xref: /netbsd-src/sys/nfs/nfs_syscalls.c (revision 466a16a118933bd295a8a104f095714fadf9cf68)
1 /*	$NetBSD: nfs_syscalls.c,v 1.143 2008/11/28 06:47:08 pooka Exp $	*/
2 
3 /*
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)nfs_syscalls.c	8.5 (Berkeley) 3/30/95
35  */
36 
37 #include <sys/cdefs.h>
38 __KERNEL_RCSID(0, "$NetBSD: nfs_syscalls.c,v 1.143 2008/11/28 06:47:08 pooka Exp $");
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/kernel.h>
43 #include <sys/file.h>
44 #include <sys/stat.h>
45 #include <sys/vnode.h>
46 #include <sys/mount.h>
47 #include <sys/proc.h>
48 #include <sys/uio.h>
49 #include <sys/malloc.h>
50 #include <sys/kmem.h>
51 #include <sys/buf.h>
52 #include <sys/mbuf.h>
53 #include <sys/socket.h>
54 #include <sys/socketvar.h>
55 #include <sys/signalvar.h>
56 #include <sys/domain.h>
57 #include <sys/protosw.h>
58 #include <sys/namei.h>
59 #include <sys/syslog.h>
60 #include <sys/filedesc.h>
61 #include <sys/kthread.h>
62 #include <sys/kauth.h>
63 #include <sys/syscallargs.h>
64 
65 #include <netinet/in.h>
66 #include <netinet/tcp.h>
67 #include <nfs/xdr_subs.h>
68 #include <nfs/rpcv2.h>
69 #include <nfs/nfsproto.h>
70 #include <nfs/nfs.h>
71 #include <nfs/nfsm_subs.h>
72 #include <nfs/nfsrvcache.h>
73 #include <nfs/nfsmount.h>
74 #include <nfs/nfsnode.h>
75 #include <nfs/nfsrtt.h>
76 #include <nfs/nfs_var.h>
77 
78 extern int32_t (*nfsrv3_procs[NFS_NPROCS]) __P((struct nfsrv_descript *,
79 						struct nfssvc_sock *,
80 						struct lwp *, struct mbuf **));
81 extern int nfsrvw_procrastinate;
82 extern int nuidhash_max;
83 
84 static int nfs_numnfsd = 0;
85 static struct nfsdrt nfsdrt;
86 kmutex_t nfsd_lock;
87 struct nfssvc_sockhead nfssvc_sockhead;
88 kcondvar_t nfsd_initcv;
89 struct nfssvc_sockhead nfssvc_sockpending;
90 struct nfsdhead nfsd_head;
91 struct nfsdidlehead nfsd_idle_head;
92 
93 int nfssvc_sockhead_flag;
94 int nfsd_head_flag;
95 
96 struct nfssvc_sock *nfs_udpsock;
97 struct nfssvc_sock *nfs_udp6sock;
98 
99 static struct nfssvc_sock *nfsrv_sockalloc __P((void));
100 static void nfsrv_sockfree __P((struct nfssvc_sock *));
101 static void nfsd_rt __P((int, struct nfsrv_descript *, int));
102 
103 /*
104  * NFS server system calls
105  */
106 
107 
108 /*
109  * Nfs server pseudo system call for the nfsd's
110  * Based on the flag value it either:
111  * - adds a socket to the selection list
112  * - remains in the kernel as an nfsd
113  * - remains in the kernel as an nfsiod
114  */
115 int
116 sys_nfssvc(struct lwp *l, const struct sys_nfssvc_args *uap, register_t *retval)
117 {
118 	/* {
119 		syscallarg(int) flag;
120 		syscallarg(void *) argp;
121 	} */
122 	int error;
123 	file_t *fp;
124 	struct mbuf *nam;
125 	struct nfsd_args nfsdarg;
126 	struct nfsd_srvargs nfsd_srvargs, *nsd = &nfsd_srvargs;
127 	struct nfsd *nfsd;
128 	struct nfssvc_sock *slp;
129 	struct nfsuid *nuidp;
130 
131 	/*
132 	 * Must be super user
133 	 */
134 	error = kauth_authorize_network(l->l_cred, KAUTH_NETWORK_NFS,
135 	    KAUTH_REQ_NETWORK_NFS_SVC, NULL, NULL, NULL);
136 	if (error)
137 		return (error);
138 
139 	mutex_enter(&nfsd_lock);
140 	while (nfssvc_sockhead_flag & SLP_INIT) {
141 		cv_wait(&nfsd_initcv, &nfsd_lock);
142 	}
143 	mutex_exit(&nfsd_lock);
144 
145 	if (SCARG(uap, flag) & NFSSVC_BIOD) {
146 		/* Dummy implementation of nfsios for 1.4 and earlier. */
147 		error = kpause("nfsbiod", true, 0, NULL);
148 	} else if (SCARG(uap, flag) & NFSSVC_MNTD) {
149 		error = ENOSYS;
150 	} else if (SCARG(uap, flag) & NFSSVC_ADDSOCK) {
151 		error = copyin(SCARG(uap, argp), (void *)&nfsdarg,
152 		    sizeof(nfsdarg));
153 		if (error)
154 			return (error);
155 		/* getsock() will use the descriptor for us */
156 		if ((fp = fd_getfile(nfsdarg.sock)) == NULL)
157 			return (EBADF);
158 		if (fp->f_type != DTYPE_SOCKET) {
159 			fd_putfile(nfsdarg.sock);
160 			return (ENOTSOCK);
161 		}
162 		if (error)
163 			return (error);
164 		/*
165 		 * Get the client address for connected sockets.
166 		 */
167 		if (nfsdarg.name == NULL || nfsdarg.namelen == 0)
168 			nam = (struct mbuf *)0;
169 		else {
170 			error = sockargs(&nam, nfsdarg.name, nfsdarg.namelen,
171 				MT_SONAME);
172 			if (error) {
173 				fd_putfile(nfsdarg.sock);
174 				return (error);
175 			}
176 		}
177 		error = nfssvc_addsock(fp, nam);
178 		fd_putfile(nfsdarg.sock);
179 	} else if (SCARG(uap, flag) & NFSSVC_SETEXPORTSLIST) {
180 		struct export_args *args;
181 		struct mountd_exports_list mel;
182 
183 		error = copyin(SCARG(uap, argp), &mel, sizeof(mel));
184 		if (error != 0)
185 			return error;
186 
187 		args = (struct export_args *)malloc(mel.mel_nexports *
188 		    sizeof(struct export_args), M_TEMP, M_WAITOK);
189 		error = copyin(mel.mel_exports, args, mel.mel_nexports *
190 		    sizeof(struct export_args));
191 		if (error != 0) {
192 			free(args, M_TEMP);
193 			return error;
194 		}
195 		mel.mel_exports = args;
196 
197 		error = mountd_set_exports_list(&mel, l);
198 
199 		free(args, M_TEMP);
200 	} else {
201 		error = copyin(SCARG(uap, argp), (void *)nsd, sizeof (*nsd));
202 		if (error)
203 			return (error);
204 		if ((SCARG(uap, flag) & NFSSVC_AUTHIN) &&
205 		    ((nfsd = nsd->nsd_nfsd)) != NULL &&
206 		    (nfsd->nfsd_slp->ns_flags & SLP_VALID)) {
207 			slp = nfsd->nfsd_slp;
208 
209 			/*
210 			 * First check to see if another nfsd has already
211 			 * added this credential.
212 			 */
213 			LIST_FOREACH(nuidp, NUIDHASH(slp, nsd->nsd_cr.cr_uid),
214 			    nu_hash) {
215 				if (kauth_cred_geteuid(nuidp->nu_cr) ==
216 				    nsd->nsd_cr.cr_uid &&
217 				    (!nfsd->nfsd_nd->nd_nam2 ||
218 				     netaddr_match(NU_NETFAM(nuidp),
219 				     &nuidp->nu_haddr, nfsd->nfsd_nd->nd_nam2)))
220 					break;
221 			}
222 			if (nuidp) {
223 			    kauth_cred_hold(nuidp->nu_cr);
224 			    nfsd->nfsd_nd->nd_cr = nuidp->nu_cr;
225 			    nfsd->nfsd_nd->nd_flag |= ND_KERBFULL;
226 			} else {
227 			    /*
228 			     * Nope, so we will.
229 			     */
230 			    if (slp->ns_numuids < nuidhash_max) {
231 				slp->ns_numuids++;
232 				nuidp = kmem_alloc(sizeof(*nuidp), KM_SLEEP);
233 			    } else
234 				nuidp = (struct nfsuid *)0;
235 			    if ((slp->ns_flags & SLP_VALID) == 0) {
236 				if (nuidp)
237 				    kmem_free(nuidp, sizeof(*nuidp));
238 			    } else {
239 				if (nuidp == (struct nfsuid *)0) {
240 				    nuidp = TAILQ_FIRST(&slp->ns_uidlruhead);
241 				    LIST_REMOVE(nuidp, nu_hash);
242 				    TAILQ_REMOVE(&slp->ns_uidlruhead, nuidp,
243 					nu_lru);
244 				    if (nuidp->nu_flag & NU_NAM)
245 					m_freem(nuidp->nu_nam);
246 			        }
247 				nuidp->nu_flag = 0;
248 				kauth_uucred_to_cred(nuidp->nu_cr,
249 				    &nsd->nsd_cr);
250 				nuidp->nu_timestamp = nsd->nsd_timestamp;
251 				nuidp->nu_expire = time_second + nsd->nsd_ttl;
252 				/*
253 				 * and save the session key in nu_key.
254 				 */
255 				memcpy(nuidp->nu_key, nsd->nsd_key,
256 				    sizeof(nsd->nsd_key));
257 				if (nfsd->nfsd_nd->nd_nam2) {
258 				    struct sockaddr_in *saddr;
259 
260 				    saddr = mtod(nfsd->nfsd_nd->nd_nam2,
261 					 struct sockaddr_in *);
262 				    switch (saddr->sin_family) {
263 				    case AF_INET:
264 					nuidp->nu_flag |= NU_INETADDR;
265 					nuidp->nu_inetaddr =
266 					     saddr->sin_addr.s_addr;
267 					break;
268 				    case AF_INET6:
269 					nuidp->nu_flag |= NU_NAM;
270 					nuidp->nu_nam = m_copym(
271 					    nfsd->nfsd_nd->nd_nam2, 0,
272 					     M_COPYALL, M_WAIT);
273 					break;
274 				    default:
275 					return EAFNOSUPPORT;
276 				    };
277 				}
278 				TAILQ_INSERT_TAIL(&slp->ns_uidlruhead, nuidp,
279 					nu_lru);
280 				LIST_INSERT_HEAD(NUIDHASH(slp, nsd->nsd_uid),
281 					nuidp, nu_hash);
282 				kauth_cred_hold(nuidp->nu_cr);
283 				nfsd->nfsd_nd->nd_cr = nuidp->nu_cr;
284 				nfsd->nfsd_nd->nd_flag |= ND_KERBFULL;
285 			    }
286 			}
287 		}
288 		if ((SCARG(uap, flag) & NFSSVC_AUTHINFAIL) &&
289 		    (nfsd = nsd->nsd_nfsd))
290 			nfsd->nfsd_flag |= NFSD_AUTHFAIL;
291 		error = nfssvc_nfsd(nsd, SCARG(uap, argp), l);
292 	}
293 	if (error == EINTR || error == ERESTART)
294 		error = 0;
295 	return (error);
296 }
297 
298 static struct nfssvc_sock *
299 nfsrv_sockalloc()
300 {
301 	struct nfssvc_sock *slp;
302 
303 	slp = kmem_alloc(sizeof(*slp), KM_SLEEP);
304 	memset(slp, 0, sizeof (struct nfssvc_sock));
305 	mutex_init(&slp->ns_lock, MUTEX_DRIVER, IPL_SOFTNET);
306 	mutex_init(&slp->ns_alock, MUTEX_DRIVER, IPL_SOFTNET);
307 	cv_init(&slp->ns_cv, "nfsdsock");
308 	TAILQ_INIT(&slp->ns_uidlruhead);
309 	LIST_INIT(&slp->ns_tq);
310 	SIMPLEQ_INIT(&slp->ns_sendq);
311 	mutex_enter(&nfsd_lock);
312 	TAILQ_INSERT_TAIL(&nfssvc_sockhead, slp, ns_chain);
313 	mutex_exit(&nfsd_lock);
314 
315 	return slp;
316 }
317 
318 static void
319 nfsrv_sockfree(struct nfssvc_sock *slp)
320 {
321 
322 	KASSERT(slp->ns_so == NULL);
323 	KASSERT(slp->ns_fp == NULL);
324 	KASSERT((slp->ns_flags & SLP_VALID) == 0);
325 	mutex_destroy(&slp->ns_lock);
326 	mutex_destroy(&slp->ns_alock);
327 	cv_destroy(&slp->ns_cv);
328 	kmem_free(slp, sizeof(*slp));
329 }
330 
331 /*
332  * Adds a socket to the list for servicing by nfsds.
333  */
334 int
335 nfssvc_addsock(fp, mynam)
336 	file_t *fp;
337 	struct mbuf *mynam;
338 {
339 	int siz;
340 	struct nfssvc_sock *slp;
341 	struct socket *so;
342 	struct nfssvc_sock *tslp;
343 	int error;
344 	int val;
345 
346 	so = (struct socket *)fp->f_data;
347 	tslp = (struct nfssvc_sock *)0;
348 	/*
349 	 * Add it to the list, as required.
350 	 */
351 	if (so->so_proto->pr_protocol == IPPROTO_UDP) {
352 		if (so->so_proto->pr_domain->dom_family == AF_INET6)
353 			tslp = nfs_udp6sock;
354 		else {
355 			tslp = nfs_udpsock;
356 			if (tslp->ns_flags & SLP_VALID) {
357 				m_freem(mynam);
358 				return (EPERM);
359 			}
360 		}
361 	}
362 	if (so->so_type == SOCK_STREAM)
363 		siz = NFS_MAXPACKET + sizeof (u_long);
364 	else
365 		siz = NFS_MAXPACKET;
366 	solock(so);
367 	error = soreserve(so, siz, siz);
368 	sounlock(so);
369 	if (error) {
370 		m_freem(mynam);
371 		return (error);
372 	}
373 
374 	/*
375 	 * Set protocol specific options { for now TCP only } and
376 	 * reserve some space. For datagram sockets, this can get called
377 	 * repeatedly for the same socket, but that isn't harmful.
378 	 */
379 	if (so->so_type == SOCK_STREAM) {
380 		val = 1;
381 		so_setsockopt(NULL, so, SOL_SOCKET, SO_KEEPALIVE, &val,
382 		    sizeof(val));
383 	}
384 	if ((so->so_proto->pr_domain->dom_family == AF_INET ||
385 	    so->so_proto->pr_domain->dom_family == AF_INET6) &&
386 	    so->so_proto->pr_protocol == IPPROTO_TCP) {
387 		val = 1;
388 		so_setsockopt(NULL, so, IPPROTO_TCP, TCP_NODELAY, &val,
389 		    sizeof(val));
390 	}
391 	solock(so);
392 	so->so_rcv.sb_flags &= ~SB_NOINTR;
393 	so->so_rcv.sb_timeo = 0;
394 	so->so_snd.sb_flags &= ~SB_NOINTR;
395 	so->so_snd.sb_timeo = 0;
396 	sounlock(so);
397 	if (tslp) {
398 		slp = tslp;
399 	} else {
400 		slp = nfsrv_sockalloc();
401 	}
402 	slp->ns_so = so;
403 	slp->ns_nam = mynam;
404 	mutex_enter(&fp->f_lock);
405 	fp->f_count++;
406 	mutex_exit(&fp->f_lock);
407 	slp->ns_fp = fp;
408 	slp->ns_flags = SLP_VALID;
409 	slp->ns_aflags = SLP_A_NEEDQ;
410 	slp->ns_gflags = 0;
411 	slp->ns_sflags = 0;
412 	solock(so);
413 	so->so_upcallarg = (void *)slp;
414 	so->so_upcall = nfsrv_soupcall;
415 	so->so_rcv.sb_flags |= SB_UPCALL;
416 	sounlock(so);
417 	nfsrv_wakenfsd(slp);
418 	return (0);
419 }
420 
421 /*
422  * Called by nfssvc() for nfsds. Just loops around servicing rpc requests
423  * until it is killed by a signal.
424  */
425 int
426 nfssvc_nfsd(nsd, argp, l)
427 	struct nfsd_srvargs *nsd;
428 	void *argp;
429 	struct lwp *l;
430 {
431 	struct timeval tv;
432 	struct mbuf *m;
433 	struct nfssvc_sock *slp;
434 	struct nfsd *nfsd = nsd->nsd_nfsd;
435 	struct nfsrv_descript *nd = NULL;
436 	struct mbuf *mreq;
437 	u_quad_t cur_usec;
438 	int error = 0, cacherep, siz, sotype, writes_todo;
439 	struct proc *p = l->l_proc;
440 	int s;
441 	bool doreinit;
442 
443 #ifndef nolint
444 	cacherep = RC_DOIT;
445 	writes_todo = 0;
446 #endif
447 	uvm_lwp_hold(l);
448 	if (nfsd == NULL) {
449 		nsd->nsd_nfsd = nfsd = kmem_alloc(sizeof(*nfsd), KM_SLEEP);
450 		memset(nfsd, 0, sizeof (struct nfsd));
451 		cv_init(&nfsd->nfsd_cv, "nfsd");
452 		nfsd->nfsd_procp = p;
453 		mutex_enter(&nfsd_lock);
454 		while ((nfssvc_sockhead_flag & SLP_INIT) != 0) {
455 			KASSERT(nfs_numnfsd == 0);
456 			cv_wait(&nfsd_initcv, &nfsd_lock);
457 		}
458 		TAILQ_INSERT_TAIL(&nfsd_head, nfsd, nfsd_chain);
459 		nfs_numnfsd++;
460 		mutex_exit(&nfsd_lock);
461 	}
462 	/*
463 	 * Loop getting rpc requests until SIGKILL.
464 	 */
465 	for (;;) {
466 		bool dummy;
467 
468 		if ((curcpu()->ci_schedstate.spc_flags & SPCF_SHOULDYIELD)
469 		    != 0) {
470 			preempt();
471 		}
472 		if (nfsd->nfsd_slp == NULL) {
473 			mutex_enter(&nfsd_lock);
474 			while (nfsd->nfsd_slp == NULL &&
475 			    (nfsd_head_flag & NFSD_CHECKSLP) == 0) {
476 				SLIST_INSERT_HEAD(&nfsd_idle_head, nfsd,
477 				    nfsd_idle);
478 				error = cv_wait_sig(&nfsd->nfsd_cv, &nfsd_lock);
479 				if (error) {
480 					slp = nfsd->nfsd_slp;
481 					nfsd->nfsd_slp = NULL;
482 					if (!slp)
483 						SLIST_REMOVE(&nfsd_idle_head,
484 						    nfsd, nfsd, nfsd_idle);
485 					mutex_exit(&nfsd_lock);
486 					if (slp) {
487 						nfsrv_wakenfsd(slp);
488 						nfsrv_slpderef(slp);
489 					}
490 					goto done;
491 				}
492 			}
493 			if (nfsd->nfsd_slp == NULL &&
494 			    (nfsd_head_flag & NFSD_CHECKSLP) != 0) {
495 				slp = TAILQ_FIRST(&nfssvc_sockpending);
496 				if (slp) {
497 					KASSERT((slp->ns_gflags & SLP_G_DOREC)
498 					    != 0);
499 					TAILQ_REMOVE(&nfssvc_sockpending, slp,
500 					    ns_pending);
501 					slp->ns_gflags &= ~SLP_G_DOREC;
502 					slp->ns_sref++;
503 					nfsd->nfsd_slp = slp;
504 				} else
505 					nfsd_head_flag &= ~NFSD_CHECKSLP;
506 			}
507 			KASSERT(nfsd->nfsd_slp == NULL ||
508 			    nfsd->nfsd_slp->ns_sref > 0);
509 			mutex_exit(&nfsd_lock);
510 			if ((slp = nfsd->nfsd_slp) == NULL)
511 				continue;
512 			if (slp->ns_flags & SLP_VALID) {
513 				bool more;
514 
515 				if (nfsdsock_testbits(slp, SLP_A_NEEDQ)) {
516 					nfsrv_rcv(slp);
517 				}
518 				if (nfsdsock_testbits(slp, SLP_A_DISCONN)) {
519 					nfsrv_zapsock(slp);
520 				}
521 				error = nfsrv_dorec(slp, nfsd, &nd, &more);
522 				getmicrotime(&tv);
523 				cur_usec = (u_quad_t)tv.tv_sec * 1000000 +
524 					(u_quad_t)tv.tv_usec;
525 				writes_todo = 0;
526 				if (error) {
527 					struct nfsrv_descript *nd2;
528 
529 					mutex_enter(&nfsd_lock);
530 					nd2 = LIST_FIRST(&slp->ns_tq);
531 					if (nd2 != NULL &&
532 					    nd2->nd_time <= cur_usec) {
533 						error = 0;
534 						cacherep = RC_DOIT;
535 						writes_todo = 1;
536 					}
537 					mutex_exit(&nfsd_lock);
538 				}
539 				if (error == 0 && more) {
540 					nfsrv_wakenfsd(slp);
541 				}
542 			}
543 		} else {
544 			error = 0;
545 			slp = nfsd->nfsd_slp;
546 		}
547 		KASSERT(slp != NULL);
548 		KASSERT(nfsd->nfsd_slp == slp);
549 		if (error || (slp->ns_flags & SLP_VALID) == 0) {
550 			if (nd) {
551 				nfsdreq_free(nd);
552 				nd = NULL;
553 			}
554 			nfsd->nfsd_slp = NULL;
555 			nfsrv_slpderef(slp);
556 			continue;
557 		}
558 		sotype = slp->ns_so->so_type;
559 		if (nd) {
560 			getmicrotime(&nd->nd_starttime);
561 			if (nd->nd_nam2)
562 				nd->nd_nam = nd->nd_nam2;
563 			else
564 				nd->nd_nam = slp->ns_nam;
565 
566 			/*
567 			 * Check to see if authorization is needed.
568 			 */
569 			if (nfsd->nfsd_flag & NFSD_NEEDAUTH) {
570 				nfsd->nfsd_flag &= ~NFSD_NEEDAUTH;
571 				nsd->nsd_haddr = mtod(nd->nd_nam,
572 				    struct sockaddr_in *)->sin_addr.s_addr;
573 				nsd->nsd_authlen = nfsd->nfsd_authlen;
574 				nsd->nsd_verflen = nfsd->nfsd_verflen;
575 				if (!copyout(nfsd->nfsd_authstr,
576 				    nsd->nsd_authstr, nfsd->nfsd_authlen) &&
577 				    !copyout(nfsd->nfsd_verfstr,
578 				    nsd->nsd_verfstr, nfsd->nfsd_verflen) &&
579 				    !copyout(nsd, argp, sizeof (*nsd))) {
580 					uvm_lwp_rele(l);
581 					return (ENEEDAUTH);
582 				}
583 				cacherep = RC_DROPIT;
584 			} else
585 				cacherep = nfsrv_getcache(nd, slp, &mreq);
586 
587 			if (nfsd->nfsd_flag & NFSD_AUTHFAIL) {
588 				nfsd->nfsd_flag &= ~NFSD_AUTHFAIL;
589 				nd->nd_procnum = NFSPROC_NOOP;
590 				nd->nd_repstat =
591 				    (NFSERR_AUTHERR | AUTH_TOOWEAK);
592 				cacherep = RC_DOIT;
593 			}
594 		}
595 
596 		/*
597 		 * Loop to get all the write rpc relies that have been
598 		 * gathered together.
599 		 */
600 		do {
601 			switch (cacherep) {
602 			case RC_DOIT:
603 				mreq = NULL;
604 				netexport_rdlock();
605 				if (writes_todo || nd == NULL ||
606 				     (!(nd->nd_flag & ND_NFSV3) &&
607 				     nd->nd_procnum == NFSPROC_WRITE &&
608 				     nfsrvw_procrastinate > 0))
609 					error = nfsrv_writegather(&nd, slp,
610 					    l, &mreq);
611 				else
612 					error =
613 					    (*(nfsrv3_procs[nd->nd_procnum]))
614 					    (nd, slp, l, &mreq);
615 				netexport_rdunlock();
616 				if (mreq == NULL) {
617 					if (nd != NULL) {
618 						if (nd->nd_nam2)
619 							m_free(nd->nd_nam2);
620 					}
621 					break;
622 				}
623 				if (error) {
624 					nfsstats.srv_errs++;
625 					nfsrv_updatecache(nd, false, mreq);
626 					if (nd->nd_nam2)
627 						m_freem(nd->nd_nam2);
628 					break;
629 				}
630 				nfsstats.srvrpccnt[nd->nd_procnum]++;
631 				nfsrv_updatecache(nd, true, mreq);
632 				nd->nd_mrep = (struct mbuf *)0;
633 			case RC_REPLY:
634 				m = mreq;
635 				siz = 0;
636 				while (m) {
637 					siz += m->m_len;
638 					m = m->m_next;
639 				}
640 				if (siz <= 0 || siz > NFS_MAXPACKET) {
641 					printf("mbuf siz=%d\n",siz);
642 					panic("Bad nfs svc reply");
643 				}
644 				m = mreq;
645 				m->m_pkthdr.len = siz;
646 				m->m_pkthdr.rcvif = (struct ifnet *)0;
647 				/*
648 				 * For stream protocols, prepend a Sun RPC
649 				 * Record Mark.
650 				 */
651 				if (sotype == SOCK_STREAM) {
652 					M_PREPEND(m, NFSX_UNSIGNED, M_WAIT);
653 					*mtod(m, u_int32_t *) =
654 					    htonl(0x80000000 | siz);
655 				}
656 				nd->nd_mreq = m;
657 				if (nfsrtton) {
658 					nfsd_rt(slp->ns_so->so_type, nd,
659 					    cacherep);
660 				}
661 				error = nfsdsock_sendreply(slp, nd);
662 				nd = NULL;
663 				if (error == EPIPE)
664 					nfsrv_zapsock(slp);
665 				if (error == EINTR || error == ERESTART) {
666 					nfsd->nfsd_slp = NULL;
667 					nfsrv_slpderef(slp);
668 					goto done;
669 				}
670 				break;
671 			case RC_DROPIT:
672 				if (nfsrtton)
673 					nfsd_rt(sotype, nd, cacherep);
674 				m_freem(nd->nd_mrep);
675 				m_freem(nd->nd_nam2);
676 				break;
677 			}
678 			if (nd) {
679 				nfsdreq_free(nd);
680 				nd = NULL;
681 			}
682 
683 			/*
684 			 * Check to see if there are outstanding writes that
685 			 * need to be serviced.
686 			 */
687 			getmicrotime(&tv);
688 			cur_usec = (u_quad_t)tv.tv_sec * 1000000 +
689 			    (u_quad_t)tv.tv_usec;
690 			s = splsoftclock();
691 			if (LIST_FIRST(&slp->ns_tq) &&
692 			    LIST_FIRST(&slp->ns_tq)->nd_time <= cur_usec) {
693 				cacherep = RC_DOIT;
694 				writes_todo = 1;
695 			} else
696 				writes_todo = 0;
697 			splx(s);
698 		} while (writes_todo);
699 		if (nfsrv_dorec(slp, nfsd, &nd, &dummy)) {
700 			nfsd->nfsd_slp = NULL;
701 			nfsrv_slpderef(slp);
702 		}
703 	}
704 done:
705 	mutex_enter(&nfsd_lock);
706 	TAILQ_REMOVE(&nfsd_head, nfsd, nfsd_chain);
707 	doreinit = --nfs_numnfsd == 0;
708 	if (doreinit)
709 		nfssvc_sockhead_flag |= SLP_INIT;
710 	mutex_exit(&nfsd_lock);
711 	cv_destroy(&nfsd->nfsd_cv);
712 	kmem_free(nfsd, sizeof(*nfsd));
713 	nsd->nsd_nfsd = NULL;
714 	if (doreinit)
715 		nfsrv_init(true);	/* Reinitialize everything */
716 	uvm_lwp_rele(l);
717 	return (error);
718 }
719 
720 /*
721  * Shut down a socket associated with an nfssvc_sock structure.
722  * Should be called with the send lock set, if required.
723  * The trick here is to increment the sref at the start, so that the nfsds
724  * will stop using it and clear ns_flag at the end so that it will not be
725  * reassigned during cleanup.
726  *
727  * called at splsoftnet.
728  */
729 void
730 nfsrv_zapsock(slp)
731 	struct nfssvc_sock *slp;
732 {
733 	struct nfsuid *nuidp, *nnuidp;
734 	struct nfsrv_descript *nwp;
735 	struct socket *so;
736 	struct mbuf *m;
737 
738 	if (nfsdsock_drain(slp)) {
739 		return;
740 	}
741 	mutex_enter(&nfsd_lock);
742 	if (slp->ns_gflags & SLP_G_DOREC) {
743 		TAILQ_REMOVE(&nfssvc_sockpending, slp, ns_pending);
744 		slp->ns_gflags &= ~SLP_G_DOREC;
745 	}
746 	mutex_exit(&nfsd_lock);
747 
748 	so = slp->ns_so;
749 	KASSERT(so != NULL);
750 	solock(so);
751 	so->so_upcall = NULL;
752 	so->so_upcallarg = NULL;
753 	so->so_rcv.sb_flags &= ~SB_UPCALL;
754 	soshutdown(so, SHUT_RDWR);
755 	sounlock(so);
756 
757 	if (slp->ns_nam)
758 		m_free(slp->ns_nam);
759 	m_freem(slp->ns_raw);
760 	m = slp->ns_rec;
761 	while (m != NULL) {
762 		struct mbuf *n;
763 
764 		n = m->m_nextpkt;
765 		m_freem(m);
766 		m = n;
767 	}
768 	for (nuidp = TAILQ_FIRST(&slp->ns_uidlruhead); nuidp != 0;
769 	    nuidp = nnuidp) {
770 		nnuidp = TAILQ_NEXT(nuidp, nu_lru);
771 		LIST_REMOVE(nuidp, nu_hash);
772 		TAILQ_REMOVE(&slp->ns_uidlruhead, nuidp, nu_lru);
773 		if (nuidp->nu_flag & NU_NAM)
774 			m_freem(nuidp->nu_nam);
775 		kmem_free(nuidp, sizeof(*nuidp));
776 	}
777 	mutex_enter(&nfsd_lock);
778 	while ((nwp = LIST_FIRST(&slp->ns_tq)) != NULL) {
779 		LIST_REMOVE(nwp, nd_tq);
780 		mutex_exit(&nfsd_lock);
781 		nfsdreq_free(nwp);
782 		mutex_enter(&nfsd_lock);
783 	}
784 	mutex_exit(&nfsd_lock);
785 }
786 
787 /*
788  * Derefence a server socket structure. If it has no more references and
789  * is no longer valid, you can throw it away.
790  */
791 void
792 nfsrv_slpderef(slp)
793 	struct nfssvc_sock *slp;
794 {
795 	uint32_t ref;
796 
797 	mutex_enter(&nfsd_lock);
798 	KASSERT(slp->ns_sref > 0);
799 	ref = --slp->ns_sref;
800 	mutex_exit(&nfsd_lock);
801 	if (ref == 0 && (slp->ns_flags & SLP_VALID) == 0) {
802 		file_t *fp;
803 
804 		mutex_enter(&nfsd_lock);
805 		KASSERT((slp->ns_gflags & SLP_G_DOREC) == 0);
806 		TAILQ_REMOVE(&nfssvc_sockhead, slp, ns_chain);
807 		mutex_exit(&nfsd_lock);
808 
809 		fp = slp->ns_fp;
810 		if (fp != NULL) {
811 			slp->ns_fp = NULL;
812 			KASSERT(fp != NULL);
813 			KASSERT(fp->f_data == slp->ns_so);
814 			KASSERT(fp->f_count > 0);
815 			closef(fp);
816 			slp->ns_so = NULL;
817 		}
818 
819 		nfsrv_sockfree(slp);
820 	}
821 }
822 
823 /*
824  * Initialize the data structures for the server.
825  * Handshake with any new nfsds starting up to avoid any chance of
826  * corruption.
827  */
828 void
829 nfsrv_init(terminating)
830 	int terminating;
831 {
832 	struct nfssvc_sock *slp;
833 
834 	if (!terminating) {
835 		mutex_init(&nfsd_lock, MUTEX_DRIVER, IPL_SOFTNET);
836 		cv_init(&nfsd_initcv, "nfsdinit");
837 	}
838 
839 	mutex_enter(&nfsd_lock);
840 	if (!terminating && (nfssvc_sockhead_flag & SLP_INIT) != 0)
841 		panic("nfsd init");
842 	nfssvc_sockhead_flag |= SLP_INIT;
843 
844 	if (terminating) {
845 		KASSERT(SLIST_EMPTY(&nfsd_idle_head));
846 		KASSERT(TAILQ_EMPTY(&nfsd_head));
847 		while ((slp = TAILQ_FIRST(&nfssvc_sockhead)) != NULL) {
848 			mutex_exit(&nfsd_lock);
849 			KASSERT(slp->ns_sref == 0);
850 			slp->ns_sref++;
851 			nfsrv_zapsock(slp);
852 			nfsrv_slpderef(slp);
853 			mutex_enter(&nfsd_lock);
854 		}
855 		KASSERT(TAILQ_EMPTY(&nfssvc_sockpending));
856 		mutex_exit(&nfsd_lock);
857 		nfsrv_cleancache();	/* And clear out server cache */
858 	} else {
859 		mutex_exit(&nfsd_lock);
860 		nfs_pub.np_valid = 0;
861 	}
862 
863 	TAILQ_INIT(&nfssvc_sockhead);
864 	TAILQ_INIT(&nfssvc_sockpending);
865 
866 	TAILQ_INIT(&nfsd_head);
867 	SLIST_INIT(&nfsd_idle_head);
868 	nfsd_head_flag &= ~NFSD_CHECKSLP;
869 
870 	nfs_udpsock = nfsrv_sockalloc();
871 	nfs_udp6sock = nfsrv_sockalloc();
872 
873 	mutex_enter(&nfsd_lock);
874 	nfssvc_sockhead_flag &= ~SLP_INIT;
875 	cv_broadcast(&nfsd_initcv);
876 	mutex_exit(&nfsd_lock);
877 }
878 
879 void
880 nfsrv_fini(void)
881 {
882 
883 	nfsrv_init(true);
884 	cv_destroy(&nfsd_initcv);
885 	mutex_destroy(&nfsd_lock);
886 }
887 
888 /*
889  * Add entries to the server monitor log.
890  */
891 static void
892 nfsd_rt(sotype, nd, cacherep)
893 	int sotype;
894 	struct nfsrv_descript *nd;
895 	int cacherep;
896 {
897 	struct timeval tv;
898 	struct drt *rt;
899 
900 	rt = &nfsdrt.drt[nfsdrt.pos];
901 	if (cacherep == RC_DOIT)
902 		rt->flag = 0;
903 	else if (cacherep == RC_REPLY)
904 		rt->flag = DRT_CACHEREPLY;
905 	else
906 		rt->flag = DRT_CACHEDROP;
907 	if (sotype == SOCK_STREAM)
908 		rt->flag |= DRT_TCP;
909 	if (nd->nd_flag & ND_NFSV3)
910 		rt->flag |= DRT_NFSV3;
911 	rt->proc = nd->nd_procnum;
912 	if (mtod(nd->nd_nam, struct sockaddr *)->sa_family == AF_INET)
913 	    rt->ipadr = mtod(nd->nd_nam, struct sockaddr_in *)->sin_addr.s_addr;
914 	else
915 	    rt->ipadr = INADDR_ANY;
916 	getmicrotime(&tv);
917 	rt->resptime = ((tv.tv_sec - nd->nd_starttime.tv_sec) * 1000000) +
918 		(tv.tv_usec - nd->nd_starttime.tv_usec);
919 	rt->tstamp = tv;
920 	nfsdrt.pos = (nfsdrt.pos + 1) % NFSRTTLOGSIZ;
921 }
922