xref: /netbsd-src/sys/nfs/nfs_syscalls.c (revision 93bf6008f8b7982c1d1a9486e4a4a0e687fe36eb)
1 /*	$NetBSD: nfs_syscalls.c,v 1.147 2009/04/10 19:04:14 bouyer Exp $	*/
2 
3 /*
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)nfs_syscalls.c	8.5 (Berkeley) 3/30/95
35  */
36 
37 #include <sys/cdefs.h>
38 __KERNEL_RCSID(0, "$NetBSD: nfs_syscalls.c,v 1.147 2009/04/10 19:04:14 bouyer Exp $");
39 
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/kernel.h>
43 #include <sys/file.h>
44 #include <sys/stat.h>
45 #include <sys/vnode.h>
46 #include <sys/mount.h>
47 #include <sys/proc.h>
48 #include <sys/uio.h>
49 #include <sys/malloc.h>
50 #include <sys/kmem.h>
51 #include <sys/buf.h>
52 #include <sys/mbuf.h>
53 #include <sys/socket.h>
54 #include <sys/socketvar.h>
55 #include <sys/signalvar.h>
56 #include <sys/domain.h>
57 #include <sys/protosw.h>
58 #include <sys/namei.h>
59 #include <sys/syslog.h>
60 #include <sys/filedesc.h>
61 #include <sys/kthread.h>
62 #include <sys/kauth.h>
63 #include <sys/syscallargs.h>
64 
65 #include <netinet/in.h>
66 #include <netinet/tcp.h>
67 #include <nfs/xdr_subs.h>
68 #include <nfs/rpcv2.h>
69 #include <nfs/nfsproto.h>
70 #include <nfs/nfs.h>
71 #include <nfs/nfsm_subs.h>
72 #include <nfs/nfsrvcache.h>
73 #include <nfs/nfsmount.h>
74 #include <nfs/nfsnode.h>
75 #include <nfs/nfsrtt.h>
76 #include <nfs/nfs_var.h>
77 
78 extern int32_t (*nfsrv3_procs[NFS_NPROCS])(struct nfsrv_descript *,
79 						struct nfssvc_sock *,
80 						struct lwp *, struct mbuf **);
81 extern int nfsrvw_procrastinate;
82 extern int nuidhash_max;
83 
84 static int nfs_numnfsd = 0;
85 static struct nfsdrt nfsdrt;
86 kmutex_t nfsd_lock;
87 struct nfssvc_sockhead nfssvc_sockhead;
88 kcondvar_t nfsd_initcv;
89 struct nfssvc_sockhead nfssvc_sockpending;
90 struct nfsdhead nfsd_head;
91 struct nfsdidlehead nfsd_idle_head;
92 
93 int nfssvc_sockhead_flag;
94 int nfsd_head_flag;
95 
96 struct nfssvc_sock *nfs_udpsock;
97 struct nfssvc_sock *nfs_udp6sock;
98 
99 static struct nfssvc_sock *nfsrv_sockalloc(void);
100 static void nfsrv_sockfree(struct nfssvc_sock *);
101 static void nfsd_rt(int, struct nfsrv_descript *, int);
102 
103 /*
104  * NFS server system calls
105  */
106 
107 
108 /*
109  * Nfs server pseudo system call for the nfsd's
110  * Based on the flag value it either:
111  * - adds a socket to the selection list
112  * - remains in the kernel as an nfsd
113  * - remains in the kernel as an nfsiod
114  */
115 int
116 sys_nfssvc(struct lwp *l, const struct sys_nfssvc_args *uap, register_t *retval)
117 {
118 	/* {
119 		syscallarg(int) flag;
120 		syscallarg(void *) argp;
121 	} */
122 	int error;
123 	file_t *fp;
124 	struct mbuf *nam;
125 	struct nfsd_args nfsdarg;
126 	struct nfsd_srvargs nfsd_srvargs, *nsd = &nfsd_srvargs;
127 	struct nfsd *nfsd;
128 	struct nfssvc_sock *slp;
129 	struct nfsuid *nuidp;
130 
131 	/*
132 	 * Must be super user
133 	 */
134 	error = kauth_authorize_network(l->l_cred, KAUTH_NETWORK_NFS,
135 	    KAUTH_REQ_NETWORK_NFS_SVC, NULL, NULL, NULL);
136 	if (error)
137 		return (error);
138 
139 	mutex_enter(&nfsd_lock);
140 	while (nfssvc_sockhead_flag & SLP_INIT) {
141 		cv_wait(&nfsd_initcv, &nfsd_lock);
142 	}
143 	mutex_exit(&nfsd_lock);
144 
145 	if (SCARG(uap, flag) & NFSSVC_BIOD) {
146 		/* Dummy implementation of nfsios for 1.4 and earlier. */
147 		error = kpause("nfsbiod", true, 0, NULL);
148 	} else if (SCARG(uap, flag) & NFSSVC_MNTD) {
149 		error = ENOSYS;
150 	} else if (SCARG(uap, flag) & NFSSVC_ADDSOCK) {
151 		error = copyin(SCARG(uap, argp), (void *)&nfsdarg,
152 		    sizeof(nfsdarg));
153 		if (error)
154 			return (error);
155 		/* getsock() will use the descriptor for us */
156 		if ((fp = fd_getfile(nfsdarg.sock)) == NULL)
157 			return (EBADF);
158 		if (fp->f_type != DTYPE_SOCKET) {
159 			fd_putfile(nfsdarg.sock);
160 			return (ENOTSOCK);
161 		}
162 		if (error)
163 			return (error);
164 		/*
165 		 * Get the client address for connected sockets.
166 		 */
167 		if (nfsdarg.name == NULL || nfsdarg.namelen == 0)
168 			nam = (struct mbuf *)0;
169 		else {
170 			error = sockargs(&nam, nfsdarg.name, nfsdarg.namelen,
171 				MT_SONAME);
172 			if (error) {
173 				fd_putfile(nfsdarg.sock);
174 				return (error);
175 			}
176 		}
177 		error = nfssvc_addsock(fp, nam);
178 		fd_putfile(nfsdarg.sock);
179 	} else if (SCARG(uap, flag) & NFSSVC_SETEXPORTSLIST) {
180 		struct export_args *args;
181 		struct mountd_exports_list mel;
182 
183 		error = copyin(SCARG(uap, argp), &mel, sizeof(mel));
184 		if (error != 0)
185 			return error;
186 
187 		args = (struct export_args *)malloc(mel.mel_nexports *
188 		    sizeof(struct export_args), M_TEMP, M_WAITOK);
189 		error = copyin(mel.mel_exports, args, mel.mel_nexports *
190 		    sizeof(struct export_args));
191 		if (error != 0) {
192 			free(args, M_TEMP);
193 			return error;
194 		}
195 		mel.mel_exports = args;
196 
197 		error = mountd_set_exports_list(&mel, l);
198 
199 		free(args, M_TEMP);
200 	} else {
201 		error = copyin(SCARG(uap, argp), (void *)nsd, sizeof (*nsd));
202 		if (error)
203 			return (error);
204 		if ((SCARG(uap, flag) & NFSSVC_AUTHIN) &&
205 		    ((nfsd = nsd->nsd_nfsd)) != NULL &&
206 		    (nfsd->nfsd_slp->ns_flags & SLP_VALID)) {
207 			slp = nfsd->nfsd_slp;
208 
209 			/*
210 			 * First check to see if another nfsd has already
211 			 * added this credential.
212 			 */
213 			LIST_FOREACH(nuidp, NUIDHASH(slp, nsd->nsd_cr.cr_uid),
214 			    nu_hash) {
215 				if (kauth_cred_geteuid(nuidp->nu_cr) ==
216 				    nsd->nsd_cr.cr_uid &&
217 				    (!nfsd->nfsd_nd->nd_nam2 ||
218 				     netaddr_match(NU_NETFAM(nuidp),
219 				     &nuidp->nu_haddr, nfsd->nfsd_nd->nd_nam2)))
220 					break;
221 			}
222 			if (nuidp) {
223 			    kauth_cred_hold(nuidp->nu_cr);
224 			    nfsd->nfsd_nd->nd_cr = nuidp->nu_cr;
225 			    nfsd->nfsd_nd->nd_flag |= ND_KERBFULL;
226 			} else {
227 			    /*
228 			     * Nope, so we will.
229 			     */
230 			    if (slp->ns_numuids < nuidhash_max) {
231 				slp->ns_numuids++;
232 				nuidp = kmem_alloc(sizeof(*nuidp), KM_SLEEP);
233 			    } else
234 				nuidp = (struct nfsuid *)0;
235 			    if ((slp->ns_flags & SLP_VALID) == 0) {
236 				if (nuidp)
237 				    kmem_free(nuidp, sizeof(*nuidp));
238 			    } else {
239 				if (nuidp == (struct nfsuid *)0) {
240 				    nuidp = TAILQ_FIRST(&slp->ns_uidlruhead);
241 				    LIST_REMOVE(nuidp, nu_hash);
242 				    TAILQ_REMOVE(&slp->ns_uidlruhead, nuidp,
243 					nu_lru);
244 				    if (nuidp->nu_flag & NU_NAM)
245 					m_freem(nuidp->nu_nam);
246 			        }
247 				nuidp->nu_flag = 0;
248 				kauth_uucred_to_cred(nuidp->nu_cr,
249 				    &nsd->nsd_cr);
250 				nuidp->nu_timestamp = nsd->nsd_timestamp;
251 				nuidp->nu_expire = time_second + nsd->nsd_ttl;
252 				/*
253 				 * and save the session key in nu_key.
254 				 */
255 				memcpy(nuidp->nu_key, nsd->nsd_key,
256 				    sizeof(nsd->nsd_key));
257 				if (nfsd->nfsd_nd->nd_nam2) {
258 				    struct sockaddr_in *saddr;
259 
260 				    saddr = mtod(nfsd->nfsd_nd->nd_nam2,
261 					 struct sockaddr_in *);
262 				    switch (saddr->sin_family) {
263 				    case AF_INET:
264 					nuidp->nu_flag |= NU_INETADDR;
265 					nuidp->nu_inetaddr =
266 					     saddr->sin_addr.s_addr;
267 					break;
268 				    case AF_INET6:
269 					nuidp->nu_flag |= NU_NAM;
270 					nuidp->nu_nam = m_copym(
271 					    nfsd->nfsd_nd->nd_nam2, 0,
272 					     M_COPYALL, M_WAIT);
273 					break;
274 				    default:
275 					return EAFNOSUPPORT;
276 				    };
277 				}
278 				TAILQ_INSERT_TAIL(&slp->ns_uidlruhead, nuidp,
279 					nu_lru);
280 				LIST_INSERT_HEAD(NUIDHASH(slp, nsd->nsd_uid),
281 					nuidp, nu_hash);
282 				kauth_cred_hold(nuidp->nu_cr);
283 				nfsd->nfsd_nd->nd_cr = nuidp->nu_cr;
284 				nfsd->nfsd_nd->nd_flag |= ND_KERBFULL;
285 			    }
286 			}
287 		}
288 		if ((SCARG(uap, flag) & NFSSVC_AUTHINFAIL) &&
289 		    (nfsd = nsd->nsd_nfsd))
290 			nfsd->nfsd_flag |= NFSD_AUTHFAIL;
291 		error = nfssvc_nfsd(nsd, SCARG(uap, argp), l);
292 	}
293 	if (error == EINTR || error == ERESTART)
294 		error = 0;
295 	return (error);
296 }
297 
298 static struct nfssvc_sock *
299 nfsrv_sockalloc(void)
300 {
301 	struct nfssvc_sock *slp;
302 
303 	slp = kmem_alloc(sizeof(*slp), KM_SLEEP);
304 	memset(slp, 0, sizeof (struct nfssvc_sock));
305 	mutex_init(&slp->ns_lock, MUTEX_DRIVER, IPL_SOFTNET);
306 	mutex_init(&slp->ns_alock, MUTEX_DRIVER, IPL_SOFTNET);
307 	cv_init(&slp->ns_cv, "nfsdsock");
308 	TAILQ_INIT(&slp->ns_uidlruhead);
309 	LIST_INIT(&slp->ns_tq);
310 	SIMPLEQ_INIT(&slp->ns_sendq);
311 	mutex_enter(&nfsd_lock);
312 	TAILQ_INSERT_TAIL(&nfssvc_sockhead, slp, ns_chain);
313 	mutex_exit(&nfsd_lock);
314 
315 	return slp;
316 }
317 
318 static void
319 nfsrv_sockfree(struct nfssvc_sock *slp)
320 {
321 
322 	KASSERT(slp->ns_so == NULL);
323 	KASSERT(slp->ns_fp == NULL);
324 	KASSERT((slp->ns_flags & SLP_VALID) == 0);
325 	mutex_destroy(&slp->ns_lock);
326 	mutex_destroy(&slp->ns_alock);
327 	cv_destroy(&slp->ns_cv);
328 	kmem_free(slp, sizeof(*slp));
329 }
330 
331 /*
332  * Adds a socket to the list for servicing by nfsds.
333  */
334 int
335 nfssvc_addsock(file_t *fp, struct mbuf *mynam)
336 {
337 	int siz;
338 	struct nfssvc_sock *slp;
339 	struct socket *so;
340 	struct nfssvc_sock *tslp;
341 	int error;
342 	int val;
343 
344 	so = (struct socket *)fp->f_data;
345 	tslp = (struct nfssvc_sock *)0;
346 	/*
347 	 * Add it to the list, as required.
348 	 */
349 	if (so->so_proto->pr_protocol == IPPROTO_UDP) {
350 		if (so->so_proto->pr_domain->dom_family == AF_INET6)
351 			tslp = nfs_udp6sock;
352 		else {
353 			tslp = nfs_udpsock;
354 			if (tslp->ns_flags & SLP_VALID) {
355 				m_freem(mynam);
356 				return (EPERM);
357 			}
358 		}
359 	}
360 	if (so->so_type == SOCK_STREAM)
361 		siz = NFS_MAXPACKET + sizeof (u_long);
362 	else
363 		siz = NFS_MAXPACKET;
364 	solock(so);
365 	error = soreserve(so, siz, siz);
366 	sounlock(so);
367 	if (error) {
368 		m_freem(mynam);
369 		return (error);
370 	}
371 
372 	/*
373 	 * Set protocol specific options { for now TCP only } and
374 	 * reserve some space. For datagram sockets, this can get called
375 	 * repeatedly for the same socket, but that isn't harmful.
376 	 */
377 	if (so->so_type == SOCK_STREAM) {
378 		val = 1;
379 		so_setsockopt(NULL, so, SOL_SOCKET, SO_KEEPALIVE, &val,
380 		    sizeof(val));
381 	}
382 	if ((so->so_proto->pr_domain->dom_family == AF_INET ||
383 	    so->so_proto->pr_domain->dom_family == AF_INET6) &&
384 	    so->so_proto->pr_protocol == IPPROTO_TCP) {
385 		val = 1;
386 		so_setsockopt(NULL, so, IPPROTO_TCP, TCP_NODELAY, &val,
387 		    sizeof(val));
388 	}
389 	solock(so);
390 	so->so_rcv.sb_flags &= ~SB_NOINTR;
391 	so->so_rcv.sb_timeo = 0;
392 	so->so_snd.sb_flags &= ~SB_NOINTR;
393 	so->so_snd.sb_timeo = 0;
394 	sounlock(so);
395 	if (tslp) {
396 		slp = tslp;
397 	} else {
398 		slp = nfsrv_sockalloc();
399 	}
400 	slp->ns_so = so;
401 	slp->ns_nam = mynam;
402 	mutex_enter(&fp->f_lock);
403 	fp->f_count++;
404 	mutex_exit(&fp->f_lock);
405 	slp->ns_fp = fp;
406 	slp->ns_flags = SLP_VALID;
407 	slp->ns_aflags = SLP_A_NEEDQ;
408 	slp->ns_gflags = 0;
409 	slp->ns_sflags = 0;
410 	solock(so);
411 	so->so_upcallarg = (void *)slp;
412 	so->so_upcall = nfsrv_soupcall;
413 	so->so_rcv.sb_flags |= SB_UPCALL;
414 	sounlock(so);
415 	nfsrv_wakenfsd(slp);
416 	return (0);
417 }
418 
419 /*
420  * Called by nfssvc() for nfsds. Just loops around servicing rpc requests
421  * until it is killed by a signal.
422  */
423 int
424 nfssvc_nfsd(struct nfsd_srvargs *nsd, void *argp, struct lwp *l)
425 {
426 	struct timeval tv;
427 	struct mbuf *m;
428 	struct nfssvc_sock *slp;
429 	struct nfsd *nfsd = nsd->nsd_nfsd;
430 	struct nfsrv_descript *nd = NULL;
431 	struct mbuf *mreq;
432 	u_quad_t cur_usec;
433 	int error = 0, cacherep, siz, sotype, writes_todo;
434 	struct proc *p = l->l_proc;
435 	bool doreinit;
436 
437 #ifndef nolint
438 	cacherep = RC_DOIT;
439 	writes_todo = 0;
440 #endif
441 	uvm_lwp_hold(l);
442 	if (nfsd == NULL) {
443 		nsd->nsd_nfsd = nfsd = kmem_alloc(sizeof(*nfsd), KM_SLEEP);
444 		memset(nfsd, 0, sizeof (struct nfsd));
445 		cv_init(&nfsd->nfsd_cv, "nfsd");
446 		nfsd->nfsd_procp = p;
447 		mutex_enter(&nfsd_lock);
448 		while ((nfssvc_sockhead_flag & SLP_INIT) != 0) {
449 			KASSERT(nfs_numnfsd == 0);
450 			cv_wait(&nfsd_initcv, &nfsd_lock);
451 		}
452 		TAILQ_INSERT_TAIL(&nfsd_head, nfsd, nfsd_chain);
453 		nfs_numnfsd++;
454 		mutex_exit(&nfsd_lock);
455 	}
456 	/*
457 	 * Loop getting rpc requests until SIGKILL.
458 	 */
459 	for (;;) {
460 		bool dummy;
461 
462 		if ((curcpu()->ci_schedstate.spc_flags & SPCF_SHOULDYIELD)
463 		    != 0) {
464 			preempt();
465 		}
466 		if (nfsd->nfsd_slp == NULL) {
467 			mutex_enter(&nfsd_lock);
468 			while (nfsd->nfsd_slp == NULL &&
469 			    (nfsd_head_flag & NFSD_CHECKSLP) == 0) {
470 				SLIST_INSERT_HEAD(&nfsd_idle_head, nfsd,
471 				    nfsd_idle);
472 				error = cv_wait_sig(&nfsd->nfsd_cv, &nfsd_lock);
473 				if (error) {
474 					slp = nfsd->nfsd_slp;
475 					nfsd->nfsd_slp = NULL;
476 					if (!slp)
477 						SLIST_REMOVE(&nfsd_idle_head,
478 						    nfsd, nfsd, nfsd_idle);
479 					mutex_exit(&nfsd_lock);
480 					if (slp) {
481 						nfsrv_wakenfsd(slp);
482 						nfsrv_slpderef(slp);
483 					}
484 					goto done;
485 				}
486 			}
487 			if (nfsd->nfsd_slp == NULL &&
488 			    (nfsd_head_flag & NFSD_CHECKSLP) != 0) {
489 				slp = TAILQ_FIRST(&nfssvc_sockpending);
490 				if (slp) {
491 					KASSERT((slp->ns_gflags & SLP_G_DOREC)
492 					    != 0);
493 					TAILQ_REMOVE(&nfssvc_sockpending, slp,
494 					    ns_pending);
495 					slp->ns_gflags &= ~SLP_G_DOREC;
496 					slp->ns_sref++;
497 					nfsd->nfsd_slp = slp;
498 				} else
499 					nfsd_head_flag &= ~NFSD_CHECKSLP;
500 			}
501 			KASSERT(nfsd->nfsd_slp == NULL ||
502 			    nfsd->nfsd_slp->ns_sref > 0);
503 			mutex_exit(&nfsd_lock);
504 			if ((slp = nfsd->nfsd_slp) == NULL)
505 				continue;
506 			if (slp->ns_flags & SLP_VALID) {
507 				bool more;
508 
509 				if (nfsdsock_testbits(slp, SLP_A_NEEDQ)) {
510 					nfsrv_rcv(slp);
511 				}
512 				if (nfsdsock_testbits(slp, SLP_A_DISCONN)) {
513 					nfsrv_zapsock(slp);
514 				}
515 				error = nfsrv_dorec(slp, nfsd, &nd, &more);
516 				getmicrotime(&tv);
517 				cur_usec = (u_quad_t)tv.tv_sec * 1000000 +
518 					(u_quad_t)tv.tv_usec;
519 				writes_todo = 0;
520 				if (error) {
521 					struct nfsrv_descript *nd2;
522 
523 					mutex_enter(&nfsd_lock);
524 					nd2 = LIST_FIRST(&slp->ns_tq);
525 					if (nd2 != NULL &&
526 					    nd2->nd_time <= cur_usec) {
527 						error = 0;
528 						cacherep = RC_DOIT;
529 						writes_todo = 1;
530 					}
531 					mutex_exit(&nfsd_lock);
532 				}
533 				if (error == 0 && more) {
534 					nfsrv_wakenfsd(slp);
535 				}
536 			}
537 		} else {
538 			error = 0;
539 			slp = nfsd->nfsd_slp;
540 		}
541 		KASSERT(slp != NULL);
542 		KASSERT(nfsd->nfsd_slp == slp);
543 		if (error || (slp->ns_flags & SLP_VALID) == 0) {
544 			if (nd) {
545 				nfsdreq_free(nd);
546 				nd = NULL;
547 			}
548 			nfsd->nfsd_slp = NULL;
549 			nfsrv_slpderef(slp);
550 			continue;
551 		}
552 		sotype = slp->ns_so->so_type;
553 		if (nd) {
554 			getmicrotime(&nd->nd_starttime);
555 			if (nd->nd_nam2)
556 				nd->nd_nam = nd->nd_nam2;
557 			else
558 				nd->nd_nam = slp->ns_nam;
559 
560 			/*
561 			 * Check to see if authorization is needed.
562 			 */
563 			if (nfsd->nfsd_flag & NFSD_NEEDAUTH) {
564 				nfsd->nfsd_flag &= ~NFSD_NEEDAUTH;
565 				nsd->nsd_haddr = mtod(nd->nd_nam,
566 				    struct sockaddr_in *)->sin_addr.s_addr;
567 				nsd->nsd_authlen = nfsd->nfsd_authlen;
568 				nsd->nsd_verflen = nfsd->nfsd_verflen;
569 				if (!copyout(nfsd->nfsd_authstr,
570 				    nsd->nsd_authstr, nfsd->nfsd_authlen) &&
571 				    !copyout(nfsd->nfsd_verfstr,
572 				    nsd->nsd_verfstr, nfsd->nfsd_verflen) &&
573 				    !copyout(nsd, argp, sizeof (*nsd))) {
574 					uvm_lwp_rele(l);
575 					return (ENEEDAUTH);
576 				}
577 				cacherep = RC_DROPIT;
578 			} else
579 				cacherep = nfsrv_getcache(nd, slp, &mreq);
580 
581 			if (nfsd->nfsd_flag & NFSD_AUTHFAIL) {
582 				nfsd->nfsd_flag &= ~NFSD_AUTHFAIL;
583 				nd->nd_procnum = NFSPROC_NOOP;
584 				nd->nd_repstat =
585 				    (NFSERR_AUTHERR | AUTH_TOOWEAK);
586 				cacherep = RC_DOIT;
587 			}
588 		}
589 
590 		/*
591 		 * Loop to get all the write rpc relies that have been
592 		 * gathered together.
593 		 */
594 		do {
595 			switch (cacherep) {
596 			case RC_DOIT:
597 				mreq = NULL;
598 				netexport_rdlock();
599 				if (writes_todo || nd == NULL ||
600 				     (!(nd->nd_flag & ND_NFSV3) &&
601 				     nd->nd_procnum == NFSPROC_WRITE &&
602 				     nfsrvw_procrastinate > 0))
603 					error = nfsrv_writegather(&nd, slp,
604 					    l, &mreq);
605 				else
606 					error =
607 					    (*(nfsrv3_procs[nd->nd_procnum]))
608 					    (nd, slp, l, &mreq);
609 				netexport_rdunlock();
610 				if (mreq == NULL) {
611 					if (nd != NULL) {
612 						if (nd->nd_nam2)
613 							m_free(nd->nd_nam2);
614 					}
615 					break;
616 				}
617 				if (error) {
618 					nfsstats.srv_errs++;
619 					nfsrv_updatecache(nd, false, mreq);
620 					if (nd->nd_nam2)
621 						m_freem(nd->nd_nam2);
622 					break;
623 				}
624 				nfsstats.srvrpccnt[nd->nd_procnum]++;
625 				nfsrv_updatecache(nd, true, mreq);
626 				nd->nd_mrep = (struct mbuf *)0;
627 			case RC_REPLY:
628 				m = mreq;
629 				siz = 0;
630 				while (m) {
631 					siz += m->m_len;
632 					m = m->m_next;
633 				}
634 				if (siz <= 0 || siz > NFS_MAXPACKET) {
635 					printf("mbuf siz=%d\n",siz);
636 					panic("Bad nfs svc reply");
637 				}
638 				m = mreq;
639 				m->m_pkthdr.len = siz;
640 				m->m_pkthdr.rcvif = (struct ifnet *)0;
641 				/*
642 				 * For stream protocols, prepend a Sun RPC
643 				 * Record Mark.
644 				 */
645 				if (sotype == SOCK_STREAM) {
646 					M_PREPEND(m, NFSX_UNSIGNED, M_WAIT);
647 					*mtod(m, u_int32_t *) =
648 					    htonl(0x80000000 | siz);
649 				}
650 				nd->nd_mreq = m;
651 				if (nfsrtton) {
652 					nfsd_rt(slp->ns_so->so_type, nd,
653 					    cacherep);
654 				}
655 				error = nfsdsock_sendreply(slp, nd);
656 				nd = NULL;
657 				if (error == EPIPE)
658 					nfsrv_zapsock(slp);
659 				if (error == EINTR || error == ERESTART) {
660 					nfsd->nfsd_slp = NULL;
661 					nfsrv_slpderef(slp);
662 					goto done;
663 				}
664 				break;
665 			case RC_DROPIT:
666 				if (nfsrtton)
667 					nfsd_rt(sotype, nd, cacherep);
668 				m_freem(nd->nd_mrep);
669 				m_freem(nd->nd_nam2);
670 				break;
671 			}
672 			if (nd) {
673 				nfsdreq_free(nd);
674 				nd = NULL;
675 			}
676 
677 			/*
678 			 * Check to see if there are outstanding writes that
679 			 * need to be serviced.
680 			 */
681 			getmicrotime(&tv);
682 			cur_usec = (u_quad_t)tv.tv_sec * 1000000 +
683 			    (u_quad_t)tv.tv_usec;
684 			mutex_enter(&nfsd_lock);
685 			if (LIST_FIRST(&slp->ns_tq) &&
686 			    LIST_FIRST(&slp->ns_tq)->nd_time <= cur_usec) {
687 				cacherep = RC_DOIT;
688 				writes_todo = 1;
689 			} else
690 				writes_todo = 0;
691 			mutex_exit(&nfsd_lock);
692 		} while (writes_todo);
693 		if (nfsrv_dorec(slp, nfsd, &nd, &dummy)) {
694 			nfsd->nfsd_slp = NULL;
695 			nfsrv_slpderef(slp);
696 		}
697 	}
698 done:
699 	mutex_enter(&nfsd_lock);
700 	TAILQ_REMOVE(&nfsd_head, nfsd, nfsd_chain);
701 	doreinit = --nfs_numnfsd == 0;
702 	if (doreinit)
703 		nfssvc_sockhead_flag |= SLP_INIT;
704 	mutex_exit(&nfsd_lock);
705 	cv_destroy(&nfsd->nfsd_cv);
706 	kmem_free(nfsd, sizeof(*nfsd));
707 	nsd->nsd_nfsd = NULL;
708 	if (doreinit)
709 		nfsrv_init(true);	/* Reinitialize everything */
710 	uvm_lwp_rele(l);
711 	return (error);
712 }
713 
714 /*
715  * Shut down a socket associated with an nfssvc_sock structure.
716  * Should be called with the send lock set, if required.
717  * The trick here is to increment the sref at the start, so that the nfsds
718  * will stop using it and clear ns_flag at the end so that it will not be
719  * reassigned during cleanup.
720  *
721  * called at splsoftnet.
722  */
723 void
724 nfsrv_zapsock(struct nfssvc_sock *slp)
725 {
726 	struct nfsuid *nuidp, *nnuidp;
727 	struct nfsrv_descript *nwp;
728 	struct socket *so;
729 	struct mbuf *m;
730 
731 	if (nfsdsock_drain(slp)) {
732 		return;
733 	}
734 	mutex_enter(&nfsd_lock);
735 	if (slp->ns_gflags & SLP_G_DOREC) {
736 		TAILQ_REMOVE(&nfssvc_sockpending, slp, ns_pending);
737 		slp->ns_gflags &= ~SLP_G_DOREC;
738 	}
739 	mutex_exit(&nfsd_lock);
740 
741 	so = slp->ns_so;
742 	KASSERT(so != NULL);
743 	solock(so);
744 	so->so_upcall = NULL;
745 	so->so_upcallarg = NULL;
746 	so->so_rcv.sb_flags &= ~SB_UPCALL;
747 	soshutdown(so, SHUT_RDWR);
748 	sounlock(so);
749 
750 	m_freem(slp->ns_raw);
751 	m = slp->ns_rec;
752 	while (m != NULL) {
753 		struct mbuf *n;
754 
755 		n = m->m_nextpkt;
756 		m_freem(m);
757 		m = n;
758 	}
759 	/* XXX what about freeing ns_frag ? */
760 	for (nuidp = TAILQ_FIRST(&slp->ns_uidlruhead); nuidp != 0;
761 	    nuidp = nnuidp) {
762 		nnuidp = TAILQ_NEXT(nuidp, nu_lru);
763 		LIST_REMOVE(nuidp, nu_hash);
764 		TAILQ_REMOVE(&slp->ns_uidlruhead, nuidp, nu_lru);
765 		if (nuidp->nu_flag & NU_NAM)
766 			m_freem(nuidp->nu_nam);
767 		kmem_free(nuidp, sizeof(*nuidp));
768 	}
769 	mutex_enter(&nfsd_lock);
770 	while ((nwp = LIST_FIRST(&slp->ns_tq)) != NULL) {
771 		LIST_REMOVE(nwp, nd_tq);
772 		mutex_exit(&nfsd_lock);
773 		nfsdreq_free(nwp);
774 		mutex_enter(&nfsd_lock);
775 	}
776 	mutex_exit(&nfsd_lock);
777 }
778 
779 /*
780  * Derefence a server socket structure. If it has no more references and
781  * is no longer valid, you can throw it away.
782  */
783 void
784 nfsrv_slpderef(struct nfssvc_sock *slp)
785 {
786 	uint32_t ref;
787 
788 	mutex_enter(&nfsd_lock);
789 	KASSERT(slp->ns_sref > 0);
790 	ref = --slp->ns_sref;
791 	if (ref == 0 && (slp->ns_flags & SLP_VALID) == 0) {
792 		file_t *fp;
793 
794 		KASSERT((slp->ns_gflags & SLP_G_DOREC) == 0);
795 		TAILQ_REMOVE(&nfssvc_sockhead, slp, ns_chain);
796 		mutex_exit(&nfsd_lock);
797 
798 		fp = slp->ns_fp;
799 		if (fp != NULL) {
800 			slp->ns_fp = NULL;
801 			KASSERT(fp != NULL);
802 			KASSERT(fp->f_data == slp->ns_so);
803 			KASSERT(fp->f_count > 0);
804 			closef(fp);
805 			slp->ns_so = NULL;
806 		}
807 
808 		if (slp->ns_nam)
809 			m_free(slp->ns_nam);
810 		nfsrv_sockfree(slp);
811 	} else
812 		mutex_exit(&nfsd_lock);
813 }
814 
815 /*
816  * Initialize the data structures for the server.
817  * Handshake with any new nfsds starting up to avoid any chance of
818  * corruption.
819  */
820 void
821 nfsrv_init(int terminating)
822 {
823 	struct nfssvc_sock *slp;
824 
825 	if (!terminating) {
826 		mutex_init(&nfsd_lock, MUTEX_DRIVER, IPL_SOFTNET);
827 		cv_init(&nfsd_initcv, "nfsdinit");
828 	}
829 
830 	mutex_enter(&nfsd_lock);
831 	if (!terminating && (nfssvc_sockhead_flag & SLP_INIT) != 0)
832 		panic("nfsd init");
833 	nfssvc_sockhead_flag |= SLP_INIT;
834 
835 	if (terminating) {
836 		KASSERT(SLIST_EMPTY(&nfsd_idle_head));
837 		KASSERT(TAILQ_EMPTY(&nfsd_head));
838 		while ((slp = TAILQ_FIRST(&nfssvc_sockhead)) != NULL) {
839 			mutex_exit(&nfsd_lock);
840 			KASSERT(slp->ns_sref == 0);
841 			slp->ns_sref++;
842 			nfsrv_zapsock(slp);
843 			nfsrv_slpderef(slp);
844 			mutex_enter(&nfsd_lock);
845 		}
846 		KASSERT(TAILQ_EMPTY(&nfssvc_sockpending));
847 		mutex_exit(&nfsd_lock);
848 		nfsrv_cleancache();	/* And clear out server cache */
849 	} else {
850 		mutex_exit(&nfsd_lock);
851 		nfs_pub.np_valid = 0;
852 	}
853 
854 	TAILQ_INIT(&nfssvc_sockhead);
855 	TAILQ_INIT(&nfssvc_sockpending);
856 
857 	TAILQ_INIT(&nfsd_head);
858 	SLIST_INIT(&nfsd_idle_head);
859 	nfsd_head_flag &= ~NFSD_CHECKSLP;
860 
861 	nfs_udpsock = nfsrv_sockalloc();
862 	nfs_udp6sock = nfsrv_sockalloc();
863 
864 	mutex_enter(&nfsd_lock);
865 	nfssvc_sockhead_flag &= ~SLP_INIT;
866 	cv_broadcast(&nfsd_initcv);
867 	mutex_exit(&nfsd_lock);
868 }
869 
870 void
871 nfsrv_fini(void)
872 {
873 
874 	nfsrv_init(true);
875 	cv_destroy(&nfsd_initcv);
876 	mutex_destroy(&nfsd_lock);
877 }
878 
879 /*
880  * Add entries to the server monitor log.
881  */
882 static void
883 nfsd_rt(int sotype, struct nfsrv_descript *nd, int cacherep)
884 {
885 	struct timeval tv;
886 	struct drt *rt;
887 
888 	rt = &nfsdrt.drt[nfsdrt.pos];
889 	if (cacherep == RC_DOIT)
890 		rt->flag = 0;
891 	else if (cacherep == RC_REPLY)
892 		rt->flag = DRT_CACHEREPLY;
893 	else
894 		rt->flag = DRT_CACHEDROP;
895 	if (sotype == SOCK_STREAM)
896 		rt->flag |= DRT_TCP;
897 	if (nd->nd_flag & ND_NFSV3)
898 		rt->flag |= DRT_NFSV3;
899 	rt->proc = nd->nd_procnum;
900 	if (mtod(nd->nd_nam, struct sockaddr *)->sa_family == AF_INET)
901 	    rt->ipadr = mtod(nd->nd_nam, struct sockaddr_in *)->sin_addr.s_addr;
902 	else
903 	    rt->ipadr = INADDR_ANY;
904 	getmicrotime(&tv);
905 	rt->resptime = ((tv.tv_sec - nd->nd_starttime.tv_sec) * 1000000) +
906 		(tv.tv_usec - nd->nd_starttime.tv_usec);
907 	rt->tstamp = tv;
908 	nfsdrt.pos = (nfsdrt.pos + 1) % NFSRTTLOGSIZ;
909 }
910