xref: /netbsd-src/sys/nfs/nfs_serv.c (revision bdc22b2e01993381dcefeff2bc9b56ca75a4235c)
1 /*	$NetBSD: nfs_serv.c,v 1.174 2018/05/03 07:28:43 hannken Exp $	*/
2 
3 /*
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)nfs_serv.c	8.8 (Berkeley) 7/31/95
35  */
36 
37 /*
38  * nfs version 2 and 3 server calls to vnode ops
39  * - these routines generally have 3 phases
40  *   1 - break down and validate rpc request in mbuf list
41  *   2 - do the vnode ops for the request
42  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
43  *   3 - build the rpc reply in an mbuf list
44  *   nb:
45  *	- do not mix the phases, since the nfsm_?? macros can return failures
46  *	  on a bad rpc or similar and do not do any vrele() or vput()'s
47  *
48  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
49  *	error number iff error != 0 whereas
50  *	returning an error from the server function implies a fatal error
51  *	such as a badly constructed rpc request that should be dropped without
52  *	a reply.
53  *	For Version 3, nfsm_reply() does not return for the error case, since
54  *	most version 3 rpcs return more than the status for error cases.
55  */
56 
57 #include <sys/cdefs.h>
58 __KERNEL_RCSID(0, "$NetBSD: nfs_serv.c,v 1.174 2018/05/03 07:28:43 hannken Exp $");
59 
60 #include <sys/param.h>
61 #include <sys/systm.h>
62 #include <sys/proc.h>
63 #include <sys/file.h>
64 #include <sys/namei.h>
65 #include <sys/vnode.h>
66 #include <sys/mount.h>
67 #include <sys/socket.h>
68 #include <sys/socketvar.h>
69 #include <sys/mbuf.h>
70 #include <sys/dirent.h>
71 #include <sys/stat.h>
72 #include <sys/kernel.h>
73 #include <sys/hash.h>
74 #include <sys/kauth.h>
75 #include <sys/module.h>
76 #include <sys/syscall.h>
77 #include <sys/syscallargs.h>
78 #include <sys/syscallvar.h>
79 
80 #include <uvm/uvm.h>
81 
82 #include <nfs/nfsproto.h>
83 #include <nfs/rpcv2.h>
84 #include <nfs/nfs.h>
85 #include <nfs/xdr_subs.h>
86 #include <nfs/nfsm_subs.h>
87 #include <nfs/nfs_var.h>
88 
89 MODULE(MODULE_CLASS_MISC, nfsserver, "nfs");
90 
91 /* Global vars */
92 extern u_int32_t nfs_xdrneg1;
93 extern u_int32_t nfs_false, nfs_true;
94 extern const enum vtype nv3tov_type[8];
95 extern struct nfsstats nfsstats;
96 extern const nfstype nfsv2_type[9];
97 extern const nfstype nfsv3_type[9];
98 int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
99 bool nfsd_use_loan = true;	/* use page-loan for READ OP */
100 
101 #define	nqsrv_getl(vp, rw)	/* nothing */
102 
103 static const struct syscall_package nfsserver_syscalls[] = {
104 	{ SYS_nfssvc, 0, (sy_call_t *)sys_nfssvc },
105 	{ 0, 0, NULL },
106 };
107 
108 static int
109 nfsserver_modcmd(modcmd_t cmd, void *arg)
110 {
111 	extern struct vfs_hooks nfs_export_hooks;	/* XXX */
112 	int error;
113 
114 	switch (cmd) {
115 	case MODULE_CMD_INIT:
116 		error = syscall_establish(NULL, nfsserver_syscalls);
117 		if (error != 0) {
118 			return error;
119 		}
120 		nfs_init();	/* XXX for monolithic kernel */
121 		netexport_init();
122 		nfsrv_initcache();	/* Init the server request cache */
123 		nfsrv_init(0);		/* Init server data structures */
124 		vfs_hooks_attach(&nfs_export_hooks);
125 		nfs_timer_srvinit(nfsrv_timer);
126 		return 0;
127 	case MODULE_CMD_FINI:
128 		error = syscall_disestablish(NULL, nfsserver_syscalls);
129 		if (error != 0) {
130 			return error;
131 		}
132 		/*
133 		 * Kill export list before detaching VFS hooks, so we
134 		 * we don't leak state due to a concurrent umount().
135 		 */
136 		netexport_fini();
137 		vfs_hooks_detach(&nfs_export_hooks);
138 
139 		/* Kill timer before server goes away. */
140 		nfs_timer_srvfini();
141 		nfsrv_fini();
142 
143 		/* Server uses server cache, so kill cache last. */
144 		nfsrv_finicache();
145 		nfs_fini();
146 		return 0;
147 	case MODULE_CMD_AUTOUNLOAD:
148 		if (netexport_hasexports())
149 			return EBUSY;
150 		/*FALLTHROUGH*/
151 	default:
152 		return ENOTTY;
153 	}
154 }
155 
156 /*
157  * nfs v3 access service
158  */
159 int
160 nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
161 {
162 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
163 	struct mbuf *nam = nfsd->nd_nam;
164 	char *dpos = nfsd->nd_dpos;
165 	kauth_cred_t cred = nfsd->nd_cr;
166 	struct vnode *vp;
167 	nfsrvfh_t nsfh;
168 	u_int32_t *tl;
169 	int32_t t1;
170 	char *bpos;
171 	int error = 0, rdonly, cache = 0, getret;
172 	char *cp2;
173 	struct mbuf *mb, *mreq __unused;
174 	struct vattr va;
175 	u_long inmode, testmode, outmode;
176 	u_quad_t frev;
177 
178 	nfsm_srvmtofh(&nsfh);
179 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
180 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
181 	    (nfsd->nd_flag & ND_KERBAUTH), false);
182 	if (error) {
183 		nfsm_reply(NFSX_UNSIGNED);
184 		nfsm_srvpostop_attr(1, (struct vattr *)0);
185 		return (0);
186 	}
187 	inmode = fxdr_unsigned(u_int32_t, *tl);
188 	outmode = 0;
189 	if ((inmode & NFSV3ACCESS_READ) &&
190 	    nfsrv_access(vp, VREAD, cred, rdonly, lwp, 0) == 0)
191 		outmode |= NFSV3ACCESS_READ;
192 	if (vp->v_type != VDIR) {
193 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
194 		if (testmode &&
195 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
196 			outmode |= testmode;
197 		if ((inmode & NFSV3ACCESS_EXECUTE) &&
198 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
199 			outmode |= NFSV3ACCESS_EXECUTE;
200 	} else {
201 		testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
202 		    NFSV3ACCESS_DELETE);
203 		if (testmode &&
204 		    nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
205 			outmode |= testmode;
206 		if ((inmode & NFSV3ACCESS_LOOKUP) &&
207 		    nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
208 			outmode |= NFSV3ACCESS_LOOKUP;
209 	}
210 	getret = VOP_GETATTR(vp, &va, cred);
211 	vput(vp);
212 	nfsm_reply(NFSX_POSTOPATTR(1) + NFSX_UNSIGNED);
213 	nfsm_srvpostop_attr(getret, &va);
214 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
215 	*tl = txdr_unsigned(outmode);
216 	nfsm_srvdone;
217 }
218 
219 /*
220  * nfs getattr service
221  */
222 int
223 nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
224 {
225 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
226 	struct mbuf *nam = nfsd->nd_nam;
227 	char *dpos = nfsd->nd_dpos;
228 	kauth_cred_t cred = nfsd->nd_cr;
229 	struct nfs_fattr *fp;
230 	struct vattr va;
231 	struct vnode *vp;
232 	nfsrvfh_t nsfh;
233 	u_int32_t *tl;
234 	int32_t t1;
235 	char *bpos;
236 	int error = 0, rdonly, cache = 0;
237 	char *cp2;
238 	struct mbuf *mb, *mreq __unused;
239 	u_quad_t frev;
240 
241 	nfsm_srvmtofh(&nsfh);
242 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
243 	    (nfsd->nd_flag & ND_KERBAUTH), false);
244 	if (error) {
245 		nfsm_reply(0);
246 		return (0);
247 	}
248 	nqsrv_getl(vp, ND_READ);
249 	error = VOP_GETATTR(vp, &va, cred);
250 	vput(vp);
251 	nfsm_reply(NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
252 	if (error)
253 		return (0);
254 	nfsm_build(fp, struct nfs_fattr *, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
255 	nfsm_srvfillattr(&va, fp);
256 	nfsm_srvdone;
257 }
258 
259 /*
260  * nfs setattr service
261  */
262 int
263 nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
264 {
265 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
266 	struct mbuf *nam = nfsd->nd_nam;
267 	char *dpos = nfsd->nd_dpos;
268 	kauth_cred_t cred = nfsd->nd_cr;
269 	struct vattr va, preat;
270 	struct nfsv2_sattr *sp;
271 	struct nfs_fattr *fp;
272 	struct vnode *vp;
273 	nfsrvfh_t nsfh;
274 	u_int32_t *tl;
275 	int32_t t1;
276 	char *bpos;
277 	int error = 0, rdonly, cache = 0, preat_ret = 1, postat_ret = 1;
278 	int v3 = (nfsd->nd_flag & ND_NFSV3), gcheck = 0;
279 	char *cp2;
280 	struct mbuf *mb, *mreq __unused;
281 	u_quad_t frev;
282 	struct timespec guard;
283 
284 	memset(&guard, 0, sizeof guard);	/* XXX gcc */
285 
286 	nfsm_srvmtofh(&nsfh);
287 	vattr_null(&va);
288 	if (v3) {
289 		nfsm_srvsattr(&va);
290 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
291 		gcheck = fxdr_unsigned(int, *tl);
292 		if (gcheck) {
293 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
294 			fxdr_nfsv3time(tl, &guard);
295 		}
296 	} else {
297 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
298 		/*
299 		 * Nah nah nah nah na nah
300 		 * There is a bug in the Sun client that puts 0xffff in the mode
301 		 * field of sattr when it should put in 0xffffffff. The u_short
302 		 * doesn't sign extend.
303 		 * --> check the low order 2 bytes for 0xffff
304 		 */
305 		if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
306 			va.va_mode = nfstov_mode(sp->sa_mode);
307 		if (sp->sa_uid != nfs_xdrneg1)
308 			va.va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
309 		if (sp->sa_gid != nfs_xdrneg1)
310 			va.va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
311 		if (sp->sa_size != nfs_xdrneg1)
312 			va.va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
313 		if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
314 #ifdef notyet
315 			fxdr_nfsv2time(&sp->sa_atime, &va.va_atime);
316 #else
317 			va.va_atime.tv_sec =
318 				fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
319 			va.va_atime.tv_nsec = 0;
320 #endif
321 		}
322 		if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
323 			fxdr_nfsv2time(&sp->sa_mtime, &va.va_mtime);
324 
325 	}
326 
327 	/*
328 	 * Now that we have all the fields, lets do it.
329 	 */
330 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
331 	    (nfsd->nd_flag & ND_KERBAUTH), false);
332 	if (error) {
333 		nfsm_reply(2 * NFSX_UNSIGNED);
334 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
335 		return (0);
336 	}
337 	nqsrv_getl(vp, ND_WRITE);
338 	if (v3) {
339 		error = preat_ret = VOP_GETATTR(vp, &preat, cred);
340 		if (!error && gcheck &&
341 			(preat.va_ctime.tv_sec != guard.tv_sec ||
342 			 preat.va_ctime.tv_nsec != guard.tv_nsec))
343 			error = NFSERR_NOT_SYNC;
344 		if (error) {
345 			vput(vp);
346 			nfsm_reply(NFSX_WCCDATA(v3));
347 			nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
348 			return (0);
349 		}
350 	}
351 
352 	/*
353 	 * If the size is being changed write acces is required, otherwise
354 	 * just check for a read only file system.
355 	 */
356 	if (va.va_size == ((u_quad_t)((quad_t) -1))) {
357 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
358 			error = EROFS;
359 			goto out;
360 		}
361 	} else {
362 		if (vp->v_type == VDIR) {
363 			error = EISDIR;
364 			goto out;
365 		} else if ((error = nfsrv_access(vp, VWRITE, cred, rdonly,
366 			lwp, 0)) != 0)
367 			goto out;
368 	}
369 	error = VOP_SETATTR(vp, &va, cred);
370 	postat_ret = VOP_GETATTR(vp, &va, cred);
371 	if (!error)
372 		error = postat_ret;
373 out:
374 	vput(vp);
375 	nfsm_reply(NFSX_WCCORFATTR(v3));
376 	if (v3) {
377 		nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
378 		return (0);
379 	} else {
380 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
381 		nfsm_srvfillattr(&va, fp);
382 	}
383 	nfsm_srvdone;
384 }
385 
386 /*
387  * nfs lookup rpc
388  */
389 int
390 nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
391 {
392 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
393 	struct mbuf *nam = nfsd->nd_nam;
394 	char *dpos = nfsd->nd_dpos;
395 	kauth_cred_t cred = nfsd->nd_cr;
396 	struct nfs_fattr *fp;
397 	struct nameidata nd, ind, *ndp = &nd;
398 	struct pathbuf *ipb = NULL;
399 	struct vnode *vp, *dirp;
400 	nfsrvfh_t nsfh;
401 	char *cp;
402 	u_int32_t *tl;
403 	int32_t t1;
404 	char *bpos;
405 	int error = 0, cache = 0, dirattr_ret = 1;
406 	uint32_t len;
407 	int v3 = (nfsd->nd_flag & ND_NFSV3), pubflag;
408 	char *cp2;
409 	struct mbuf *mb, *mreq __unused;
410 	struct vattr va, dirattr;
411 	u_quad_t frev;
412 
413 	nfsm_srvmtofh(&nsfh);
414 	nfsm_srvnamesiz(len);
415 
416 	pubflag = nfs_ispublicfh(&nsfh);
417 
418 	nd.ni_cnd.cn_cred = cred;
419 	nd.ni_cnd.cn_nameiop = LOOKUP;
420 	nd.ni_cnd.cn_flags = LOCKLEAF;
421 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
422 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), pubflag);
423 
424 	if (!error && pubflag) {
425 		if (nd.ni_vp->v_type == VDIR && nfs_pub.np_index != NULL &&
426 		    (ipb = pathbuf_create(nfs_pub.np_index)) != NULL) {
427 			/*
428 			 * Setup call to lookup() to see if we can find
429 			 * the index file. Arguably, this doesn't belong
430 			 * in a kernel.. Ugh.
431 			 */
432 			ind = nd;
433 			VOP_UNLOCK(nd.ni_vp);
434 			ind.ni_pathbuf = ipb;
435 
436 			error = lookup_for_nfsd_index(&ind, nd.ni_vp);
437 			if (!error) {
438 				/*
439 				 * Found an index file. Get rid of
440 				 * the old references.
441 				 */
442 				if (dirp)
443 					vrele(dirp);
444 				dirp = nd.ni_vp;
445 				ndp = &ind;
446 			} else
447 				error = 0;
448 		}
449 		/*
450 		 * If the public filehandle was used, check that this lookup
451 		 * didn't result in a filehandle outside the publicly exported
452 		 * filesystem.
453 		 */
454 
455 		if (!error && ndp->ni_vp->v_mount != nfs_pub.np_mount) {
456 			vput(nd.ni_vp);
457 			error = EPERM;
458 		}
459 	}
460 
461 	if (error) {
462 		if (nd.ni_pathbuf != NULL) {
463 			pathbuf_destroy(nd.ni_pathbuf);
464 		}
465 		if (ipb != NULL) {
466 			pathbuf_destroy(ipb);
467 		}
468 		if (dirp) {
469 			if (v3) {
470 				vn_lock(dirp, LK_SHARED | LK_RETRY);
471 				dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred);
472 				vput(dirp);
473 			} else
474 				vrele(dirp);
475 		}
476 		nfsm_reply(NFSX_POSTOPATTR(v3));
477 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
478 		return (0);
479 	}
480 
481 	nqsrv_getl(ndp->ni_startdir, ND_READ);
482 	pathbuf_destroy(nd.ni_pathbuf);
483 	if (ipb != NULL) {
484 		pathbuf_destroy(ipb);
485 	}
486 	vp = ndp->ni_vp;
487 	error = nfsrv_composefh(vp, &nsfh, v3);
488 	if (!error)
489 		error = VOP_GETATTR(vp, &va, cred);
490 	vput(vp);
491 	if (dirp) {
492 		if (v3) {
493 			vn_lock(dirp, LK_SHARED | LK_RETRY);
494 			dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred);
495 			vput(dirp);
496 		} else
497 			vrele(dirp);
498 	}
499 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPORFATTR(v3) +
500 	    NFSX_POSTOPATTR(v3));
501 	if (error) {
502 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
503 		return (0);
504 	}
505 	nfsm_srvfhtom(&nsfh, v3);
506 	if (v3) {
507 		nfsm_srvpostop_attr(0, &va);
508 		nfsm_srvpostop_attr(dirattr_ret, &dirattr);
509 	} else {
510 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
511 		nfsm_srvfillattr(&va, fp);
512 	}
513 	nfsm_srvdone;
514 }
515 
516 /*
517  * nfs readlink service
518  */
519 int
520 nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
521 {
522 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
523 	struct mbuf *nam = nfsd->nd_nam;
524 	char *dpos = nfsd->nd_dpos;
525 	kauth_cred_t cred = nfsd->nd_cr;
526 	struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
527 	struct iovec *ivp = iv;
528 	struct mbuf *mp;
529 	u_int32_t *tl;
530 	int32_t t1;
531 	char *bpos;
532 	int error = 0, rdonly, cache = 0, i, padlen, getret;
533 	uint32_t len;
534 	int v3 = (nfsd->nd_flag & ND_NFSV3);
535 	char *cp2;
536 	struct mbuf *mb, *mp2 = NULL, *mp3 = NULL, *mreq __unused;
537 	struct vnode *vp;
538 	struct vattr attr;
539 	nfsrvfh_t nsfh;
540 	struct uio io, *uiop = &io;
541 	u_quad_t frev;
542 
543 	nfsm_srvmtofh(&nsfh);
544 	len = 0;
545 	i = 0;
546 	while (len < NFS_MAXPATHLEN) {
547 		mp = m_get(M_WAIT, MT_DATA);
548 		MCLAIM(mp, &nfs_mowner);
549 		m_clget(mp, M_WAIT);
550 		mp->m_len = NFSMSIZ(mp);
551 		if (len == 0)
552 			mp3 = mp2 = mp;
553 		else {
554 			mp2->m_next = mp;
555 			mp2 = mp;
556 		}
557 		if ((len+mp->m_len) > NFS_MAXPATHLEN) {
558 			mp->m_len = NFS_MAXPATHLEN-len;
559 			len = NFS_MAXPATHLEN;
560 		} else
561 			len += mp->m_len;
562 		ivp->iov_base = mtod(mp, void *);
563 		ivp->iov_len = mp->m_len;
564 		i++;
565 		ivp++;
566 	}
567 	uiop->uio_iov = iv;
568 	uiop->uio_iovcnt = i;
569 	uiop->uio_offset = 0;
570 	uiop->uio_resid = len;
571 	uiop->uio_rw = UIO_READ;
572 	UIO_SETUP_SYSSPACE(uiop);
573 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
574 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
575 	if (error) {
576 		m_freem(mp3);
577 		nfsm_reply(2 * NFSX_UNSIGNED);
578 		nfsm_srvpostop_attr(1, (struct vattr *)0);
579 		return (0);
580 	}
581 	if (vp->v_type != VLNK) {
582 		if (v3)
583 			error = EINVAL;
584 		else
585 			error = ENXIO;
586 		goto out;
587 	}
588 	nqsrv_getl(vp, ND_READ);
589 	error = VOP_READLINK(vp, uiop, cred);
590 out:
591 	getret = VOP_GETATTR(vp, &attr, cred);
592 	vput(vp);
593 	if (error)
594 		m_freem(mp3);
595 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_UNSIGNED);
596 	if (v3) {
597 		nfsm_srvpostop_attr(getret, &attr);
598 		if (error)
599 			return (0);
600 	}
601 	len -= uiop->uio_resid;
602 	padlen = nfsm_padlen(len);
603 	if (len == 0) {
604 		m_freem(mp3);
605 		mp3 = NULL;
606 	} else if (uiop->uio_resid || padlen)
607 		nfs_zeropad(mp3, uiop->uio_resid, padlen);
608 	nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
609 	*tl = txdr_unsigned(len);
610 	mb->m_next = mp3;
611 	nfsm_srvdone;
612 }
613 
614 /*
615  * nfs read service
616  */
617 int
618 nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
619 {
620 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
621 	struct mbuf *nam = nfsd->nd_nam;
622 	char *dpos = nfsd->nd_dpos;
623 	kauth_cred_t cred = nfsd->nd_cr;
624 	struct mbuf *m;
625 	struct nfs_fattr *fp;
626 	u_int32_t *tl;
627 	int32_t t1;
628 	int i;
629 	char *bpos;
630 	int error = 0, rdonly, cache = 0, getret;
631 	int v3 = (nfsd->nd_flag & ND_NFSV3);
632 	uint32_t reqlen, len, cnt, left;
633 	int padlen;
634 	char *cp2;
635 	struct mbuf *mb, *mreq;
636 	struct vnode *vp;
637 	nfsrvfh_t nsfh;
638 	struct uio io, *uiop = &io;
639 	struct vattr va;
640 	off_t off;
641 	u_quad_t frev;
642 
643 	nfsm_srvmtofh(&nsfh);
644 	if (v3) {
645 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
646 		off = fxdr_hyper(tl);
647 	} else {
648 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
649 		off = (off_t)fxdr_unsigned(u_int32_t, *tl);
650 	}
651 	nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
652 	reqlen = fxdr_unsigned(uint32_t, *tl);
653 	reqlen = MIN(reqlen, NFS_SRVMAXDATA(nfsd));
654 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
655 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
656 	if (error) {
657 		nfsm_reply(2 * NFSX_UNSIGNED);
658 		nfsm_srvpostop_attr(1, (struct vattr *)0);
659 		return (0);
660 	}
661 	if (vp->v_type != VREG) {
662 		if (v3)
663 			error = EINVAL;
664 		else
665 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
666 	}
667 	if (!error) {
668 	    nqsrv_getl(vp, ND_READ);
669 	    if ((error = nfsrv_access(vp, VREAD, cred, rdonly, lwp, 1)) != 0)
670 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 1);
671 	}
672 	getret = VOP_GETATTR(vp, &va, cred);
673 	if (!error)
674 		error = getret;
675 	if (error) {
676 		vput(vp);
677 		nfsm_reply(NFSX_POSTOPATTR(v3));
678 		nfsm_srvpostop_attr(getret, &va);
679 		return (0);
680 	}
681 	if (off >= va.va_size)
682 		cnt = 0;
683 	else if ((off + reqlen) > va.va_size)
684 		cnt = va.va_size - off;
685 	else
686 		cnt = reqlen;
687 	nfsm_reply(NFSX_POSTOPORFATTR(v3) + 3 * NFSX_UNSIGNED+nfsm_rndup(cnt));
688 	if (v3) {
689 		nfsm_build(tl, u_int32_t *, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
690 		*tl++ = nfs_true;
691 		fp = (struct nfs_fattr *)tl;
692 		tl += (NFSX_V3FATTR / sizeof (u_int32_t));
693 	} else {
694 		nfsm_build(tl, u_int32_t *, NFSX_V2FATTR + NFSX_UNSIGNED);
695 		fp = (struct nfs_fattr *)tl;
696 		tl += (NFSX_V2FATTR / sizeof (u_int32_t));
697 	}
698 	len = left = cnt;
699 	if (cnt > 0) {
700 		if (nfsd_use_loan) {
701 			struct vm_page **pgpp;
702 			voff_t pgoff = trunc_page(off);
703 			int npages;
704 			vaddr_t lva;
705 
706 			npages = (round_page(off + cnt) - pgoff) >> PAGE_SHIFT;
707 			KASSERT(npages <= M_EXT_MAXPAGES); /* XXX */
708 
709 			/* allocate kva for mbuf data */
710 			lva = sokvaalloc(pgoff, npages << PAGE_SHIFT,
711 			    slp->ns_so);
712 			if (lva == 0) {
713 				/* fall back to VOP_READ */
714 				goto loan_fail;
715 			}
716 
717 			/* allocate mbuf */
718 			m = m_get(M_WAIT, MT_DATA);
719 			MCLAIM(m, &nfs_mowner);
720 			pgpp = m->m_ext.ext_pgs;
721 
722 			/* loan pages */
723 			error = uvm_loanuobjpages(&vp->v_uobj, pgoff, npages,
724 			    pgpp);
725 			if (error) {
726 				sokvafree(lva, npages << PAGE_SHIFT);
727 				m_free(m);
728 				if (error == EBUSY)
729 					goto loan_fail;
730 				goto read_error;
731 			}
732 
733 			/* associate kva to mbuf */
734 			MEXTADD(m, (void *)(lva + ((vaddr_t)off & PAGE_MASK)),
735 			    cnt, M_MBUF, soloanfree, slp->ns_so);
736 			m->m_flags |= M_EXT_PAGES | M_EXT_ROMAP;
737 			m->m_len = cnt;
738 
739 			/* map pages */
740 			for (i = 0; i < npages; i++) {
741 				pmap_kenter_pa(lva, VM_PAGE_TO_PHYS(pgpp[i]),
742 				    VM_PROT_READ, 0);
743 				lva += PAGE_SIZE;
744 			}
745 
746 			pmap_update(pmap_kernel());
747 
748 			mb->m_next = m;
749 			mb = m;
750 			error = 0;
751 			uiop->uio_resid = 0;
752 		} else {
753 			struct iovec *iv;
754 			struct iovec *iv2;
755 			struct mbuf *m2;
756 			int siz;
757 loan_fail:
758 			/*
759 			 * Generate the mbuf list with the uio_iov ref. to it.
760 			 */
761 			i = 0;
762 			m = m2 = mb;
763 			while (left > 0) {
764 				siz = min(M_TRAILINGSPACE(m), left);
765 				if (siz > 0) {
766 					left -= siz;
767 					i++;
768 				}
769 				if (left > 0) {
770 					m = m_get(M_WAIT, MT_DATA);
771 					MCLAIM(m, &nfs_mowner);
772 					m_clget(m, M_WAIT);
773 					m->m_len = 0;
774 					m2->m_next = m;
775 					m2 = m;
776 				}
777 			}
778 			iv = malloc(i * sizeof(struct iovec), M_TEMP, M_WAITOK);
779 			uiop->uio_iov = iv2 = iv;
780 			m = mb;
781 			left = cnt;
782 			i = 0;
783 			while (left > 0) {
784 				if (m == NULL)
785 					panic("nfsrv_read iov");
786 				siz = min(M_TRAILINGSPACE(m), left);
787 				if (siz > 0) {
788 					iv->iov_base = mtod(m, char *) +
789 					    m->m_len;
790 					iv->iov_len = siz;
791 					m->m_len += siz;
792 					left -= siz;
793 					iv++;
794 					i++;
795 				}
796 				m = m->m_next;
797 			}
798 			uiop->uio_iovcnt = i;
799 			uiop->uio_offset = off;
800 			uiop->uio_resid = cnt;
801 			uiop->uio_rw = UIO_READ;
802 			UIO_SETUP_SYSSPACE(uiop);
803 			error = VOP_READ(vp, uiop, IO_NODELOCKED, cred);
804 			free((void *)iv2, M_TEMP);
805 		}
806 read_error:
807 		if (error || (getret = VOP_GETATTR(vp, &va, cred)) != 0){
808 			if (!error)
809 				error = getret;
810 			m_freem(mreq);
811 			vput(vp);
812 			nfsm_reply(NFSX_POSTOPATTR(v3));
813 			nfsm_srvpostop_attr(getret, &va);
814 			return (0);
815 		}
816 	} else {
817 		uiop->uio_resid = 0;
818 	}
819 	vput(vp);
820 	nfsm_srvfillattr(&va, fp);
821 	len -= uiop->uio_resid;
822 	padlen = nfsm_padlen(len);
823 	if (uiop->uio_resid || padlen)
824 		nfs_zeropad(mb, uiop->uio_resid, padlen);
825 	if (v3) {
826 		/* count */
827 		*tl++ = txdr_unsigned(len);
828 		/* eof */
829 		if (off + len >= va.va_size)
830 			*tl++ = nfs_true;
831 		else
832 			*tl++ = nfs_false;
833 	}
834 	*tl = txdr_unsigned(len);
835 	nfsm_srvdone;
836 }
837 
838 /*
839  * nfs write service
840  */
841 int
842 nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
843 {
844 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
845 	struct mbuf *nam = nfsd->nd_nam;
846 	char *dpos = nfsd->nd_dpos;
847 	kauth_cred_t cred = nfsd->nd_cr;
848 	struct iovec *ivp;
849 	int i, cnt;
850 	struct mbuf *mp;
851 	struct nfs_fattr *fp;
852 	struct iovec *iv;
853 	struct vattr va, forat;
854 	u_int32_t *tl;
855 	int32_t t1;
856 	char *bpos;
857 	int error = 0, rdonly, cache = 0, len, forat_ret = 1;
858 	int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
859 	int stable = NFSV3WRITE_FILESYNC;
860 	int v3 = (nfsd->nd_flag & ND_NFSV3);
861 	char *cp2;
862 	struct mbuf *mb, *mreq __unused;
863 	struct vnode *vp;
864 	nfsrvfh_t nsfh;
865 	struct uio io, *uiop = &io;
866 	off_t off;
867 	u_quad_t frev;
868 
869 	if (mrep == NULL) {
870 		*mrq = NULL;
871 		return (0);
872 	}
873 	nfsm_srvmtofh(&nsfh);
874 	if (v3) {
875 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
876 		off = fxdr_hyper(tl);
877 		tl += 3;
878 		stable = fxdr_unsigned(int, *tl++);
879 	} else {
880 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
881 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
882 		tl += 2;
883 	}
884 	retlen = len = fxdr_unsigned(int32_t, *tl);
885 	cnt = i = 0;
886 
887 	/*
888 	 * For NFS Version 2, it is not obvious what a write of zero length
889 	 * should do, but I might as well be consistent with Version 3,
890 	 * which is to return ok so long as there are no permission problems.
891 	 */
892 	if (len > 0) {
893 		zeroing = 1;
894 		mp = mrep;
895 		while (mp) {
896 			if (mp == md) {
897 				zeroing = 0;
898 				adjust = dpos - mtod(mp, char *);
899 				mp->m_len -= adjust;
900 				if (mp->m_len > 0 && adjust > 0)
901 					NFSMADV(mp, adjust);
902 			}
903 			if (zeroing)
904 				mp->m_len = 0;
905 			else if (mp->m_len > 0) {
906 				i += mp->m_len;
907 				if (i > len) {
908 					mp->m_len -= (i - len);
909 					zeroing	= 1;
910 				}
911 				if (mp->m_len > 0)
912 					cnt++;
913 			}
914 			mp = mp->m_next;
915 		}
916 	}
917 	if (len > NFS_MAXDATA || len < 0 || i < len) {
918 		error = EIO;
919 		nfsm_reply(2 * NFSX_UNSIGNED);
920 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
921 		return (0);
922 	}
923 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
924 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
925 	if (error) {
926 		nfsm_reply(2 * NFSX_UNSIGNED);
927 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
928 		return (0);
929 	}
930 	if (v3)
931 		forat_ret = VOP_GETATTR(vp, &forat, cred);
932 	if (vp->v_type != VREG) {
933 		if (v3)
934 			error = EINVAL;
935 		else
936 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
937 	}
938 	if (!error) {
939 		nqsrv_getl(vp, ND_WRITE);
940 		error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
941 	}
942 	if (error) {
943 		vput(vp);
944 		nfsm_reply(NFSX_WCCDATA(v3));
945 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
946 		return (0);
947 	}
948 
949 	if (len > 0) {
950 		ivp = malloc(cnt * sizeof (struct iovec), M_TEMP, M_WAITOK);
951 		uiop->uio_iov = iv = ivp;
952 		uiop->uio_iovcnt = cnt;
953 		mp = mrep;
954 		while (mp) {
955 			if (mp->m_len > 0) {
956 				ivp->iov_base = mtod(mp, void *);
957 				ivp->iov_len = mp->m_len;
958 				ivp++;
959 			}
960 			mp = mp->m_next;
961 		}
962 
963 		/*
964 		 * XXX
965 		 * The IO_METASYNC flag indicates that all metadata (and not
966 		 * just enough to ensure data integrity) must be written to
967 		 * stable storage synchronously.
968 		 * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
969 		 */
970 		if (stable == NFSV3WRITE_UNSTABLE)
971 			ioflags = IO_NODELOCKED;
972 		else if (stable == NFSV3WRITE_DATASYNC)
973 			ioflags = (IO_SYNC | IO_NODELOCKED);
974 		else
975 			ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
976 		uiop->uio_resid = len;
977 		uiop->uio_rw = UIO_WRITE;
978 		uiop->uio_offset = off;
979 		UIO_SETUP_SYSSPACE(uiop);
980 		error = VOP_WRITE(vp, uiop, ioflags, cred);
981 		nfsstats.srvvop_writes++;
982 		free(iv, M_TEMP);
983 	}
984 	aftat_ret = VOP_GETATTR(vp, &va, cred);
985 	vput(vp);
986 	if (!error)
987 		error = aftat_ret;
988 	nfsm_reply(NFSX_PREOPATTR(v3) + NFSX_POSTOPORFATTR(v3) +
989 		2 * NFSX_UNSIGNED + NFSX_WRITEVERF(v3));
990 	if (v3) {
991 		nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
992 		if (error)
993 			return (0);
994 		nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
995 		*tl++ = txdr_unsigned(retlen);
996 		if (stable == NFSV3WRITE_UNSTABLE)
997 			*tl++ = txdr_unsigned(stable);
998 		else
999 			*tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
1000 		/*
1001 		 * Actually, there is no need to txdr these fields,
1002 		 * but it may make the values more human readable,
1003 		 * for debugging purposes.
1004 		 */
1005 		*tl++ = txdr_unsigned(boottime.tv_sec);
1006 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
1007 	} else {
1008 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1009 		nfsm_srvfillattr(&va, fp);
1010 	}
1011 	nfsm_srvdone;
1012 }
1013 
1014 /*
1015  * XXX elad: the original NFSW_SAMECRED() macro also made sure the
1016  *	     two nd_flag fields of the descriptors contained
1017  *	     ND_KERBAUTH.
1018  */
1019 static int
1020 nfsrv_samecred(kauth_cred_t cred1, kauth_cred_t cred2)
1021 {
1022 	int i, do_ngroups;
1023 
1024 	if (kauth_cred_geteuid(cred1) != kauth_cred_geteuid(cred2))
1025 		return (0);
1026 	if (kauth_cred_ngroups(cred1) != kauth_cred_ngroups(cred2))
1027 		return (0);
1028 	do_ngroups = kauth_cred_ngroups(cred1);
1029 	for (i = 0; i < do_ngroups; i++)
1030 		if (kauth_cred_group(cred1, i) !=
1031 		    kauth_cred_group(cred2, i))
1032 			return (0);
1033 
1034 	return (1);
1035 }
1036 
1037 static struct nfsrvw_delayhash *
1038 nfsrv_nwdelayhash(struct nfssvc_sock *slp, const nfsrvfh_t *nsfh)
1039 {
1040 	uint32_t hash;
1041 
1042 	hash = hash32_buf(NFSRVFH_DATA(nsfh), NFSRVFH_SIZE(nsfh),
1043 	    HASH32_BUF_INIT);
1044 	return &slp->ns_wdelayhashtbl[hash % NFS_WDELAYHASHSIZ];
1045 }
1046 
1047 /*
1048  * NFS write service with write gathering support. Called when
1049  * nfsrvw_procrastinate > 0.
1050  * See: Chet Juszczak, "Improving the Write Performance of an NFS Server",
1051  * in Proc. of the Winter 1994 Usenix Conference, pg. 247-259, San Franscisco,
1052  * Jan. 1994.
1053  */
1054 int
1055 nfsrv_writegather(struct nfsrv_descript **ndp, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1056 {
1057 	struct timeval now;
1058 	struct iovec *ivp;
1059 	struct mbuf *mp;
1060 	struct nfsrv_descript *wp, *nfsd, *owp, *swp;
1061 	struct nfs_fattr *fp;
1062 	int i = 0;
1063 	struct iovec *iov;
1064 	struct nfsrvw_delayhash *wpp;
1065 	kauth_cred_t cred;
1066 	struct vattr va, forat;
1067 	u_int32_t *tl;
1068 	int32_t t1;
1069 	char *bpos, *dpos;
1070 	int error = 0, rdonly, cache = 0, len = 0, forat_ret = 1;
1071 	int ioflags, aftat_ret = 1, adjust, v3, zeroing;
1072 	char *cp2;
1073 	struct mbuf *mb, *mreq, *mrep, *md;
1074 	struct vnode *vp;
1075 	struct uio io, *uiop = &io;
1076 	u_quad_t frev, cur_usec;
1077 
1078 	*mrq = NULL;
1079 	if (*ndp) {
1080 	    nfsd = *ndp;
1081 	    *ndp = NULL;
1082 	    mrep = nfsd->nd_mrep;
1083 	    md = nfsd->nd_md;
1084 	    dpos = nfsd->nd_dpos;
1085 	    cred = nfsd->nd_cr;
1086 	    v3 = (nfsd->nd_flag & ND_NFSV3);
1087 	    LIST_INIT(&nfsd->nd_coalesce);
1088 	    nfsd->nd_mreq = NULL;
1089 	    nfsd->nd_stable = NFSV3WRITE_FILESYNC;
1090 	    getmicrotime(&now);
1091 	    cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1092 	    nfsd->nd_time = cur_usec + nfsrvw_procrastinate;
1093 
1094 	    /*
1095 	     * Now, get the write header..
1096 	     */
1097 	    nfsm_srvmtofh(&nfsd->nd_fh);
1098 	    if (v3) {
1099 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1100 		nfsd->nd_off = fxdr_hyper(tl);
1101 		tl += 3;
1102 		nfsd->nd_stable = fxdr_unsigned(int, *tl++);
1103 	    } else {
1104 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1105 		nfsd->nd_off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1106 		tl += 2;
1107 	    }
1108 	    len = fxdr_unsigned(int32_t, *tl);
1109 	    nfsd->nd_len = len;
1110 	    nfsd->nd_eoff = nfsd->nd_off + len;
1111 
1112 	    /*
1113 	     * Trim the header out of the mbuf list and trim off any trailing
1114 	     * junk so that the mbuf list has only the write data.
1115 	     */
1116 	    zeroing = 1;
1117 	    i = 0;
1118 	    mp = mrep;
1119 	    while (mp) {
1120 		if (mp == md) {
1121 		    zeroing = 0;
1122 		    adjust = dpos - mtod(mp, char *);
1123 		    mp->m_len -= adjust;
1124 		    if (mp->m_len > 0 && adjust > 0)
1125 			NFSMADV(mp, adjust);
1126 		}
1127 		if (zeroing)
1128 		    mp->m_len = 0;
1129 		else {
1130 		    i += mp->m_len;
1131 		    if (i > len) {
1132 			mp->m_len -= (i - len);
1133 			zeroing = 1;
1134 		    }
1135 		}
1136 		mp = mp->m_next;
1137 	    }
1138 	    if (len > NFS_MAXDATA || len < 0  || i < len) {
1139 nfsmout:
1140 		m_freem(mrep);
1141 		error = EIO;
1142 		nfsm_writereply(2 * NFSX_UNSIGNED, v3);
1143 		if (v3)
1144 		    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1145 		nfsd->nd_mreq = mreq;
1146 		nfsd->nd_mrep = NULL;
1147 		nfsd->nd_time = 0;
1148 	    }
1149 
1150 	    /*
1151 	     * Add this entry to the hash and time queues.
1152 	     */
1153 	    owp = NULL;
1154 	    mutex_enter(&nfsd_lock);
1155 	    wp = LIST_FIRST(&slp->ns_tq);
1156 	    while (wp && wp->nd_time < nfsd->nd_time) {
1157 		owp = wp;
1158 		wp = LIST_NEXT(wp, nd_tq);
1159 	    }
1160 	    if (owp) {
1161 		LIST_INSERT_AFTER(owp, nfsd, nd_tq);
1162 	    } else {
1163 		LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1164 	    }
1165 	    if (nfsd->nd_mrep) {
1166 		wpp = nfsrv_nwdelayhash(slp, &nfsd->nd_fh);
1167 		owp = NULL;
1168 		wp = LIST_FIRST(wpp);
1169 		while (wp && nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1170 		    owp = wp;
1171 		    wp = LIST_NEXT(wp, nd_hash);
1172 		}
1173 		while (wp && wp->nd_off < nfsd->nd_off &&
1174 		    !nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1175 		    owp = wp;
1176 		    wp = LIST_NEXT(wp, nd_hash);
1177 		}
1178 		if (owp) {
1179 		    LIST_INSERT_AFTER(owp, nfsd, nd_hash);
1180 
1181 		    /*
1182 		     * Search the hash list for overlapping entries and
1183 		     * coalesce.
1184 		     */
1185 		    for(; nfsd && NFSW_CONTIG(owp, nfsd); nfsd = wp) {
1186 			wp = LIST_NEXT(nfsd, nd_hash);
1187 			if (nfsrv_samecred(owp->nd_cr, nfsd->nd_cr))
1188 			    nfsrvw_coalesce(owp, nfsd);
1189 		    }
1190 		} else {
1191 		    LIST_INSERT_HEAD(wpp, nfsd, nd_hash);
1192 		}
1193 	    }
1194 	    mutex_exit(&nfsd_lock);
1195 	}
1196 
1197 	/*
1198 	 * Now, do VOP_WRITE()s for any one(s) that need to be done now
1199 	 * and generate the associated reply mbuf list(s).
1200 	 */
1201 loop1:
1202 	getmicrotime(&now);
1203 	cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1204 	mutex_enter(&nfsd_lock);
1205 	for (nfsd = LIST_FIRST(&slp->ns_tq); nfsd; nfsd = owp) {
1206 		owp = LIST_NEXT(nfsd, nd_tq);
1207 		if (nfsd->nd_time > cur_usec)
1208 		    break;
1209 		if (nfsd->nd_mreq)
1210 		    continue;
1211 		LIST_REMOVE(nfsd, nd_tq);
1212 		LIST_REMOVE(nfsd, nd_hash);
1213 		mutex_exit(&nfsd_lock);
1214 
1215 		mrep = nfsd->nd_mrep;
1216 		nfsd->nd_mrep = NULL;
1217 		cred = nfsd->nd_cr;
1218 		v3 = (nfsd->nd_flag & ND_NFSV3);
1219 		forat_ret = aftat_ret = 1;
1220 		error = nfsrv_fhtovp(&nfsd->nd_fh, 1, &vp, cred, slp,
1221 		    nfsd->nd_nam, &rdonly, (nfsd->nd_flag & ND_KERBAUTH),
1222 		    false);
1223 		if (!error) {
1224 		    if (v3)
1225 			forat_ret = VOP_GETATTR(vp, &forat, cred);
1226 		    if (vp->v_type != VREG) {
1227 			if (v3)
1228 			    error = EINVAL;
1229 			else
1230 			    error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1231 		    }
1232 		} else
1233 		    vp = NULL;
1234 		if (!error) {
1235 		    nqsrv_getl(vp, ND_WRITE);
1236 		    error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
1237 		}
1238 
1239 		if (nfsd->nd_stable == NFSV3WRITE_UNSTABLE)
1240 		    ioflags = IO_NODELOCKED;
1241 		else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC)
1242 		    ioflags = (IO_SYNC | IO_NODELOCKED);
1243 		else
1244 		    ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1245 		uiop->uio_rw = UIO_WRITE;
1246 		uiop->uio_offset = nfsd->nd_off;
1247 		uiop->uio_resid = nfsd->nd_eoff - nfsd->nd_off;
1248 		UIO_SETUP_SYSSPACE(uiop);
1249 		if (uiop->uio_resid > 0) {
1250 		    mp = mrep;
1251 		    i = 0;
1252 		    while (mp) {
1253 			if (mp->m_len > 0)
1254 			    i++;
1255 			mp = mp->m_next;
1256 		    }
1257 		    uiop->uio_iovcnt = i;
1258 		    iov = malloc(i * sizeof (struct iovec), M_TEMP, M_WAITOK);
1259 		    uiop->uio_iov = ivp = iov;
1260 		    mp = mrep;
1261 		    while (mp) {
1262 			if (mp->m_len > 0) {
1263 			    ivp->iov_base = mtod(mp, void *);
1264 			    ivp->iov_len = mp->m_len;
1265 			    ivp++;
1266 			}
1267 			mp = mp->m_next;
1268 		    }
1269 		    if (!error) {
1270 			error = VOP_WRITE(vp, uiop, ioflags, cred);
1271 			nfsstats.srvvop_writes++;
1272 		    }
1273 		    free((void *)iov, M_TEMP);
1274 		}
1275 		m_freem(mrep);
1276 		if (vp) {
1277 		    aftat_ret = VOP_GETATTR(vp, &va, cred);
1278 		    vput(vp);
1279 		}
1280 
1281 		/*
1282 		 * Loop around generating replies for all write rpcs that have
1283 		 * now been completed.
1284 		 */
1285 		swp = nfsd;
1286 		do {
1287 		    if (error) {
1288 			nfsm_writereply(NFSX_WCCDATA(v3), v3);
1289 			if (v3) {
1290 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1291 			}
1292 		    } else {
1293 			nfsm_writereply(NFSX_PREOPATTR(v3) +
1294 			    NFSX_POSTOPORFATTR(v3) + 2 * NFSX_UNSIGNED +
1295 			    NFSX_WRITEVERF(v3), v3);
1296 			if (v3) {
1297 			    nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1298 			    nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1299 			    *tl++ = txdr_unsigned(nfsd->nd_len);
1300 			    *tl++ = txdr_unsigned(swp->nd_stable);
1301 			    /*
1302 			     * Actually, there is no need to txdr these fields,
1303 			     * but it may make the values more human readable,
1304 			     * for debugging purposes.
1305 			     */
1306 			    *tl++ = txdr_unsigned(boottime.tv_sec);
1307 			    *tl = txdr_unsigned(boottime.tv_nsec / 1000);
1308 			} else {
1309 			    nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1310 			    nfsm_srvfillattr(&va, fp);
1311 			}
1312 		    }
1313 		    nfsd->nd_mreq = mreq;
1314 		    if (nfsd->nd_mrep)
1315 			panic("nfsrv_write: nd_mrep not free");
1316 
1317 		    /*
1318 		     * Done. Put it at the head of the timer queue so that
1319 		     * the final phase can return the reply.
1320 		     */
1321 		    mutex_enter(&nfsd_lock);
1322 		    if (nfsd != swp) {
1323 			nfsd->nd_time = 0;
1324 			LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1325 		    }
1326 		    nfsd = LIST_FIRST(&swp->nd_coalesce);
1327 		    if (nfsd) {
1328 			LIST_REMOVE(nfsd, nd_tq);
1329 		    }
1330 		    mutex_exit(&nfsd_lock);
1331 		} while (nfsd);
1332 		swp->nd_time = 0;
1333 
1334 		mutex_enter(&nfsd_lock);
1335 		LIST_INSERT_HEAD(&slp->ns_tq, swp, nd_tq);
1336 		mutex_exit(&nfsd_lock);
1337 		goto loop1;
1338 	}
1339 	mutex_exit(&nfsd_lock);
1340 	nfs_timer_start();
1341 
1342 	/*
1343 	 * Search for a reply to return.
1344 	 */
1345 	mutex_enter(&nfsd_lock);
1346 	LIST_FOREACH(nfsd, &slp->ns_tq, nd_tq) {
1347 		if (nfsd->nd_mreq) {
1348 		    LIST_REMOVE(nfsd, nd_tq);
1349 		    *mrq = nfsd->nd_mreq;
1350 		    *ndp = nfsd;
1351 		    break;
1352 		}
1353 	}
1354 	mutex_exit(&nfsd_lock);
1355 	return (0);
1356 }
1357 
1358 /*
1359  * Coalesce the write request nfsd into owp. To do this we must:
1360  * - remove nfsd from the queues
1361  * - merge nfsd->nd_mrep into owp->nd_mrep
1362  * - update the nd_eoff and nd_stable for owp
1363  * - put nfsd on owp's nd_coalesce list
1364  * NB: Must be called at splsoftclock().
1365  */
1366 void
1367 nfsrvw_coalesce(struct nfsrv_descript *owp, struct nfsrv_descript *nfsd)
1368 {
1369         int overlap;
1370         struct mbuf *mp;
1371 	struct nfsrv_descript *m;
1372 
1373 	KASSERT(mutex_owned(&nfsd_lock));
1374 
1375         LIST_REMOVE(nfsd, nd_hash);
1376         LIST_REMOVE(nfsd, nd_tq);
1377         if (owp->nd_eoff < nfsd->nd_eoff) {
1378             overlap = owp->nd_eoff - nfsd->nd_off;
1379             if (overlap < 0)
1380                 panic("nfsrv_coalesce: bad off");
1381             if (overlap > 0)
1382                 m_adj(nfsd->nd_mrep, overlap);
1383             mp = owp->nd_mrep;
1384             while (mp->m_next)
1385                 mp = mp->m_next;
1386             mp->m_next = nfsd->nd_mrep;
1387             owp->nd_eoff = nfsd->nd_eoff;
1388         } else
1389             m_freem(nfsd->nd_mrep);
1390         nfsd->nd_mrep = NULL;
1391         if (nfsd->nd_stable == NFSV3WRITE_FILESYNC)
1392             owp->nd_stable = NFSV3WRITE_FILESYNC;
1393         else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC &&
1394             owp->nd_stable == NFSV3WRITE_UNSTABLE)
1395             owp->nd_stable = NFSV3WRITE_DATASYNC;
1396         LIST_INSERT_HEAD(&owp->nd_coalesce, nfsd, nd_tq);
1397  	/*
1398  	 * nfsd might hold coalesce elements! Move them to owp.
1399  	 * Otherwise, requests may be lost and clients will be stuck.
1400  	 */
1401 	while ((m = LIST_FIRST(&nfsd->nd_coalesce)) != NULL) {
1402 		LIST_REMOVE(m, nd_tq);
1403 		LIST_INSERT_HEAD(&owp->nd_coalesce, m, nd_tq);
1404 	}
1405 }
1406 
1407 /*
1408  * nfs create service
1409  * now does a truncate to 0 length via. setattr if it already exists
1410  */
1411 int
1412 nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1413 {
1414 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1415 	struct mbuf *nam = nfsd->nd_nam;
1416 	char *dpos = nfsd->nd_dpos;
1417 	kauth_cred_t cred = nfsd->nd_cr;
1418 	struct nfs_fattr *fp;
1419 	struct vattr va, dirfor, diraft;
1420 	struct nfsv2_sattr *sp;
1421 	u_int32_t *tl;
1422 	struct nameidata nd;
1423 	char *cp;
1424 	int32_t t1;
1425 	char *bpos;
1426 	int error = 0, cache = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
1427 	int rdev = 0, abort = 0;
1428 	int v3 = (nfsd->nd_flag & ND_NFSV3), how, exclusive_flag = 0;
1429 	char *cp2;
1430 	struct mbuf *mb, *mreq __unused;
1431 	struct vnode *vp = NULL, *dirp = NULL;
1432 	nfsrvfh_t nsfh;
1433 	u_quad_t frev, tempsize;
1434 	u_char cverf[NFSX_V3CREATEVERF];
1435 
1436 	nd.ni_cnd.cn_nameiop = 0;
1437 	nfsm_srvmtofh(&nsfh);
1438 	nfsm_srvnamesiz(len);
1439 	nd.ni_cnd.cn_cred = cred;
1440 	nd.ni_cnd.cn_nameiop = CREATE;
1441 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1442 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1443 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1444 	if (dirp && v3) {
1445 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1446 	}
1447 	if (error) {
1448 		nfsm_reply(NFSX_WCCDATA(v3));
1449 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1450 		if (dirp)
1451 			vrele(dirp);
1452 		if (nd.ni_pathbuf != NULL) {
1453 			pathbuf_destroy(nd.ni_pathbuf);
1454 			nd.ni_pathbuf = NULL;
1455 		}
1456 		return (0);
1457 	}
1458 	abort = 1;
1459 	vattr_null(&va);
1460 	if (v3) {
1461 		va.va_mode = 0;
1462 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1463 		how = fxdr_unsigned(int, *tl);
1464 		switch (how) {
1465 		case NFSV3CREATE_GUARDED:
1466 			if (nd.ni_vp) {
1467 				error = EEXIST;
1468 				break;
1469 			}
1470 		case NFSV3CREATE_UNCHECKED:
1471 			nfsm_srvsattr(&va);
1472 			break;
1473 		case NFSV3CREATE_EXCLUSIVE:
1474 			nfsm_dissect(cp, void *, NFSX_V3CREATEVERF);
1475 			memcpy(cverf, cp, NFSX_V3CREATEVERF);
1476 			exclusive_flag = 1;
1477 			break;
1478 		};
1479 		va.va_type = VREG;
1480 	} else {
1481 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1482 		va.va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1483 		if (va.va_type == VNON)
1484 			va.va_type = VREG;
1485 		va.va_mode = nfstov_mode(sp->sa_mode);
1486 		switch (va.va_type) {
1487 		case VREG:
1488 			tsize = fxdr_unsigned(int32_t, sp->sa_size);
1489 			if (tsize != -1)
1490 				va.va_size = (u_quad_t)tsize;
1491 			break;
1492 		case VCHR:
1493 		case VBLK:
1494 		case VFIFO:
1495 			rdev = fxdr_unsigned(int32_t, sp->sa_size);
1496 			break;
1497 		default:
1498 			break;
1499 		};
1500 	}
1501 
1502 	/*
1503 	 * Iff doesn't exist, create it
1504 	 * otherwise just truncate to 0 length
1505 	 *   should I set the mode too ??
1506 	 */
1507 	if (nd.ni_vp == NULL) {
1508 		if (va.va_type == VREG || va.va_type == VSOCK) {
1509 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1510 			error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1511 			if (!error) {
1512 				vn_lock(nd.ni_vp, LK_EXCLUSIVE | LK_RETRY);
1513 				if (exclusive_flag) {
1514 					exclusive_flag = 0;
1515 					vattr_null(&va);
1516 					/*
1517 					 * XXX
1518 					 * assuming NFSX_V3CREATEVERF
1519 					 * == sizeof(nfstime3)
1520 					 */
1521 					fxdr_nfsv3time(cverf, &va.va_atime);
1522 					error = VOP_SETATTR(nd.ni_vp, &va,
1523 						cred);
1524 				}
1525 			}
1526 		} else if (va.va_type == VCHR || va.va_type == VBLK ||
1527 			va.va_type == VFIFO) {
1528 			if (va.va_type == VCHR && rdev == 0xffffffff)
1529 				va.va_type = VFIFO;
1530 			if (va.va_type != VFIFO &&
1531 			    (error = kauth_authorize_system(cred,
1532 			    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1533 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1534 				vput(nd.ni_dvp);
1535 				abort = 0;
1536 				nfsm_reply(0);
1537 				if (nd.ni_pathbuf != NULL) {
1538 					pathbuf_destroy(nd.ni_pathbuf);
1539 					nd.ni_pathbuf = NULL;
1540 				}
1541 				return (error);
1542 			} else
1543 				va.va_rdev = (dev_t)rdev;
1544 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1545 			error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd,
1546 			    &va);
1547 			if (!error) {
1548 				vn_lock(nd.ni_vp, LK_EXCLUSIVE | LK_RETRY);
1549 			} else {
1550 				nfsm_reply(0);
1551 			}
1552 		} else {
1553 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1554 			if (nd.ni_pathbuf != NULL) {
1555 				pathbuf_destroy(nd.ni_pathbuf);
1556 				nd.ni_pathbuf = NULL;
1557 			}
1558 			error = ENXIO;
1559 			abort = 0;
1560 		}
1561 		vp = nd.ni_vp;
1562 	} else {
1563 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1564 		if (nd.ni_pathbuf != NULL) {
1565 			pathbuf_destroy(nd.ni_pathbuf);
1566 			nd.ni_pathbuf = NULL;
1567 		}
1568 		vp = nd.ni_vp;
1569 		abort = 0;
1570 		if (!error && va.va_size != -1) {
1571 			error = nfsrv_access(vp, VWRITE, cred,
1572 			    (nd.ni_cnd.cn_flags & RDONLY), lwp, 0);
1573 			if (!error) {
1574 				nqsrv_getl(vp, ND_WRITE);
1575 				tempsize = va.va_size;
1576 				vattr_null(&va);
1577 				va.va_size = tempsize;
1578 				error = VOP_SETATTR(vp, &va, cred);
1579 			}
1580 		}
1581 		if (error)
1582 			vput(vp);
1583 	}
1584 	if (!error) {
1585 		error = nfsrv_composefh(vp, &nsfh, v3);
1586 		if (!error)
1587 			error = VOP_GETATTR(vp, &va, cred);
1588 		vput(vp);
1589 	}
1590 	if (nd.ni_dvp == vp)
1591 		vrele(nd.ni_dvp);
1592 	else
1593 		vput(nd.ni_dvp);
1594 	if (v3) {
1595 		if (exclusive_flag && !error) {
1596 			/*
1597 			 * XXX assuming NFSX_V3CREATEVERF == sizeof(nfstime3)
1598 			 */
1599 			char oldverf[NFSX_V3CREATEVERF];
1600 
1601 			txdr_nfsv3time(&va.va_atime, oldverf);
1602 			if (memcmp(cverf, oldverf, NFSX_V3CREATEVERF))
1603 				error = EEXIST;
1604 		}
1605 		if (dirp) {
1606 			vn_lock(dirp, LK_SHARED | LK_RETRY);
1607 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1608 			VOP_UNLOCK(dirp);
1609 		}
1610 	}
1611 	if (dirp) {
1612 		vrele(dirp);
1613 		dirp = NULL;
1614 	}
1615 	if (nd.ni_pathbuf != NULL) {
1616 		pathbuf_destroy(nd.ni_pathbuf);
1617 		nd.ni_pathbuf = NULL;
1618 	}
1619 	abort = 0;
1620 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_FATTR(v3) + NFSX_WCCDATA(v3));
1621 	if (v3) {
1622 		if (!error) {
1623 			nfsm_srvpostop_fh(&nsfh);
1624 			nfsm_srvpostop_attr(0, &va);
1625 		}
1626 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1627 	} else {
1628 		nfsm_srvfhtom(&nsfh, v3);
1629 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1630 		nfsm_srvfillattr(&va, fp);
1631 	}
1632 	return (0);
1633 nfsmout:
1634 	if (dirp)
1635 		vrele(dirp);
1636 	if (abort) {
1637 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1638 		if (nd.ni_dvp == nd.ni_vp)
1639 			vrele(nd.ni_dvp);
1640 		else
1641 			vput(nd.ni_dvp);
1642 		if (nd.ni_vp)
1643 			vput(nd.ni_vp);
1644 	}
1645 	if (nd.ni_pathbuf != NULL) {
1646 		pathbuf_destroy(nd.ni_pathbuf);
1647 		nd.ni_pathbuf = NULL;
1648 	}
1649 	return (error);
1650 }
1651 
1652 /*
1653  * nfs v3 mknod service
1654  */
1655 int
1656 nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1657 {
1658 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1659 	struct mbuf *nam = nfsd->nd_nam;
1660 	char *dpos = nfsd->nd_dpos;
1661 	kauth_cred_t cred = nfsd->nd_cr;
1662 	struct vattr va, dirfor, diraft;
1663 	u_int32_t *tl;
1664 	struct nameidata nd;
1665 	int32_t t1;
1666 	char *bpos;
1667 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1668 	int abort = 0;
1669 	u_int32_t major, minor;
1670 	enum vtype vtyp;
1671 	char *cp2;
1672 	struct mbuf *mb, *mreq __unused;
1673 	struct vnode *vp, *dirp = (struct vnode *)0;
1674 	nfsrvfh_t nsfh;
1675 	u_quad_t frev;
1676 
1677 	nd.ni_cnd.cn_nameiop = 0;
1678 	nfsm_srvmtofh(&nsfh);
1679 	nfsm_srvnamesiz(len);
1680 	nd.ni_cnd.cn_cred = cred;
1681 	nd.ni_cnd.cn_nameiop = CREATE;
1682 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1683 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1684 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1685 	if (dirp)
1686 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1687 	if (error) {
1688 		nfsm_reply(NFSX_WCCDATA(1));
1689 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1690 		if (dirp)
1691 			vrele(dirp);
1692 		if (nd.ni_pathbuf != NULL) {
1693 			pathbuf_destroy(nd.ni_pathbuf);
1694 			nd.ni_pathbuf = NULL;
1695 		}
1696 		return (0);
1697 	}
1698 	abort = 1;
1699 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1700 	vtyp = nfsv3tov_type(*tl);
1701 	if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1702 		error = NFSERR_BADTYPE;
1703 		goto abort;
1704 	}
1705 	vattr_null(&va);
1706 	va.va_mode = 0;
1707 	nfsm_srvsattr(&va);
1708 	if (vtyp == VCHR || vtyp == VBLK) {
1709 		dev_t rdev;
1710 
1711 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1712 		major = fxdr_unsigned(u_int32_t, *tl++);
1713 		minor = fxdr_unsigned(u_int32_t, *tl);
1714 		rdev = makedev(major, minor);
1715 		if (major(rdev) != major || minor(rdev) != minor) {
1716 			error = EINVAL;
1717 			goto abort;
1718 		}
1719 		va.va_rdev = rdev;
1720 	}
1721 
1722 	/*
1723 	 * Iff doesn't exist, create it.
1724 	 */
1725 	if (nd.ni_vp) {
1726 		error = EEXIST;
1727 abort:
1728 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1729 		if (nd.ni_vp)
1730 			vput(nd.ni_vp);
1731 		if (nd.ni_pathbuf != NULL) {
1732 			pathbuf_destroy(nd.ni_pathbuf);
1733 			nd.ni_pathbuf = NULL;
1734 		}
1735 		goto out;
1736 	}
1737 	va.va_type = vtyp;
1738 	if (vtyp == VSOCK) {
1739 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1740 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1741 	} else {
1742 		if (va.va_type != VFIFO &&
1743 		    (error = kauth_authorize_system(cred,
1744 		    KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1745 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1746 			vput(nd.ni_dvp);
1747 			goto out;
1748 		}
1749 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
1750 		error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1751 		if (error)
1752 			goto out;
1753 	}
1754 	if (!error) {
1755 		vn_lock(nd.ni_vp, LK_EXCLUSIVE | LK_RETRY);
1756 	}
1757 out:
1758 	vp = nd.ni_vp;
1759 	if (!error) {
1760 		error = nfsrv_composefh(vp, &nsfh, true);
1761 		if (!error)
1762 			error = VOP_GETATTR(vp, &va, cred);
1763 		vput(vp);
1764 	}
1765 	if (nd.ni_dvp == nd.ni_vp)
1766 		vrele(nd.ni_dvp);
1767 	else
1768 		vput(nd.ni_dvp);
1769 	if (dirp) {
1770 		vn_lock(dirp, LK_SHARED | LK_RETRY);
1771 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1772 		VOP_UNLOCK(dirp);
1773 		vrele(dirp);
1774 		dirp = NULL;
1775 	}
1776 	if (nd.ni_pathbuf != NULL) {
1777 		pathbuf_destroy(nd.ni_pathbuf);
1778 		nd.ni_pathbuf = NULL;
1779 	}
1780 	abort = 0;
1781 	nfsm_reply(NFSX_SRVFH(&nsfh, true) + NFSX_POSTOPATTR(1) +
1782 	    NFSX_WCCDATA(1));
1783 	if (!error) {
1784 		nfsm_srvpostop_fh(&nsfh);
1785 		nfsm_srvpostop_attr(0, &va);
1786 	}
1787 	nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1788 	return (0);
1789 nfsmout:
1790 	if (abort) {
1791 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1792 		if (nd.ni_dvp == nd.ni_vp)
1793 			vrele(nd.ni_dvp);
1794 		else
1795 			vput(nd.ni_dvp);
1796 		if (nd.ni_vp)
1797 			vput(nd.ni_vp);
1798 	}
1799 	if (nd.ni_pathbuf != NULL) {
1800 		pathbuf_destroy(nd.ni_pathbuf);
1801 		nd.ni_pathbuf = NULL;
1802 	}
1803 	if (dirp)
1804 		vrele(dirp);
1805 	return (error);
1806 }
1807 
1808 /*
1809  * nfs remove service
1810  */
1811 int
1812 nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1813 {
1814 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1815 	struct mbuf *nam = nfsd->nd_nam;
1816 	char *dpos = nfsd->nd_dpos;
1817 	kauth_cred_t cred = nfsd->nd_cr;
1818 	struct nameidata nd;
1819 	u_int32_t *tl;
1820 	int32_t t1;
1821 	char *bpos;
1822 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1823 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1824 	char *cp2;
1825 	struct mbuf *mb, *mreq __unused;
1826 	struct vnode *vp, *dirp;
1827 	struct vattr dirfor, diraft;
1828 	nfsrvfh_t nsfh;
1829 	u_quad_t frev;
1830 
1831 #ifndef nolint
1832 	vp = (struct vnode *)0;
1833 #endif
1834 	nfsm_srvmtofh(&nsfh);
1835 	nfsm_srvnamesiz(len);
1836 	nd.ni_cnd.cn_cred = cred;
1837 	nd.ni_cnd.cn_nameiop = DELETE;
1838 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1839 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1840 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1841 	if (error == 0 && dirp && v3) {
1842 		if (nd.ni_dvp == nd.ni_vp)
1843 			vn_lock(dirp, LK_SHARED | LK_RETRY);
1844 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1845 		if (nd.ni_dvp == nd.ni_vp)
1846 			VOP_UNLOCK(dirp);
1847 	}
1848 	if (!error) {
1849 		vp = nd.ni_vp;
1850 		if (vp->v_type == VDIR) {
1851 			error = EPERM;
1852 			goto out;
1853 		}
1854 		/*
1855 		 * The root of a mounted filesystem cannot be deleted.
1856 		 */
1857 		if (vp->v_vflag & VV_ROOT) {
1858 			error = EBUSY;
1859 		}
1860 out:
1861 		if (!error) {
1862 			nqsrv_getl(nd.ni_dvp, ND_WRITE);
1863 			nqsrv_getl(vp, ND_WRITE);
1864 			error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1865 			vput(nd.ni_dvp);
1866 		} else {
1867 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1868 			if (nd.ni_dvp == vp)
1869 				vrele(nd.ni_dvp);
1870 			else
1871 				vput(nd.ni_dvp);
1872 			vput(vp);
1873 		}
1874 	}
1875 	if (nd.ni_pathbuf != NULL) {
1876 		pathbuf_destroy(nd.ni_pathbuf);
1877 		nd.ni_pathbuf = NULL;
1878 	}
1879 	if (dirp) {
1880 		if (v3) {
1881 			vn_lock(dirp, LK_SHARED | LK_RETRY);
1882 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1883 			VOP_UNLOCK(dirp);
1884 		}
1885 		vrele(dirp);
1886 	}
1887 	nfsm_reply(NFSX_WCCDATA(v3));
1888 	if (v3) {
1889 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1890 		return (0);
1891 	}
1892 	nfsm_srvdone;
1893 }
1894 
1895 /*
1896  * nfs rename service
1897  */
1898 int
1899 nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1900 {
1901 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1902 	struct mbuf *nam = nfsd->nd_nam;
1903 	char *dpos = nfsd->nd_dpos;
1904 	kauth_cred_t cred = nfsd->nd_cr;
1905 	u_int32_t *tl;
1906 	int32_t t1;
1907 	char *bpos;
1908 	int error = 0, cache = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1909 	uint32_t len, len2;
1910 	int tdirfor_ret = 1, tdiraft_ret = 1;
1911 	int v3 = (nfsd->nd_flag & ND_NFSV3);
1912 	char *cp2;
1913 	struct mbuf *mb, *mreq __unused;
1914 	struct nameidata fromnd, tond;
1915 	struct vnode *fvp, *tvp, *tdvp;
1916 	struct vnode *fdirp = NULL, *tdirp = NULL;
1917 	struct mount *localfs = NULL;
1918 	struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
1919 	nfsrvfh_t fnsfh, tnsfh;
1920 	u_quad_t frev;
1921 	uid_t saved_uid;
1922 
1923 #ifndef nolint
1924 	fvp = (struct vnode *)0;
1925 #endif
1926 	fromnd.ni_cnd.cn_nameiop = 0;
1927 	tond.ni_cnd.cn_nameiop = 0;
1928 	nfsm_srvmtofh(&fnsfh);
1929 	nfsm_srvnamesiz(len);
1930 	/*
1931 	 * Remember our original uid so that we can reset cr_uid before
1932 	 * the second nfs_namei() call, in case it is remapped.
1933 	 */
1934 	saved_uid = kauth_cred_geteuid(cred);
1935 	fromnd.ni_cnd.cn_cred = cred;
1936 	fromnd.ni_cnd.cn_nameiop = DELETE;
1937 	fromnd.ni_cnd.cn_flags = LOCKPARENT;
1938 	error = nfs_namei(&fromnd, &fnsfh, len, slp, nam, &md,
1939 		&dpos, &fdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1940 	if (error == 0 && fdirp && v3) {
1941 		if (fromnd.ni_dvp == fromnd.ni_vp)
1942 			vn_lock(fdirp, LK_SHARED | LK_RETRY);
1943 		fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor, cred);
1944 		if (fromnd.ni_dvp == fromnd.ni_vp)
1945 			VOP_UNLOCK(fdirp);
1946 	}
1947 	if (error) {
1948 		fromnd.ni_cnd.cn_nameiop = 0;
1949 		nfsm_reply(2 * NFSX_WCCDATA(v3));
1950 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1951 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1952 		if (fdirp)
1953 			vrele(fdirp);
1954 		if (fromnd.ni_pathbuf != NULL) {
1955 			pathbuf_destroy(fromnd.ni_pathbuf);
1956 		}
1957 		return (0);
1958 	}
1959 	if (fromnd.ni_dvp != fromnd.ni_vp) {
1960 		VOP_UNLOCK(fromnd.ni_dvp);
1961 	}
1962 	fvp = fromnd.ni_vp;
1963 
1964 	localfs = fvp->v_mount;
1965 	error = VFS_RENAMELOCK_ENTER(localfs);
1966 	if (error) {
1967 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1968 		vrele(fromnd.ni_dvp);
1969 		vrele(fvp);
1970 		goto out1;
1971 	}
1972 
1973 	/* Copied, regrettably, from vfs_syscalls.c (q.v.) */
1974 	vrele(fvp);
1975 	if ((fromnd.ni_cnd.cn_namelen == 1 &&
1976 	     fromnd.ni_cnd.cn_nameptr[0] == '.') ||
1977 	    (fromnd.ni_cnd.cn_namelen == 2 &&
1978 	     fromnd.ni_cnd.cn_nameptr[0] == '.' &&
1979 	     fromnd.ni_cnd.cn_nameptr[1] == '.')) {
1980 		error = EINVAL;
1981 		VFS_RENAMELOCK_EXIT(localfs);
1982 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1983 		vrele(fromnd.ni_dvp);
1984 		goto out1;
1985 	}
1986 	vn_lock(fromnd.ni_dvp, LK_EXCLUSIVE | LK_RETRY);
1987 	error = relookup(fromnd.ni_dvp, &fromnd.ni_vp, &fromnd.ni_cnd, 0);
1988 	if (error) {
1989 		VOP_UNLOCK(fromnd.ni_dvp);
1990 		VFS_RENAMELOCK_EXIT(localfs);
1991 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1992 		vrele(fromnd.ni_dvp);
1993 		goto out1;
1994 	}
1995 	VOP_UNLOCK(fromnd.ni_vp);
1996 	if (fromnd.ni_dvp != fromnd.ni_vp)
1997 		VOP_UNLOCK(fromnd.ni_dvp);
1998 	fvp = fromnd.ni_vp;
1999 
2000 	nfsm_srvmtofh(&tnsfh);
2001 	if (v3) {
2002 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
2003 		len2 = fxdr_unsigned(uint32_t, *tl);
2004 		/* len2 will be checked by nfs_namei */
2005 	}
2006 	else {
2007 		/* NFSv2 */
2008 		nfsm_strsiz(len2, NFS_MAXNAMLEN);
2009 	}
2010 	kauth_cred_seteuid(cred, saved_uid);
2011 	tond.ni_cnd.cn_cred = cred;
2012 	tond.ni_cnd.cn_nameiop = RENAME;
2013 	tond.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | NOCACHE;
2014 	error = nfs_namei(&tond, &tnsfh, len2, slp, nam, &md,
2015 		&dpos, &tdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2016 	if (tdirp && v3) {
2017 		tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor, cred);
2018 	}
2019 	if (error) {
2020 		VFS_RENAMELOCK_EXIT(localfs);
2021 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2022 		vrele(fromnd.ni_dvp);
2023 		vrele(fvp);
2024 		goto out1;
2025 	}
2026 	tdvp = tond.ni_dvp;
2027 	tvp = tond.ni_vp;
2028 	if (tvp != NULL) {
2029 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
2030 			if (v3)
2031 				error = EEXIST;
2032 			else
2033 				error = EISDIR;
2034 			goto out;
2035 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
2036 			if (v3)
2037 				error = EEXIST;
2038 			else
2039 				error = ENOTDIR;
2040 			goto out;
2041 		}
2042 		if (tvp->v_type == VDIR && tvp->v_mountedhere) {
2043 			if (v3)
2044 				error = EXDEV;
2045 			else
2046 				error = ENOTEMPTY;
2047 			goto out;
2048 		}
2049 	}
2050 	if (fvp->v_type == VDIR && fvp->v_mountedhere) {
2051 		if (v3)
2052 			error = EXDEV;
2053 		else
2054 			error = ENOTEMPTY;
2055 		goto out;
2056 	}
2057 	if (fvp->v_mount != tdvp->v_mount) {
2058 		if (v3)
2059 			error = EXDEV;
2060 		else
2061 			error = ENOTEMPTY;
2062 		goto out;
2063 	}
2064 	if (fvp == tdvp) {
2065 		if (v3)
2066 			error = EINVAL;
2067 		else
2068 			error = ENOTEMPTY;
2069 	}
2070 	/*
2071 	 * If source is the same as the destination (that is the
2072 	 * same vnode with the same name in the same directory),
2073 	 * then there is nothing to do.
2074 	 */
2075 	if (fvp == tvp && fromnd.ni_dvp == tdvp &&
2076 	    fromnd.ni_cnd.cn_namelen == tond.ni_cnd.cn_namelen &&
2077 	    !memcmp(fromnd.ni_cnd.cn_nameptr, tond.ni_cnd.cn_nameptr,
2078 	      fromnd.ni_cnd.cn_namelen))
2079 		error = -1;
2080 out:
2081 	if (!error) {
2082 		nqsrv_getl(fromnd.ni_dvp, ND_WRITE);
2083 		nqsrv_getl(tdvp, ND_WRITE);
2084 		if (tvp) {
2085 			nqsrv_getl(tvp, ND_WRITE);
2086 		}
2087 		error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
2088 				   tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
2089 		VFS_RENAMELOCK_EXIT(localfs);
2090 	} else {
2091 		VOP_ABORTOP(tond.ni_dvp, &tond.ni_cnd);
2092 		if (tdvp == tvp)
2093 			vrele(tdvp);
2094 		else
2095 			vput(tdvp);
2096 		if (tvp)
2097 			vput(tvp);
2098 		VFS_RENAMELOCK_EXIT(localfs);
2099 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2100 		vrele(fromnd.ni_dvp);
2101 		vrele(fvp);
2102 		if (error == -1)
2103 			error = 0;
2104 	}
2105 	if (tond.ni_pathbuf != NULL) {
2106 		pathbuf_destroy(tond.ni_pathbuf);
2107 		tond.ni_pathbuf = NULL;
2108 	}
2109 	tond.ni_cnd.cn_nameiop = 0;
2110 out1:
2111 	if (fdirp) {
2112 		if (v3) {
2113 			vn_lock(fdirp, LK_SHARED | LK_RETRY);
2114 			fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred);
2115 			VOP_UNLOCK(fdirp);
2116 		}
2117 		vrele(fdirp);
2118 		fdirp = NULL;
2119 	}
2120 	if (tdirp) {
2121 		if (v3) {
2122 			vn_lock(tdirp, LK_SHARED | LK_RETRY);
2123 			tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred);
2124 			VOP_UNLOCK(tdirp);
2125 		}
2126 		vrele(tdirp);
2127 		tdirp = NULL;
2128 	}
2129 	pathbuf_destroy(fromnd.ni_pathbuf);
2130 	fromnd.ni_pathbuf = NULL;
2131 	fromnd.ni_cnd.cn_nameiop = 0;
2132 	localfs = NULL;
2133 	nfsm_reply(2 * NFSX_WCCDATA(v3));
2134 	if (v3) {
2135 		nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
2136 		nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
2137 	}
2138 	return (0);
2139 
2140 nfsmout:
2141 	if (fdirp)
2142 		vrele(fdirp);
2143 #ifdef notdef
2144 	if (tdirp)
2145 		vrele(tdirp);
2146 #endif
2147 	if (tond.ni_cnd.cn_nameiop) {
2148 		if (tond.ni_pathbuf != NULL) {
2149 			pathbuf_destroy(tond.ni_pathbuf);
2150 			tond.ni_pathbuf = NULL;
2151 		}
2152 	}
2153 	if (localfs) {
2154 		VFS_RENAMELOCK_EXIT(localfs);
2155 	}
2156 	if (fromnd.ni_cnd.cn_nameiop) {
2157 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2158 		if (fromnd.ni_pathbuf != NULL) {
2159 			pathbuf_destroy(fromnd.ni_pathbuf);
2160 			fromnd.ni_pathbuf = NULL;
2161 		}
2162 		vrele(fromnd.ni_dvp);
2163 		vrele(fvp);
2164 	}
2165 	return (error);
2166 }
2167 
2168 /*
2169  * nfs link service
2170  */
2171 int
2172 nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2173 {
2174 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2175 	struct mbuf *nam = nfsd->nd_nam;
2176 	char *dpos = nfsd->nd_dpos;
2177 	kauth_cred_t cred = nfsd->nd_cr;
2178 	struct nameidata nd;
2179 	u_int32_t *tl;
2180 	int32_t t1;
2181 	char *bpos;
2182 	int error = 0, rdonly, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2183 	int getret = 1, v3 = (nfsd->nd_flag & ND_NFSV3);
2184 	char *cp2;
2185 	struct mbuf *mb, *mreq __unused;
2186 	struct vnode *vp, *xp, *dirp = (struct vnode *)0;
2187 	struct vattr dirfor, diraft, at;
2188 	nfsrvfh_t nsfh, dnsfh;
2189 	u_quad_t frev;
2190 
2191 	nfsm_srvmtofh(&nsfh);
2192 	nfsm_srvmtofh(&dnsfh);
2193 	nfsm_srvnamesiz(len);
2194 	error = nfsrv_fhtovp(&nsfh, false, &vp, cred, slp, nam,
2195 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2196 	if (error) {
2197 		nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2198 		nfsm_srvpostop_attr(getret, &at);
2199 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2200 		return (0);
2201 	}
2202 	if (vp->v_type == VDIR) {
2203 		error = EPERM;
2204 		goto out1;
2205 	}
2206 	nd.ni_cnd.cn_cred = cred;
2207 	nd.ni_cnd.cn_nameiop = CREATE;
2208 	nd.ni_cnd.cn_flags = LOCKPARENT;
2209 	error = nfs_namei(&nd, &dnsfh, len, slp, nam, &md, &dpos,
2210 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2211 	if (dirp && v3) {
2212 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2213 	}
2214 	if (error)
2215 		goto out1;
2216 	xp = nd.ni_vp;
2217 	if (xp != NULL) {
2218 		error = EEXIST;
2219 		goto out;
2220 	}
2221 	xp = nd.ni_dvp;
2222 	if (vp->v_mount != xp->v_mount)
2223 		error = EXDEV;
2224 out:
2225 	if (!error) {
2226 		nqsrv_getl(vp, ND_WRITE);
2227 		nqsrv_getl(xp, ND_WRITE);
2228 		error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
2229 		if (nd.ni_dvp != nd.ni_vp)
2230 			VOP_UNLOCK(nd.ni_dvp);
2231 		vrele(nd.ni_dvp);
2232 	} else {
2233 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2234 		if (nd.ni_dvp == nd.ni_vp)
2235 			vrele(nd.ni_dvp);
2236 		else
2237 			vput(nd.ni_dvp);
2238 		if (nd.ni_vp)
2239 			vrele(nd.ni_vp);
2240 	}
2241 out1:
2242 	if (v3) {
2243 		vn_lock(vp, LK_SHARED | LK_RETRY);
2244 		getret = VOP_GETATTR(vp, &at, cred);
2245 		VOP_UNLOCK(vp);
2246 	}
2247 	if (dirp) {
2248 		if (v3) {
2249 			vn_lock(dirp, LK_SHARED | LK_RETRY);
2250 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2251 			VOP_UNLOCK(dirp);
2252 		}
2253 		vrele(dirp);
2254 	}
2255 	vrele(vp);
2256 	if (nd.ni_pathbuf != NULL) {
2257 		pathbuf_destroy(nd.ni_pathbuf);
2258 		nd.ni_pathbuf = NULL;
2259 	}
2260 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2261 	if (v3) {
2262 		nfsm_srvpostop_attr(getret, &at);
2263 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2264 		return (0);
2265 	}
2266 	nfsm_srvdone;
2267 }
2268 
2269 /*
2270  * nfs symbolic link service
2271  */
2272 int
2273 nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2274 {
2275 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2276 	struct mbuf *nam = nfsd->nd_nam;
2277 	char *dpos = nfsd->nd_dpos;
2278 	kauth_cred_t cred = nfsd->nd_cr;
2279 	struct vattr va, dirfor, diraft;
2280 	struct nameidata nd;
2281 	u_int32_t *tl;
2282 	int32_t t1;
2283 	struct nfsv2_sattr *sp;
2284 	char *bpos, *pathcp = NULL, *cp2;
2285 	struct uio io;
2286 	struct iovec iv;
2287 	int error = 0, cache = 0, dirfor_ret = 1, diraft_ret = 1, abort = 0;
2288 	uint32_t len, len2;
2289 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2290 	struct mbuf *mb, *mreq __unused;
2291 	struct vnode *dirp = (struct vnode *)0;
2292 	nfsrvfh_t nsfh;
2293 	u_quad_t frev;
2294 
2295 	nd.ni_cnd.cn_nameiop = 0;
2296 	nfsm_srvmtofh(&nsfh);
2297 	nfsm_srvnamesiz(len);
2298 	nd.ni_cnd.cn_cred = cred;
2299 	nd.ni_cnd.cn_nameiop = CREATE;
2300 	nd.ni_cnd.cn_flags = LOCKPARENT;
2301 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2302 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2303 	if (dirp && v3) {
2304 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2305 	}
2306 	if (error)
2307 		goto out;
2308 	abort = 1;
2309 	vattr_null(&va);
2310 	va.va_type = VLNK;
2311 	if (v3) {
2312 		va.va_mode = 0;
2313 		nfsm_srvsattr(&va);
2314 		nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
2315 		len2 = fxdr_unsigned(uint32_t, *tl);
2316 		if (len2 > PATH_MAX) {
2317 			/* XXX should check _PC_NO_TRUNC */
2318 			error = ENAMETOOLONG;
2319 			goto abortop;
2320 		}
2321 	}
2322 	else {
2323 		/* NFSv2 */
2324 		nfsm_strsiz(len2, NFS_MAXPATHLEN);
2325 	}
2326 	pathcp = malloc(len2 + 1, M_TEMP, M_WAITOK);
2327 	iv.iov_base = pathcp;
2328 	iv.iov_len = len2;
2329 	io.uio_resid = len2;
2330 	io.uio_offset = 0;
2331 	io.uio_iov = &iv;
2332 	io.uio_iovcnt = 1;
2333 	io.uio_rw = UIO_READ;
2334 	UIO_SETUP_SYSSPACE(&io);
2335 	nfsm_mtouio(&io, len2);
2336 	if (!v3) {
2337 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
2338 		va.va_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
2339 	}
2340 	*(pathcp + len2) = '\0';
2341 	if (nd.ni_vp) {
2342 		error = EEXIST;
2343 abortop:
2344 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2345 		if (nd.ni_dvp == nd.ni_vp)
2346 			vrele(nd.ni_dvp);
2347 		else
2348 			vput(nd.ni_dvp);
2349 		if (nd.ni_vp)
2350 			vrele(nd.ni_vp);
2351 		goto out;
2352 	}
2353 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2354 	error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va, pathcp);
2355 	if (!error) {
2356 	    if (v3) {
2357 		vn_lock(nd.ni_vp, LK_SHARED | LK_RETRY);
2358 		error = nfsrv_composefh(nd.ni_vp, &nsfh, v3);
2359 		if (!error)
2360 		    error = VOP_GETATTR(nd.ni_vp, &va, cred);
2361 		vput(nd.ni_vp);
2362 	    } else {
2363 		vrele(nd.ni_vp);
2364 	    }
2365 	}
2366 	vput(nd.ni_dvp);
2367 out:
2368 	if (pathcp)
2369 		free(pathcp, M_TEMP);
2370 	if (dirp) {
2371 		if (v3) {
2372 			vn_lock(dirp, LK_SHARED | LK_RETRY);
2373 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2374 			VOP_UNLOCK(dirp);
2375 		}
2376 		vrele(dirp);
2377 		dirp = NULL;
2378 	}
2379 	if (nd.ni_pathbuf != NULL) {
2380 		pathbuf_destroy(nd.ni_pathbuf);
2381 		nd.ni_pathbuf = NULL;
2382 	}
2383 	abort = 0;
2384 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2385 	    NFSX_WCCDATA(v3));
2386 	if (v3) {
2387 		if (!error) {
2388 			nfsm_srvpostop_fh(&nsfh);
2389 			nfsm_srvpostop_attr(0, &va);
2390 		}
2391 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2392 	}
2393 	return (0);
2394 nfsmout:
2395 	if (abort) {
2396 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2397 		if (nd.ni_dvp == nd.ni_vp)
2398 			vrele(nd.ni_dvp);
2399 		else
2400 			vput(nd.ni_dvp);
2401 		if (nd.ni_vp)
2402 			vrele(nd.ni_vp);
2403 		if (nd.ni_pathbuf != NULL) {
2404 			pathbuf_destroy(nd.ni_pathbuf);
2405 			nd.ni_pathbuf = NULL;
2406 		}
2407 	}
2408 	if (dirp)
2409 		vrele(dirp);
2410 	if (pathcp)
2411 		free(pathcp, M_TEMP);
2412 	return (error);
2413 }
2414 
2415 /*
2416  * nfs mkdir service
2417  */
2418 int
2419 nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2420 {
2421 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2422 	struct mbuf *nam = nfsd->nd_nam;
2423 	char *dpos = nfsd->nd_dpos;
2424 	kauth_cred_t cred = nfsd->nd_cr;
2425 	struct vattr va, dirfor, diraft;
2426 	struct nfs_fattr *fp;
2427 	struct nameidata nd;
2428 	char *cp;
2429 	u_int32_t *tl;
2430 	int32_t t1;
2431 	char *bpos;
2432 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2433 	int abort = 0;
2434 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2435 	char *cp2;
2436 	struct mbuf *mb, *mreq __unused;
2437 	struct vnode *vp, *dirp = (struct vnode *)0;
2438 	nfsrvfh_t nsfh;
2439 	u_quad_t frev;
2440 
2441 	nfsm_srvmtofh(&nsfh);
2442 	nfsm_srvnamesiz(len);
2443 	nd.ni_cnd.cn_cred = cred;
2444 	nd.ni_cnd.cn_nameiop = CREATE;
2445 	nd.ni_cnd.cn_flags = LOCKPARENT;
2446 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2447 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2448 	if (dirp && v3) {
2449 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2450 	}
2451 	if (error) {
2452 		if (nd.ni_pathbuf != NULL) {
2453 			pathbuf_destroy(nd.ni_pathbuf);
2454 			nd.ni_pathbuf = NULL;
2455 		}
2456 		nfsm_reply(NFSX_WCCDATA(v3));
2457 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2458 		if (dirp)
2459 			vrele(dirp);
2460 		return (0);
2461 	}
2462 	abort = 1;
2463 	vattr_null(&va);
2464 	if (v3) {
2465 		va.va_mode = 0;
2466 		nfsm_srvsattr(&va);
2467 	} else {
2468 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
2469 		va.va_mode = nfstov_mode(*tl++);
2470 	}
2471 	va.va_type = VDIR;
2472 	vp = nd.ni_vp;
2473 	if (vp != NULL) {
2474 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2475 		if (nd.ni_dvp == vp)
2476 			vrele(nd.ni_dvp);
2477 		else
2478 			vput(nd.ni_dvp);
2479 		vrele(vp);
2480 		error = EEXIST;
2481 		goto out;
2482 	}
2483 	nqsrv_getl(nd.ni_dvp, ND_WRITE);
2484 	error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
2485 	if (!error) {
2486 		vp = nd.ni_vp;
2487 		vn_lock(vp, LK_SHARED | LK_RETRY);
2488 		error = nfsrv_composefh(vp, &nsfh, v3);
2489 		if (!error)
2490 			error = VOP_GETATTR(vp, &va, cred);
2491 		vput(vp);
2492 	}
2493 	vput(nd.ni_dvp);
2494 out:
2495 	if (dirp) {
2496 		if (v3) {
2497 			vn_lock(dirp, LK_SHARED | LK_RETRY);
2498 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2499 			VOP_UNLOCK(dirp);
2500 		}
2501 		vrele(dirp);
2502 		dirp = NULL;
2503 	}
2504 	if (nd.ni_pathbuf != NULL) {
2505 		pathbuf_destroy(nd.ni_pathbuf);
2506 		nd.ni_pathbuf = NULL;
2507 	}
2508 	abort = 0;
2509 	nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2510 	    NFSX_WCCDATA(v3));
2511 	if (v3) {
2512 		if (!error) {
2513 			nfsm_srvpostop_fh(&nsfh);
2514 			nfsm_srvpostop_attr(0, &va);
2515 		}
2516 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2517 	} else {
2518 		nfsm_srvfhtom(&nsfh, v3);
2519 		nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
2520 		nfsm_srvfillattr(&va, fp);
2521 	}
2522 	return (0);
2523 nfsmout:
2524 	if (abort) {
2525 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2526 		if (nd.ni_dvp == nd.ni_vp)
2527 			vrele(nd.ni_dvp);
2528 		else
2529 			vput(nd.ni_dvp);
2530 		if (nd.ni_vp)
2531 			vrele(nd.ni_vp);
2532 		if (nd.ni_pathbuf != NULL) {
2533 			pathbuf_destroy(nd.ni_pathbuf);
2534 			nd.ni_pathbuf = NULL;
2535 		}
2536 	}
2537 	if (dirp)
2538 		vrele(dirp);
2539 	return (error);
2540 }
2541 
2542 /*
2543  * nfs rmdir service
2544  */
2545 int
2546 nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2547 {
2548 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2549 	struct mbuf *nam = nfsd->nd_nam;
2550 	char *dpos = nfsd->nd_dpos;
2551 	kauth_cred_t cred = nfsd->nd_cr;
2552 	u_int32_t *tl;
2553 	int32_t t1;
2554 	char *bpos;
2555 	int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2556 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2557 	char *cp2;
2558 	struct mbuf *mb, *mreq __unused;
2559 	struct vnode *vp, *dirp = (struct vnode *)0;
2560 	struct vattr dirfor, diraft;
2561 	nfsrvfh_t nsfh;
2562 	struct nameidata nd;
2563 	u_quad_t frev;
2564 
2565 	nfsm_srvmtofh(&nsfh);
2566 	nfsm_srvnamesiz(len);
2567 	nd.ni_cnd.cn_cred = cred;
2568 	nd.ni_cnd.cn_nameiop = DELETE;
2569 	nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
2570 	error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2571 		&dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2572 	if (dirp && v3) {
2573 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2574 	}
2575 	if (error) {
2576 		if (nd.ni_pathbuf != NULL) {
2577 			pathbuf_destroy(nd.ni_pathbuf);
2578 			nd.ni_pathbuf = NULL;
2579 		}
2580 		nfsm_reply(NFSX_WCCDATA(v3));
2581 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2582 		if (dirp)
2583 			vrele(dirp);
2584 		return (0);
2585 	}
2586 	vp = nd.ni_vp;
2587 	if (vp->v_type != VDIR) {
2588 		error = ENOTDIR;
2589 		goto out;
2590 	}
2591 	/*
2592 	 * No rmdir "." please.
2593 	 */
2594 	if (nd.ni_dvp == vp) {
2595 		error = EINVAL;
2596 		goto out;
2597 	}
2598 	/*
2599 	 * The root of a mounted filesystem cannot be deleted.
2600 	 */
2601 	if (vp->v_vflag & VV_ROOT)
2602 		error = EBUSY;
2603 out:
2604 	if (!error) {
2605 		nqsrv_getl(nd.ni_dvp, ND_WRITE);
2606 		nqsrv_getl(vp, ND_WRITE);
2607 		error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
2608 		vput(nd.ni_dvp);
2609 	} else {
2610 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2611 		if (nd.ni_dvp == nd.ni_vp)
2612 			vrele(nd.ni_dvp);
2613 		else
2614 			vput(nd.ni_dvp);
2615 		vput(vp);
2616 	}
2617 	if (nd.ni_pathbuf != NULL) {
2618 		pathbuf_destroy(nd.ni_pathbuf);
2619 		nd.ni_pathbuf = NULL;
2620 	}
2621 	if (dirp) {
2622 		if (v3) {
2623 			vn_lock(dirp, LK_SHARED | LK_RETRY);
2624 			diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2625 			VOP_UNLOCK(dirp);
2626 		}
2627 		vrele(dirp);
2628 	}
2629 	nfsm_reply(NFSX_WCCDATA(v3));
2630 	if (v3) {
2631 		nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2632 		return (0);
2633 	}
2634 	nfsm_srvdone;
2635 }
2636 
2637 /*
2638  * nfs readdir service
2639  * - mallocs what it thinks is enough to read
2640  *	count rounded up to a multiple of NFS_SRVDIRBLKSIZ <= NFS_MAXREADDIR
2641  * - calls VOP_READDIR()
2642  * - loops around building the reply
2643  *	if the output generated exceeds count break out of loop
2644  *	The nfsm_clget macro is used here so that the reply will be packed
2645  *	tightly in mbuf clusters.
2646  * - it only knows that it has encountered eof when the VOP_READDIR()
2647  *	reads nothing
2648  * - as such one readdir rpc will return eof false although you are there
2649  *	and then the next will return eof
2650  * - it trims out records with d_fileno == 0
2651  *	this doesn't matter for Unix clients, but they might confuse clients
2652  *	for other os'.
2653  * - it trims out records with d_type == DT_WHT
2654  *	these cannot be seen through NFS (unless we extend the protocol)
2655  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2656  *	than requested, but this may not apply to all filesystems. For
2657  *	example, client NFS does not { although it is never remote mounted
2658  *	anyhow }
2659  *     The alternate call nfsrv_readdirplus() does lookups as well.
2660  * PS: The NFS protocol spec. does not clarify what the "count" byte
2661  *	argument is a count of.. just name strings and file id's or the
2662  *	entire reply rpc or ...
2663  *	I tried just file name and id sizes and it confused the Sun client,
2664  *	so I am using the full rpc size now. The "paranoia.." comment refers
2665  *	to including the status longwords that are not a part of the dir.
2666  *	"entry" structures, but are in the rpc.
2667  */
2668 
2669 #define	NFS_SRVDIRBLKSIZ	1024
2670 
2671 struct flrep {
2672 	nfsuint64 fl_off;
2673 	u_int32_t fl_postopok;
2674 	struct nfs_fattr fl_fattr; /* XXX: must be of fattr3 size */
2675 	u_int32_t fl_fhok;
2676 	u_int32_t fl_fhsize;
2677 	/* handle comes here, filled in dynamically */
2678 };
2679 
2680 int
2681 nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2682 {
2683 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2684 	struct mbuf *nam = nfsd->nd_nam;
2685 	char *dpos = nfsd->nd_dpos;
2686 	kauth_cred_t cred = nfsd->nd_cr;
2687 	char *bp, *be;
2688 	struct mbuf *mp;
2689 	struct dirent *dp;
2690 	char *cp;
2691 	u_int32_t *tl;
2692 	int32_t t1;
2693 	char *bpos;
2694 	struct mbuf *mb, *mreq __unused, *mp2;
2695 	char *cpos, *cend, *cp2, *rbuf;
2696 	struct vnode *vp;
2697 	struct vattr at;
2698 	nfsrvfh_t nsfh;
2699 	struct uio io;
2700 	struct iovec iv;
2701 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2702 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, ncookies;
2703 	int v3 = (nfsd->nd_flag & ND_NFSV3);
2704 	u_quad_t frev, off, toff;
2705 #ifdef NFS3_STRICTVERF
2706 	u_quad_t verf;
2707 #endif
2708 	off_t *cookies = NULL, *cookiep;
2709 	nfsuint64 jar;
2710 
2711 	nfsm_srvmtofh(&nsfh);
2712 	if (v3) {
2713 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2714 		toff = fxdr_hyper(tl);
2715 		tl += 2;
2716 #ifdef NFS3_STRICTVERF
2717 		verf = fxdr_hyper(tl);
2718 #endif
2719 		tl += 2;
2720 	} else {
2721 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2722 		toff = fxdr_unsigned(u_quad_t, *tl++);
2723 	}
2724 	off = toff;
2725 	cnt = fxdr_unsigned(int, *tl);
2726 	siz = ((cnt + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2727 	xfer = NFS_SRVMAXDATA(nfsd);
2728 	if (siz > xfer)
2729 		siz = xfer;
2730 	fullsiz = siz;
2731 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2732 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2733 	if (!error && vp->v_type != VDIR) {
2734 		error = ENOTDIR;
2735 		vput(vp);
2736 	}
2737 	if (error) {
2738 		nfsm_reply(NFSX_UNSIGNED);
2739 		nfsm_srvpostop_attr(getret, &at);
2740 		return (0);
2741 	}
2742 	nqsrv_getl(vp, ND_READ);
2743 	if (v3) {
2744 		error = getret = VOP_GETATTR(vp, &at, cred);
2745 #ifdef NFS3_STRICTVERF
2746 		/*
2747 		 * XXX This check is too strict for Solaris 2.5 clients.
2748 		 */
2749 		if (!error && toff && verf != at.va_filerev)
2750 			error = NFSERR_BAD_COOKIE;
2751 #endif
2752 	}
2753 	if (!error)
2754 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2755 	if (error) {
2756 		vput(vp);
2757 		nfsm_reply(NFSX_POSTOPATTR(v3));
2758 		nfsm_srvpostop_attr(getret, &at);
2759 		return (0);
2760 	}
2761 	VOP_UNLOCK(vp);
2762 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
2763 again:
2764 	iv.iov_base = rbuf;
2765 	iv.iov_len = fullsiz;
2766 	io.uio_iov = &iv;
2767 	io.uio_iovcnt = 1;
2768 	io.uio_offset = (off_t)off;
2769 	io.uio_resid = fullsiz;
2770 	io.uio_rw = UIO_READ;
2771 	UIO_SETUP_SYSSPACE(&io);
2772 	eofflag = 0;
2773 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2774 
2775 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2776 
2777 	off = (off_t)io.uio_offset;
2778 	if (!cookies && !error)
2779 		error = NFSERR_PERM;
2780 	if (v3) {
2781 		getret = VOP_GETATTR(vp, &at, cred);
2782 		if (!error)
2783 			error = getret;
2784 	}
2785 
2786 	VOP_UNLOCK(vp);
2787 	if (error) {
2788 		vrele(vp);
2789 		free((void *)rbuf, M_TEMP);
2790 		if (cookies)
2791 			free((void *)cookies, M_TEMP);
2792 		nfsm_reply(NFSX_POSTOPATTR(v3));
2793 		nfsm_srvpostop_attr(getret, &at);
2794 		return (0);
2795 	}
2796 	if (io.uio_resid) {
2797 		siz -= io.uio_resid;
2798 
2799 		/*
2800 		 * If nothing read, return eof
2801 		 * rpc reply
2802 		 */
2803 		if (siz == 0) {
2804 			vrele(vp);
2805 			nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) +
2806 				2 * NFSX_UNSIGNED);
2807 			if (v3) {
2808 				nfsm_srvpostop_attr(getret, &at);
2809 				nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
2810 				txdr_hyper(at.va_filerev, tl);
2811 				tl += 2;
2812 			} else
2813 				nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2814 			*tl++ = nfs_false;
2815 			*tl = nfs_true;
2816 			free((void *)rbuf, M_TEMP);
2817 			free((void *)cookies, M_TEMP);
2818 			return (0);
2819 		}
2820 	}
2821 
2822 	/*
2823 	 * Check for degenerate cases of nothing useful read.
2824 	 * If so go try again
2825 	 */
2826 	cpos = rbuf;
2827 	cend = rbuf + siz;
2828 	dp = (struct dirent *)cpos;
2829 	cookiep = cookies;
2830 
2831 	while (cpos < cend && ncookies > 0 &&
2832 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
2833 		cpos += dp->d_reclen;
2834 		dp = (struct dirent *)cpos;
2835 		cookiep++;
2836 		ncookies--;
2837 	}
2838 	if (cpos >= cend || ncookies == 0) {
2839 		toff = off;
2840 		siz = fullsiz;
2841 		free(cookies, M_TEMP);
2842 		cookies = NULL;
2843 		goto again;
2844 	}
2845 
2846 	len = 3 * NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
2847 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) + siz);
2848 	if (v3) {
2849 		nfsm_srvpostop_attr(getret, &at);
2850 		nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2851 		txdr_hyper(at.va_filerev, tl);
2852 	}
2853 	mp = mp2 = mb;
2854 	bp = bpos;
2855 	be = bp + M_TRAILINGSPACE(mp);
2856 
2857 	/* Loop through the records and build reply */
2858 	while (cpos < cend && ncookies > 0) {
2859 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
2860 			nlen = dp->d_namlen;
2861 			rem = nfsm_rndup(nlen)-nlen;
2862 			len += (4 * NFSX_UNSIGNED + nlen + rem);
2863 			if (v3)
2864 				len += 2 * NFSX_UNSIGNED;
2865 			if (len > cnt) {
2866 				eofflag = 0;
2867 				break;
2868 			}
2869 			/*
2870 			 * Build the directory record xdr from
2871 			 * the dirent entry.
2872 			 */
2873 			nfsm_clget;
2874 			*tl = nfs_true;
2875 			bp += NFSX_UNSIGNED;
2876 			if (v3) {
2877 				nfsm_clget;
2878 				*tl = txdr_unsigned(dp->d_fileno >> 32);
2879 				bp += NFSX_UNSIGNED;
2880 			}
2881 			nfsm_clget;
2882 			*tl = txdr_unsigned(dp->d_fileno);
2883 			bp += NFSX_UNSIGNED;
2884 			nfsm_clget;
2885 			*tl = txdr_unsigned(nlen);
2886 			bp += NFSX_UNSIGNED;
2887 
2888 			/* And loop around copying the name */
2889 			xfer = nlen;
2890 			cp = dp->d_name;
2891 			while (xfer > 0) {
2892 				nfsm_clget;
2893 				if ((bp+xfer) > be)
2894 					tsiz = be-bp;
2895 				else
2896 					tsiz = xfer;
2897 				memcpy(bp, cp, tsiz);
2898 				bp += tsiz;
2899 				xfer -= tsiz;
2900 				if (xfer > 0)
2901 					cp += tsiz;
2902 			}
2903 			/* And null pad to an int32_t boundary */
2904 			for (i = 0; i < rem; i++)
2905 				*bp++ = '\0';
2906 			nfsm_clget;
2907 
2908 			/* Finish off the record */
2909 			txdr_hyper(*cookiep, &jar);
2910 			if (v3) {
2911 				*tl = jar.nfsuquad[0];
2912 				bp += NFSX_UNSIGNED;
2913 				nfsm_clget;
2914 			}
2915 			*tl = jar.nfsuquad[1];
2916 			bp += NFSX_UNSIGNED;
2917 		}
2918 		cpos += dp->d_reclen;
2919 		dp = (struct dirent *)cpos;
2920 		cookiep++;
2921 		ncookies--;
2922 	}
2923 	vrele(vp);
2924 	nfsm_clget;
2925 	*tl = nfs_false;
2926 	bp += NFSX_UNSIGNED;
2927 	nfsm_clget;
2928 	if (eofflag)
2929 		*tl = nfs_true;
2930 	else
2931 		*tl = nfs_false;
2932 	bp += NFSX_UNSIGNED;
2933 	if (mp != mb) {
2934 		if (bp < be)
2935 			mp->m_len = bp - mtod(mp, char *);
2936 	} else
2937 		mp->m_len += bp - bpos;
2938 	free((void *)rbuf, M_TEMP);
2939 	free((void *)cookies, M_TEMP);
2940 	nfsm_srvdone;
2941 }
2942 
2943 int
2944 nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2945 {
2946 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2947 	struct mbuf *nam = nfsd->nd_nam;
2948 	char *dpos = nfsd->nd_dpos;
2949 	kauth_cred_t cred = nfsd->nd_cr;
2950 	char *bp, *be;
2951 	struct mbuf *mp;
2952 	struct dirent *dp;
2953 	char *cp;
2954 	u_int32_t *tl;
2955 	int32_t t1;
2956 	char *bpos;
2957 	struct mbuf *mb, *mreq __unused, *mp2;
2958 	char *cpos, *cend, *cp2, *rbuf;
2959 	struct vnode *vp, *nvp;
2960 	struct flrep fl;
2961 	nfsrvfh_t nsfh;
2962 	struct uio io;
2963 	struct iovec iv;
2964 	struct vattr va, at, *vap = &va;
2965 	struct nfs_fattr *fp;
2966 	int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2967 	int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, dirlen, ncookies;
2968 	u_quad_t frev, off, toff;
2969 #ifdef NFS3_STRICTVERF
2970 	u_quad_t verf;
2971 #endif
2972 	off_t *cookies = NULL, *cookiep;
2973 
2974 	nfsm_srvmtofh(&nsfh);
2975 	nfsm_dissect(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2976 	toff = fxdr_hyper(tl);
2977 	tl += 2;
2978 #ifdef NFS3_STRICTVERF
2979 	verf = fxdr_hyper(tl);
2980 #endif
2981 	tl += 2;
2982 	siz = fxdr_unsigned(int, *tl++);
2983 	cnt = fxdr_unsigned(int, *tl);
2984 	off = toff;
2985 	siz = ((siz + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2986 	xfer = NFS_SRVMAXDATA(nfsd);
2987 	if (siz > xfer)
2988 		siz = xfer;
2989 	fullsiz = siz;
2990 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2991 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2992 	if (!error && vp->v_type != VDIR) {
2993 		error = ENOTDIR;
2994 		vput(vp);
2995 	}
2996 	if (error) {
2997 		nfsm_reply(NFSX_UNSIGNED);
2998 		nfsm_srvpostop_attr(getret, &at);
2999 		return (0);
3000 	}
3001 	error = getret = VOP_GETATTR(vp, &at, cred);
3002 #ifdef NFS3_STRICTVERF
3003 	/*
3004 	 * XXX This check is too strict for Solaris 2.5 clients.
3005 	 */
3006 	if (!error && toff && verf != at.va_filerev)
3007 		error = NFSERR_BAD_COOKIE;
3008 #endif
3009 	if (!error) {
3010 		nqsrv_getl(vp, ND_READ);
3011 		error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
3012 	}
3013 	if (error) {
3014 		vput(vp);
3015 		nfsm_reply(NFSX_V3POSTOPATTR);
3016 		nfsm_srvpostop_attr(getret, &at);
3017 		return (0);
3018 	}
3019 	VOP_UNLOCK(vp);
3020 
3021 	rbuf = malloc(siz, M_TEMP, M_WAITOK);
3022 again:
3023 	iv.iov_base = rbuf;
3024 	iv.iov_len = fullsiz;
3025 	io.uio_iov = &iv;
3026 	io.uio_iovcnt = 1;
3027 	io.uio_offset = (off_t)off;
3028 	io.uio_resid = fullsiz;
3029 	io.uio_rw = UIO_READ;
3030 	UIO_SETUP_SYSSPACE(&io);
3031 	eofflag = 0;
3032 
3033 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
3034 
3035 	error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
3036 
3037 	off = (u_quad_t)io.uio_offset;
3038 	getret = VOP_GETATTR(vp, &at, cred);
3039 
3040 	VOP_UNLOCK(vp);
3041 
3042 	/*
3043 	 * If the VGET operation doesn't work for this filesystem,
3044 	 * we can't support readdirplus. Returning NOTSUPP should
3045 	 * make clients fall back to plain readdir.
3046 	 * There's no need to check for VPTOFH as well, we wouldn't
3047 	 * even be here otherwise.
3048 	 */
3049 	if (!getret) {
3050 		if ((getret = VFS_VGET(vp->v_mount, at.va_fileid, &nvp)))
3051 			getret = (getret == EOPNOTSUPP) ?
3052 				NFSERR_NOTSUPP : NFSERR_IO;
3053 		else
3054 			vput(nvp);
3055 	}
3056 
3057 	if (!cookies && !error)
3058 		error = NFSERR_PERM;
3059 	if (!error)
3060 		error = getret;
3061 	if (error) {
3062 		vrele(vp);
3063 		if (cookies)
3064 			free((void *)cookies, M_TEMP);
3065 		free((void *)rbuf, M_TEMP);
3066 		nfsm_reply(NFSX_V3POSTOPATTR);
3067 		nfsm_srvpostop_attr(getret, &at);
3068 		return (0);
3069 	}
3070 	if (io.uio_resid) {
3071 		siz -= io.uio_resid;
3072 
3073 		/*
3074 		 * If nothing read, return eof
3075 		 * rpc reply
3076 		 */
3077 		if (siz == 0) {
3078 			vrele(vp);
3079 			nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
3080 				2 * NFSX_UNSIGNED);
3081 			nfsm_srvpostop_attr(getret, &at);
3082 			nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
3083 			txdr_hyper(at.va_filerev, tl);
3084 			tl += 2;
3085 			*tl++ = nfs_false;
3086 			*tl = nfs_true;
3087 			free((void *)cookies, M_TEMP);
3088 			free((void *)rbuf, M_TEMP);
3089 			return (0);
3090 		}
3091 	}
3092 
3093 	/*
3094 	 * Check for degenerate cases of nothing useful read.
3095 	 * If so go try again
3096 	 */
3097 	cpos = rbuf;
3098 	cend = rbuf + siz;
3099 	dp = (struct dirent *)cpos;
3100 	cookiep = cookies;
3101 
3102 	while (cpos < cend && ncookies > 0 &&
3103 		(dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
3104 		cpos += dp->d_reclen;
3105 		dp = (struct dirent *)cpos;
3106 		cookiep++;
3107 		ncookies--;
3108 	}
3109 	if (cpos >= cend || ncookies == 0) {
3110 		toff = off;
3111 		siz = fullsiz;
3112 		free(cookies, M_TEMP);
3113 		cookies = NULL;
3114 		goto again;
3115 	}
3116 
3117 	dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF + 2 * NFSX_UNSIGNED;
3118 	nfsm_reply(cnt);
3119 	nfsm_srvpostop_attr(getret, &at);
3120 	nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3121 	txdr_hyper(at.va_filerev, tl);
3122 	mp = mp2 = mb;
3123 	bp = bpos;
3124 	be = bp + M_TRAILINGSPACE(mp);
3125 
3126 	/* Loop through the records and build reply */
3127 	while (cpos < cend && ncookies > 0) {
3128 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
3129 			nfsrvfh_t nnsfh;
3130 
3131 			nlen = dp->d_namlen;
3132 			rem = nfsm_rndup(nlen)-nlen;
3133 
3134 			/*
3135 			 * For readdir_and_lookup get the vnode using
3136 			 * the file number.
3137 			 */
3138 			if (VFS_VGET(vp->v_mount, dp->d_fileno, &nvp))
3139 				goto invalid;
3140 			if (nfsrv_composefh(nvp, &nnsfh, true)) {
3141 				vput(nvp);
3142 				goto invalid;
3143 			}
3144 			if (VOP_GETATTR(nvp, vap, cred)) {
3145 				vput(nvp);
3146 				goto invalid;
3147 			}
3148 			vput(nvp);
3149 
3150 			/*
3151 			 * If either the dircount or maxcount will be
3152 			 * exceeded, get out now. Both of these lengths
3153 			 * are calculated conservatively, including all
3154 			 * XDR overheads.
3155 			 */
3156 			len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
3157 				NFSX_V3POSTOPATTR);
3158 			dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
3159 			if (len > cnt || dirlen > fullsiz) {
3160 				eofflag = 0;
3161 				break;
3162 			}
3163 
3164 			/*
3165 			 * Build the directory record xdr from
3166 			 * the dirent entry.
3167 			 */
3168 			fp = (struct nfs_fattr *)&fl.fl_fattr;
3169 			nfsm_srvfillattr(vap, fp);
3170 			fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
3171 			fl.fl_fhok = nfs_true;
3172 			fl.fl_postopok = nfs_true;
3173 			txdr_hyper(*cookiep, fl.fl_off.nfsuquad);
3174 
3175 			nfsm_clget;
3176 			*tl = nfs_true;
3177 			bp += NFSX_UNSIGNED;
3178 			nfsm_clget;
3179 			*tl = txdr_unsigned(dp->d_fileno >> 32);
3180 			bp += NFSX_UNSIGNED;
3181 			nfsm_clget;
3182 			*tl = txdr_unsigned(dp->d_fileno);
3183 			bp += NFSX_UNSIGNED;
3184 			nfsm_clget;
3185 			*tl = txdr_unsigned(nlen);
3186 			bp += NFSX_UNSIGNED;
3187 
3188 			/* And loop around copying the name */
3189 			xfer = nlen;
3190 			cp = dp->d_name;
3191 			while (xfer > 0) {
3192 				nfsm_clget;
3193 				if ((bp + xfer) > be)
3194 					tsiz = be - bp;
3195 				else
3196 					tsiz = xfer;
3197 				memcpy(bp, cp, tsiz);
3198 				bp += tsiz;
3199 				xfer -= tsiz;
3200 				if (xfer > 0)
3201 					cp += tsiz;
3202 			}
3203 			/* And null pad to an int32_t boundary */
3204 			for (i = 0; i < rem; i++)
3205 				*bp++ = '\0';
3206 
3207 			/*
3208 			 * Now copy the flrep structure out.
3209 			 */
3210 			xfer = sizeof(struct flrep);
3211 			cp = (void *)&fl;
3212 			while (xfer > 0) {
3213 				nfsm_clget;
3214 				if ((bp + xfer) > be)
3215 					tsiz = be - bp;
3216 				else
3217 					tsiz = xfer;
3218 				memcpy(bp, cp, tsiz);
3219 				bp += tsiz;
3220 				xfer -= tsiz;
3221 				if (xfer > 0)
3222 					cp += tsiz;
3223 			}
3224 
3225 			/*
3226 			 * ... and filehandle.
3227 			 */
3228 			xfer = NFSRVFH_SIZE(&nnsfh);
3229 			cp = NFSRVFH_DATA(&nnsfh);
3230 			while (xfer > 0) {
3231 				nfsm_clget;
3232 				if ((bp + xfer) > be)
3233 					tsiz = be - bp;
3234 				else
3235 					tsiz = xfer;
3236 				memcpy(bp, cp, tsiz);
3237 				bp += tsiz;
3238 				xfer -= tsiz;
3239 				if (xfer > 0)
3240 					cp += tsiz;
3241 			}
3242 		}
3243 invalid:
3244 		cpos += dp->d_reclen;
3245 		dp = (struct dirent *)cpos;
3246 		cookiep++;
3247 		ncookies--;
3248 	}
3249 	vrele(vp);
3250 	nfsm_clget;
3251 	*tl = nfs_false;
3252 	bp += NFSX_UNSIGNED;
3253 	nfsm_clget;
3254 	if (eofflag)
3255 		*tl = nfs_true;
3256 	else
3257 		*tl = nfs_false;
3258 	bp += NFSX_UNSIGNED;
3259 	if (mp != mb) {
3260 		if (bp < be)
3261 			mp->m_len = bp - mtod(mp, char *);
3262 	} else
3263 		mp->m_len += bp - bpos;
3264 	free((void *)cookies, M_TEMP);
3265 	free((void *)rbuf, M_TEMP);
3266 	nfsm_srvdone;
3267 }
3268 
3269 /*
3270  * nfs commit service
3271  */
3272 int
3273 nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3274 {
3275 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3276 	struct mbuf *nam = nfsd->nd_nam;
3277 	char *dpos = nfsd->nd_dpos;
3278 	kauth_cred_t cred = nfsd->nd_cr;
3279 	struct vattr bfor, aft;
3280 	struct vnode *vp;
3281 	nfsrvfh_t nsfh;
3282 	u_int32_t *tl;
3283 	int32_t t1;
3284 	char *bpos;
3285 	int error = 0, rdonly, for_ret = 1, aft_ret = 1, cache = 0;
3286 	uint32_t cnt;
3287 	char *cp2;
3288 	struct mbuf *mb, *mreq __unused;
3289 	u_quad_t frev, off, end;
3290 
3291 	nfsm_srvmtofh(&nsfh);
3292 	nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3293 
3294 	off = fxdr_hyper(tl);
3295 	tl += 2;
3296 	cnt = fxdr_unsigned(uint32_t, *tl);
3297 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3298 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3299 	if (error) {
3300 		nfsm_reply(2 * NFSX_UNSIGNED);
3301 		nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3302 		return (0);
3303 	}
3304 	for_ret = VOP_GETATTR(vp, &bfor, cred);
3305 	end = (cnt > 0) ? off + cnt : vp->v_size;
3306 	if (end < off || end > vp->v_size)
3307 		end = vp->v_size;
3308 	if (off < vp->v_size)
3309 		error = VOP_FSYNC(vp, cred, FSYNC_WAIT, off, end);
3310 	/* else error == 0, from nfsrv_fhtovp() */
3311 	aft_ret = VOP_GETATTR(vp, &aft, cred);
3312 	vput(vp);
3313 	nfsm_reply(NFSX_V3WCCDATA + NFSX_V3WRITEVERF);
3314 	nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3315 	if (!error) {
3316 		nfsm_build(tl, u_int32_t *, NFSX_V3WRITEVERF);
3317 		*tl++ = txdr_unsigned(boottime.tv_sec);
3318 		*tl = txdr_unsigned(boottime.tv_nsec / 1000);
3319 	} else {
3320 		return (0);
3321 	}
3322 	nfsm_srvdone;
3323 }
3324 
3325 /*
3326  * nfs statfs service
3327  */
3328 int
3329 nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3330 {
3331 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3332 	struct mbuf *nam = nfsd->nd_nam;
3333 	char *dpos = nfsd->nd_dpos;
3334 	kauth_cred_t cred = nfsd->nd_cr;
3335 	struct statvfs *sf = NULL;
3336 	struct nfs_statfs *sfp;
3337 	u_int32_t *tl;
3338 	int32_t t1;
3339 	char *bpos;
3340 	int error = 0, rdonly, cache = 0, getret = 1;
3341 	int v3 = (nfsd->nd_flag & ND_NFSV3);
3342 	char *cp2;
3343 	struct mbuf *mb, *mreq __unused;
3344 	struct vnode *vp;
3345 	struct vattr at;
3346 	nfsrvfh_t nsfh;
3347 	u_quad_t frev, tval;
3348 
3349 	nfsm_srvmtofh(&nsfh);
3350 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3351 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3352 	if (error) {
3353 		nfsm_reply(NFSX_UNSIGNED);
3354 		nfsm_srvpostop_attr(getret, &at);
3355 		return (0);
3356 	}
3357 	sf = malloc(sizeof(*sf), M_TEMP, M_WAITOK);
3358 	error = VFS_STATVFS(vp->v_mount, sf);
3359 	getret = VOP_GETATTR(vp, &at, cred);
3360 	vput(vp);
3361 	nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_STATFS(v3));
3362 	if (v3)
3363 		nfsm_srvpostop_attr(getret, &at);
3364 	if (error) {
3365 		free(sf, M_TEMP);
3366 		return (0);
3367 	}
3368 	nfsm_build(sfp, struct nfs_statfs *, NFSX_STATFS(v3));
3369 	if (v3) {
3370 		tval = (u_quad_t)((quad_t)sf->f_blocks * (quad_t)sf->f_frsize);
3371 		txdr_hyper(tval, &sfp->sf_tbytes);
3372 		tval = (u_quad_t)((quad_t)sf->f_bfree * (quad_t)sf->f_frsize);
3373 		txdr_hyper(tval, &sfp->sf_fbytes);
3374 		tval = (u_quad_t)((quad_t)sf->f_bavail * (quad_t)sf->f_frsize);
3375 		txdr_hyper(tval, &sfp->sf_abytes);
3376 		tval = (u_quad_t)sf->f_files;
3377 		txdr_hyper(tval, &sfp->sf_tfiles);
3378 		tval = (u_quad_t)sf->f_ffree;
3379 		txdr_hyper(tval, &sfp->sf_ffiles);
3380 		txdr_hyper(tval, &sfp->sf_afiles);
3381 		sfp->sf_invarsec = 0;
3382 	} else {
3383 		sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
3384 		sfp->sf_bsize = txdr_unsigned(sf->f_frsize);
3385 		sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
3386 		sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
3387 		sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
3388 	}
3389 nfsmout:
3390 	if (sf)
3391 	    free(sf, M_TEMP);
3392 	return error;
3393 }
3394 
3395 /*
3396  * nfs fsinfo service
3397  */
3398 int
3399 nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3400 {
3401 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3402 	struct mbuf *nam = nfsd->nd_nam;
3403 	char *dpos = nfsd->nd_dpos;
3404 	kauth_cred_t cred = nfsd->nd_cr;
3405 	u_int32_t *tl;
3406 	struct nfsv3_fsinfo *sip;
3407 	int32_t t1;
3408 	char *bpos;
3409 	int error = 0, rdonly, cache = 0, getret = 1;
3410 	uint32_t maxdata;
3411 	char *cp2;
3412 	struct mbuf *mb, *mreq __unused;
3413 	struct vnode *vp;
3414 	struct vattr at;
3415 	nfsrvfh_t nsfh;
3416 	u_quad_t frev, maxfsize;
3417 	struct statvfs *sb;
3418 
3419 	nfsm_srvmtofh(&nsfh);
3420 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3421 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3422 	if (error) {
3423 		nfsm_reply(NFSX_UNSIGNED);
3424 		nfsm_srvpostop_attr(getret, &at);
3425 		return (0);
3426 	}
3427 
3428 	/* XXX Try to make a guess on the max file size. */
3429 	sb = malloc(sizeof(*sb), M_TEMP, M_WAITOK);
3430 	VFS_STATVFS(vp->v_mount, sb);
3431 	maxfsize = (u_quad_t)0x80000000 * sb->f_frsize - 1;
3432 	free(sb, M_TEMP);
3433 
3434 	getret = VOP_GETATTR(vp, &at, cred);
3435 	vput(vp);
3436 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3FSINFO);
3437 	nfsm_srvpostop_attr(getret, &at);
3438 	nfsm_build(sip, struct nfsv3_fsinfo *, NFSX_V3FSINFO);
3439 
3440 	/*
3441 	 * XXX
3442 	 * There should be file system VFS OP(s) to get this information.
3443 	 * For now, assume ufs.
3444 	 */
3445 	if (slp->ns_so->so_type == SOCK_DGRAM)
3446 		maxdata = NFS_MAXDGRAMDATA;
3447 	else
3448 		maxdata = NFS_MAXDATA;
3449 	sip->fs_rtmax = txdr_unsigned(maxdata);
3450 	sip->fs_rtpref = txdr_unsigned(maxdata);
3451 	sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
3452 	sip->fs_wtmax = txdr_unsigned(maxdata);
3453 	sip->fs_wtpref = txdr_unsigned(maxdata);
3454 	sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
3455 	sip->fs_dtpref = txdr_unsigned(maxdata);
3456 	txdr_hyper(maxfsize, &sip->fs_maxfilesize);
3457 	sip->fs_timedelta.nfsv3_sec = 0;
3458 	sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
3459 	sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
3460 		NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
3461 		NFSV3FSINFO_CANSETTIME);
3462 	nfsm_srvdone;
3463 }
3464 
3465 /*
3466  * nfs pathconf service
3467  */
3468 int
3469 nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3470 {
3471 	struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3472 	struct mbuf *nam = nfsd->nd_nam;
3473 	char *dpos = nfsd->nd_dpos;
3474 	kauth_cred_t cred = nfsd->nd_cr;
3475 	u_int32_t *tl;
3476 	struct nfsv3_pathconf *pc;
3477 	int32_t t1;
3478 	char *bpos;
3479 	int error = 0, rdonly, cache = 0, getret = 1;
3480 	register_t linkmax, namemax, chownres, notrunc;
3481 	char *cp2;
3482 	struct mbuf *mb, *mreq __unused;
3483 	struct vnode *vp;
3484 	struct vattr at;
3485 	nfsrvfh_t nsfh;
3486 	u_quad_t frev;
3487 
3488 	nfsm_srvmtofh(&nsfh);
3489 	error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3490 		 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3491 	if (error) {
3492 		nfsm_reply(NFSX_UNSIGNED);
3493 		nfsm_srvpostop_attr(getret, &at);
3494 		return (0);
3495 	}
3496 	error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
3497 	if (!error)
3498 		error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
3499 	if (!error)
3500 		error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
3501 	if (!error)
3502 		error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
3503 	getret = VOP_GETATTR(vp, &at, cred);
3504 	vput(vp);
3505 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3PATHCONF);
3506 	nfsm_srvpostop_attr(getret, &at);
3507 	if (error)
3508 		return (0);
3509 	nfsm_build(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
3510 
3511 	pc->pc_linkmax = txdr_unsigned(linkmax);
3512 	pc->pc_namemax = txdr_unsigned(namemax);
3513 	pc->pc_notrunc = txdr_unsigned(notrunc);
3514 	pc->pc_chownrestricted = txdr_unsigned(chownres);
3515 
3516 	/*
3517 	 * These should probably be supported by VOP_PATHCONF(), but
3518 	 * until msdosfs is exportable (why would you want to?), the
3519 	 * Unix defaults should be ok.
3520 	 */
3521 	pc->pc_caseinsensitive = nfs_false;
3522 	pc->pc_casepreserving = nfs_true;
3523 	nfsm_srvdone;
3524 }
3525 
3526 /*
3527  * Null operation, used by clients to ping server
3528  */
3529 /* ARGSUSED */
3530 int
3531 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3532     struct lwp *lwp, struct mbuf **mrq)
3533 {
3534 	struct mbuf *mrep = nfsd->nd_mrep;
3535 	char *bpos;
3536 	int error = NFSERR_RETVOID, cache = 0;
3537 	struct mbuf *mb, *mreq __unused;
3538 	u_quad_t frev;
3539 
3540 	nfsm_reply(0);
3541 nfsmout:
3542 	return (0);
3543 }
3544 
3545 /*
3546  * No operation, used for obsolete procedures
3547  */
3548 /* ARGSUSED */
3549 int
3550 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3551     struct lwp *lwp, struct mbuf **mrq)
3552 {
3553 	struct mbuf *mrep = nfsd->nd_mrep;
3554 	char *bpos;
3555 	int error, cache = 0;
3556 	struct mbuf *mb, *mreq __unused;
3557 	u_quad_t frev;
3558 
3559 	if (nfsd->nd_repstat)
3560 		error = nfsd->nd_repstat;
3561 	else
3562 		error = EPROCUNAVAIL;
3563 	nfsm_reply(0);
3564 nfsmout:
3565 	return (0);
3566 }
3567 
3568 /*
3569  * Perform access checking for vnodes obtained from file handles that would
3570  * refer to files already opened by a Unix client. You cannot just use
3571  * vn_writechk() and VOP_ACCESS() for two reasons.
3572  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
3573  * 2 - The owner is to be given access irrespective of mode bits for some
3574  *     operations, so that processes that chmod after opening a file don't
3575  *     break. I don't like this because it opens a security hole, but since
3576  *     the nfs server opens a security hole the size of a barn door anyhow,
3577  *     what the heck.
3578  *
3579  * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
3580  * will return EPERM instead of EACCES. EPERM is always an error.
3581  */
3582 int
3583 nfsrv_access(struct vnode *vp, int flags, kauth_cred_t cred, int rdonly, struct lwp *lwp, int override)
3584 {
3585 	struct vattr vattr;
3586 	int error;
3587 	if (flags & VWRITE) {
3588 		/* Just vn_writechk() changed to check rdonly */
3589 		/*
3590 		 * Disallow write attempts on read-only file systems;
3591 		 * unless the file is a socket or a block or character
3592 		 * device resident on the file system.
3593 		 */
3594 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
3595 			switch (vp->v_type) {
3596 			case VREG:
3597 			case VDIR:
3598 			case VLNK:
3599 				return (EROFS);
3600 			default:
3601 				break;
3602 			}
3603 		}
3604 
3605 		/*
3606 		 * If the vnode is in use as a process's text,
3607 		 * we can't allow writing.
3608 		 */
3609 		if (vp->v_iflag & VI_TEXT)
3610 			return (ETXTBSY);
3611 	}
3612 	error = VOP_GETATTR(vp, &vattr, cred);
3613 	if (error)
3614 		return (error);
3615 	error = VOP_ACCESS(vp, flags, cred);
3616 	/*
3617 	 * Allow certain operations for the owner (reads and writes
3618 	 * on files that are already open).
3619 	 */
3620 	if (override && error == EACCES && kauth_cred_geteuid(cred) == vattr.va_uid)
3621 		error = 0;
3622 	return error;
3623 }
3624