xref: /netbsd-src/sys/nfs/nfs_serv.c (revision b5677b36047b601b9addaaa494a58ceae82c2a6c)
1 /*	$NetBSD: nfs_serv.c,v 1.144 2009/04/10 18:58:50 bouyer Exp $	*/
2 
3 /*
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)nfs_serv.c	8.8 (Berkeley) 7/31/95
35  */
36 
37 /*
38  * nfs version 2 and 3 server calls to vnode ops
39  * - these routines generally have 3 phases
40  *   1 - break down and validate rpc request in mbuf list
41  *   2 - do the vnode ops for the request
42  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
43  *   3 - build the rpc reply in an mbuf list
44  *   nb:
45  *	- do not mix the phases, since the nfsm_?? macros can return failures
46  *	  on a bad rpc or similar and do not do any vrele() or vput()'s
47  *
48  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
49  *	error number iff error != 0 whereas
50  *	returning an error from the server function implies a fatal error
51  *	such as a badly constructed rpc request that should be dropped without
52  *	a reply.
53  *	For Version 3, nfsm_reply() does not return for the error case, since
54  *	most version 3 rpcs return more than the status for error cases.
55  */
56 
57 #include <sys/cdefs.h>
58 __KERNEL_RCSID(0, "$NetBSD: nfs_serv.c,v 1.144 2009/04/10 18:58:50 bouyer Exp $");
59 
60 #include <sys/param.h>
61 #include <sys/systm.h>
62 #include <sys/proc.h>
63 #include <sys/file.h>
64 #include <sys/namei.h>
65 #include <sys/vnode.h>
66 #include <sys/mount.h>
67 #include <sys/socket.h>
68 #include <sys/socketvar.h>
69 #include <sys/mbuf.h>
70 #include <sys/dirent.h>
71 #include <sys/stat.h>
72 #include <sys/kernel.h>
73 #include <sys/hash.h>
74 #include <sys/kauth.h>
75 #include <sys/module.h>
76 #include <sys/syscall.h>
77 #include <sys/syscallargs.h>
78 #include <sys/syscallvar.h>
79 
80 #include <uvm/uvm.h>
81 
82 #include <nfs/nfsproto.h>
83 #include <nfs/rpcv2.h>
84 #include <nfs/nfs.h>
85 #include <nfs/xdr_subs.h>
86 #include <nfs/nfsm_subs.h>
87 #include <nfs/nfs_var.h>
88 
89 MODULE(MODULE_CLASS_MISC, nfsserver, "nfs");
90 
91 /* Global vars */
92 extern u_int32_t nfs_xdrneg1;
93 extern u_int32_t nfs_false, nfs_true;
94 extern const enum vtype nv3tov_type[8];
95 extern struct nfsstats nfsstats;
96 extern const nfstype nfsv2_type[9];
97 extern const nfstype nfsv3_type[9];
98 int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
99 bool nfsd_use_loan = true;	/* use page-loan for READ OP */
100 
101 #define	nqsrv_getl(vp, rw)	/* nothing */
102 
103 static const struct syscall_package nfsserver_syscalls[] = {
104 	{ SYS_nfssvc, 0, (sy_call_t *)sys_nfssvc },
105 	{ 0, 0, NULL },
106 };
107 
108 static int
109 nfsserver_modcmd(modcmd_t cmd, void *arg)
110 {
111 	extern krwlock_t netexport_lock;		/* XXX */
112 	extern struct vfs_hooks nfs_export_hooks;	/* XXX */
113 	int error;
114 
115 	switch (cmd) {
116 	case MODULE_CMD_INIT:
117 		error = syscall_establish(NULL, nfsserver_syscalls);
118 		if (error != 0) {
119 			return error;
120 		}
121 		nfs_init();	/* XXX for monolithic kernel */
122 		rw_init(&netexport_lock);
123 		nfsrv_init(0);		/* Init server data structures */
124 		nfsrv_initcache();	/* Init the server request cache */
125 		vfs_hooks_attach(&nfs_export_hooks);
126 		nfs_timer_srvinit(nfsrv_timer);
127 		return 0;
128 	case MODULE_CMD_FINI:
129 		error = syscall_disestablish(NULL, nfsserver_syscalls);
130 		if (error != 0) {
131 			return error;
132 		}
133 		nfs_timer_srvfini();
134 		vfs_hooks_detach(&nfs_export_hooks);
135 		nfsrv_finicache();
136 		nfsrv_fini();
137 		rw_destroy(&netexport_lock);
138 		return 0;
139 	default:
140 		return ENOTTY;
141 	}
142 }
143 
144 /*
145  * nfs v3 access service
146  */
147 int
148 nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
149 {
150 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
151 	struct mbuf *nam = nfsd->nd_nam;
152 	char *dpos = nfsd->nd_dpos;
153 	kauth_cred_t cred = nfsd->nd_cr;
154 	struct vnode *vp;
155 	nfsrvfh_t nsfh;
156 	u_int32_t *tl;
157 	int32_t t1;
158 	char *bpos;
159 	int error = 0, rdonly, cache = 0, getret;
160 	char *cp2;
161 	struct mbuf *mb, *mreq;
162 	struct vattr va;
163 	u_long inmode, testmode, outmode;
164 	u_quad_t frev;
165 
166 	nfsm_srvmtofh(&nsfh);
167 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
168 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
169 	    (nfsd->nd_flag & ND_KERBAUTH), false);
170 	if (error) {
171 		nfsm_reply(NFSX_UNSIGNED);
172 		nfsm_srvpostop_attr(1, (struct vattr *)0);
173 		return (0);
174 	}
175 	inmode = fxdr_unsigned(u_int32_t, *tl);
176 	outmode = 0;
177 	if ((inmode & NFSV3ACCESS_READ) &&
178 	    nfsrv_access(vp, VREAD, cred, rdonly, lwp, 0) == 0)
179 		outmode |= NFSV3ACCESS_READ;
180 	if (vp->v_type != VDIR) {
181 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
182 		if (testmode &&
183 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
184 			outmode |= testmode;
185 		if ((inmode & NFSV3ACCESS_EXECUTE) &&
186 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
187 			outmode |= NFSV3ACCESS_EXECUTE;
188 	} else {
189 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
190 		    NFSV3ACCESS_DELETE);
191 		if (testmode &&
192 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
193 			outmode |= testmode;
194 		if ((inmode & NFSV3ACCESS_LOOKUP) &&
195 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
196 			outmode |= NFSV3ACCESS_LOOKUP;
197 	}
198 	getret = VOP_GETATTR(vp, &va, cred);
199 	vput(vp);
200 	nfsm_reply(NFSX_POSTOPATTR(1) + NFSX_UNSIGNED);
201 	nfsm_srvpostop_attr(getret, &va);
202 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
203 	*tl = txdr_unsigned(outmode);
204 	nfsm_srvdone;
205 }
206 
207 /*
208  * nfs getattr service
209  */
210 int
211 nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
212 {
213 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
214 	struct mbuf *nam = nfsd->nd_nam;
215 	char *dpos = nfsd->nd_dpos;
216 	kauth_cred_t cred = nfsd->nd_cr;
217 	struct nfs_fattr *fp;
218 	struct vattr va;
219 	struct vnode *vp;
220 	nfsrvfh_t nsfh;
221 	u_int32_t *tl;
222 	int32_t t1;
223 	char *bpos;
224 	int error = 0, rdonly, cache = 0;
225 	char *cp2;
226 	struct mbuf *mb, *mreq;
227 	u_quad_t frev;
228 
229 	nfsm_srvmtofh(&nsfh);
230 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
231 	    (nfsd->nd_flag & ND_KERBAUTH), false);
232 	if (error) {
233 		nfsm_reply(0);
234 		return (0);
235 	}
236 	nqsrv_getl(vp, ND_READ);
237 	error = VOP_GETATTR(vp, &va, cred);
238 	vput(vp);
239 	nfsm_reply(NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
240 	if (error)
241 		return (0);
242 	nfsm_build(fp, struct nfs_fattr *, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
243 	nfsm_srvfillattr(&va, fp);
244 	nfsm_srvdone;
245 }
246 
247 /*
248  * nfs setattr service
249  */
250 int
251 nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
252 {
253 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
254 	struct mbuf *nam = nfsd->nd_nam;
255 	char *dpos = nfsd->nd_dpos;
256 	kauth_cred_t cred = nfsd->nd_cr;
257 	struct vattr va, preat;
258 	struct nfsv2_sattr *sp;
259 	struct nfs_fattr *fp;
260 	struct vnode *vp;
261 	nfsrvfh_t nsfh;
262 	u_int32_t *tl;
263 	int32_t t1;
264 	char *bpos;
265 	int error = 0, rdonly, cache = 0, preat_ret = 1, postat_ret = 1;
266 	int v3 = (nfsd->nd_flag & ND_NFSV3), gcheck = 0;
267 	char *cp2;
268 	struct mbuf *mb, *mreq;
269 	u_quad_t frev;
270 	struct timespec guard;
271 
272 	memset(&guard, 0, sizeof guard);	/* XXX gcc */
273 
274 	nfsm_srvmtofh(&nsfh);
275 	VATTR_NULL(&va);
276 	if (v3) {
277 		nfsm_srvsattr(&va);
278 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
279 		gcheck = fxdr_unsigned(int, *tl);
280 		if (gcheck) {
281 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
282 			fxdr_nfsv3time(tl, &guard);
283 		}
284 	} else {
285 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
286 		/*
287 		 * Nah nah nah nah na nah
288 		 * There is a bug in the Sun client that puts 0xffff in the mode
289 		 * field of sattr when it should put in 0xffffffff. The u_short
290 		 * doesn't sign extend.
291 		 * --> check the low order 2 bytes for 0xffff
292 		 */
293 		if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
294 			va.va_mode = nfstov_mode(sp->sa_mode);
295 		if (sp->sa_uid != nfs_xdrneg1)
296 			va.va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
297 		if (sp->sa_gid != nfs_xdrneg1)
298 			va.va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
299 		if (sp->sa_size != nfs_xdrneg1)
300 			va.va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
301 		if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
302 #ifdef notyet
303 			fxdr_nfsv2time(&sp->sa_atime, &va.va_atime);
304 #else
305 			va.va_atime.tv_sec =
306 				fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
307 			va.va_atime.tv_nsec = 0;
308 #endif
309 		}
310 		if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
311 			fxdr_nfsv2time(&sp->sa_mtime, &va.va_mtime);
312 
313 	}
314 
315 	/*
316 	 * Now that we have all the fields, lets do it.
317 	 */
318 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
319 	    (nfsd->nd_flag & ND_KERBAUTH), false);
320 	if (error) {
321 		nfsm_reply(2 * NFSX_UNSIGNED);
322 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
323 		return (0);
324 	}
325 	nqsrv_getl(vp, ND_WRITE);
326 	if (v3) {
327 		error = preat_ret = VOP_GETATTR(vp, &preat, cred);
328 		if (!error && gcheck &&
329 			(preat.va_ctime.tv_sec != guard.tv_sec ||
330 			 preat.va_ctime.tv_nsec != guard.tv_nsec))
331 			error = NFSERR_NOT_SYNC;
332 		if (error) {
333 			vput(vp);
334 			nfsm_reply(NFSX_WCCDATA(v3));
335 			nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
336 			return (0);
337 		}
338 	}
339 
340 	/*
341 	 * If the size is being changed write acces is required, otherwise
342 	 * just check for a read only file system.
343 	 */
344 	if (va.va_size == ((u_quad_t)((quad_t) -1))) {
345 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
346 			error = EROFS;
347 			goto out;
348 		}
349 	} else {
350 		if (vp->v_type == VDIR) {
351 			error = EISDIR;
352 			goto out;
353 		} else if ((error = nfsrv_access(vp, VWRITE, cred, rdonly,
354 			lwp, 0)) != 0)
355 			goto out;
356 	}
357 	error = VOP_SETATTR(vp, &va, cred);
358 	postat_ret = VOP_GETATTR(vp, &va, cred);
359 	if (!error)
360 		error = postat_ret;
361 out:
362 	vput(vp);
363 	nfsm_reply(NFSX_WCCORFATTR(v3));
364 	if (v3) {
365 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
366 		return (0);
367 	} else {
368 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
369 		nfsm_srvfillattr(&va, fp);
370 	}
371 	nfsm_srvdone;
372 }
373 
374 /*
375  * nfs lookup rpc
376  */
377 int
378 nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
379 {
380 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
381 	struct mbuf *nam = nfsd->nd_nam;
382 	char *dpos = nfsd->nd_dpos;
383 	kauth_cred_t cred = nfsd->nd_cr;
384 	struct nfs_fattr *fp;
385 	struct nameidata nd, ind, *ndp = &nd;
386 	struct vnode *vp, *dirp;
387 	nfsrvfh_t nsfh;
388 	char *cp;
389 	u_int32_t *tl;
390 	int32_t t1;
391 	char *bpos;
392 	int error = 0, cache = 0, dirattr_ret = 1;
393 	uint32_t len;
394 	int v3 = (nfsd->nd_flag & ND_NFSV3), pubflag;
395 	char *cp2;
396 	struct mbuf *mb, *mreq;
397 	struct vattr va, dirattr;
398 	u_quad_t frev;
399 
400 	nfsm_srvmtofh(&nsfh);
401 	nfsm_srvnamesiz(len);
402 
403 	pubflag = nfs_ispublicfh(&nsfh);
404 
405 	nd.ni_cnd.cn_cred = cred;
406 	nd.ni_cnd.cn_nameiop = LOOKUP;
407 	nd.ni_cnd.cn_flags = LOCKLEAF | SAVESTART;
408 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
409 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), pubflag);
410 
411 	if (!error && pubflag) {
412 		if (nd.ni_vp->v_type == VDIR && nfs_pub.np_index != NULL) {
413 			/*
414 			 * Setup call to lookup() to see if we can find
415 			 * the index file. Arguably, this doesn't belong
416 			 * in a kernel.. Ugh.
417 			 */
418 			ind = nd;
419 			VOP_UNLOCK(nd.ni_vp, 0);
420 			ind.ni_pathlen = strlen(nfs_pub.np_index);
421 			ind.ni_cnd.cn_nameptr = ind.ni_cnd.cn_pnbuf =
422 			    nfs_pub.np_index;
423 			ind.ni_startdir = nd.ni_vp;
424 			VREF(ind.ni_startdir);
425 			error = lookup(&ind);
426 			if (!error) {
427 				/*
428 				 * Found an index file. Get rid of
429 				 * the old references.
430 				 */
431 				if (dirp)
432 					vrele(dirp);
433 				dirp = nd.ni_vp;
434 				vrele(nd.ni_startdir);
435 				ndp = &ind;
436 			} else
437 				error = 0;
438 		}
439 		/*
440 		 * If the public filehandle was used, check that this lookup
441 		 * didn't result in a filehandle outside the publicly exported
442 		 * filesystem.
443 		 */
444 
445 		if (!error && ndp->ni_vp->v_mount != nfs_pub.np_mount) {
446 			vput(nd.ni_vp);
447 			error = EPERM;
448 		}
449 	}
450 
451 	if (dirp) {
452 		if (v3)
453 			dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred);
454 		vrele(dirp);
455 	}
456 
457 	if (error) {
458 		nfsm_reply(NFSX_POSTOPATTR(v3));
459 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
460 		return (0);
461 	}
462 
463 	nqsrv_getl(ndp->ni_startdir, ND_READ);
464 	PNBUF_PUT(nd.ni_cnd.cn_pnbuf);
465 	vp = ndp->ni_vp;
466 	error = nfsrv_composefh(vp, &nsfh, v3);
467 	if (!error)
468 		error = VOP_GETATTR(vp, &va, cred);
469 	vput(vp);
470 	vrele(ndp->ni_startdir);
471 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPORFATTR(v3) +
472 	    NFSX_POSTOPATTR(v3));
473 	if (error) {
474 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
475 		return (0);
476 	}
477 	nfsm_srvfhtom(&nsfh, v3);
478 	if (v3) {
479 		nfsm_srvpostop_attr(0, &va);
480 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
481 	} else {
482 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
483 		nfsm_srvfillattr(&va, fp);
484 	}
485 	nfsm_srvdone;
486 }
487 
488 /*
489  * nfs readlink service
490  */
491 int
492 nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
493 {
494 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
495 	struct mbuf *nam = nfsd->nd_nam;
496 	char *dpos = nfsd->nd_dpos;
497 	kauth_cred_t cred = nfsd->nd_cr;
498 	struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
499 	struct iovec *ivp = iv;
500 	struct mbuf *mp;
501 	u_int32_t *tl;
502 	int32_t t1;
503 	char *bpos;
504 	int error = 0, rdonly, cache = 0, i, padlen, getret;
505 	uint32_t len;
506 	int v3 = (nfsd->nd_flag & ND_NFSV3);
507 	char *cp2;
508 	struct mbuf *mb, *mp2 = NULL, *mp3 = NULL, *mreq;
509 	struct vnode *vp;
510 	struct vattr attr;
511 	nfsrvfh_t nsfh;
512 	struct uio io, *uiop = &io;
513 	u_quad_t frev;
514 
515 	nfsm_srvmtofh(&nsfh);
516 	len = 0;
517 	i = 0;
518 	while (len < NFS_MAXPATHLEN) {
519 		mp = m_get(M_WAIT, MT_DATA);
520 		MCLAIM(mp, &nfs_mowner);
521 		m_clget(mp, M_WAIT);
522 		mp->m_len = NFSMSIZ(mp);
523 		if (len == 0)
524 			mp3 = mp2 = mp;
525 		else {
526 			mp2->m_next = mp;
527 			mp2 = mp;
528 		}
529 		if ((len+mp->m_len) > NFS_MAXPATHLEN) {
530 			mp->m_len = NFS_MAXPATHLEN-len;
531 			len = NFS_MAXPATHLEN;
532 		} else
533 			len += mp->m_len;
534 		ivp->iov_base = mtod(mp, void *);
535 		ivp->iov_len = mp->m_len;
536 		i++;
537 		ivp++;
538 	}
539 	uiop->uio_iov = iv;
540 	uiop->uio_iovcnt = i;
541 	uiop->uio_offset = 0;
542 	uiop->uio_resid = len;
543 	uiop->uio_rw = UIO_READ;
544 	UIO_SETUP_SYSSPACE(uiop);
545 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
546 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
547 	if (error) {
548 		m_freem(mp3);
549 		nfsm_reply(2 * NFSX_UNSIGNED);
550 		nfsm_srvpostop_attr(1, (struct vattr *)0);
551 		return (0);
552 	}
553 	if (vp->v_type != VLNK) {
554 		if (v3)
555 			error = EINVAL;
556 		else
557 			error = ENXIO;
558 		goto out;
559 	}
560 	nqsrv_getl(vp, ND_READ);
561 	error = VOP_READLINK(vp, uiop, cred);
562 out:
563 	getret = VOP_GETATTR(vp, &attr, cred);
564 	vput(vp);
565 	if (error)
566 		m_freem(mp3);
567 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_UNSIGNED);
568 	if (v3) {
569 		nfsm_srvpostop_attr(getret, &attr);
570 		if (error)
571 			return (0);
572 	}
573 	len -= uiop->uio_resid;
574 	padlen = nfsm_padlen(len);
575 	if (uiop->uio_resid || padlen)
576 		nfs_zeropad(mp3, uiop->uio_resid, padlen);
577 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
578 	*tl = txdr_unsigned(len);
579 	mb->m_next = mp3;
580 	nfsm_srvdone;
581 }
582 
583 /*
584  * nfs read service
585  */
586 int
587 nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
588 {
589 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
590 	struct mbuf *nam = nfsd->nd_nam;
591 	char *dpos = nfsd->nd_dpos;
592 	kauth_cred_t cred = nfsd->nd_cr;
593 	struct mbuf *m;
594 	struct nfs_fattr *fp;
595 	u_int32_t *tl;
596 	int32_t t1;
597 	int i;
598 	char *bpos;
599 	int error = 0, rdonly, cache = 0, getret;
600 	int v3 = (nfsd->nd_flag & ND_NFSV3);
601 	uint32_t reqlen, len, cnt, left;
602 	int padlen;
603 	char *cp2;
604 	struct mbuf *mb, *mreq;
605 	struct vnode *vp;
606 	nfsrvfh_t nsfh;
607 	struct uio io, *uiop = &io;
608 	struct vattr va;
609 	off_t off;
610 	u_quad_t frev;
611 
612 	nfsm_srvmtofh(&nsfh);
613 	if (v3) {
614 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
615 		off = fxdr_hyper(tl);
616 	} else {
617 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
618 		off = (off_t)fxdr_unsigned(u_int32_t, *tl);
619 	}
620 	nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
621 	reqlen = fxdr_unsigned(uint32_t, *tl);
622 	reqlen = MIN(reqlen, NFS_SRVMAXDATA(nfsd));
623 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
624 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
625 	if (error) {
626 		nfsm_reply(2 * NFSX_UNSIGNED);
627 		nfsm_srvpostop_attr(1, (struct vattr *)0);
628 		return (0);
629 	}
630 	if (vp->v_type != VREG) {
631 		if (v3)
632 			error = EINVAL;
633 		else
634 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
635 	}
636 	if (!error) {
637 	    nqsrv_getl(vp, ND_READ);
638 	    if ((error = nfsrv_access(vp, VREAD, cred, rdonly, lwp, 1)) != 0)
639 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 1);
640 	}
641 	getret = VOP_GETATTR(vp, &va, cred);
642 	if (!error)
643 		error = getret;
644 	if (error) {
645 		vput(vp);
646 		nfsm_reply(NFSX_POSTOPATTR(v3));
647 		nfsm_srvpostop_attr(getret, &va);
648 		return (0);
649 	}
650 	if (off >= va.va_size)
651 		cnt = 0;
652 	else if ((off + reqlen) > va.va_size)
653 		cnt = va.va_size - off;
654 	else
655 		cnt = reqlen;
656 	nfsm_reply(NFSX_POSTOPORFATTR(v3) + 3 * NFSX_UNSIGNED+nfsm_rndup(cnt));
657 	if (v3) {
658 		nfsm_build(tl, u_int32_t *, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
659 		*tl++ = nfs_true;
660 		fp = (struct nfs_fattr *)tl;
661 		tl += (NFSX_V3FATTR / sizeof (u_int32_t));
662 	} else {
663 		nfsm_build(tl, u_int32_t *, NFSX_V2FATTR + NFSX_UNSIGNED);
664 		fp = (struct nfs_fattr *)tl;
665 		tl += (NFSX_V2FATTR / sizeof (u_int32_t));
666 	}
667 	len = left = cnt;
668 	if (cnt > 0) {
669 		if (nfsd_use_loan) {
670 			struct vm_page **pgpp;
671 			voff_t pgoff = trunc_page(off);
672 			int npages;
673 			vaddr_t lva;
674 
675 			npages = (round_page(off + cnt) - pgoff) >> PAGE_SHIFT;
676 			KASSERT(npages <= M_EXT_MAXPAGES); /* XXX */
677 
678 			/* allocate kva for mbuf data */
679 			lva = sokvaalloc(npages << PAGE_SHIFT, slp->ns_so);
680 			if (lva == 0) {
681 				/* fall back to VOP_READ */
682 				goto loan_fail;
683 			}
684 
685 			/* allocate mbuf */
686 			m = m_get(M_WAIT, MT_DATA);
687 			MCLAIM(m, &nfs_mowner);
688 			pgpp = m->m_ext.ext_pgs;
689 
690 			/* loan pages */
691 			error = uvm_loanuobjpages(&vp->v_uobj, pgoff, npages,
692 			    pgpp);
693 			if (error) {
694 				sokvafree(lva, npages << PAGE_SHIFT);
695 				m_free(m);
696 				if (error == EBUSY)
697 					goto loan_fail;
698 				goto read_error;
699 			}
700 
701 			/* associate kva to mbuf */
702 			MEXTADD(m, (void *)(lva + ((vaddr_t)off & PAGE_MASK)),
703 			    cnt, M_MBUF, soloanfree, slp->ns_so);
704 			m->m_flags |= M_EXT_PAGES | M_EXT_ROMAP;
705 			m->m_len = cnt;
706 
707 			/* map pages */
708 			for (i = 0; i < npages; i++) {
709 				pmap_kenter_pa(lva, VM_PAGE_TO_PHYS(pgpp[i]),
710 				    VM_PROT_READ);
711 				lva += PAGE_SIZE;
712 			}
713 
714 			pmap_update(pmap_kernel());
715 
716 			mb->m_next = m;
717 			mb = m;
718 			error = 0;
719 			uiop->uio_resid = 0;
720 		} else {
721 			struct iovec *iv;
722 			struct iovec *iv2;
723 			struct mbuf *m2;
724 			int siz;
725 loan_fail:
726 			/*
727 			 * Generate the mbuf list with the uio_iov ref. to it.
728 			 */
729 			i = 0;
730 			m = m2 = mb;
731 			while (left > 0) {
732 				siz = min(M_TRAILINGSPACE(m), left);
733 				if (siz > 0) {
734 					left -= siz;
735 					i++;
736 				}
737 				if (left > 0) {
738 					m = m_get(M_WAIT, MT_DATA);
739 					MCLAIM(m, &nfs_mowner);
740 					m_clget(m, M_WAIT);
741 					m->m_len = 0;
742 					m2->m_next = m;
743 					m2 = m;
744 				}
745 			}
746 			iv = malloc(i * sizeof(struct iovec), M_TEMP, M_WAITOK);
747 			uiop->uio_iov = iv2 = iv;
748 			m = mb;
749 			left = cnt;
750 			i = 0;
751 			while (left > 0) {
752 				if (m == NULL)
753 					panic("nfsrv_read iov");
754 				siz = min(M_TRAILINGSPACE(m), left);
755 				if (siz > 0) {
756 					iv->iov_base = mtod(m, char *) +
757 					    m->m_len;
758 					iv->iov_len = siz;
759 					m->m_len += siz;
760 					left -= siz;
761 					iv++;
762 					i++;
763 				}
764 				m = m->m_next;
765 			}
766 			uiop->uio_iovcnt = i;
767 			uiop->uio_offset = off;
768 			uiop->uio_resid = cnt;
769 			uiop->uio_rw = UIO_READ;
770 			UIO_SETUP_SYSSPACE(uiop);
771 			error = VOP_READ(vp, uiop, IO_NODELOCKED, cred);
772 			free((void *)iv2, M_TEMP);
773 		}
774 read_error:
775 		if (error || (getret = VOP_GETATTR(vp, &va, cred)) != 0){
776 			if (!error)
777 				error = getret;
778 			m_freem(mreq);
779 			vput(vp);
780 			nfsm_reply(NFSX_POSTOPATTR(v3));
781 			nfsm_srvpostop_attr(getret, &va);
782 			return (0);
783 		}
784 	} else {
785 		uiop->uio_resid = 0;
786 	}
787 	vput(vp);
788 	nfsm_srvfillattr(&va, fp);
789 	len -= uiop->uio_resid;
790 	padlen = nfsm_padlen(len);
791 	if (uiop->uio_resid || padlen)
792 		nfs_zeropad(mb, uiop->uio_resid, padlen);
793 	if (v3) {
794 		/* count */
795 		*tl++ = txdr_unsigned(len);
796 		/* eof */
797 		if (off + len >= va.va_size)
798 			*tl++ = nfs_true;
799 		else
800 			*tl++ = nfs_false;
801 	}
802 	*tl = txdr_unsigned(len);
803 	nfsm_srvdone;
804 }
805 
806 /*
807  * nfs write service
808  */
809 int
810 nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
811 {
812 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
813 	struct mbuf *nam = nfsd->nd_nam;
814 	char *dpos = nfsd->nd_dpos;
815 	kauth_cred_t cred = nfsd->nd_cr;
816 	struct iovec *ivp;
817 	int i, cnt;
818 	struct mbuf *mp;
819 	struct nfs_fattr *fp;
820 	struct iovec *iv;
821 	struct vattr va, forat;
822 	u_int32_t *tl;
823 	int32_t t1;
824 	char *bpos;
825 	int error = 0, rdonly, cache = 0, len, forat_ret = 1;
826 	int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
827 	int stable = NFSV3WRITE_FILESYNC;
828 	int v3 = (nfsd->nd_flag & ND_NFSV3);
829 	char *cp2;
830 	struct mbuf *mb, *mreq;
831 	struct vnode *vp;
832 	nfsrvfh_t nsfh;
833 	struct uio io, *uiop = &io;
834 	off_t off;
835 	u_quad_t frev;
836 
837 	if (mrep == NULL) {
838 		*mrq = NULL;
839 		return (0);
840 	}
841 	nfsm_srvmtofh(&nsfh);
842 	if (v3) {
843 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
844 		off = fxdr_hyper(tl);
845 		tl += 3;
846 		stable = fxdr_unsigned(int, *tl++);
847 	} else {
848 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
849 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
850 		tl += 2;
851 	}
852 	retlen = len = fxdr_unsigned(int32_t, *tl);
853 	cnt = i = 0;
854 
855 	/*
856 	 * For NFS Version 2, it is not obvious what a write of zero length
857 	 * should do, but I might as well be consistent with Version 3,
858 	 * which is to return ok so long as there are no permission problems.
859 	 */
860 	if (len > 0) {
861 		zeroing = 1;
862 		mp = mrep;
863 		while (mp) {
864 			if (mp == md) {
865 				zeroing = 0;
866 				adjust = dpos - mtod(mp, char *);
867 				mp->m_len -= adjust;
868 				if (mp->m_len > 0 && adjust > 0)
869 					NFSMADV(mp, adjust);
870 			}
871 			if (zeroing)
872 				mp->m_len = 0;
873 			else if (mp->m_len > 0) {
874 				i += mp->m_len;
875 				if (i > len) {
876 					mp->m_len -= (i - len);
877 					zeroing	= 1;
878 				}
879 				if (mp->m_len > 0)
880 					cnt++;
881 			}
882 			mp = mp->m_next;
883 		}
884 	}
885 	if (len > NFS_MAXDATA || len < 0 || i < len) {
886 		error = EIO;
887 		nfsm_reply(2 * NFSX_UNSIGNED);
888 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
889 		return (0);
890 	}
891 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
892 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
893 	if (error) {
894 		nfsm_reply(2 * NFSX_UNSIGNED);
895 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
896 		return (0);
897 	}
898 	if (v3)
899 		forat_ret = VOP_GETATTR(vp, &forat, cred);
900 	if (vp->v_type != VREG) {
901 		if (v3)
902 			error = EINVAL;
903 		else
904 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
905 	}
906 	if (!error) {
907 		nqsrv_getl(vp, ND_WRITE);
908 		error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
909 	}
910 	if (error) {
911 		vput(vp);
912 		nfsm_reply(NFSX_WCCDATA(v3));
913 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
914 		return (0);
915 	}
916 
917 	if (len > 0) {
918 		ivp = malloc(cnt * sizeof (struct iovec), M_TEMP, M_WAITOK);
919 		uiop->uio_iov = iv = ivp;
920 		uiop->uio_iovcnt = cnt;
921 		mp = mrep;
922 		while (mp) {
923 			if (mp->m_len > 0) {
924 				ivp->iov_base = mtod(mp, void *);
925 				ivp->iov_len = mp->m_len;
926 				ivp++;
927 			}
928 			mp = mp->m_next;
929 		}
930 
931 		/*
932 		 * XXX
933 		 * The IO_METASYNC flag indicates that all metadata (and not
934 		 * just enough to ensure data integrity) must be written to
935 		 * stable storage synchronously.
936 		 * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
937 		 */
938 		if (stable == NFSV3WRITE_UNSTABLE)
939 			ioflags = IO_NODELOCKED;
940 		else if (stable == NFSV3WRITE_DATASYNC)
941 			ioflags = (IO_SYNC | IO_NODELOCKED);
942 		else
943 			ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
944 		uiop->uio_resid = len;
945 		uiop->uio_rw = UIO_WRITE;
946 		uiop->uio_offset = off;
947 		UIO_SETUP_SYSSPACE(uiop);
948 		error = VOP_WRITE(vp, uiop, ioflags, cred);
949 		nfsstats.srvvop_writes++;
950 		free(iv, M_TEMP);
951 	}
952 	aftat_ret = VOP_GETATTR(vp, &va, cred);
953 	vput(vp);
954 	if (!error)
955 		error = aftat_ret;
956 	nfsm_reply(NFSX_PREOPATTR(v3) + NFSX_POSTOPORFATTR(v3) +
957 		2 * NFSX_UNSIGNED + NFSX_WRITEVERF(v3));
958 	if (v3) {
959 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
960 		if (error)
961 			return (0);
962 		nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
963 		*tl++ = txdr_unsigned(retlen);
964 		if (stable == NFSV3WRITE_UNSTABLE)
965 			*tl++ = txdr_unsigned(stable);
966 		else
967 			*tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
968 		/*
969 		 * Actually, there is no need to txdr these fields,
970 		 * but it may make the values more human readable,
971 		 * for debugging purposes.
972 		 */
973 		*tl++ = txdr_unsigned(boottime.tv_sec);
974 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
975 	} else {
976 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
977 		nfsm_srvfillattr(&va, fp);
978 	}
979 	nfsm_srvdone;
980 }
981 
982 /*
983  * XXX elad: the original NFSW_SAMECRED() macro also made sure the
984  *	     two nd_flag fields of the descriptors contained
985  *	     ND_KERBAUTH.
986  */
987 static int
988 nfsrv_samecred(kauth_cred_t cred1, kauth_cred_t cred2)
989 {
990 	int i, do_ngroups;
991 
992 	if (kauth_cred_geteuid(cred1) != kauth_cred_geteuid(cred2))
993 		return (0);
994 	if (kauth_cred_ngroups(cred1) != kauth_cred_ngroups(cred2))
995 		return (0);
996 	do_ngroups = kauth_cred_ngroups(cred1);
997 	for (i = 0; i < do_ngroups; i++)
998 		if (kauth_cred_group(cred1, i) !=
999 		    kauth_cred_group(cred2, i))
1000 			return (0);
1001 
1002 	return (1);
1003 }
1004 
1005 static struct nfsrvw_delayhash *
1006 nfsrv_nwdelayhash(struct nfssvc_sock *slp, const nfsrvfh_t *nsfh)
1007 {
1008 	uint32_t hash;
1009 
1010 	hash = hash32_buf(NFSRVFH_DATA(nsfh), NFSRVFH_SIZE(nsfh),
1011 	    HASH32_BUF_INIT);
1012 	return &slp->ns_wdelayhashtbl[hash % NFS_WDELAYHASHSIZ];
1013 }
1014 
1015 /*
1016  * NFS write service with write gathering support. Called when
1017  * nfsrvw_procrastinate > 0.
1018  * See: Chet Juszczak, "Improving the Write Performance of an NFS Server",
1019  * in Proc. of the Winter 1994 Usenix Conference, pg. 247-259, San Franscisco,
1020  * Jan. 1994.
1021  */
1022 int
1023 nfsrv_writegather(struct nfsrv_descript **ndp, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1024 {
1025 	struct timeval now;
1026 	struct iovec *ivp;
1027 	struct mbuf *mp;
1028 	struct nfsrv_descript *wp, *nfsd, *owp, *swp;
1029 	struct nfs_fattr *fp;
1030 	int i = 0;
1031 	struct iovec *iov;
1032 	struct nfsrvw_delayhash *wpp;
1033 	kauth_cred_t cred;
1034 	struct vattr va, forat;
1035 	u_int32_t *tl;
1036 	int32_t t1;
1037 	char *bpos, *dpos;
1038 	int error = 0, rdonly, cache = 0, len = 0, forat_ret = 1;
1039 	int ioflags, aftat_ret = 1, adjust, v3, zeroing;
1040 	char *cp2;
1041 	struct mbuf *mb, *mreq, *mrep, *md;
1042 	struct vnode *vp;
1043 	struct uio io, *uiop = &io;
1044 	u_quad_t frev, cur_usec;
1045 
1046 	*mrq = NULL;
1047 	if (*ndp) {
1048 	    nfsd = *ndp;
1049 	    *ndp = NULL;
1050 	    mrep = nfsd->nd_mrep;
1051 	    md = nfsd->nd_md;
1052 	    dpos = nfsd->nd_dpos;
1053 	    cred = nfsd->nd_cr;
1054 	    v3 = (nfsd->nd_flag & ND_NFSV3);
1055 	    LIST_INIT(&nfsd->nd_coalesce);
1056 	    nfsd->nd_mreq = NULL;
1057 	    nfsd->nd_stable = NFSV3WRITE_FILESYNC;
1058 	    getmicrotime(&now);
1059 	    cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1060 	    nfsd->nd_time = cur_usec + nfsrvw_procrastinate;
1061 
1062 	    /*
1063 	     * Now, get the write header..
1064 	     */
1065 	    nfsm_srvmtofh(&nfsd->nd_fh);
1066 	    if (v3) {
1067 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1068 		nfsd->nd_off = fxdr_hyper(tl);
1069 		tl += 3;
1070 		nfsd->nd_stable = fxdr_unsigned(int, *tl++);
1071 	    } else {
1072 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1073 		nfsd->nd_off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1074 		tl += 2;
1075 	    }
1076 	    len = fxdr_unsigned(int32_t, *tl);
1077 	    nfsd->nd_len = len;
1078 	    nfsd->nd_eoff = nfsd->nd_off + len;
1079 
1080 	    /*
1081 	     * Trim the header out of the mbuf list and trim off any trailing
1082 	     * junk so that the mbuf list has only the write data.
1083 	     */
1084 	    zeroing = 1;
1085 	    i = 0;
1086 	    mp = mrep;
1087 	    while (mp) {
1088 		if (mp == md) {
1089 		    zeroing = 0;
1090 		    adjust = dpos - mtod(mp, char *);
1091 		    mp->m_len -= adjust;
1092 		    if (mp->m_len > 0 && adjust > 0)
1093 			NFSMADV(mp, adjust);
1094 		}
1095 		if (zeroing)
1096 		    mp->m_len = 0;
1097 		else {
1098 		    i += mp->m_len;
1099 		    if (i > len) {
1100 			mp->m_len -= (i - len);
1101 			zeroing = 1;
1102 		    }
1103 		}
1104 		mp = mp->m_next;
1105 	    }
1106 	    if (len > NFS_MAXDATA || len < 0  || i < len) {
1107 nfsmout:
1108 		m_freem(mrep);
1109 		error = EIO;
1110 		nfsm_writereply(2 * NFSX_UNSIGNED, v3);
1111 		if (v3)
1112 		    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1113 		nfsd->nd_mreq = mreq;
1114 		nfsd->nd_mrep = NULL;
1115 		nfsd->nd_time = 0;
1116 	    }
1117 
1118 	    /*
1119 	     * Add this entry to the hash and time queues.
1120 	     */
1121 	    owp = NULL;
1122 	    mutex_enter(&nfsd_lock);
1123 	    wp = LIST_FIRST(&slp->ns_tq);
1124 	    while (wp && wp->nd_time < nfsd->nd_time) {
1125 		owp = wp;
1126 		wp = LIST_NEXT(wp, nd_tq);
1127 	    }
1128 	    if (owp) {
1129 		LIST_INSERT_AFTER(owp, nfsd, nd_tq);
1130 	    } else {
1131 		LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1132 	    }
1133 	    if (nfsd->nd_mrep) {
1134 		wpp = nfsrv_nwdelayhash(slp, &nfsd->nd_fh);
1135 		owp = NULL;
1136 		wp = LIST_FIRST(wpp);
1137 		while (wp && nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1138 		    owp = wp;
1139 		    wp = LIST_NEXT(wp, nd_hash);
1140 		}
1141 		while (wp && wp->nd_off < nfsd->nd_off &&
1142 		    !nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1143 		    owp = wp;
1144 		    wp = LIST_NEXT(wp, nd_hash);
1145 		}
1146 		if (owp) {
1147 		    LIST_INSERT_AFTER(owp, nfsd, nd_hash);
1148 
1149 		    /*
1150 		     * Search the hash list for overlapping entries and
1151 		     * coalesce.
1152 		     */
1153 		    for(; nfsd && NFSW_CONTIG(owp, nfsd); nfsd = wp) {
1154 			wp = LIST_NEXT(nfsd, nd_hash);
1155 			if (nfsrv_samecred(owp->nd_cr, nfsd->nd_cr))
1156 			    nfsrvw_coalesce(owp, nfsd);
1157 		    }
1158 		} else {
1159 		    LIST_INSERT_HEAD(wpp, nfsd, nd_hash);
1160 		}
1161 	    }
1162 	    mutex_exit(&nfsd_lock);
1163 	}
1164 
1165 	/*
1166 	 * Now, do VOP_WRITE()s for any one(s) that need to be done now
1167 	 * and generate the associated reply mbuf list(s).
1168 	 */
1169 loop1:
1170 	getmicrotime(&now);
1171 	cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1172 	mutex_enter(&nfsd_lock);
1173 	for (nfsd = LIST_FIRST(&slp->ns_tq); nfsd; nfsd = owp) {
1174 		owp = LIST_NEXT(nfsd, nd_tq);
1175 		if (nfsd->nd_time > cur_usec)
1176 		    break;
1177 		if (nfsd->nd_mreq)
1178 		    continue;
1179 		LIST_REMOVE(nfsd, nd_tq);
1180 		LIST_REMOVE(nfsd, nd_hash);
1181 		mutex_exit(&nfsd_lock);
1182 
1183 		mrep = nfsd->nd_mrep;
1184 		nfsd->nd_mrep = NULL;
1185 		cred = nfsd->nd_cr;
1186 		v3 = (nfsd->nd_flag & ND_NFSV3);
1187 		forat_ret = aftat_ret = 1;
1188 		error = nfsrv_fhtovp(&nfsd->nd_fh, 1, &vp, cred, slp,
1189 		    nfsd->nd_nam, &rdonly, (nfsd->nd_flag & ND_KERBAUTH),
1190 		    false);
1191 		if (!error) {
1192 		    if (v3)
1193 			forat_ret = VOP_GETATTR(vp, &forat, cred);
1194 		    if (vp->v_type != VREG) {
1195 			if (v3)
1196 			    error = EINVAL;
1197 			else
1198 			    error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1199 		    }
1200 		} else
1201 		    vp = NULL;
1202 		if (!error) {
1203 		    nqsrv_getl(vp, ND_WRITE);
1204 		    error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
1205 		}
1206 
1207 		if (nfsd->nd_stable == NFSV3WRITE_UNSTABLE)
1208 		    ioflags = IO_NODELOCKED;
1209 		else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC)
1210 		    ioflags = (IO_SYNC | IO_NODELOCKED);
1211 		else
1212 		    ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1213 		uiop->uio_rw = UIO_WRITE;
1214 		uiop->uio_offset = nfsd->nd_off;
1215 		uiop->uio_resid = nfsd->nd_eoff - nfsd->nd_off;
1216 		UIO_SETUP_SYSSPACE(uiop);
1217 		if (uiop->uio_resid > 0) {
1218 		    mp = mrep;
1219 		    i = 0;
1220 		    while (mp) {
1221 			if (mp->m_len > 0)
1222 			    i++;
1223 			mp = mp->m_next;
1224 		    }
1225 		    uiop->uio_iovcnt = i;
1226 		    iov = malloc(i * sizeof (struct iovec), M_TEMP, M_WAITOK);
1227 		    uiop->uio_iov = ivp = iov;
1228 		    mp = mrep;
1229 		    while (mp) {
1230 			if (mp->m_len > 0) {
1231 			    ivp->iov_base = mtod(mp, void *);
1232 			    ivp->iov_len = mp->m_len;
1233 			    ivp++;
1234 			}
1235 			mp = mp->m_next;
1236 		    }
1237 		    if (!error) {
1238 			error = VOP_WRITE(vp, uiop, ioflags, cred);
1239 			nfsstats.srvvop_writes++;
1240 		    }
1241 		    free((void *)iov, M_TEMP);
1242 		}
1243 		m_freem(mrep);
1244 		if (vp) {
1245 		    aftat_ret = VOP_GETATTR(vp, &va, cred);
1246 		    vput(vp);
1247 		}
1248 
1249 		/*
1250 		 * Loop around generating replies for all write rpcs that have
1251 		 * now been completed.
1252 		 */
1253 		swp = nfsd;
1254 		do {
1255 		    if (error) {
1256 			nfsm_writereply(NFSX_WCCDATA(v3), v3);
1257 			if (v3) {
1258 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1259 			}
1260 		    } else {
1261 			nfsm_writereply(NFSX_PREOPATTR(v3) +
1262 			    NFSX_POSTOPORFATTR(v3) + 2 * NFSX_UNSIGNED +
1263 			    NFSX_WRITEVERF(v3), v3);
1264 			if (v3) {
1265 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1266 			    nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1267 			    *tl++ = txdr_unsigned(nfsd->nd_len);
1268 			    *tl++ = txdr_unsigned(swp->nd_stable);
1269 			    /*
1270 			     * Actually, there is no need to txdr these fields,
1271 			     * but it may make the values more human readable,
1272 			     * for debugging purposes.
1273 			     */
1274 			    *tl++ = txdr_unsigned(boottime.tv_sec);
1275 			    *tl = txdr_unsigned(boottime.tv_nsec / 1000);
1276 			} else {
1277 			    nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1278 			    nfsm_srvfillattr(&va, fp);
1279 			}
1280 		    }
1281 		    nfsd->nd_mreq = mreq;
1282 		    if (nfsd->nd_mrep)
1283 			panic("nfsrv_write: nd_mrep not free");
1284 
1285 		    /*
1286 		     * Done. Put it at the head of the timer queue so that
1287 		     * the final phase can return the reply.
1288 		     */
1289 		    mutex_enter(&nfsd_lock);
1290 		    if (nfsd != swp) {
1291 			nfsd->nd_time = 0;
1292 			LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1293 		    }
1294 		    nfsd = LIST_FIRST(&swp->nd_coalesce);
1295 		    if (nfsd) {
1296 			LIST_REMOVE(nfsd, nd_tq);
1297 		    }
1298 		    mutex_exit(&nfsd_lock);
1299 		} while (nfsd);
1300 		swp->nd_time = 0;
1301 
1302 		mutex_enter(&nfsd_lock);
1303 		LIST_INSERT_HEAD(&slp->ns_tq, swp, nd_tq);
1304 		mutex_exit(&nfsd_lock);
1305 		goto loop1;
1306 	}
1307 	mutex_exit(&nfsd_lock);
1308 	nfs_timer_start();
1309 
1310 	/*
1311 	 * Search for a reply to return.
1312 	 */
1313 	mutex_enter(&nfsd_lock);
1314 	LIST_FOREACH(nfsd, &slp->ns_tq, nd_tq) {
1315 		if (nfsd->nd_mreq) {
1316 		    LIST_REMOVE(nfsd, nd_tq);
1317 		    *mrq = nfsd->nd_mreq;
1318 		    *ndp = nfsd;
1319 		    break;
1320 		}
1321 	}
1322 	mutex_exit(&nfsd_lock);
1323 	return (0);
1324 }
1325 
1326 /*
1327  * Coalesce the write request nfsd into owp. To do this we must:
1328  * - remove nfsd from the queues
1329  * - merge nfsd->nd_mrep into owp->nd_mrep
1330  * - update the nd_eoff and nd_stable for owp
1331  * - put nfsd on owp's nd_coalesce list
1332  * NB: Must be called at splsoftclock().
1333  */
1334 void
1335 nfsrvw_coalesce(struct nfsrv_descript *owp, struct nfsrv_descript *nfsd)
1336 {
1337         int overlap;
1338         struct mbuf *mp;
1339 	struct nfsrv_descript *m;
1340 
1341 	KASSERT(mutex_owned(&nfsd_lock));
1342 
1343         LIST_REMOVE(nfsd, nd_hash);
1344         LIST_REMOVE(nfsd, nd_tq);
1345         if (owp->nd_eoff < nfsd->nd_eoff) {
1346             overlap = owp->nd_eoff - nfsd->nd_off;
1347             if (overlap < 0)
1348                 panic("nfsrv_coalesce: bad off");
1349             if (overlap > 0)
1350                 m_adj(nfsd->nd_mrep, overlap);
1351             mp = owp->nd_mrep;
1352             while (mp->m_next)
1353                 mp = mp->m_next;
1354             mp->m_next = nfsd->nd_mrep;
1355             owp->nd_eoff = nfsd->nd_eoff;
1356         } else
1357             m_freem(nfsd->nd_mrep);
1358         nfsd->nd_mrep = NULL;
1359         if (nfsd->nd_stable == NFSV3WRITE_FILESYNC)
1360             owp->nd_stable = NFSV3WRITE_FILESYNC;
1361         else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC &&
1362             owp->nd_stable == NFSV3WRITE_UNSTABLE)
1363             owp->nd_stable = NFSV3WRITE_DATASYNC;
1364         LIST_INSERT_HEAD(&owp->nd_coalesce, nfsd, nd_tq);
1365  	/*
1366  	 * nfsd might hold coalesce elements! Move them to owp.
1367  	 * Otherwise, requests may be lost and clients will be stuck.
1368  	 */
1369 	while ((m = LIST_FIRST(&nfsd->nd_coalesce)) != NULL) {
1370 		LIST_REMOVE(m, nd_tq);
1371 		LIST_INSERT_HEAD(&owp->nd_coalesce, m, nd_tq);
1372 	}
1373 }
1374 
1375 /*
1376  * nfs create service
1377  * now does a truncate to 0 length via. setattr if it already exists
1378  */
1379 int
1380 nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1381 {
1382 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1383 	struct mbuf *nam = nfsd->nd_nam;
1384 	char *dpos = nfsd->nd_dpos;
1385 	kauth_cred_t cred = nfsd->nd_cr;
1386 	struct nfs_fattr *fp;
1387 	struct vattr va, dirfor, diraft;
1388 	struct nfsv2_sattr *sp;
1389 	u_int32_t *tl;
1390 	struct nameidata nd;
1391 	char *cp;
1392 	int32_t t1;
1393 	char *bpos;
1394 	int error = 0, cache = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
1395 	int rdev = 0, abort = 0;
1396 	int v3 = (nfsd->nd_flag & ND_NFSV3), how, exclusive_flag = 0;
1397 	char *cp2;
1398 	struct mbuf *mb, *mreq;
1399 	struct vnode *vp = NULL, *dirp = NULL;
1400 	nfsrvfh_t nsfh;
1401 	u_quad_t frev, tempsize;
1402 	u_char cverf[NFSX_V3CREATEVERF];
1403 
1404 	nd.ni_cnd.cn_nameiop = 0;
1405 	nfsm_srvmtofh(&nsfh);
1406 	nfsm_srvnamesiz(len);
1407 	nd.ni_cnd.cn_cred = cred;
1408 	nd.ni_cnd.cn_nameiop = CREATE;
1409 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1410 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1411 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1412 	if (dirp && v3) {
1413 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1414 	}
1415 	if (error) {
1416 		nfsm_reply(NFSX_WCCDATA(v3));
1417 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1418 		if (dirp)
1419 			vrele(dirp);
1420 		return (0);
1421 	}
1422 	abort = 1;
1423 	VATTR_NULL(&va);
1424 	if (v3) {
1425 		va.va_mode = 0;
1426 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1427 		how = fxdr_unsigned(int, *tl);
1428 		switch (how) {
1429 		case NFSV3CREATE_GUARDED:
1430 			if (nd.ni_vp) {
1431 				error = EEXIST;
1432 				break;
1433 			}
1434 		case NFSV3CREATE_UNCHECKED:
1435 			nfsm_srvsattr(&va);
1436 			break;
1437 		case NFSV3CREATE_EXCLUSIVE:
1438 			nfsm_dissect(cp, void *, NFSX_V3CREATEVERF);
1439 			memcpy(cverf, cp, NFSX_V3CREATEVERF);
1440 			exclusive_flag = 1;
1441 			break;
1442 		};
1443 		va.va_type = VREG;
1444 	} else {
1445 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1446 		va.va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1447 		if (va.va_type == VNON)
1448 			va.va_type = VREG;
1449 		va.va_mode = nfstov_mode(sp->sa_mode);
1450 		switch (va.va_type) {
1451 		case VREG:
1452 			tsize = fxdr_unsigned(int32_t, sp->sa_size);
1453 			if (tsize != -1)
1454 				va.va_size = (u_quad_t)tsize;
1455 			break;
1456 		case VCHR:
1457 		case VBLK:
1458 		case VFIFO:
1459 			rdev = fxdr_unsigned(int32_t, sp->sa_size);
1460 			break;
1461 		default:
1462 			break;
1463 		};
1464 	}
1465 
1466 	/*
1467 	 * Iff doesn't exist, create it
1468 	 * otherwise just truncate to 0 length
1469 	 *   should I set the mode too ??
1470 	 */
1471 	if (nd.ni_vp == NULL) {
1472 		if (va.va_type == VREG || va.va_type == VSOCK) {
1473 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1474 			error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1475 			if (!error) {
1476 				if (exclusive_flag) {
1477 					exclusive_flag = 0;
1478 					VATTR_NULL(&va);
1479 					/*
1480 					 * XXX
1481 					 * assuming NFSX_V3CREATEVERF
1482 					 * == sizeof(nfstime3)
1483 					 */
1484 					fxdr_nfsv3time(cverf, &va.va_atime);
1485 					error = VOP_SETATTR(nd.ni_vp, &va,
1486 						cred);
1487 				}
1488 			}
1489 		} else if (va.va_type == VCHR || va.va_type == VBLK ||
1490 			va.va_type == VFIFO) {
1491 			if (va.va_type == VCHR && rdev == 0xffffffff)
1492 				va.va_type = VFIFO;
1493 			if (va.va_type != VFIFO &&
1494 			    (error = kauth_authorize_system(cred,
1495 			    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1496 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1497 				vput(nd.ni_dvp);
1498 				abort = 0;
1499 				nfsm_reply(0);
1500 				return (error);
1501 			} else
1502 				va.va_rdev = (dev_t)rdev;
1503 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1504 			error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd,
1505 			    &va);
1506 			if (error) {
1507 				nfsm_reply(0);
1508 			}
1509 			if (nd.ni_cnd.cn_flags & ISSYMLINK) {
1510 				vput(nd.ni_vp);
1511 				vrele(nd.ni_dvp);
1512 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1513 				error = EINVAL;
1514 				abort = 0;
1515 				nfsm_reply(0);
1516 			}
1517 		} else {
1518 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1519 			vput(nd.ni_dvp);
1520 			error = ENXIO;
1521 			abort = 0;
1522 		}
1523 		vp = nd.ni_vp;
1524 	} else {
1525 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1526 		vp = nd.ni_vp;
1527 		if (nd.ni_dvp == vp)
1528 			vrele(nd.ni_dvp);
1529 		else
1530 			vput(nd.ni_dvp);
1531 		abort = 0;
1532 		if (!error && va.va_size != -1) {
1533 			error = nfsrv_access(vp, VWRITE, cred,
1534 			    (nd.ni_cnd.cn_flags & RDONLY), lwp, 0);
1535 			if (!error) {
1536 				nqsrv_getl(vp, ND_WRITE);
1537 				tempsize = va.va_size;
1538 				VATTR_NULL(&va);
1539 				va.va_size = tempsize;
1540 				error = VOP_SETATTR(vp, &va, cred);
1541 			}
1542 		}
1543 		if (error)
1544 			vput(vp);
1545 	}
1546 	if (!error) {
1547 		error = nfsrv_composefh(vp, &nsfh, v3);
1548 		if (!error)
1549 			error = VOP_GETATTR(vp, &va, cred);
1550 		vput(vp);
1551 	}
1552 	if (v3) {
1553 		if (exclusive_flag && !error) {
1554 			/*
1555 			 * XXX assuming NFSX_V3CREATEVERF == sizeof(nfstime3)
1556 			 */
1557 			char oldverf[NFSX_V3CREATEVERF];
1558 
1559 			txdr_nfsv3time(&va.va_atime, oldverf);
1560 			if (memcmp(cverf, oldverf, NFSX_V3CREATEVERF))
1561 				error = EEXIST;
1562 		}
1563 		if (dirp) {
1564 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1565 		}
1566 	}
1567 	if (dirp) {
1568 		vrele(dirp);
1569 		dirp = NULL;
1570 	}
1571 	abort = 0;
1572 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_FATTR(v3) + NFSX_WCCDATA(v3));
1573 	if (v3) {
1574 		if (!error) {
1575 			nfsm_srvpostop_fh(&nsfh);
1576 			nfsm_srvpostop_attr(0, &va);
1577 		}
1578 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1579 	} else {
1580 		nfsm_srvfhtom(&nsfh, v3);
1581 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1582 		nfsm_srvfillattr(&va, fp);
1583 	}
1584 	return (0);
1585 nfsmout:
1586 	if (dirp)
1587 		vrele(dirp);
1588 	if (abort) {
1589 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1590 		if (nd.ni_dvp == nd.ni_vp)
1591 			vrele(nd.ni_dvp);
1592 		else
1593 			vput(nd.ni_dvp);
1594 		if (nd.ni_vp)
1595 			vput(nd.ni_vp);
1596 	}
1597 	return (error);
1598 }
1599 
1600 /*
1601  * nfs v3 mknod service
1602  */
1603 int
1604 nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1605 {
1606 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1607 	struct mbuf *nam = nfsd->nd_nam;
1608 	char *dpos = nfsd->nd_dpos;
1609 	kauth_cred_t cred = nfsd->nd_cr;
1610 	struct vattr va, dirfor, diraft;
1611 	u_int32_t *tl;
1612 	struct nameidata nd;
1613 	int32_t t1;
1614 	char *bpos;
1615 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1616 	int abort = 0;
1617 	u_int32_t major, minor;
1618 	enum vtype vtyp;
1619 	char *cp2;
1620 	struct mbuf *mb, *mreq;
1621 	struct vnode *vp, *dirp = (struct vnode *)0;
1622 	nfsrvfh_t nsfh;
1623 	u_quad_t frev;
1624 
1625 	nd.ni_cnd.cn_nameiop = 0;
1626 	nfsm_srvmtofh(&nsfh);
1627 	nfsm_srvnamesiz(len);
1628 	nd.ni_cnd.cn_cred = cred;
1629 	nd.ni_cnd.cn_nameiop = CREATE;
1630 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1631 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1632 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1633 	if (dirp)
1634 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1635 	if (error) {
1636 		nfsm_reply(NFSX_WCCDATA(1));
1637 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1638 		if (dirp)
1639 			vrele(dirp);
1640 		return (0);
1641 	}
1642 	abort = 1;
1643 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1644 	vtyp = nfsv3tov_type(*tl);
1645 	if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1646 		error = NFSERR_BADTYPE;
1647 		goto abort;
1648 	}
1649 	VATTR_NULL(&va);
1650 	va.va_mode = 0;
1651 	nfsm_srvsattr(&va);
1652 	if (vtyp == VCHR || vtyp == VBLK) {
1653 		dev_t rdev;
1654 
1655 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1656 		major = fxdr_unsigned(u_int32_t, *tl++);
1657 		minor = fxdr_unsigned(u_int32_t, *tl);
1658 		rdev = makedev(major, minor);
1659 		if (major(rdev) != major || minor(rdev) != minor) {
1660 			error = EINVAL;
1661 			goto abort;
1662 		}
1663 		va.va_rdev = rdev;
1664 	}
1665 
1666 	/*
1667 	 * Iff doesn't exist, create it.
1668 	 */
1669 	if (nd.ni_vp) {
1670 		error = EEXIST;
1671 abort:
1672 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1673 		if (nd.ni_dvp == nd.ni_vp)
1674 			vrele(nd.ni_dvp);
1675 		else
1676 			vput(nd.ni_dvp);
1677 		if (nd.ni_vp)
1678 			vput(nd.ni_vp);
1679 		goto out;
1680 	}
1681 	va.va_type = vtyp;
1682 	if (vtyp == VSOCK) {
1683 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1684 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1685 	} else {
1686 		if (va.va_type != VFIFO &&
1687 		    (error = kauth_authorize_system(cred,
1688 		    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1689 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1690 			vput(nd.ni_dvp);
1691 			goto out;
1692 		}
1693 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1694 		error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1695 		if (error)
1696 			goto out;
1697 		if (nd.ni_cnd.cn_flags & ISSYMLINK) {
1698 			vput(nd.ni_vp);
1699 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1700 			error = EINVAL;
1701 		}
1702 	}
1703 out:
1704 	vp = nd.ni_vp;
1705 	if (!error) {
1706 		error = nfsrv_composefh(vp, &nsfh, true);
1707 		if (!error)
1708 			error = VOP_GETATTR(vp, &va, cred);
1709 		vput(vp);
1710 	}
1711 	if (dirp) {
1712 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1713 		vrele(dirp);
1714 		dirp = NULL;
1715 	}
1716 	abort = 0;
1717 	nfsm_reply(NFSX_SRVFH(&nsfh, true) + NFSX_POSTOPATTR(1) +
1718 	    NFSX_WCCDATA(1));
1719 	if (!error) {
1720 		nfsm_srvpostop_fh(&nsfh);
1721 		nfsm_srvpostop_attr(0, &va);
1722 	}
1723 	nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1724 	return (0);
1725 nfsmout:
1726 	if (abort) {
1727 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1728 		if (nd.ni_dvp == nd.ni_vp)
1729 			vrele(nd.ni_dvp);
1730 		else
1731 			vput(nd.ni_dvp);
1732 		if (nd.ni_vp)
1733 			vput(nd.ni_vp);
1734 	}
1735 	if (dirp)
1736 		vrele(dirp);
1737 	return (error);
1738 }
1739 
1740 /*
1741  * nfs remove service
1742  */
1743 int
1744 nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1745 {
1746 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1747 	struct mbuf *nam = nfsd->nd_nam;
1748 	char *dpos = nfsd->nd_dpos;
1749 	kauth_cred_t cred = nfsd->nd_cr;
1750 	struct nameidata nd;
1751 	u_int32_t *tl;
1752 	int32_t t1;
1753 	char *bpos;
1754 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1755 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1756 	char *cp2;
1757 	struct mbuf *mb, *mreq;
1758 	struct vnode *vp, *dirp;
1759 	struct vattr dirfor, diraft;
1760 	nfsrvfh_t nsfh;
1761 	u_quad_t frev;
1762 
1763 #ifndef nolint
1764 	vp = (struct vnode *)0;
1765 #endif
1766 	nfsm_srvmtofh(&nsfh);
1767 	nfsm_srvnamesiz(len);
1768 	nd.ni_cnd.cn_cred = cred;
1769 	nd.ni_cnd.cn_nameiop = DELETE;
1770 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1771 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1772 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1773 	if (dirp && v3) {
1774 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1775 	}
1776 	if (!error) {
1777 		vp = nd.ni_vp;
1778 		if (vp->v_type == VDIR) {
1779 			error = EPERM;
1780 			goto out;
1781 		}
1782 		/*
1783 		 * The root of a mounted filesystem cannot be deleted.
1784 		 */
1785 		if (vp->v_vflag & VV_ROOT) {
1786 			error = EBUSY;
1787 		}
1788 out:
1789 		if (!error) {
1790 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1791 			nqsrv_getl(vp, ND_WRITE);
1792 			error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1793 		} else {
1794 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1795 			if (nd.ni_dvp == vp)
1796 				vrele(nd.ni_dvp);
1797 			else
1798 				vput(nd.ni_dvp);
1799 			vput(vp);
1800 		}
1801 	}
1802 	if (dirp) {
1803 		if (v3) {
1804 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1805 		}
1806 		vrele(dirp);
1807 	}
1808 	nfsm_reply(NFSX_WCCDATA(v3));
1809 	if (v3) {
1810 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1811 		return (0);
1812 	}
1813 	nfsm_srvdone;
1814 }
1815 
1816 /*
1817  * nfs rename service
1818  */
1819 int
1820 nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1821 {
1822 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1823 	struct mbuf *nam = nfsd->nd_nam;
1824 	char *dpos = nfsd->nd_dpos;
1825 	kauth_cred_t cred = nfsd->nd_cr;
1826 	u_int32_t *tl;
1827 	int32_t t1;
1828 	char *bpos;
1829 	int error = 0, cache = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1830 	uint32_t len, len2;
1831 	int tdirfor_ret = 1, tdiraft_ret = 1;
1832 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1833 	char *cp2;
1834 	struct mbuf *mb, *mreq;
1835 	struct nameidata fromnd, tond;
1836 	struct vnode *fvp, *tvp, *tdvp;
1837 	struct vnode *fdirp = NULL, *tdirp = NULL;
1838 	struct mount *localfs = NULL;
1839 	struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
1840 	nfsrvfh_t fnsfh, tnsfh;
1841 	u_quad_t frev;
1842 	uid_t saved_uid;
1843 	uint32_t saveflag;
1844 
1845 #ifndef nolint
1846 	fvp = (struct vnode *)0;
1847 #endif
1848 	fromnd.ni_cnd.cn_nameiop = 0;
1849 	tond.ni_cnd.cn_nameiop = 0;
1850 	nfsm_srvmtofh(&fnsfh);
1851 	nfsm_srvnamesiz(len);
1852 	/*
1853 	 * Remember our original uid so that we can reset cr_uid before
1854 	 * the second nfs_namei() call, in case it is remapped.
1855 	 */
1856 	saved_uid = kauth_cred_geteuid(cred);
1857 	fromnd.ni_cnd.cn_cred = cred;
1858 	fromnd.ni_cnd.cn_nameiop = DELETE;
1859 	fromnd.ni_cnd.cn_flags = LOCKPARENT | SAVESTART;
1860 	error = nfs_namei(&fromnd, &fnsfh, len, slp, nam, &md,
1861 		&dpos, &fdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1862 	if (fdirp && v3) {
1863 		fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor, cred);
1864 	}
1865 	if (error) {
1866 		nfsm_reply(2 * NFSX_WCCDATA(v3));
1867 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1868 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1869 		if (fdirp)
1870 			vrele(fdirp);
1871 		return (0);
1872 	}
1873 	if (fromnd.ni_dvp != fromnd.ni_vp) {
1874 		VOP_UNLOCK(fromnd.ni_dvp, 0);
1875 	}
1876 	fvp = fromnd.ni_vp;
1877 
1878 	localfs = fvp->v_mount;
1879 	error = VFS_RENAMELOCK_ENTER(localfs);
1880 	if (error) {
1881 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1882 		vrele(fromnd.ni_dvp);
1883 		vrele(fvp);
1884 		goto out1;
1885 	}
1886 
1887 	/* Copied, regrettably, from vfs_syscalls.c (q.v.) */
1888 	vrele(fvp);
1889 	if ((fromnd.ni_cnd.cn_namelen == 1 &&
1890 	     fromnd.ni_cnd.cn_nameptr[0] == '.') ||
1891 	    (fromnd.ni_cnd.cn_namelen == 2 &&
1892 	     fromnd.ni_cnd.cn_nameptr[0] == '.' &&
1893 	     fromnd.ni_cnd.cn_nameptr[1] == '.')) {
1894 		error = EINVAL;
1895 		VFS_RENAMELOCK_EXIT(localfs);
1896 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1897 		vrele(fromnd.ni_dvp);
1898 		goto out1;
1899 	}
1900 	saveflag = fromnd.ni_cnd.cn_flags & SAVESTART;
1901 	fromnd.ni_cnd.cn_flags &= ~SAVESTART;
1902 	vn_lock(fromnd.ni_dvp, LK_EXCLUSIVE | LK_RETRY);
1903 	error = relookup(fromnd.ni_dvp, &fromnd.ni_vp, &fromnd.ni_cnd);
1904 	fromnd.ni_cnd.cn_flags |= saveflag;
1905 	if (error) {
1906 		VOP_UNLOCK(fromnd.ni_dvp, 0);
1907 		VFS_RENAMELOCK_EXIT(localfs);
1908 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1909 		vrele(fromnd.ni_dvp);
1910 		goto out1;
1911 	}
1912 	VOP_UNLOCK(fromnd.ni_vp, 0);
1913 	if (fromnd.ni_dvp != fromnd.ni_vp)
1914 		VOP_UNLOCK(fromnd.ni_dvp, 0);
1915 	fvp = fromnd.ni_vp;
1916 
1917 	nfsm_srvmtofh(&tnsfh);
1918 	if (v3) {
1919 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
1920 		len2 = fxdr_unsigned(uint32_t, *tl);
1921 		/* len2 will be checked by nfs_namei */
1922 	}
1923 	else {
1924 		/* NFSv2 */
1925 		nfsm_strsiz(len2, NFS_MAXNAMLEN);
1926 	}
1927 	kauth_cred_seteuid(cred, saved_uid);
1928 	tond.ni_cnd.cn_cred = cred;
1929 	tond.ni_cnd.cn_nameiop = RENAME;
1930 	tond.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | NOCACHE | SAVESTART;
1931 	error = nfs_namei(&tond, &tnsfh, len2, slp, nam, &md,
1932 		&dpos, &tdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1933 	if (tdirp && v3) {
1934 		tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor, cred);
1935 	}
1936 	if (error) {
1937 		VFS_RENAMELOCK_EXIT(localfs);
1938 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1939 		vrele(fromnd.ni_dvp);
1940 		vrele(fvp);
1941 		goto out1;
1942 	}
1943 	tdvp = tond.ni_dvp;
1944 	tvp = tond.ni_vp;
1945 	if (tvp != NULL) {
1946 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
1947 			if (v3)
1948 				error = EEXIST;
1949 			else
1950 				error = EISDIR;
1951 			goto out;
1952 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
1953 			if (v3)
1954 				error = EEXIST;
1955 			else
1956 				error = ENOTDIR;
1957 			goto out;
1958 		}
1959 		if (tvp->v_type == VDIR && tvp->v_mountedhere) {
1960 			if (v3)
1961 				error = EXDEV;
1962 			else
1963 				error = ENOTEMPTY;
1964 			goto out;
1965 		}
1966 	}
1967 	if (fvp->v_type == VDIR && fvp->v_mountedhere) {
1968 		if (v3)
1969 			error = EXDEV;
1970 		else
1971 			error = ENOTEMPTY;
1972 		goto out;
1973 	}
1974 	if (fvp->v_mount != tdvp->v_mount) {
1975 		if (v3)
1976 			error = EXDEV;
1977 		else
1978 			error = ENOTEMPTY;
1979 		goto out;
1980 	}
1981 	if (fvp == tdvp) {
1982 		if (v3)
1983 			error = EINVAL;
1984 		else
1985 			error = ENOTEMPTY;
1986 	}
1987 	/*
1988 	 * If source is the same as the destination (that is the
1989 	 * same vnode with the same name in the same directory),
1990 	 * then there is nothing to do.
1991 	 */
1992 	if (fvp == tvp && fromnd.ni_dvp == tdvp &&
1993 	    fromnd.ni_cnd.cn_namelen == tond.ni_cnd.cn_namelen &&
1994 	    !memcmp(fromnd.ni_cnd.cn_nameptr, tond.ni_cnd.cn_nameptr,
1995 	      fromnd.ni_cnd.cn_namelen))
1996 		error = -1;
1997 out:
1998 	if (!error) {
1999 		nqsrv_getl(fromnd.ni_dvp, ND_WRITE);
2000 		nqsrv_getl(tdvp, ND_WRITE);
2001 		if (tvp) {
2002 			nqsrv_getl(tvp, ND_WRITE);
2003 		}
2004 		error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
2005 				   tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
2006 		VFS_RENAMELOCK_EXIT(localfs);
2007 	} else {
2008 		VOP_ABORTOP(tond.ni_dvp, &tond.ni_cnd);
2009 		if (tdvp == tvp)
2010 			vrele(tdvp);
2011 		else
2012 			vput(tdvp);
2013 		if (tvp)
2014 			vput(tvp);
2015 		VFS_RENAMELOCK_EXIT(localfs);
2016 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2017 		vrele(fromnd.ni_dvp);
2018 		vrele(fvp);
2019 		if (error == -1)
2020 			error = 0;
2021 	}
2022 	vrele(tond.ni_startdir);
2023 	PNBUF_PUT(tond.ni_cnd.cn_pnbuf);
2024 	tond.ni_cnd.cn_nameiop = 0;
2025 out1:
2026 	if (fdirp) {
2027 		if (v3) {
2028 			fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred);
2029 		}
2030 		vrele(fdirp);
2031 		fdirp = NULL;
2032 	}
2033 	if (tdirp) {
2034 		if (v3) {
2035 			tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred);
2036 		}
2037 		vrele(tdirp);
2038 		tdirp = NULL;
2039 	}
2040 	vrele(fromnd.ni_startdir);
2041 	PNBUF_PUT(fromnd.ni_cnd.cn_pnbuf);
2042 	fromnd.ni_cnd.cn_nameiop = 0;
2043 	localfs = NULL;
2044 	nfsm_reply(2 * NFSX_WCCDATA(v3));
2045 	if (v3) {
2046 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
2047 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
2048 	}
2049 	return (0);
2050 
2051 nfsmout:
2052 	if (fdirp)
2053 		vrele(fdirp);
2054 #ifdef notdef
2055 	if (tdirp)
2056 		vrele(tdirp);
2057 #endif
2058 	if (tond.ni_cnd.cn_nameiop) {
2059 		vrele(tond.ni_startdir);
2060 		PNBUF_PUT(tond.ni_cnd.cn_pnbuf);
2061 	}
2062 	if (localfs) {
2063 		VFS_RENAMELOCK_EXIT(localfs);
2064 	}
2065 	if (fromnd.ni_cnd.cn_nameiop) {
2066 		vrele(fromnd.ni_startdir);
2067 		PNBUF_PUT(fromnd.ni_cnd.cn_pnbuf);
2068 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2069 		vrele(fromnd.ni_dvp);
2070 		vrele(fvp);
2071 	}
2072 	return (error);
2073 }
2074 
2075 /*
2076  * nfs link service
2077  */
2078 int
2079 nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2080 {
2081 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2082 	struct mbuf *nam = nfsd->nd_nam;
2083 	char *dpos = nfsd->nd_dpos;
2084 	kauth_cred_t cred = nfsd->nd_cr;
2085 	struct nameidata nd;
2086 	u_int32_t *tl;
2087 	int32_t t1;
2088 	char *bpos;
2089 	int error = 0, rdonly, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2090 	int getret = 1, v3 = (nfsd->nd_flag & ND_NFSV3);
2091 	char *cp2;
2092 	struct mbuf *mb, *mreq;
2093 	struct vnode *vp, *xp, *dirp = (struct vnode *)0;
2094 	struct vattr dirfor, diraft, at;
2095 	nfsrvfh_t nsfh, dnsfh;
2096 	u_quad_t frev;
2097 
2098 	nfsm_srvmtofh(&nsfh);
2099 	nfsm_srvmtofh(&dnsfh);
2100 	nfsm_srvnamesiz(len);
2101 	error = nfsrv_fhtovp(&nsfh, false, &vp, cred, slp, nam,
2102 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2103 	if (error) {
2104 		nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2105 		nfsm_srvpostop_attr(getret, &at);
2106 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2107 		return (0);
2108 	}
2109 	if (vp->v_type == VDIR) {
2110 		error = EPERM;
2111 		goto out1;
2112 	}
2113 	nd.ni_cnd.cn_cred = cred;
2114 	nd.ni_cnd.cn_nameiop = CREATE;
2115 	nd.ni_cnd.cn_flags = LOCKPARENT;
2116 	error = nfs_namei(&nd, &dnsfh, len, slp, nam, &md, &dpos,
2117 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2118 	if (dirp && v3) {
2119 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2120 	}
2121 	if (error)
2122 		goto out1;
2123 	xp = nd.ni_vp;
2124 	if (xp != NULL) {
2125 		error = EEXIST;
2126 		goto out;
2127 	}
2128 	xp = nd.ni_dvp;
2129 	if (vp->v_mount != xp->v_mount)
2130 		error = EXDEV;
2131 out:
2132 	if (!error) {
2133 		nqsrv_getl(vp, ND_WRITE);
2134 		nqsrv_getl(xp, ND_WRITE);
2135 		error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
2136 	} else {
2137 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2138 		if (nd.ni_dvp == nd.ni_vp)
2139 			vrele(nd.ni_dvp);
2140 		else
2141 			vput(nd.ni_dvp);
2142 		if (nd.ni_vp)
2143 			vrele(nd.ni_vp);
2144 	}
2145 out1:
2146 	if (v3)
2147 		getret = VOP_GETATTR(vp, &at, cred);
2148 	if (dirp) {
2149 		if (v3) {
2150 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2151 		}
2152 		vrele(dirp);
2153 	}
2154 	vrele(vp);
2155 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2156 	if (v3) {
2157 		nfsm_srvpostop_attr(getret, &at);
2158 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2159 		return (0);
2160 	}
2161 	nfsm_srvdone;
2162 }
2163 
2164 /*
2165  * nfs symbolic link service
2166  */
2167 int
2168 nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2169 {
2170 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2171 	struct mbuf *nam = nfsd->nd_nam;
2172 	char *dpos = nfsd->nd_dpos;
2173 	kauth_cred_t cred = nfsd->nd_cr;
2174 	struct vattr va, dirfor, diraft;
2175 	struct nameidata nd;
2176 	u_int32_t *tl;
2177 	int32_t t1;
2178 	struct nfsv2_sattr *sp;
2179 	char *bpos, *pathcp = NULL, *cp2;
2180 	struct uio io;
2181 	struct iovec iv;
2182 	int error = 0, cache = 0, dirfor_ret = 1, diraft_ret = 1, abort = 0;
2183 	uint32_t len, len2;
2184 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2185 	struct mbuf *mb, *mreq;
2186 	struct vnode *dirp = (struct vnode *)0;
2187 	nfsrvfh_t nsfh;
2188 	u_quad_t frev;
2189 
2190 	nd.ni_cnd.cn_nameiop = 0;
2191 	nfsm_srvmtofh(&nsfh);
2192 	nfsm_srvnamesiz(len);
2193 	nd.ni_cnd.cn_cred = cred;
2194 	nd.ni_cnd.cn_nameiop = CREATE;
2195 	nd.ni_cnd.cn_flags = LOCKPARENT;
2196 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2197 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2198 	if (dirp && v3) {
2199 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2200 	}
2201 	if (error)
2202 		goto out;
2203 	abort = 1;
2204 	VATTR_NULL(&va);
2205 	va.va_type = VLNK;
2206 	if (v3) {
2207 		va.va_mode = 0;
2208 		nfsm_srvsattr(&va);
2209 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
2210 		len2 = fxdr_unsigned(uint32_t, *tl);
2211 		if (len2 > PATH_MAX) {
2212 			/* XXX should check _PC_NO_TRUNC */
2213 			error = ENAMETOOLONG;
2214 			goto abortop;
2215 		}
2216 	}
2217 	else {
2218 		/* NFSv2 */
2219 		nfsm_strsiz(len2, NFS_MAXPATHLEN);
2220 	}
2221 	pathcp = malloc(len2 + 1, M_TEMP, M_WAITOK);
2222 	iv.iov_base = pathcp;
2223 	iv.iov_len = len2;
2224 	io.uio_resid = len2;
2225 	io.uio_offset = 0;
2226 	io.uio_iov = &iv;
2227 	io.uio_iovcnt = 1;
2228 	io.uio_rw = UIO_READ;
2229 	UIO_SETUP_SYSSPACE(&io);
2230 	nfsm_mtouio(&io, len2);
2231 	if (!v3) {
2232 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
2233 		va.va_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
2234 	}
2235 	*(pathcp + len2) = '\0';
2236 	if (nd.ni_vp) {
2237 		error = EEXIST;
2238 abortop:
2239 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2240 		if (nd.ni_dvp == nd.ni_vp)
2241 			vrele(nd.ni_dvp);
2242 		else
2243 			vput(nd.ni_dvp);
2244 		if (nd.ni_vp)
2245 			vrele(nd.ni_vp);
2246 		goto out;
2247 	}
2248 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2249 	error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va, pathcp);
2250 	if (!error) {
2251 	    if (v3) {
2252 		error = nfsrv_composefh(nd.ni_vp, &nsfh, v3);
2253 		if (!error)
2254 		    error = VOP_GETATTR(nd.ni_vp, &va, cred);
2255 		vput(nd.ni_vp);
2256 	    } else {
2257 		vput(nd.ni_vp);
2258 	    }
2259 	}
2260 out:
2261 	if (pathcp)
2262 		free(pathcp, M_TEMP);
2263 	if (dirp) {
2264 		if (v3) {
2265 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2266 		}
2267 		vrele(dirp);
2268 		dirp = NULL;
2269 	}
2270 	abort = 0;
2271 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2272 	    NFSX_WCCDATA(v3));
2273 	if (v3) {
2274 		if (!error) {
2275 			nfsm_srvpostop_fh(&nsfh);
2276 			nfsm_srvpostop_attr(0, &va);
2277 		}
2278 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2279 	}
2280 	return (0);
2281 nfsmout:
2282 	if (abort) {
2283 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2284 		if (nd.ni_dvp == nd.ni_vp)
2285 			vrele(nd.ni_dvp);
2286 		else
2287 			vput(nd.ni_dvp);
2288 		if (nd.ni_vp)
2289 			vrele(nd.ni_vp);
2290 	}
2291 	if (dirp)
2292 		vrele(dirp);
2293 	if (pathcp)
2294 		free(pathcp, M_TEMP);
2295 	return (error);
2296 }
2297 
2298 /*
2299  * nfs mkdir service
2300  */
2301 int
2302 nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2303 {
2304 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2305 	struct mbuf *nam = nfsd->nd_nam;
2306 	char *dpos = nfsd->nd_dpos;
2307 	kauth_cred_t cred = nfsd->nd_cr;
2308 	struct vattr va, dirfor, diraft;
2309 	struct nfs_fattr *fp;
2310 	struct nameidata nd;
2311 	char *cp;
2312 	u_int32_t *tl;
2313 	int32_t t1;
2314 	char *bpos;
2315 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2316 	int abort = 0;
2317 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2318 	char *cp2;
2319 	struct mbuf *mb, *mreq;
2320 	struct vnode *vp, *dirp = (struct vnode *)0;
2321 	nfsrvfh_t nsfh;
2322 	u_quad_t frev;
2323 
2324 	nfsm_srvmtofh(&nsfh);
2325 	nfsm_srvnamesiz(len);
2326 	nd.ni_cnd.cn_cred = cred;
2327 	nd.ni_cnd.cn_nameiop = CREATE;
2328 	nd.ni_cnd.cn_flags = LOCKPARENT;
2329 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2330 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2331 	if (dirp && v3) {
2332 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2333 	}
2334 	if (error) {
2335 		nfsm_reply(NFSX_WCCDATA(v3));
2336 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2337 		if (dirp)
2338 			vrele(dirp);
2339 		return (0);
2340 	}
2341 	abort = 1;
2342 	VATTR_NULL(&va);
2343 	if (v3) {
2344 		va.va_mode = 0;
2345 		nfsm_srvsattr(&va);
2346 	} else {
2347 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
2348 		va.va_mode = nfstov_mode(*tl++);
2349 	}
2350 	va.va_type = VDIR;
2351 	vp = nd.ni_vp;
2352 	if (vp != NULL) {
2353 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2354 		if (nd.ni_dvp == vp)
2355 			vrele(nd.ni_dvp);
2356 		else
2357 			vput(nd.ni_dvp);
2358 		vrele(vp);
2359 		error = EEXIST;
2360 		goto out;
2361 	}
2362 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2363 	error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
2364 	if (!error) {
2365 		vp = nd.ni_vp;
2366 		error = nfsrv_composefh(vp, &nsfh, v3);
2367 		if (!error)
2368 			error = VOP_GETATTR(vp, &va, cred);
2369 		vput(vp);
2370 	}
2371 out:
2372 	if (dirp) {
2373 		if (v3) {
2374 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2375 		}
2376 		vrele(dirp);
2377 		dirp = NULL;
2378 	}
2379 	abort = 0;
2380 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2381 	    NFSX_WCCDATA(v3));
2382 	if (v3) {
2383 		if (!error) {
2384 			nfsm_srvpostop_fh(&nsfh);
2385 			nfsm_srvpostop_attr(0, &va);
2386 		}
2387 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2388 	} else {
2389 		nfsm_srvfhtom(&nsfh, v3);
2390 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
2391 		nfsm_srvfillattr(&va, fp);
2392 	}
2393 	return (0);
2394 nfsmout:
2395 	if (abort) {
2396 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2397 		if (nd.ni_dvp == nd.ni_vp)
2398 			vrele(nd.ni_dvp);
2399 		else
2400 			vput(nd.ni_dvp);
2401 		if (nd.ni_vp)
2402 			vrele(nd.ni_vp);
2403 	}
2404 	if (dirp)
2405 		vrele(dirp);
2406 	return (error);
2407 }
2408 
2409 /*
2410  * nfs rmdir service
2411  */
2412 int
2413 nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2414 {
2415 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2416 	struct mbuf *nam = nfsd->nd_nam;
2417 	char *dpos = nfsd->nd_dpos;
2418 	kauth_cred_t cred = nfsd->nd_cr;
2419 	u_int32_t *tl;
2420 	int32_t t1;
2421 	char *bpos;
2422 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2423 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2424 	char *cp2;
2425 	struct mbuf *mb, *mreq;
2426 	struct vnode *vp, *dirp = (struct vnode *)0;
2427 	struct vattr dirfor, diraft;
2428 	nfsrvfh_t nsfh;
2429 	struct nameidata nd;
2430 	u_quad_t frev;
2431 
2432 	nfsm_srvmtofh(&nsfh);
2433 	nfsm_srvnamesiz(len);
2434 	nd.ni_cnd.cn_cred = cred;
2435 	nd.ni_cnd.cn_nameiop = DELETE;
2436 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
2437 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2438 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2439 	if (dirp && v3) {
2440 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2441 	}
2442 	if (error) {
2443 		nfsm_reply(NFSX_WCCDATA(v3));
2444 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2445 		if (dirp)
2446 			vrele(dirp);
2447 		return (0);
2448 	}
2449 	vp = nd.ni_vp;
2450 	if (vp->v_type != VDIR) {
2451 		error = ENOTDIR;
2452 		goto out;
2453 	}
2454 	/*
2455 	 * No rmdir "." please.
2456 	 */
2457 	if (nd.ni_dvp == vp) {
2458 		error = EINVAL;
2459 		goto out;
2460 	}
2461 	/*
2462 	 * The root of a mounted filesystem cannot be deleted.
2463 	 */
2464 	if (vp->v_vflag & VV_ROOT)
2465 		error = EBUSY;
2466 out:
2467 	if (!error) {
2468 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
2469 		nqsrv_getl(vp, ND_WRITE);
2470 		error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
2471 	} else {
2472 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2473 		if (nd.ni_dvp == nd.ni_vp)
2474 			vrele(nd.ni_dvp);
2475 		else
2476 			vput(nd.ni_dvp);
2477 		vput(vp);
2478 	}
2479 	if (dirp) {
2480 		if (v3) {
2481 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2482 		}
2483 		vrele(dirp);
2484 	}
2485 	nfsm_reply(NFSX_WCCDATA(v3));
2486 	if (v3) {
2487 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2488 		return (0);
2489 	}
2490 	nfsm_srvdone;
2491 }
2492 
2493 /*
2494  * nfs readdir service
2495  * - mallocs what it thinks is enough to read
2496  *	count rounded up to a multiple of NFS_SRVDIRBLKSIZ <= NFS_MAXREADDIR
2497  * - calls VOP_READDIR()
2498  * - loops around building the reply
2499  *	if the output generated exceeds count break out of loop
2500  *	The nfsm_clget macro is used here so that the reply will be packed
2501  *	tightly in mbuf clusters.
2502  * - it only knows that it has encountered eof when the VOP_READDIR()
2503  *	reads nothing
2504  * - as such one readdir rpc will return eof false although you are there
2505  *	and then the next will return eof
2506  * - it trims out records with d_fileno == 0
2507  *	this doesn't matter for Unix clients, but they might confuse clients
2508  *	for other os'.
2509  * - it trims out records with d_type == DT_WHT
2510  *	these cannot be seen through NFS (unless we extend the protocol)
2511  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2512  *	than requested, but this may not apply to all filesystems. For
2513  *	example, client NFS does not { although it is never remote mounted
2514  *	anyhow }
2515  *     The alternate call nfsrv_readdirplus() does lookups as well.
2516  * PS: The NFS protocol spec. does not clarify what the "count" byte
2517  *	argument is a count of.. just name strings and file id's or the
2518  *	entire reply rpc or ...
2519  *	I tried just file name and id sizes and it confused the Sun client,
2520  *	so I am using the full rpc size now. The "paranoia.." comment refers
2521  *	to including the status longwords that are not a part of the dir.
2522  *	"entry" structures, but are in the rpc.
2523  */
2524 
2525 #define	NFS_SRVDIRBLKSIZ	1024
2526 
2527 struct flrep {
2528 	nfsuint64 fl_off;
2529 	u_int32_t fl_postopok;
2530 	struct nfs_fattr fl_fattr; /* XXX: must be of fattr3 size */
2531 	u_int32_t fl_fhok;
2532 	u_int32_t fl_fhsize;
2533 	/* handle comes here, filled in dynamically */
2534 };
2535 
2536 int
2537 nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2538 {
2539 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2540 	struct mbuf *nam = nfsd->nd_nam;
2541 	char *dpos = nfsd->nd_dpos;
2542 	kauth_cred_t cred = nfsd->nd_cr;
2543 	char *bp, *be;
2544 	struct mbuf *mp;
2545 	struct dirent *dp;
2546 	char *cp;
2547 	u_int32_t *tl;
2548 	int32_t t1;
2549 	char *bpos;
2550 	struct mbuf *mb, *mreq, *mp2;
2551 	char *cpos, *cend, *cp2, *rbuf;
2552 	struct vnode *vp;
2553 	struct vattr at;
2554 	nfsrvfh_t nsfh;
2555 	struct uio io;
2556 	struct iovec iv;
2557 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2558 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, ncookies;
2559 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2560 	u_quad_t frev, off, toff, verf;
2561 	off_t *cookies = NULL, *cookiep;
2562 	nfsuint64 jar;
2563 
2564 	nfsm_srvmtofh(&nsfh);
2565 	if (v3) {
2566 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2567 		toff = fxdr_hyper(tl);
2568 		tl += 2;
2569 		verf = fxdr_hyper(tl);
2570 		tl += 2;
2571 	} else {
2572 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2573 		toff = fxdr_unsigned(u_quad_t, *tl++);
2574 	}
2575 	off = toff;
2576 	cnt = fxdr_unsigned(int, *tl);
2577 	siz = ((cnt + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2578 	xfer = NFS_SRVMAXDATA(nfsd);
2579 	if (siz > xfer)
2580 		siz = xfer;
2581 	fullsiz = siz;
2582 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2583 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2584 	if (!error && vp->v_type != VDIR) {
2585 		error = ENOTDIR;
2586 		vput(vp);
2587 	}
2588 	if (error) {
2589 		nfsm_reply(NFSX_UNSIGNED);
2590 		nfsm_srvpostop_attr(getret, &at);
2591 		return (0);
2592 	}
2593 	nqsrv_getl(vp, ND_READ);
2594 	if (v3) {
2595 		error = getret = VOP_GETATTR(vp, &at, cred);
2596 #ifdef NFS3_STRICTVERF
2597 		/*
2598 		 * XXX This check is too strict for Solaris 2.5 clients.
2599 		 */
2600 		if (!error && toff && verf != at.va_filerev)
2601 			error = NFSERR_BAD_COOKIE;
2602 #endif
2603 	}
2604 	if (!error)
2605 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2606 	if (error) {
2607 		vput(vp);
2608 		nfsm_reply(NFSX_POSTOPATTR(v3));
2609 		nfsm_srvpostop_attr(getret, &at);
2610 		return (0);
2611 	}
2612 	VOP_UNLOCK(vp, 0);
2613 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2614 again:
2615 	iv.iov_base = rbuf;
2616 	iv.iov_len = fullsiz;
2617 	io.uio_iov = &iv;
2618 	io.uio_iovcnt = 1;
2619 	io.uio_offset = (off_t)off;
2620 	io.uio_resid = fullsiz;
2621 	io.uio_rw = UIO_READ;
2622 	UIO_SETUP_SYSSPACE(&io);
2623 	eofflag = 0;
2624 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2625 
2626 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2627 
2628 	off = (off_t)io.uio_offset;
2629 	if (!cookies && !error)
2630 		error = NFSERR_PERM;
2631 	if (v3) {
2632 		getret = VOP_GETATTR(vp, &at, cred);
2633 		if (!error)
2634 			error = getret;
2635 	}
2636 
2637 	VOP_UNLOCK(vp, 0);
2638 	if (error) {
2639 		vrele(vp);
2640 		free((void *)rbuf, M_TEMP);
2641 		if (cookies)
2642 			free((void *)cookies, M_TEMP);
2643 		nfsm_reply(NFSX_POSTOPATTR(v3));
2644 		nfsm_srvpostop_attr(getret, &at);
2645 		return (0);
2646 	}
2647 	if (io.uio_resid) {
2648 		siz -= io.uio_resid;
2649 
2650 		/*
2651 		 * If nothing read, return eof
2652 		 * rpc reply
2653 		 */
2654 		if (siz == 0) {
2655 			vrele(vp);
2656 			nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) +
2657 				2 * NFSX_UNSIGNED);
2658 			if (v3) {
2659 				nfsm_srvpostop_attr(getret, &at);
2660 				nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
2661 				txdr_hyper(at.va_filerev, tl);
2662 				tl += 2;
2663 			} else
2664 				nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2665 			*tl++ = nfs_false;
2666 			*tl = nfs_true;
2667 			free((void *)rbuf, M_TEMP);
2668 			free((void *)cookies, M_TEMP);
2669 			return (0);
2670 		}
2671 	}
2672 
2673 	/*
2674 	 * Check for degenerate cases of nothing useful read.
2675 	 * If so go try again
2676 	 */
2677 	cpos = rbuf;
2678 	cend = rbuf + siz;
2679 	dp = (struct dirent *)cpos;
2680 	cookiep = cookies;
2681 
2682 	while (cpos < cend && ncookies > 0 &&
2683 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
2684 		cpos += dp->d_reclen;
2685 		dp = (struct dirent *)cpos;
2686 		cookiep++;
2687 		ncookies--;
2688 	}
2689 	if (cpos >= cend || ncookies == 0) {
2690 		toff = off;
2691 		siz = fullsiz;
2692 		free(cookies, M_TEMP);
2693 		cookies = NULL;
2694 		goto again;
2695 	}
2696 
2697 	len = 3 * NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
2698 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) + siz);
2699 	if (v3) {
2700 		nfsm_srvpostop_attr(getret, &at);
2701 		nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2702 		txdr_hyper(at.va_filerev, tl);
2703 	}
2704 	mp = mp2 = mb;
2705 	bp = bpos;
2706 	be = bp + M_TRAILINGSPACE(mp);
2707 
2708 	/* Loop through the records and build reply */
2709 	while (cpos < cend && ncookies > 0) {
2710 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
2711 			nlen = dp->d_namlen;
2712 			rem = nfsm_rndup(nlen)-nlen;
2713 			len += (4 * NFSX_UNSIGNED + nlen + rem);
2714 			if (v3)
2715 				len += 2 * NFSX_UNSIGNED;
2716 			if (len > cnt) {
2717 				eofflag = 0;
2718 				break;
2719 			}
2720 			/*
2721 			 * Build the directory record xdr from
2722 			 * the dirent entry.
2723 			 */
2724 			nfsm_clget;
2725 			*tl = nfs_true;
2726 			bp += NFSX_UNSIGNED;
2727 			if (v3) {
2728 				nfsm_clget;
2729 				*tl = txdr_unsigned(dp->d_fileno >> 32);
2730 				bp += NFSX_UNSIGNED;
2731 			}
2732 			nfsm_clget;
2733 			*tl = txdr_unsigned(dp->d_fileno);
2734 			bp += NFSX_UNSIGNED;
2735 			nfsm_clget;
2736 			*tl = txdr_unsigned(nlen);
2737 			bp += NFSX_UNSIGNED;
2738 
2739 			/* And loop around copying the name */
2740 			xfer = nlen;
2741 			cp = dp->d_name;
2742 			while (xfer > 0) {
2743 				nfsm_clget;
2744 				if ((bp+xfer) > be)
2745 					tsiz = be-bp;
2746 				else
2747 					tsiz = xfer;
2748 				memcpy(bp, cp, tsiz);
2749 				bp += tsiz;
2750 				xfer -= tsiz;
2751 				if (xfer > 0)
2752 					cp += tsiz;
2753 			}
2754 			/* And null pad to an int32_t boundary */
2755 			for (i = 0; i < rem; i++)
2756 				*bp++ = '\0';
2757 			nfsm_clget;
2758 
2759 			/* Finish off the record */
2760 			txdr_hyper(*cookiep, &jar);
2761 			if (v3) {
2762 				*tl = jar.nfsuquad[0];
2763 				bp += NFSX_UNSIGNED;
2764 				nfsm_clget;
2765 			}
2766 			*tl = jar.nfsuquad[1];
2767 			bp += NFSX_UNSIGNED;
2768 		}
2769 		cpos += dp->d_reclen;
2770 		dp = (struct dirent *)cpos;
2771 		cookiep++;
2772 		ncookies--;
2773 	}
2774 	vrele(vp);
2775 	nfsm_clget;
2776 	*tl = nfs_false;
2777 	bp += NFSX_UNSIGNED;
2778 	nfsm_clget;
2779 	if (eofflag)
2780 		*tl = nfs_true;
2781 	else
2782 		*tl = nfs_false;
2783 	bp += NFSX_UNSIGNED;
2784 	if (mp != mb) {
2785 		if (bp < be)
2786 			mp->m_len = bp - mtod(mp, char *);
2787 	} else
2788 		mp->m_len += bp - bpos;
2789 	free((void *)rbuf, M_TEMP);
2790 	free((void *)cookies, M_TEMP);
2791 	nfsm_srvdone;
2792 }
2793 
2794 int
2795 nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2796 {
2797 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2798 	struct mbuf *nam = nfsd->nd_nam;
2799 	char *dpos = nfsd->nd_dpos;
2800 	kauth_cred_t cred = nfsd->nd_cr;
2801 	char *bp, *be;
2802 	struct mbuf *mp;
2803 	struct dirent *dp;
2804 	char *cp;
2805 	u_int32_t *tl;
2806 	int32_t t1;
2807 	char *bpos;
2808 	struct mbuf *mb, *mreq, *mp2;
2809 	char *cpos, *cend, *cp2, *rbuf;
2810 	struct vnode *vp, *nvp;
2811 	struct flrep fl;
2812 	nfsrvfh_t nsfh;
2813 	struct uio io;
2814 	struct iovec iv;
2815 	struct vattr va, at, *vap = &va;
2816 	struct nfs_fattr *fp;
2817 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2818 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, dirlen, ncookies;
2819 	u_quad_t frev, off, toff, verf;
2820 	off_t *cookies = NULL, *cookiep;
2821 
2822 	nfsm_srvmtofh(&nsfh);
2823 	nfsm_dissect(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2824 	toff = fxdr_hyper(tl);
2825 	tl += 2;
2826 	verf = fxdr_hyper(tl);
2827 	tl += 2;
2828 	siz = fxdr_unsigned(int, *tl++);
2829 	cnt = fxdr_unsigned(int, *tl);
2830 	off = toff;
2831 	siz = ((siz + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2832 	xfer = NFS_SRVMAXDATA(nfsd);
2833 	if (siz > xfer)
2834 		siz = xfer;
2835 	fullsiz = siz;
2836 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2837 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2838 	if (!error && vp->v_type != VDIR) {
2839 		error = ENOTDIR;
2840 		vput(vp);
2841 	}
2842 	if (error) {
2843 		nfsm_reply(NFSX_UNSIGNED);
2844 		nfsm_srvpostop_attr(getret, &at);
2845 		return (0);
2846 	}
2847 	error = getret = VOP_GETATTR(vp, &at, cred);
2848 #ifdef NFS3_STRICTVERF
2849 	/*
2850 	 * XXX This check is too strict for Solaris 2.5 clients.
2851 	 */
2852 	if (!error && toff && verf != at.va_filerev)
2853 		error = NFSERR_BAD_COOKIE;
2854 #endif
2855 	if (!error) {
2856 		nqsrv_getl(vp, ND_READ);
2857 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2858 	}
2859 	if (error) {
2860 		vput(vp);
2861 		nfsm_reply(NFSX_V3POSTOPATTR);
2862 		nfsm_srvpostop_attr(getret, &at);
2863 		return (0);
2864 	}
2865 	VOP_UNLOCK(vp, 0);
2866 
2867 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2868 again:
2869 	iv.iov_base = rbuf;
2870 	iv.iov_len = fullsiz;
2871 	io.uio_iov = &iv;
2872 	io.uio_iovcnt = 1;
2873 	io.uio_offset = (off_t)off;
2874 	io.uio_resid = fullsiz;
2875 	io.uio_rw = UIO_READ;
2876 	UIO_SETUP_SYSSPACE(&io);
2877 	eofflag = 0;
2878 
2879 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2880 
2881 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2882 
2883 	off = (u_quad_t)io.uio_offset;
2884 	getret = VOP_GETATTR(vp, &at, cred);
2885 
2886 	VOP_UNLOCK(vp, 0);
2887 
2888 	/*
2889 	 * If the VGET operation doesn't work for this filesystem,
2890 	 * we can't support readdirplus. Returning NOTSUPP should
2891 	 * make clients fall back to plain readdir.
2892 	 * There's no need to check for VPTOFH as well, we wouldn't
2893 	 * even be here otherwise.
2894 	 */
2895 	if (!getret) {
2896 		if ((getret = VFS_VGET(vp->v_mount, at.va_fileid, &nvp)))
2897 			getret = (getret == EOPNOTSUPP) ?
2898 				NFSERR_NOTSUPP : NFSERR_IO;
2899 		else
2900 			vput(nvp);
2901 	}
2902 
2903 	if (!cookies && !error)
2904 		error = NFSERR_PERM;
2905 	if (!error)
2906 		error = getret;
2907 	if (error) {
2908 		vrele(vp);
2909 		if (cookies)
2910 			free((void *)cookies, M_TEMP);
2911 		free((void *)rbuf, M_TEMP);
2912 		nfsm_reply(NFSX_V3POSTOPATTR);
2913 		nfsm_srvpostop_attr(getret, &at);
2914 		return (0);
2915 	}
2916 	if (io.uio_resid) {
2917 		siz -= io.uio_resid;
2918 
2919 		/*
2920 		 * If nothing read, return eof
2921 		 * rpc reply
2922 		 */
2923 		if (siz == 0) {
2924 			vrele(vp);
2925 			nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
2926 				2 * NFSX_UNSIGNED);
2927 			nfsm_srvpostop_attr(getret, &at);
2928 			nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
2929 			txdr_hyper(at.va_filerev, tl);
2930 			tl += 2;
2931 			*tl++ = nfs_false;
2932 			*tl = nfs_true;
2933 			free((void *)cookies, M_TEMP);
2934 			free((void *)rbuf, M_TEMP);
2935 			return (0);
2936 		}
2937 	}
2938 
2939 	/*
2940 	 * Check for degenerate cases of nothing useful read.
2941 	 * If so go try again
2942 	 */
2943 	cpos = rbuf;
2944 	cend = rbuf + siz;
2945 	dp = (struct dirent *)cpos;
2946 	cookiep = cookies;
2947 
2948 	while (cpos < cend && ncookies > 0 &&
2949 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
2950 		cpos += dp->d_reclen;
2951 		dp = (struct dirent *)cpos;
2952 		cookiep++;
2953 		ncookies--;
2954 	}
2955 	if (cpos >= cend || ncookies == 0) {
2956 		toff = off;
2957 		siz = fullsiz;
2958 		free(cookies, M_TEMP);
2959 		cookies = NULL;
2960 		goto again;
2961 	}
2962 
2963 	dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF + 2 * NFSX_UNSIGNED;
2964 	nfsm_reply(cnt);
2965 	nfsm_srvpostop_attr(getret, &at);
2966 	nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2967 	txdr_hyper(at.va_filerev, tl);
2968 	mp = mp2 = mb;
2969 	bp = bpos;
2970 	be = bp + M_TRAILINGSPACE(mp);
2971 
2972 	/* Loop through the records and build reply */
2973 	while (cpos < cend && ncookies > 0) {
2974 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
2975 			nfsrvfh_t nnsfh;
2976 
2977 			nlen = dp->d_namlen;
2978 			rem = nfsm_rndup(nlen)-nlen;
2979 
2980 			/*
2981 			 * For readdir_and_lookup get the vnode using
2982 			 * the file number.
2983 			 */
2984 			if (VFS_VGET(vp->v_mount, dp->d_fileno, &nvp))
2985 				goto invalid;
2986 			if (nfsrv_composefh(nvp, &nnsfh, true)) {
2987 				vput(nvp);
2988 				goto invalid;
2989 			}
2990 			if (VOP_GETATTR(nvp, vap, cred)) {
2991 				vput(nvp);
2992 				goto invalid;
2993 			}
2994 			vput(nvp);
2995 
2996 			/*
2997 			 * If either the dircount or maxcount will be
2998 			 * exceeded, get out now. Both of these lengths
2999 			 * are calculated conservatively, including all
3000 			 * XDR overheads.
3001 			 */
3002 			len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
3003 				NFSX_V3POSTOPATTR);
3004 			dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
3005 			if (len > cnt || dirlen > fullsiz) {
3006 				eofflag = 0;
3007 				break;
3008 			}
3009 
3010 			/*
3011 			 * Build the directory record xdr from
3012 			 * the dirent entry.
3013 			 */
3014 			fp = (struct nfs_fattr *)&fl.fl_fattr;
3015 			nfsm_srvfillattr(vap, fp);
3016 			fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
3017 			fl.fl_fhok = nfs_true;
3018 			fl.fl_postopok = nfs_true;
3019 			txdr_hyper(*cookiep, fl.fl_off.nfsuquad);
3020 
3021 			nfsm_clget;
3022 			*tl = nfs_true;
3023 			bp += NFSX_UNSIGNED;
3024 			nfsm_clget;
3025 			*tl = txdr_unsigned(dp->d_fileno >> 32);
3026 			bp += NFSX_UNSIGNED;
3027 			nfsm_clget;
3028 			*tl = txdr_unsigned(dp->d_fileno);
3029 			bp += NFSX_UNSIGNED;
3030 			nfsm_clget;
3031 			*tl = txdr_unsigned(nlen);
3032 			bp += NFSX_UNSIGNED;
3033 
3034 			/* And loop around copying the name */
3035 			xfer = nlen;
3036 			cp = dp->d_name;
3037 			while (xfer > 0) {
3038 				nfsm_clget;
3039 				if ((bp + xfer) > be)
3040 					tsiz = be - bp;
3041 				else
3042 					tsiz = xfer;
3043 				memcpy(bp, cp, tsiz);
3044 				bp += tsiz;
3045 				xfer -= tsiz;
3046 				if (xfer > 0)
3047 					cp += tsiz;
3048 			}
3049 			/* And null pad to an int32_t boundary */
3050 			for (i = 0; i < rem; i++)
3051 				*bp++ = '\0';
3052 
3053 			/*
3054 			 * Now copy the flrep structure out.
3055 			 */
3056 			xfer = sizeof(struct flrep);
3057 			cp = (void *)&fl;
3058 			while (xfer > 0) {
3059 				nfsm_clget;
3060 				if ((bp + xfer) > be)
3061 					tsiz = be - bp;
3062 				else
3063 					tsiz = xfer;
3064 				memcpy(bp, cp, tsiz);
3065 				bp += tsiz;
3066 				xfer -= tsiz;
3067 				if (xfer > 0)
3068 					cp += tsiz;
3069 			}
3070 
3071 			/*
3072 			 * ... and filehandle.
3073 			 */
3074 			xfer = NFSRVFH_SIZE(&nnsfh);
3075 			cp = NFSRVFH_DATA(&nnsfh);
3076 			while (xfer > 0) {
3077 				nfsm_clget;
3078 				if ((bp + xfer) > be)
3079 					tsiz = be - bp;
3080 				else
3081 					tsiz = xfer;
3082 				memcpy(bp, cp, tsiz);
3083 				bp += tsiz;
3084 				xfer -= tsiz;
3085 				if (xfer > 0)
3086 					cp += tsiz;
3087 			}
3088 		}
3089 invalid:
3090 		cpos += dp->d_reclen;
3091 		dp = (struct dirent *)cpos;
3092 		cookiep++;
3093 		ncookies--;
3094 	}
3095 	vrele(vp);
3096 	nfsm_clget;
3097 	*tl = nfs_false;
3098 	bp += NFSX_UNSIGNED;
3099 	nfsm_clget;
3100 	if (eofflag)
3101 		*tl = nfs_true;
3102 	else
3103 		*tl = nfs_false;
3104 	bp += NFSX_UNSIGNED;
3105 	if (mp != mb) {
3106 		if (bp < be)
3107 			mp->m_len = bp - mtod(mp, char *);
3108 	} else
3109 		mp->m_len += bp - bpos;
3110 	free((void *)cookies, M_TEMP);
3111 	free((void *)rbuf, M_TEMP);
3112 	nfsm_srvdone;
3113 }
3114 
3115 /*
3116  * nfs commit service
3117  */
3118 int
3119 nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3120 {
3121 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3122 	struct mbuf *nam = nfsd->nd_nam;
3123 	char *dpos = nfsd->nd_dpos;
3124 	kauth_cred_t cred = nfsd->nd_cr;
3125 	struct vattr bfor, aft;
3126 	struct vnode *vp;
3127 	nfsrvfh_t nsfh;
3128 	u_int32_t *tl;
3129 	int32_t t1;
3130 	char *bpos;
3131 	int error = 0, rdonly, for_ret = 1, aft_ret = 1, cache = 0;
3132 	uint32_t cnt;
3133 	char *cp2;
3134 	struct mbuf *mb, *mreq;
3135 	u_quad_t frev, off, end;
3136 
3137 	nfsm_srvmtofh(&nsfh);
3138 	nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3139 
3140 	off = fxdr_hyper(tl);
3141 	tl += 2;
3142 	cnt = fxdr_unsigned(uint32_t, *tl);
3143 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3144 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3145 	if (error) {
3146 		nfsm_reply(2 * NFSX_UNSIGNED);
3147 		nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3148 		return (0);
3149 	}
3150 	for_ret = VOP_GETATTR(vp, &bfor, cred);
3151 	end = (cnt > 0) ? off + cnt : vp->v_size;
3152 	if (end < off || end > vp->v_size)
3153 		end = vp->v_size;
3154 	if (off < vp->v_size)
3155 		error = VOP_FSYNC(vp, cred, FSYNC_WAIT, off, end);
3156 	/* else error == 0, from nfsrv_fhtovp() */
3157 	aft_ret = VOP_GETATTR(vp, &aft, cred);
3158 	vput(vp);
3159 	nfsm_reply(NFSX_V3WCCDATA + NFSX_V3WRITEVERF);
3160 	nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3161 	if (!error) {
3162 		nfsm_build(tl, u_int32_t *, NFSX_V3WRITEVERF);
3163 		*tl++ = txdr_unsigned(boottime.tv_sec);
3164 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
3165 	} else {
3166 		return (0);
3167 	}
3168 	nfsm_srvdone;
3169 }
3170 
3171 /*
3172  * nfs statfs service
3173  */
3174 int
3175 nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3176 {
3177 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3178 	struct mbuf *nam = nfsd->nd_nam;
3179 	char *dpos = nfsd->nd_dpos;
3180 	kauth_cred_t cred = nfsd->nd_cr;
3181 	struct statvfs *sf = NULL;
3182 	struct nfs_statfs *sfp;
3183 	u_int32_t *tl;
3184 	int32_t t1;
3185 	char *bpos;
3186 	int error = 0, rdonly, cache = 0, getret = 1;
3187 	int v3 = (nfsd->nd_flag & ND_NFSV3);
3188 	char *cp2;
3189 	struct mbuf *mb, *mreq;
3190 	struct vnode *vp;
3191 	struct vattr at;
3192 	nfsrvfh_t nsfh;
3193 	u_quad_t frev, tval;
3194 
3195 	nfsm_srvmtofh(&nsfh);
3196 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3197 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3198 	if (error) {
3199 		nfsm_reply(NFSX_UNSIGNED);
3200 		nfsm_srvpostop_attr(getret, &at);
3201 		return (0);
3202 	}
3203 	sf = malloc(sizeof(*sf), M_TEMP, M_WAITOK);
3204 	error = VFS_STATVFS(vp->v_mount, sf);
3205 	getret = VOP_GETATTR(vp, &at, cred);
3206 	vput(vp);
3207 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_STATFS(v3));
3208 	if (v3)
3209 		nfsm_srvpostop_attr(getret, &at);
3210 	if (error) {
3211 		free(sf, M_TEMP);
3212 		return (0);
3213 	}
3214 	nfsm_build(sfp, struct nfs_statfs *, NFSX_STATFS(v3));
3215 	if (v3) {
3216 		tval = (u_quad_t)((quad_t)sf->f_blocks * (quad_t)sf->f_frsize);
3217 		txdr_hyper(tval, &sfp->sf_tbytes);
3218 		tval = (u_quad_t)((quad_t)sf->f_bfree * (quad_t)sf->f_frsize);
3219 		txdr_hyper(tval, &sfp->sf_fbytes);
3220 		tval = (u_quad_t)((quad_t)sf->f_bavail * (quad_t)sf->f_frsize);
3221 		txdr_hyper(tval, &sfp->sf_abytes);
3222 		tval = (u_quad_t)sf->f_files;
3223 		txdr_hyper(tval, &sfp->sf_tfiles);
3224 		tval = (u_quad_t)sf->f_ffree;
3225 		txdr_hyper(tval, &sfp->sf_ffiles);
3226 		txdr_hyper(tval, &sfp->sf_afiles);
3227 		sfp->sf_invarsec = 0;
3228 	} else {
3229 		sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
3230 		sfp->sf_bsize = txdr_unsigned(sf->f_frsize);
3231 		sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
3232 		sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
3233 		sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
3234 	}
3235 nfsmout:
3236 	if (sf)
3237 	    free(sf, M_TEMP);
3238 	return error;
3239 }
3240 
3241 /*
3242  * nfs fsinfo service
3243  */
3244 int
3245 nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3246 {
3247 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3248 	struct mbuf *nam = nfsd->nd_nam;
3249 	char *dpos = nfsd->nd_dpos;
3250 	kauth_cred_t cred = nfsd->nd_cr;
3251 	u_int32_t *tl;
3252 	struct nfsv3_fsinfo *sip;
3253 	int32_t t1;
3254 	char *bpos;
3255 	int error = 0, rdonly, cache = 0, getret = 1;
3256 	uint32_t maxdata;
3257 	char *cp2;
3258 	struct mbuf *mb, *mreq;
3259 	struct vnode *vp;
3260 	struct vattr at;
3261 	nfsrvfh_t nsfh;
3262 	u_quad_t frev, maxfsize;
3263 	struct statvfs *sb;
3264 
3265 	nfsm_srvmtofh(&nsfh);
3266 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3267 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3268 	if (error) {
3269 		nfsm_reply(NFSX_UNSIGNED);
3270 		nfsm_srvpostop_attr(getret, &at);
3271 		return (0);
3272 	}
3273 
3274 	/* XXX Try to make a guess on the max file size. */
3275 	sb = malloc(sizeof(*sb), M_TEMP, M_WAITOK);
3276 	VFS_STATVFS(vp->v_mount, sb);
3277 	maxfsize = (u_quad_t)0x80000000 * sb->f_frsize - 1;
3278 	free(sb, M_TEMP);
3279 
3280 	getret = VOP_GETATTR(vp, &at, cred);
3281 	vput(vp);
3282 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3FSINFO);
3283 	nfsm_srvpostop_attr(getret, &at);
3284 	nfsm_build(sip, struct nfsv3_fsinfo *, NFSX_V3FSINFO);
3285 
3286 	/*
3287 	 * XXX
3288 	 * There should be file system VFS OP(s) to get this information.
3289 	 * For now, assume ufs.
3290 	 */
3291 	if (slp->ns_so->so_type == SOCK_DGRAM)
3292 		maxdata = NFS_MAXDGRAMDATA;
3293 	else
3294 		maxdata = NFS_MAXDATA;
3295 	sip->fs_rtmax = txdr_unsigned(maxdata);
3296 	sip->fs_rtpref = txdr_unsigned(maxdata);
3297 	sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
3298 	sip->fs_wtmax = txdr_unsigned(maxdata);
3299 	sip->fs_wtpref = txdr_unsigned(maxdata);
3300 	sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
3301 	sip->fs_dtpref = txdr_unsigned(maxdata);
3302 	txdr_hyper(maxfsize, &sip->fs_maxfilesize);
3303 	sip->fs_timedelta.nfsv3_sec = 0;
3304 	sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
3305 	sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
3306 		NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
3307 		NFSV3FSINFO_CANSETTIME);
3308 	nfsm_srvdone;
3309 }
3310 
3311 /*
3312  * nfs pathconf service
3313  */
3314 int
3315 nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3316 {
3317 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3318 	struct mbuf *nam = nfsd->nd_nam;
3319 	char *dpos = nfsd->nd_dpos;
3320 	kauth_cred_t cred = nfsd->nd_cr;
3321 	u_int32_t *tl;
3322 	struct nfsv3_pathconf *pc;
3323 	int32_t t1;
3324 	char *bpos;
3325 	int error = 0, rdonly, cache = 0, getret = 1;
3326 	register_t linkmax, namemax, chownres, notrunc;
3327 	char *cp2;
3328 	struct mbuf *mb, *mreq;
3329 	struct vnode *vp;
3330 	struct vattr at;
3331 	nfsrvfh_t nsfh;
3332 	u_quad_t frev;
3333 
3334 	nfsm_srvmtofh(&nsfh);
3335 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3336 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3337 	if (error) {
3338 		nfsm_reply(NFSX_UNSIGNED);
3339 		nfsm_srvpostop_attr(getret, &at);
3340 		return (0);
3341 	}
3342 	error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
3343 	if (!error)
3344 		error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
3345 	if (!error)
3346 		error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
3347 	if (!error)
3348 		error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
3349 	getret = VOP_GETATTR(vp, &at, cred);
3350 	vput(vp);
3351 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3PATHCONF);
3352 	nfsm_srvpostop_attr(getret, &at);
3353 	if (error)
3354 		return (0);
3355 	nfsm_build(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
3356 
3357 	pc->pc_linkmax = txdr_unsigned(linkmax);
3358 	pc->pc_namemax = txdr_unsigned(namemax);
3359 	pc->pc_notrunc = txdr_unsigned(notrunc);
3360 	pc->pc_chownrestricted = txdr_unsigned(chownres);
3361 
3362 	/*
3363 	 * These should probably be supported by VOP_PATHCONF(), but
3364 	 * until msdosfs is exportable (why would you want to?), the
3365 	 * Unix defaults should be ok.
3366 	 */
3367 	pc->pc_caseinsensitive = nfs_false;
3368 	pc->pc_casepreserving = nfs_true;
3369 	nfsm_srvdone;
3370 }
3371 
3372 /*
3373  * Null operation, used by clients to ping server
3374  */
3375 /* ARGSUSED */
3376 int
3377 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3378     struct lwp *lwp, struct mbuf **mrq)
3379 {
3380 	struct mbuf *mrep = nfsd->nd_mrep;
3381 	char *bpos;
3382 	int error = NFSERR_RETVOID, cache = 0;
3383 	struct mbuf *mb, *mreq;
3384 	u_quad_t frev;
3385 
3386 	nfsm_reply(0);
3387 nfsmout:
3388 	return (0);
3389 }
3390 
3391 /*
3392  * No operation, used for obsolete procedures
3393  */
3394 /* ARGSUSED */
3395 int
3396 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3397     struct lwp *lwp, struct mbuf **mrq)
3398 {
3399 	struct mbuf *mrep = nfsd->nd_mrep;
3400 	char *bpos;
3401 	int error, cache = 0;
3402 	struct mbuf *mb, *mreq;
3403 	u_quad_t frev;
3404 
3405 	if (nfsd->nd_repstat)
3406 		error = nfsd->nd_repstat;
3407 	else
3408 		error = EPROCUNAVAIL;
3409 	nfsm_reply(0);
3410 nfsmout:
3411 	return (0);
3412 }
3413 
3414 /*
3415  * Perform access checking for vnodes obtained from file handles that would
3416  * refer to files already opened by a Unix client. You cannot just use
3417  * vn_writechk() and VOP_ACCESS() for two reasons.
3418  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
3419  * 2 - The owner is to be given access irrespective of mode bits for some
3420  *     operations, so that processes that chmod after opening a file don't
3421  *     break. I don't like this because it opens a security hole, but since
3422  *     the nfs server opens a security hole the size of a barn door anyhow,
3423  *     what the heck.
3424  *
3425  * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
3426  * will return EPERM instead of EACCESS. EPERM is always an error.
3427  */
3428 int
3429 nfsrv_access(struct vnode *vp, int flags, kauth_cred_t cred, int rdonly, struct lwp *lwp, int override)
3430 {
3431 	struct vattr vattr;
3432 	int error;
3433 	if (flags & VWRITE) {
3434 		/* Just vn_writechk() changed to check rdonly */
3435 		/*
3436 		 * Disallow write attempts on read-only file systems;
3437 		 * unless the file is a socket or a block or character
3438 		 * device resident on the file system.
3439 		 */
3440 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
3441 			switch (vp->v_type) {
3442 			case VREG:
3443 			case VDIR:
3444 			case VLNK:
3445 				return (EROFS);
3446 			default:
3447 				break;
3448 			}
3449 		}
3450 
3451 		/*
3452 		 * If the vnode is in use as a process's text,
3453 		 * we can't allow writing.
3454 		 */
3455 		if (vp->v_iflag & VI_TEXT)
3456 			return (ETXTBSY);
3457 	}
3458 	error = VOP_GETATTR(vp, &vattr, cred);
3459 	if (error)
3460 		return (error);
3461 	error = VOP_ACCESS(vp, flags, cred);
3462 	/*
3463 	 * Allow certain operations for the owner (reads and writes
3464 	 * on files that are already open).
3465 	 */
3466 	if (override && error == EACCES && kauth_cred_geteuid(cred) == vattr.va_uid)
3467 		error = 0;
3468 	return error;
3469 }
3470