, M_TEMP);
3392 
3393 	getret = VOP_GETATTR(vp, &at, cred);
3394 	vput(vp);
3395 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3FSINFO);
3396 	nfsm_srvpostop_attr(getret, &at);
3397 	nfsm_build(sip, struct nfsv3_fsinfo *, NFSX_V3FSINFO);
3398 
3399 	/*
3400 	 * XXX
3401 	 * There should be file system VFS OP(s) to get this information.
3402 	 * For now, assume ufs.
3403 	 */
3404 	if (slp->ns_so->so_type == SOCK_DGRAM)
3405 		maxdata = NFS_MAXDGRAMDATA;
3406 	else
3407 		maxdata = NFS_MAXDATA;
3408 	sip->fs_rtmax = txdr_unsigned(maxdata);
3409 	sip->fs_rtpref = txdr_unsigned(maxdata);
3410 	sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
3411 	sip->fs_wtmax = txdr_unsigned(maxdata);
3412 	sip->fs_wtpref = txdr_unsigned(maxdata);
3413 	sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
3414 	sip->fs_dtpref = txdr_unsigned(maxdata);
3415 	txdr_hyper(maxfsize, &sip->fs_maxfilesize);
3416 	sip->fs_timedelta.nfsv3_sec = 0;
3417 	sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
3418 	sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
3419 		NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
3420 		NFSV3FSINFO_CANSETTIME);
3421 	nfsm_srvdone;
3422 }
3423 
3424 /*
3425  * nfs pathconf service
3426  */
3427 int
3428 nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3429 {
3430 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3431 	struct mbuf *nam = nfsd->nd_nam;
3432 	char *dpos = nfsd->nd_dpos;
3433 	kauth_cred_t cred = nfsd->nd_cr;
3434 	u_int32_t *tl;
3435 	struct nfsv3_pathconf *pc;
3436 	int32_t t1;
3437 	char *bpos;
3438 	int error = 0, rdonly, cache = 0, getret = 1;
3439 	register_t linkmax, namemax, chownres, notrunc;
3440 	char *cp2;
3441 	struct mbuf *mb, *mreq;
3442 	struct vnode *vp;
3443 	struct vattr at;
3444 	nfsrvfh_t nsfh;
3445 	u_quad_t frev;
3446 
3447 	nfsm_srvmtofh(&nsfh);
3448 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3449 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3450 	if (error) {
3451 		nfsm_reply(NFSX_UNSIGNED);
3452 		nfsm_srvpostop_attr(getret, &at);
3453 		return (0);
3454 	}
3455 	error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
3456 	if (!error)
3457 		error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
3458 	if (!error)
3459 		error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
3460 	if (!error)
3461 		error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
3462 	getret = VOP_GETATTR(vp, &at, cred);
3463 	vput(vp);
3464 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3PATHCONF);
3465 	nfsm_srvpostop_attr(getret, &at);
3466 	if (error)
3467 		return (0);
3468 	nfsm_build(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
3469 
3470 	pc->pc_linkmax = txdr_unsigned(linkmax);
3471 	pc->pc_namemax = txdr_unsigned(namemax);
3472 	pc->pc_notrunc = txdr_unsigned(notrunc);
3473 	pc->pc_chownrestricted = txdr_unsigned(chownres);
3474 
3475 	/*
3476 	 * These should probably be supported by VOP_PATHCONF(), but
3477 	 * until msdosfs is exportable (why would you want to?), the
3478 	 * Unix defaults should be ok.
3479 	 */
3480 	pc->pc_caseinsensitive = nfs_false;
3481 	pc->pc_casepreserving = nfs_true;
3482 	nfsm_srvdone;
3483 }
3484 
3485 /*
3486  * Null operation, used by clients to ping server
3487  */
3488 /* ARGSUSED */
3489 int
3490 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3491     struct lwp *lwp, struct mbuf **mrq)
3492 {
3493 	struct mbuf *mrep = nfsd->nd_mrep;
3494 	char *bpos;
3495 	int error = NFSERR_RETVOID, cache = 0;
3496 	struct mbuf *mb, *mreq;
3497 	u_quad_t frev;
3498 
3499 	nfsm_reply(0);
3500 nfsmout:
3501 	return (0);
3502 }
3503 
3504 /*
3505  * No operation, used for obsolete procedures
3506  */
3507 /* ARGSUSED */
3508 int
3509 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3510     struct lwp *lwp, struct mbuf **mrq)
3511 {
3512 	struct mbuf *mrep = nfsd->nd_mrep;
3513 	char *bpos;
3514 	int error, cache = 0;
3515 	struct mbuf *mb, *mreq;
3516 	u_quad_t frev;
3517 
3518 	if (nfsd->nd_repstat)
3519 		error = nfsd->nd_repstat;
3520 	else
3521 		error = EPROCUNAVAIL;
3522 	nfsm_reply(0);
3523 nfsmout:
3524 	return (0);
3525 }
3526 
3527 /*
3528  * Perform access checking for vnodes obtained from file handles that would
3529  * refer to files already opened by a Unix client. You cannot just use
3530  * vn_writechk() and VOP_ACCESS() for two reasons.
3531  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
3532  * 2 - The owner is to be given access irrespective of mode bits for some
3533  *     operations, so that processes that chmod after opening a file don't
3534  *     break. I don't like this because it opens a security hole, but since
3535  *     the nfs server opens a security hole the size of a barn door anyhow,
3536  *     what the heck.
3537  *
3538  * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
3539  * will return EPERM instead of EACCES. EPERM is always an error.
3540  */
3541 int
3542 nfsrv_access(struct vnode *vp, int flags, kauth_cred_t cred, int rdonly, struct lwp *lwp, int override)
3543 {
3544 	struct vattr vattr;
3545 	int error;
3546 	if (flags & VWRITE) {
3547 		/* Just vn_writechk() changed to check rdonly */
3548 		/*
3549 		 * Disallow write attempts on read-only file systems;
3550 		 * unless the file is a socket or a block or character
3551 		 * device resident on the file system.
3552 		 */
3553 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
3554 			switch (vp->v_type) {
3555 			case VREG:
3556 			case VDIR:
3557 			case VLNK:
3558 				return (EROFS);
3559 			default:
3560 				break;
3561 			}
3562 		}
3563 
3564 		/*
3565 		 * If the vnode is in use as a process's text,
3566 		 * we can't allow writing.
3567 		 */
3568 		if (vp->v_iflag & VI_TEXT)
3569 			return (ETXTBSY);
3570 	}
3571 	error = VOP_GETATTR(vp, &vattr, cred);
3572 	if (error)
3573 		return (error);
3574 	error = VOP_ACCESS(vp, flags, cred);
3575 	/*
3576 	 * Allow certain operations for the owner (reads and writes
3577 	 * on files that are already open).
3578 	 */
3579 	if (override && error == EACCES && kauth_cred_geteuid(cred) == vattr.va_uid)
3580 		error = 0;
3581 	return error;
3582 }
3583