xref: /openbsd-src/sys/nfs/nfs_socket.c (revision a4afd6dad3fba28f80e70208181c06c482259988)
1 /*	$OpenBSD: nfs_socket.c,v 1.7 1996/07/03 07:10:33 deraadt Exp $	*/
2 /*	$NetBSD: nfs_socket.c,v 1.27 1996/04/15 20:20:00 thorpej Exp $	*/
3 
4 /*
5  * Copyright (c) 1989, 1991, 1993, 1995
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * This code is derived from software contributed to Berkeley by
9  * Rick Macklem at The University of Guelph.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. All advertising materials mentioning features or use of this software
20  *    must display the following acknowledgement:
21  *	This product includes software developed by the University of
22  *	California, Berkeley and its contributors.
23  * 4. Neither the name of the University nor the names of its contributors
24  *    may be used to endorse or promote products derived from this software
25  *    without specific prior written permission.
26  *
27  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
28  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
29  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
30  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
31  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
32  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
33  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
34  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
35  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
36  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
37  * SUCH DAMAGE.
38  *
39  *	@(#)nfs_socket.c	8.5 (Berkeley) 3/30/95
40  */
41 
42 /*
43  * Socket operations for use by nfs
44  */
45 
46 #include <sys/param.h>
47 #include <sys/systm.h>
48 #include <sys/proc.h>
49 #include <sys/mount.h>
50 #include <sys/kernel.h>
51 #include <sys/mbuf.h>
52 #include <sys/vnode.h>
53 #include <sys/domain.h>
54 #include <sys/protosw.h>
55 #include <sys/socket.h>
56 #include <sys/socketvar.h>
57 #include <sys/syslog.h>
58 #include <sys/tprintf.h>
59 #include <sys/namei.h>
60 
61 #include <netinet/in.h>
62 #include <netinet/tcp.h>
63 
64 #include <nfs/rpcv2.h>
65 #include <nfs/nfsproto.h>
66 #include <nfs/nfs.h>
67 #include <nfs/xdr_subs.h>
68 #include <nfs/nfsm_subs.h>
69 #include <nfs/nfsmount.h>
70 #include <nfs/nfsnode.h>
71 #include <nfs/nfsrtt.h>
72 #include <nfs/nqnfs.h>
73 #include <nfs/nfs_var.h>
74 
75 #define	TRUE	1
76 #define	FALSE	0
77 
78 /*
79  * Estimate rto for an nfs rpc sent via. an unreliable datagram.
80  * Use the mean and mean deviation of rtt for the appropriate type of rpc
81  * for the frequent rpcs and a default for the others.
82  * The justification for doing "other" this way is that these rpcs
83  * happen so infrequently that timer est. would probably be stale.
84  * Also, since many of these rpcs are
85  * non-idempotent, a conservative timeout is desired.
86  * getattr, lookup - A+2D
87  * read, write     - A+4D
88  * other           - nm_timeo
89  */
90 #define	NFS_RTO(n, t) \
91 	((t) == 0 ? (n)->nm_timeo : \
92 	 ((t) < 3 ? \
93 	  (((((n)->nm_srtt[t-1] + 3) >> 2) + (n)->nm_sdrtt[t-1] + 1) >> 1) : \
94 	  ((((n)->nm_srtt[t-1] + 7) >> 3) + (n)->nm_sdrtt[t-1] + 1)))
95 #define	NFS_SRTT(r)	(r)->r_nmp->nm_srtt[proct[(r)->r_procnum] - 1]
96 #define	NFS_SDRTT(r)	(r)->r_nmp->nm_sdrtt[proct[(r)->r_procnum] - 1]
97 /*
98  * External data, mostly RPC constants in XDR form
99  */
100 extern u_int32_t rpc_reply, rpc_msgdenied, rpc_mismatch, rpc_vers,
101 	rpc_auth_unix, rpc_msgaccepted, rpc_call, rpc_autherr,
102 	rpc_auth_kerb;
103 extern u_int32_t nfs_prog, nqnfs_prog;
104 extern time_t nqnfsstarttime;
105 extern struct nfsstats nfsstats;
106 extern int nfsv3_procid[NFS_NPROCS];
107 extern int nfs_ticks;
108 
109 /*
110  * Defines which timer to use for the procnum.
111  * 0 - default
112  * 1 - getattr
113  * 2 - lookup
114  * 3 - read
115  * 4 - write
116  */
117 static int proct[NFS_NPROCS] = {
118 	0, 1, 0, 2, 1, 3, 3, 4, 0, 0, 0, 0, 0, 0, 0, 0, 3, 3, 0, 0, 0, 0, 0,
119 	0, 0, 0,
120 };
121 
122 /*
123  * There is a congestion window for outstanding rpcs maintained per mount
124  * point. The cwnd size is adjusted in roughly the way that:
125  * Van Jacobson, Congestion avoidance and Control, In "Proceedings of
126  * SIGCOMM '88". ACM, August 1988.
127  * describes for TCP. The cwnd size is chopped in half on a retransmit timeout
128  * and incremented by 1/cwnd when each rpc reply is received and a full cwnd
129  * of rpcs is in progress.
130  * (The sent count and cwnd are scaled for integer arith.)
131  * Variants of "slow start" were tried and were found to be too much of a
132  * performance hit (ave. rtt 3 times larger),
133  * I suspect due to the large rtt that nfs rpcs have.
134  */
135 #define	NFS_CWNDSCALE	256
136 #define	NFS_MAXCWND	(NFS_CWNDSCALE * 32)
137 static int nfs_backoff[8] = { 2, 4, 8, 16, 32, 64, 128, 256, };
138 int nfsrtton = 0;
139 struct nfsrtt nfsrtt;
140 
141 /*
142  * Initialize sockets and congestion for a new NFS connection.
143  * We do not free the sockaddr if error.
144  */
145 int
146 nfs_connect(nmp, rep)
147 	register struct nfsmount *nmp;
148 	struct nfsreq *rep;
149 {
150 	register struct socket *so;
151 	int s, error, rcvreserve, sndreserve;
152 	struct sockaddr *saddr;
153 	struct sockaddr_in *sin;
154 	struct mbuf *m;
155 	u_int16_t tport;
156 
157 	nmp->nm_so = (struct socket *)0;
158 	saddr = mtod(nmp->nm_nam, struct sockaddr *);
159 	error = socreate(saddr->sa_family, &nmp->nm_so, nmp->nm_sotype,
160 		nmp->nm_soproto);
161 	if (error)
162 		goto bad;
163 	so = nmp->nm_so;
164 	nmp->nm_soflags = so->so_proto->pr_flags;
165 
166 	/*
167 	 * Some servers require that the client port be a reserved port number.
168 	 */
169 	if (saddr->sa_family == AF_INET && (nmp->nm_flag & NFSMNT_RESVPORT)) {
170 		MGET(m, M_WAIT, MT_SONAME);
171 		sin = mtod(m, struct sockaddr_in *);
172 		sin->sin_len = m->m_len = sizeof (struct sockaddr_in);
173 		sin->sin_family = AF_INET;
174 		sin->sin_addr.s_addr = INADDR_ANY;
175 		tport = IPPORT_RESERVED - 1;
176 		sin->sin_port = htons(tport);
177 		while ((error = sobind(so, m)) == EADDRINUSE &&
178 		       --tport > IPPORT_RESERVED / 2)
179 			sin->sin_port = htons(tport);
180 		m_freem(m);
181 		if (error)
182 			goto bad;
183 	}
184 
185 	/*
186 	 * Protocols that do not require connections may be optionally left
187 	 * unconnected for servers that reply from a port other than NFS_PORT.
188 	 */
189 	if (nmp->nm_flag & NFSMNT_NOCONN) {
190 		if (nmp->nm_soflags & PR_CONNREQUIRED) {
191 			error = ENOTCONN;
192 			goto bad;
193 		}
194 	} else {
195 		error = soconnect(so, nmp->nm_nam);
196 		if (error)
197 			goto bad;
198 
199 		/*
200 		 * Wait for the connection to complete. Cribbed from the
201 		 * connect system call but with the wait timing out so
202 		 * that interruptible mounts don't hang here for a long time.
203 		 */
204 		s = splsoftnet();
205 		while ((so->so_state & SS_ISCONNECTING) && so->so_error == 0) {
206 			(void) tsleep((caddr_t)&so->so_timeo, PSOCK,
207 				"nfscon", 2 * hz);
208 			if ((so->so_state & SS_ISCONNECTING) &&
209 			    so->so_error == 0 && rep &&
210 			    (error = nfs_sigintr(nmp, rep, rep->r_procp)) != 0){
211 				so->so_state &= ~SS_ISCONNECTING;
212 				splx(s);
213 				goto bad;
214 			}
215 		}
216 		if (so->so_error) {
217 			error = so->so_error;
218 			so->so_error = 0;
219 			splx(s);
220 			goto bad;
221 		}
222 		splx(s);
223 	}
224 	if (nmp->nm_flag & (NFSMNT_SOFT | NFSMNT_INT)) {
225 		so->so_rcv.sb_timeo = (5 * hz);
226 		so->so_snd.sb_timeo = (5 * hz);
227 	} else {
228 		so->so_rcv.sb_timeo = 0;
229 		so->so_snd.sb_timeo = 0;
230 	}
231 	if (nmp->nm_sotype == SOCK_DGRAM) {
232 		sndreserve = nmp->nm_wsize + NFS_MAXPKTHDR;
233 		rcvreserve = max(nmp->nm_rsize, nmp->nm_readdirsize) +
234 		    NFS_MAXPKTHDR;
235 	} else if (nmp->nm_sotype == SOCK_SEQPACKET) {
236 		sndreserve = (nmp->nm_wsize + NFS_MAXPKTHDR) * 2;
237 		rcvreserve = (max(nmp->nm_rsize, nmp->nm_readdirsize) +
238 		    NFS_MAXPKTHDR) * 2;
239 	} else {
240 		if (nmp->nm_sotype != SOCK_STREAM)
241 			panic("nfscon sotype");
242 		if (so->so_proto->pr_flags & PR_CONNREQUIRED) {
243 			MGET(m, M_WAIT, MT_SOOPTS);
244 			*mtod(m, int32_t *) = 1;
245 			m->m_len = sizeof(int32_t);
246 			sosetopt(so, SOL_SOCKET, SO_KEEPALIVE, m);
247 		}
248 		if (so->so_proto->pr_protocol == IPPROTO_TCP) {
249 			MGET(m, M_WAIT, MT_SOOPTS);
250 			*mtod(m, int32_t *) = 1;
251 			m->m_len = sizeof(int32_t);
252 			sosetopt(so, IPPROTO_TCP, TCP_NODELAY, m);
253 		}
254 		sndreserve = (nmp->nm_wsize + NFS_MAXPKTHDR +
255 		    sizeof (u_int32_t)) * 2;
256 		rcvreserve = (nmp->nm_rsize + NFS_MAXPKTHDR +
257 		    sizeof (u_int32_t)) * 2;
258 	}
259 	error = soreserve(so, sndreserve, rcvreserve);
260 	if (error)
261 		goto bad;
262 	so->so_rcv.sb_flags |= SB_NOINTR;
263 	so->so_snd.sb_flags |= SB_NOINTR;
264 
265 	/* Initialize other non-zero congestion variables */
266 	nmp->nm_srtt[0] = nmp->nm_srtt[1] = nmp->nm_srtt[2] = nmp->nm_srtt[3] =
267 		nmp->nm_srtt[4] = (NFS_TIMEO << 3);
268 	nmp->nm_sdrtt[0] = nmp->nm_sdrtt[1] = nmp->nm_sdrtt[2] =
269 		nmp->nm_sdrtt[3] = nmp->nm_sdrtt[4] = 0;
270 	nmp->nm_cwnd = NFS_MAXCWND / 2;	    /* Initial send window */
271 	nmp->nm_sent = 0;
272 	nmp->nm_timeouts = 0;
273 	return (0);
274 
275 bad:
276 	nfs_disconnect(nmp);
277 	return (error);
278 }
279 
280 /*
281  * Reconnect routine:
282  * Called when a connection is broken on a reliable protocol.
283  * - clean up the old socket
284  * - nfs_connect() again
285  * - set R_MUSTRESEND for all outstanding requests on mount point
286  * If this fails the mount point is DEAD!
287  * nb: Must be called with the nfs_sndlock() set on the mount point.
288  */
289 int
290 nfs_reconnect(rep)
291 	register struct nfsreq *rep;
292 {
293 	register struct nfsreq *rp;
294 	register struct nfsmount *nmp = rep->r_nmp;
295 	int error;
296 
297 	nfs_disconnect(nmp);
298 	while ((error = nfs_connect(nmp, rep)) != 0) {
299 		if (error == EINTR || error == ERESTART)
300 			return (EINTR);
301 		(void) tsleep((caddr_t)&lbolt, PSOCK, "nfscon", 0);
302 	}
303 
304 	/*
305 	 * Loop through outstanding request list and fix up all requests
306 	 * on old socket.
307 	 */
308 	for (rp = nfs_reqq.tqh_first; rp != 0; rp = rp->r_chain.tqe_next) {
309 		if (rp->r_nmp == nmp)
310 			rp->r_flags |= R_MUSTRESEND;
311 	}
312 	return (0);
313 }
314 
315 /*
316  * NFS disconnect. Clean up and unlink.
317  */
318 void
319 nfs_disconnect(nmp)
320 	register struct nfsmount *nmp;
321 {
322 	register struct socket *so;
323 
324 	if (nmp->nm_so) {
325 		so = nmp->nm_so;
326 		nmp->nm_so = (struct socket *)0;
327 		soshutdown(so, 2);
328 		soclose(so);
329 	}
330 }
331 
332 /*
333  * This is the nfs send routine. For connection based socket types, it
334  * must be called with an nfs_sndlock() on the socket.
335  * "rep == NULL" indicates that it has been called from a server.
336  * For the client side:
337  * - return EINTR if the RPC is terminated, 0 otherwise
338  * - set R_MUSTRESEND if the send fails for any reason
339  * - do any cleanup required by recoverable socket errors (???)
340  * For the server side:
341  * - return EINTR or ERESTART if interrupted by a signal
342  * - return EPIPE if a connection is lost for connection based sockets (TCP...)
343  * - do any cleanup required by recoverable socket errors (???)
344  */
345 int
346 nfs_send(so, nam, top, rep)
347 	register struct socket *so;
348 	struct mbuf *nam;
349 	register struct mbuf *top;
350 	struct nfsreq *rep;
351 {
352 	struct mbuf *sendnam;
353 	int error, soflags, flags;
354 
355 	if (rep) {
356 		if (rep->r_flags & R_SOFTTERM) {
357 			m_freem(top);
358 			return (EINTR);
359 		}
360 		if ((so = rep->r_nmp->nm_so) == NULL) {
361 			rep->r_flags |= R_MUSTRESEND;
362 			m_freem(top);
363 			return (0);
364 		}
365 		rep->r_flags &= ~R_MUSTRESEND;
366 		soflags = rep->r_nmp->nm_soflags;
367 	} else
368 		soflags = so->so_proto->pr_flags;
369 	if ((soflags & PR_CONNREQUIRED) || (so->so_state & SS_ISCONNECTED))
370 		sendnam = (struct mbuf *)0;
371 	else
372 		sendnam = nam;
373 	if (so->so_type == SOCK_SEQPACKET)
374 		flags = MSG_EOR;
375 	else
376 		flags = 0;
377 
378 	error = sosend(so, sendnam, (struct uio *)0, top,
379 		(struct mbuf *)0, flags);
380 	if (error) {
381 		if (rep) {
382 			log(LOG_INFO, "nfs send error %d for server %s\n",error,
383 			    rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname);
384 			/*
385 			 * Deal with errors for the client side.
386 			 */
387 			if (rep->r_flags & R_SOFTTERM)
388 				error = EINTR;
389 			else
390 				rep->r_flags |= R_MUSTRESEND;
391 		} else
392 			log(LOG_INFO, "nfsd send error %d\n", error);
393 
394 		/*
395 		 * Handle any recoverable (soft) socket errors here. (???)
396 		 */
397 		if (error != EINTR && error != ERESTART &&
398 			error != EWOULDBLOCK && error != EPIPE)
399 			error = 0;
400 	}
401 	return (error);
402 }
403 
404 #ifdef NFSCLIENT
405 /*
406  * Receive a Sun RPC Request/Reply. For SOCK_DGRAM, the work is all
407  * done by soreceive(), but for SOCK_STREAM we must deal with the Record
408  * Mark and consolidate the data into a new mbuf list.
409  * nb: Sometimes TCP passes the data up to soreceive() in long lists of
410  *     small mbufs.
411  * For SOCK_STREAM we must be very careful to read an entire record once
412  * we have read any of it, even if the system call has been interrupted.
413  */
414 int
415 nfs_receive(rep, aname, mp)
416 	register struct nfsreq *rep;
417 	struct mbuf **aname;
418 	struct mbuf **mp;
419 {
420 	register struct socket *so;
421 	struct uio auio;
422 	struct iovec aio;
423 	register struct mbuf *m;
424 	struct mbuf *control;
425 	u_int32_t len;
426 	struct mbuf **getnam;
427 	int error, sotype, rcvflg;
428 	struct proc *p = curproc;	/* XXX */
429 
430 	/*
431 	 * Set up arguments for soreceive()
432 	 */
433 	*mp = (struct mbuf *)0;
434 	*aname = (struct mbuf *)0;
435 	sotype = rep->r_nmp->nm_sotype;
436 
437 	/*
438 	 * For reliable protocols, lock against other senders/receivers
439 	 * in case a reconnect is necessary.
440 	 * For SOCK_STREAM, first get the Record Mark to find out how much
441 	 * more there is to get.
442 	 * We must lock the socket against other receivers
443 	 * until we have an entire rpc request/reply.
444 	 */
445 	if (sotype != SOCK_DGRAM) {
446 		error = nfs_sndlock(&rep->r_nmp->nm_flag, rep);
447 		if (error)
448 			return (error);
449 tryagain:
450 		/*
451 		 * Check for fatal errors and resending request.
452 		 */
453 		/*
454 		 * Ugh: If a reconnect attempt just happened, nm_so
455 		 * would have changed. NULL indicates a failed
456 		 * attempt that has essentially shut down this
457 		 * mount point.
458 		 */
459 		if (rep->r_mrep || (rep->r_flags & R_SOFTTERM)) {
460 			nfs_sndunlock(&rep->r_nmp->nm_flag);
461 			return (EINTR);
462 		}
463 		so = rep->r_nmp->nm_so;
464 		if (!so) {
465 			error = nfs_reconnect(rep);
466 			if (error) {
467 				nfs_sndunlock(&rep->r_nmp->nm_flag);
468 				return (error);
469 			}
470 			goto tryagain;
471 		}
472 		while (rep->r_flags & R_MUSTRESEND) {
473 			m = m_copym(rep->r_mreq, 0, M_COPYALL, M_WAIT);
474 			nfsstats.rpcretries++;
475 			error = nfs_send(so, rep->r_nmp->nm_nam, m, rep);
476 			if (error) {
477 				if (error == EINTR || error == ERESTART ||
478 				    (error = nfs_reconnect(rep)) != 0) {
479 					nfs_sndunlock(&rep->r_nmp->nm_flag);
480 					return (error);
481 				}
482 				goto tryagain;
483 			}
484 		}
485 		nfs_sndunlock(&rep->r_nmp->nm_flag);
486 		if (sotype == SOCK_STREAM) {
487 			aio.iov_base = (caddr_t) &len;
488 			aio.iov_len = sizeof(u_int32_t);
489 			auio.uio_iov = &aio;
490 			auio.uio_iovcnt = 1;
491 			auio.uio_segflg = UIO_SYSSPACE;
492 			auio.uio_rw = UIO_READ;
493 			auio.uio_offset = 0;
494 			auio.uio_resid = sizeof(u_int32_t);
495 			auio.uio_procp = p;
496 			do {
497 			   rcvflg = MSG_WAITALL;
498 			   error = soreceive(so, (struct mbuf **)0, &auio,
499 				(struct mbuf **)0, (struct mbuf **)0, &rcvflg);
500 			   if (error == EWOULDBLOCK && rep) {
501 				if (rep->r_flags & R_SOFTTERM)
502 					return (EINTR);
503 			   }
504 			} while (error == EWOULDBLOCK);
505 			if (!error && auio.uio_resid > 0) {
506 			    log(LOG_INFO,
507 				 "short receive (%d/%d) from nfs server %s\n",
508 				 sizeof(u_int32_t) - auio.uio_resid,
509 				 sizeof(u_int32_t),
510 				 rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname);
511 			    error = EPIPE;
512 			}
513 			if (error)
514 				goto errout;
515 			len = ntohl(len) & ~0x80000000;
516 			/*
517 			 * This is SERIOUS! We are out of sync with the sender
518 			 * and forcing a disconnect/reconnect is all I can do.
519 			 */
520 			if (len > NFS_MAXPACKET) {
521 			    log(LOG_ERR, "%s (%d) from nfs server %s\n",
522 				"impossible packet length",
523 				len,
524 				rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname);
525 			    error = EFBIG;
526 			    goto errout;
527 			}
528 			auio.uio_resid = len;
529 			do {
530 			    rcvflg = MSG_WAITALL;
531 			    error =  soreceive(so, (struct mbuf **)0,
532 				&auio, mp, (struct mbuf **)0, &rcvflg);
533 			} while (error == EWOULDBLOCK || error == EINTR ||
534 				 error == ERESTART);
535 			if (!error && auio.uio_resid > 0) {
536 			    log(LOG_INFO,
537 				"short receive (%d/%d) from nfs server %s\n",
538 				len - auio.uio_resid, len,
539 				rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname);
540 			    error = EPIPE;
541 			}
542 		} else {
543 			/*
544 			 * NB: Since uio_resid is big, MSG_WAITALL is ignored
545 			 * and soreceive() will return when it has either a
546 			 * control msg or a data msg.
547 			 * We have no use for control msg., but must grab them
548 			 * and then throw them away so we know what is going
549 			 * on.
550 			 */
551 			auio.uio_resid = len = 100000000; /* Anything Big */
552 			auio.uio_procp = p;
553 			do {
554 			    rcvflg = 0;
555 			    error =  soreceive(so, (struct mbuf **)0,
556 				&auio, mp, &control, &rcvflg);
557 			    if (control)
558 				m_freem(control);
559 			    if (error == EWOULDBLOCK && rep) {
560 				if (rep->r_flags & R_SOFTTERM)
561 					return (EINTR);
562 			    }
563 			} while (error == EWOULDBLOCK ||
564 				 (!error && *mp == NULL && control));
565 			if ((rcvflg & MSG_EOR) == 0)
566 				printf("Egad!!\n");
567 			if (!error && *mp == NULL)
568 				error = EPIPE;
569 			len -= auio.uio_resid;
570 		}
571 errout:
572 		if (error && error != EINTR && error != ERESTART) {
573 			m_freem(*mp);
574 			*mp = (struct mbuf *)0;
575 			if (error != EPIPE)
576 				log(LOG_INFO,
577 				    "receive error %d from nfs server %s\n",
578 				    error,
579 				 rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname);
580 			error = nfs_sndlock(&rep->r_nmp->nm_flag, rep);
581 			if (!error)
582 				error = nfs_reconnect(rep);
583 			if (!error)
584 				goto tryagain;
585 		}
586 	} else {
587 		if ((so = rep->r_nmp->nm_so) == NULL)
588 			return (EACCES);
589 		if (so->so_state & SS_ISCONNECTED)
590 			getnam = (struct mbuf **)0;
591 		else
592 			getnam = aname;
593 		auio.uio_resid = len = 1000000;
594 		auio.uio_procp = p;
595 		do {
596 			rcvflg = 0;
597 			error =  soreceive(so, getnam, &auio, mp,
598 				(struct mbuf **)0, &rcvflg);
599 			if (error == EWOULDBLOCK &&
600 			    (rep->r_flags & R_SOFTTERM))
601 				return (EINTR);
602 		} while (error == EWOULDBLOCK);
603 		len -= auio.uio_resid;
604 	}
605 	if (error) {
606 		m_freem(*mp);
607 		*mp = (struct mbuf *)0;
608 	}
609 	/*
610 	 * Search for any mbufs that are not a multiple of 4 bytes long
611 	 * or with m_data not longword aligned.
612 	 * These could cause pointer alignment problems, so copy them to
613 	 * well aligned mbufs.
614 	 */
615 	nfs_realign(*mp, 5 * NFSX_UNSIGNED);
616 	return (error);
617 }
618 
619 /*
620  * Implement receipt of reply on a socket.
621  * We must search through the list of received datagrams matching them
622  * with outstanding requests using the xid, until ours is found.
623  */
624 /* ARGSUSED */
625 int
626 nfs_reply(myrep)
627 	struct nfsreq *myrep;
628 {
629 	register struct nfsreq *rep;
630 	register struct nfsmount *nmp = myrep->r_nmp;
631 	register int32_t t1;
632 	struct mbuf *mrep, *nam, *md;
633 	u_int32_t rxid, *tl;
634 	caddr_t dpos, cp2;
635 	int error;
636 
637 	/*
638 	 * Loop around until we get our own reply
639 	 */
640 	for (;;) {
641 		/*
642 		 * Lock against other receivers so that I don't get stuck in
643 		 * sbwait() after someone else has received my reply for me.
644 		 * Also necessary for connection based protocols to avoid
645 		 * race conditions during a reconnect.
646 		 */
647 		error = nfs_rcvlock(myrep);
648 		if (error)
649 			return (error);
650 		/* Already received, bye bye */
651 		if (myrep->r_mrep != NULL) {
652 			nfs_rcvunlock(&nmp->nm_flag);
653 			return (0);
654 		}
655 		/*
656 		 * Get the next Rpc reply off the socket
657 		 */
658 		error = nfs_receive(myrep, &nam, &mrep);
659 		nfs_rcvunlock(&nmp->nm_flag);
660 		if (error) {
661 
662 			/*
663 			 * Ignore routing errors on connectionless protocols??
664 			 */
665 			if (NFSIGNORE_SOERROR(nmp->nm_soflags, error)) {
666 				nmp->nm_so->so_error = 0;
667 				if (myrep->r_flags & R_GETONEREP)
668 					return (0);
669 				continue;
670 			}
671 			return (error);
672 		}
673 		if (nam)
674 			m_freem(nam);
675 
676 		/*
677 		 * Get the xid and check that it is an rpc reply
678 		 */
679 		md = mrep;
680 		dpos = mtod(md, caddr_t);
681 		nfsm_dissect(tl, u_int32_t *, 2*NFSX_UNSIGNED);
682 		rxid = *tl++;
683 		if (*tl != rpc_reply) {
684 			if (nmp->nm_flag & NFSMNT_NQNFS) {
685 				if (nqnfs_callback(nmp, mrep, md, dpos))
686 					nfsstats.rpcinvalid++;
687 			} else {
688 				nfsstats.rpcinvalid++;
689 				m_freem(mrep);
690 			}
691 nfsmout:
692 			if (myrep->r_flags & R_GETONEREP)
693 				return (0);
694 			continue;
695 		}
696 
697 		/*
698 		 * Loop through the request list to match up the reply
699 		 * Iff no match, just drop the datagram
700 		 */
701 		for (rep = nfs_reqq.tqh_first; rep != 0;
702 		    rep = rep->r_chain.tqe_next) {
703 			if (rep->r_mrep == NULL && rxid == rep->r_xid) {
704 				/* Found it.. */
705 				rep->r_mrep = mrep;
706 				rep->r_md = md;
707 				rep->r_dpos = dpos;
708 				if (nfsrtton) {
709 					struct rttl *rt;
710 
711 					rt = &nfsrtt.rttl[nfsrtt.pos];
712 					rt->proc = rep->r_procnum;
713 					rt->rto = NFS_RTO(nmp, proct[rep->r_procnum]);
714 					rt->sent = nmp->nm_sent;
715 					rt->cwnd = nmp->nm_cwnd;
716 					rt->srtt = nmp->nm_srtt[proct[rep->r_procnum] - 1];
717 					rt->sdrtt = nmp->nm_sdrtt[proct[rep->r_procnum] - 1];
718 					rt->fsid = nmp->nm_mountp->mnt_stat.f_fsid;
719 					rt->tstamp = time;
720 					if (rep->r_flags & R_TIMING)
721 						rt->rtt = rep->r_rtt;
722 					else
723 						rt->rtt = 1000000;
724 					nfsrtt.pos = (nfsrtt.pos + 1) % NFSRTTLOGSIZ;
725 				}
726 				/*
727 				 * Update congestion window.
728 				 * Do the additive increase of
729 				 * one rpc/rtt.
730 				 */
731 				if (nmp->nm_cwnd <= nmp->nm_sent) {
732 					nmp->nm_cwnd +=
733 					   (NFS_CWNDSCALE * NFS_CWNDSCALE +
734 					   (nmp->nm_cwnd >> 1)) / nmp->nm_cwnd;
735 					if (nmp->nm_cwnd > NFS_MAXCWND)
736 						nmp->nm_cwnd = NFS_MAXCWND;
737 				}
738 				rep->r_flags &= ~R_SENT;
739 				nmp->nm_sent -= NFS_CWNDSCALE;
740 				/*
741 				 * Update rtt using a gain of 0.125 on the mean
742 				 * and a gain of 0.25 on the deviation.
743 				 */
744 				if (rep->r_flags & R_TIMING) {
745 					/*
746 					 * Since the timer resolution of
747 					 * NFS_HZ is so course, it can often
748 					 * result in r_rtt == 0. Since
749 					 * r_rtt == N means that the actual
750 					 * rtt is between N+dt and N+2-dt ticks,
751 					 * add 1.
752 					 */
753 					t1 = rep->r_rtt + 1;
754 					t1 -= (NFS_SRTT(rep) >> 3);
755 					NFS_SRTT(rep) += t1;
756 					if (t1 < 0)
757 						t1 = -t1;
758 					t1 -= (NFS_SDRTT(rep) >> 2);
759 					NFS_SDRTT(rep) += t1;
760 				}
761 				nmp->nm_timeouts = 0;
762 				break;
763 			}
764 		}
765 		/*
766 		 * If not matched to a request, drop it.
767 		 * If it's mine, get out.
768 		 */
769 		if (rep == 0) {
770 			nfsstats.rpcunexpected++;
771 			m_freem(mrep);
772 		} else if (rep == myrep) {
773 			if (rep->r_mrep == NULL)
774 				panic("nfsreply nil");
775 			return (0);
776 		}
777 		if (myrep->r_flags & R_GETONEREP)
778 			return (0);
779 	}
780 }
781 
782 /*
783  * nfs_request - goes something like this
784  *	- fill in request struct
785  *	- links it into list
786  *	- calls nfs_send() for first transmit
787  *	- calls nfs_receive() to get reply
788  *	- break down rpc header and return with nfs reply pointed to
789  *	  by mrep or error
790  * nb: always frees up mreq mbuf list
791  */
792 int
793 nfs_request(vp, mrest, procnum, procp, cred, mrp, mdp, dposp)
794 	struct vnode *vp;
795 	struct mbuf *mrest;
796 	int procnum;
797 	struct proc *procp;
798 	struct ucred *cred;
799 	struct mbuf **mrp;
800 	struct mbuf **mdp;
801 	caddr_t *dposp;
802 {
803 	register struct mbuf *m, *mrep;
804 	register struct nfsreq *rep;
805 	register u_int32_t *tl;
806 	register int i;
807 	struct nfsmount *nmp;
808 	struct mbuf *md, *mheadend;
809 	struct nfsnode *np;
810 	char nickv[RPCX_NICKVERF];
811 	time_t reqtime, waituntil;
812 	caddr_t dpos, cp2;
813 	int t1, nqlflag, cachable, s, error = 0, mrest_len, auth_len, auth_type;
814 	int trylater_delay = NQ_TRYLATERDEL, trylater_cnt = 0, failed_auth = 0;
815 	int verf_len, verf_type;
816 	u_int32_t xid;
817 	u_quad_t frev;
818 	char *auth_str, *verf_str;
819 	NFSKERBKEY_T key;		/* save session key */
820 
821 	nmp = VFSTONFS(vp->v_mount);
822 	MALLOC(rep, struct nfsreq *, sizeof(struct nfsreq), M_NFSREQ, M_WAITOK);
823 	rep->r_nmp = nmp;
824 	rep->r_vp = vp;
825 	rep->r_procp = procp;
826 	rep->r_procnum = procnum;
827 	i = 0;
828 	m = mrest;
829 	while (m) {
830 		i += m->m_len;
831 		m = m->m_next;
832 	}
833 	mrest_len = i;
834 
835 	/*
836 	 * Get the RPC header with authorization.
837 	 */
838 kerbauth:
839 	verf_str = auth_str = (char *)0;
840 	if (nmp->nm_flag & NFSMNT_KERB) {
841 		verf_str = nickv;
842 		verf_len = sizeof (nickv);
843 		auth_type = RPCAUTH_KERB4;
844 		bzero((caddr_t)key, sizeof (key));
845 		if (failed_auth || nfs_getnickauth(nmp, cred, &auth_str,
846 			&auth_len, verf_str, verf_len)) {
847 			error = nfs_getauth(nmp, rep, cred, &auth_str,
848 				&auth_len, verf_str, &verf_len, key);
849 			if (error) {
850 				free((caddr_t)rep, M_NFSREQ);
851 				m_freem(mrest);
852 				return (error);
853 			}
854 		}
855 	} else {
856 		auth_type = RPCAUTH_UNIX;
857 		auth_len = (((cred->cr_ngroups > nmp->nm_numgrps) ?
858 			nmp->nm_numgrps : cred->cr_ngroups) << 2) +
859 			5 * NFSX_UNSIGNED;
860 	}
861 	m = nfsm_rpchead(cred, nmp->nm_flag, procnum, auth_type, auth_len,
862 	     auth_str, verf_len, verf_str, mrest, mrest_len, &mheadend, &xid);
863 	if (auth_str)
864 		free(auth_str, M_TEMP);
865 
866 	/*
867 	 * For stream protocols, insert a Sun RPC Record Mark.
868 	 */
869 	if (nmp->nm_sotype == SOCK_STREAM) {
870 		M_PREPEND(m, NFSX_UNSIGNED, M_WAIT);
871 		*mtod(m, u_int32_t *) = htonl(0x80000000 |
872 			 (m->m_pkthdr.len - NFSX_UNSIGNED));
873 	}
874 	rep->r_mreq = m;
875 	rep->r_xid = xid;
876 tryagain:
877 	if (nmp->nm_flag & NFSMNT_SOFT)
878 		rep->r_retry = nmp->nm_retry;
879 	else
880 		rep->r_retry = NFS_MAXREXMIT + 1;	/* past clip limit */
881 	rep->r_rtt = rep->r_rexmit = 0;
882 	if (proct[procnum] > 0)
883 		rep->r_flags = R_TIMING;
884 	else
885 		rep->r_flags = 0;
886 	rep->r_mrep = NULL;
887 
888 	/*
889 	 * Do the client side RPC.
890 	 */
891 	nfsstats.rpcrequests++;
892 	/*
893 	 * Chain request into list of outstanding requests. Be sure
894 	 * to put it LAST so timer finds oldest requests first.
895 	 */
896 	s = splsoftclock();
897 	TAILQ_INSERT_TAIL(&nfs_reqq, rep, r_chain);
898 
899 	/* Get send time for nqnfs */
900 	reqtime = time.tv_sec;
901 
902 	/*
903 	 * If backing off another request or avoiding congestion, don't
904 	 * send this one now but let timer do it. If not timing a request,
905 	 * do it now.
906 	 */
907 	if (nmp->nm_so && (nmp->nm_sotype != SOCK_DGRAM ||
908 		(nmp->nm_flag & NFSMNT_DUMBTIMR) ||
909 		nmp->nm_sent < nmp->nm_cwnd)) {
910 		splx(s);
911 		if (nmp->nm_soflags & PR_CONNREQUIRED)
912 			error = nfs_sndlock(&nmp->nm_flag, rep);
913 		if (!error) {
914 			m = m_copym(m, 0, M_COPYALL, M_WAIT);
915 			error = nfs_send(nmp->nm_so, nmp->nm_nam, m, rep);
916 			if (nmp->nm_soflags & PR_CONNREQUIRED)
917 				nfs_sndunlock(&nmp->nm_flag);
918 		}
919 		if (!error && (rep->r_flags & R_MUSTRESEND) == 0) {
920 			nmp->nm_sent += NFS_CWNDSCALE;
921 			rep->r_flags |= R_SENT;
922 		}
923 	} else {
924 		splx(s);
925 		rep->r_rtt = -1;
926 	}
927 
928 	/*
929 	 * Wait for the reply from our send or the timer's.
930 	 */
931 	if (!error || error == EPIPE)
932 		error = nfs_reply(rep);
933 
934 	/*
935 	 * RPC done, unlink the request.
936 	 */
937 	s = splsoftclock();
938 	TAILQ_REMOVE(&nfs_reqq, rep, r_chain);
939 	splx(s);
940 
941 	/*
942 	 * Decrement the outstanding request count.
943 	 */
944 	if (rep->r_flags & R_SENT) {
945 		rep->r_flags &= ~R_SENT;	/* paranoia */
946 		nmp->nm_sent -= NFS_CWNDSCALE;
947 	}
948 
949 	/*
950 	 * If there was a successful reply and a tprintf msg.
951 	 * tprintf a response.
952 	 */
953 	if (!error && (rep->r_flags & R_TPRINTFMSG))
954 		nfs_msg(rep->r_procp, nmp->nm_mountp->mnt_stat.f_mntfromname,
955 		    "is alive again");
956 	mrep = rep->r_mrep;
957 	md = rep->r_md;
958 	dpos = rep->r_dpos;
959 	if (error) {
960 		m_freem(rep->r_mreq);
961 		free((caddr_t)rep, M_NFSREQ);
962 		return (error);
963 	}
964 
965 	/*
966 	 * break down the rpc header and check if ok
967 	 */
968 	nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
969 	if (*tl++ == rpc_msgdenied) {
970 		if (*tl == rpc_mismatch)
971 			error = EOPNOTSUPP;
972 		else if ((nmp->nm_flag & NFSMNT_KERB) && *tl++ == rpc_autherr) {
973 			if (!failed_auth) {
974 				failed_auth++;
975 				mheadend->m_next = (struct mbuf *)0;
976 				m_freem(mrep);
977 				m_freem(rep->r_mreq);
978 				goto kerbauth;
979 			} else
980 				error = EAUTH;
981 		} else
982 			error = EACCES;
983 		m_freem(mrep);
984 		m_freem(rep->r_mreq);
985 		free((caddr_t)rep, M_NFSREQ);
986 		return (error);
987 	}
988 
989 	/*
990 	 * Grab any Kerberos verifier, otherwise just throw it away.
991 	 */
992 	verf_type = fxdr_unsigned(int, *tl++);
993 	i = fxdr_unsigned(int32_t, *tl);
994 	if ((nmp->nm_flag & NFSMNT_KERB) && verf_type == RPCAUTH_KERB4) {
995 		error = nfs_savenickauth(nmp, cred, i, key, &md, &dpos, mrep);
996 		if (error)
997 			goto nfsmout;
998 	} else if (i > 0)
999 		nfsm_adv(nfsm_rndup(i));
1000 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1001 	/* 0 == ok */
1002 	if (*tl == 0) {
1003 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1004 		if (*tl != 0) {
1005 			error = fxdr_unsigned(int, *tl);
1006 			if ((nmp->nm_flag & NFSMNT_NFSV3) &&
1007 				error == NFSERR_TRYLATER) {
1008 				m_freem(mrep);
1009 				error = 0;
1010 				waituntil = time.tv_sec + trylater_delay;
1011 				while (time.tv_sec < waituntil)
1012 					(void) tsleep((caddr_t)&lbolt,
1013 						PSOCK, "nqnfstry", 0);
1014 				trylater_delay *= nfs_backoff[trylater_cnt];
1015 				if (trylater_cnt < 7)
1016 					trylater_cnt++;
1017 				goto tryagain;
1018 			}
1019 
1020 			/*
1021 			 * If the File Handle was stale, invalidate the
1022 			 * lookup cache, just in case.
1023 			 */
1024 			if (error == ESTALE)
1025 				cache_purge(vp);
1026 			if (nmp->nm_flag & NFSMNT_NFSV3) {
1027 				*mrp = mrep;
1028 				*mdp = md;
1029 				*dposp = dpos;
1030 				error |= NFSERR_RETERR;
1031 			} else
1032 				m_freem(mrep);
1033 			m_freem(rep->r_mreq);
1034 			free((caddr_t)rep, M_NFSREQ);
1035 			return (error);
1036 		}
1037 
1038 		/*
1039 		 * For nqnfs, get any lease in reply
1040 		 */
1041 		if (nmp->nm_flag & NFSMNT_NQNFS) {
1042 			nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1043 			if (*tl) {
1044 				np = VTONFS(vp);
1045 				nqlflag = fxdr_unsigned(int, *tl);
1046 				nfsm_dissect(tl, u_int32_t *, 4*NFSX_UNSIGNED);
1047 				cachable = fxdr_unsigned(int, *tl++);
1048 				reqtime += fxdr_unsigned(int, *tl++);
1049 				if (reqtime > time.tv_sec) {
1050 				    fxdr_hyper(tl, &frev);
1051 				    nqnfs_clientlease(nmp, np, nqlflag,
1052 					cachable, reqtime, frev);
1053 				}
1054 			}
1055 		}
1056 		*mrp = mrep;
1057 		*mdp = md;
1058 		*dposp = dpos;
1059 		m_freem(rep->r_mreq);
1060 		FREE((caddr_t)rep, M_NFSREQ);
1061 		return (0);
1062 	}
1063 	m_freem(mrep);
1064 	error = EPROTONOSUPPORT;
1065 nfsmout:
1066 	m_freem(rep->r_mreq);
1067 	free((caddr_t)rep, M_NFSREQ);
1068 	return (error);
1069 }
1070 #endif /* NFSCLIENT */
1071 
1072 /*
1073  * Generate the rpc reply header
1074  * siz arg. is used to decide if adding a cluster is worthwhile
1075  */
1076 int
1077 nfs_rephead(siz, nd, slp, err, cache, frev, mrq, mbp, bposp)
1078 	int siz;
1079 	struct nfsrv_descript *nd;
1080 	struct nfssvc_sock *slp;
1081 	int err;
1082 	int cache;
1083 	u_quad_t *frev;
1084 	struct mbuf **mrq;
1085 	struct mbuf **mbp;
1086 	caddr_t *bposp;
1087 {
1088 	register u_int32_t *tl;
1089 	register struct mbuf *mreq;
1090 	caddr_t bpos;
1091 	struct mbuf *mb, *mb2;
1092 
1093 	MGETHDR(mreq, M_WAIT, MT_DATA);
1094 	mb = mreq;
1095 	/*
1096 	 * If this is a big reply, use a cluster else
1097 	 * try and leave leading space for the lower level headers.
1098 	 */
1099 	siz += RPC_REPLYSIZ;
1100 	if (siz >= MINCLSIZE) {
1101 		MCLGET(mreq, M_WAIT);
1102 	} else
1103 		mreq->m_data += max_hdr;
1104 	tl = mtod(mreq, u_int32_t *);
1105 	mreq->m_len = 6 * NFSX_UNSIGNED;
1106 	bpos = ((caddr_t)tl) + mreq->m_len;
1107 	*tl++ = txdr_unsigned(nd->nd_retxid);
1108 	*tl++ = rpc_reply;
1109 	if (err == ERPCMISMATCH || (err & NFSERR_AUTHERR)) {
1110 		*tl++ = rpc_msgdenied;
1111 		if (err & NFSERR_AUTHERR) {
1112 			*tl++ = rpc_autherr;
1113 			*tl = txdr_unsigned(err & ~NFSERR_AUTHERR);
1114 			mreq->m_len -= NFSX_UNSIGNED;
1115 			bpos -= NFSX_UNSIGNED;
1116 		} else {
1117 			*tl++ = rpc_mismatch;
1118 			*tl++ = txdr_unsigned(RPC_VER2);
1119 			*tl = txdr_unsigned(RPC_VER2);
1120 		}
1121 	} else {
1122 		*tl++ = rpc_msgaccepted;
1123 
1124 		/*
1125 		 * For Kerberos authentication, we must send the nickname
1126 		 * verifier back, otherwise just RPCAUTH_NULL.
1127 		 */
1128 		if (nd->nd_flag & ND_KERBFULL) {
1129 		    register struct nfsuid *nuidp;
1130 		    struct timeval ktvin, ktvout;
1131 
1132 		    for (nuidp = NUIDHASH(slp, nd->nd_cr.cr_uid)->lh_first;
1133 			nuidp != 0; nuidp = nuidp->nu_hash.le_next) {
1134 			if (nuidp->nu_cr.cr_uid == nd->nd_cr.cr_uid &&
1135 			    (!nd->nd_nam2 || netaddr_match(NU_NETFAM(nuidp),
1136 			     &nuidp->nu_haddr, nd->nd_nam2)))
1137 			    break;
1138 		    }
1139 		    if (nuidp) {
1140 			ktvin.tv_sec =
1141 			    txdr_unsigned(nuidp->nu_timestamp.tv_sec - 1);
1142 			ktvin.tv_usec =
1143 			    txdr_unsigned(nuidp->nu_timestamp.tv_usec);
1144 
1145 			/*
1146 			 * Encrypt the timestamp in ecb mode using the
1147 			 * session key.
1148 			 */
1149 #ifdef NFSKERB
1150 			XXX
1151 #endif
1152 
1153 			*tl++ = rpc_auth_kerb;
1154 			*tl++ = txdr_unsigned(3 * NFSX_UNSIGNED);
1155 			*tl = ktvout.tv_sec;
1156 			nfsm_build(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
1157 			*tl++ = ktvout.tv_usec;
1158 			*tl++ = txdr_unsigned(nuidp->nu_cr.cr_uid);
1159 		    } else {
1160 			*tl++ = 0;
1161 			*tl++ = 0;
1162 		    }
1163 		} else {
1164 			*tl++ = 0;
1165 			*tl++ = 0;
1166 		}
1167 		switch (err) {
1168 		case EPROGUNAVAIL:
1169 			*tl = txdr_unsigned(RPC_PROGUNAVAIL);
1170 			break;
1171 		case EPROGMISMATCH:
1172 			*tl = txdr_unsigned(RPC_PROGMISMATCH);
1173 			nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1174 			if (nd->nd_flag & ND_NQNFS) {
1175 				*tl++ = txdr_unsigned(3);
1176 				*tl = txdr_unsigned(3);
1177 			} else {
1178 				*tl++ = txdr_unsigned(2);
1179 				*tl = txdr_unsigned(3);
1180 			}
1181 			break;
1182 		case EPROCUNAVAIL:
1183 			*tl = txdr_unsigned(RPC_PROCUNAVAIL);
1184 			break;
1185 		case EBADRPC:
1186 			*tl = txdr_unsigned(RPC_GARBAGE);
1187 			break;
1188 		default:
1189 			*tl = 0;
1190 			if (err != NFSERR_RETVOID) {
1191 				nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
1192 				if (err)
1193 				    *tl = txdr_unsigned(nfsrv_errmap(nd, err));
1194 				else
1195 				    *tl = 0;
1196 			}
1197 			break;
1198 		};
1199 	}
1200 
1201 	/*
1202 	 * For nqnfs, piggyback lease as requested.
1203 	 */
1204 	if ((nd->nd_flag & ND_NQNFS) && err == 0) {
1205 		if (nd->nd_flag & ND_LEASE) {
1206 			nfsm_build(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1207 			*tl++ = txdr_unsigned(nd->nd_flag & ND_LEASE);
1208 			*tl++ = txdr_unsigned(cache);
1209 			*tl++ = txdr_unsigned(nd->nd_duration);
1210 			txdr_hyper(frev, tl);
1211 		} else {
1212 			nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
1213 			*tl = 0;
1214 		}
1215 	}
1216 	*mrq = mreq;
1217 	*mbp = mb;
1218 	*bposp = bpos;
1219 	if (err != 0 && err != NFSERR_RETVOID)
1220 		nfsstats.srvrpc_errs++;
1221 	return (0);
1222 }
1223 
1224 /*
1225  * Nfs timer routine
1226  * Scan the nfsreq list and retranmit any requests that have timed out
1227  * To avoid retransmission attempts on STREAM sockets (in the future) make
1228  * sure to set the r_retry field to 0 (implies nm_retry == 0).
1229  */
1230 void
1231 nfs_timer(arg)
1232 	void *arg;	/* never used */
1233 {
1234 	register struct nfsreq *rep;
1235 	register struct mbuf *m;
1236 	register struct socket *so;
1237 	register struct nfsmount *nmp;
1238 	register int timeo;
1239 	int s, error;
1240 #ifdef NFSSERVER
1241 	register struct nfssvc_sock *slp;
1242 	static long lasttime = 0;
1243 	u_quad_t cur_usec;
1244 #endif
1245 
1246 	s = splsoftnet();
1247 	for (rep = nfs_reqq.tqh_first; rep != 0; rep = rep->r_chain.tqe_next) {
1248 		nmp = rep->r_nmp;
1249 		if (rep->r_mrep || (rep->r_flags & R_SOFTTERM))
1250 			continue;
1251 		if (nfs_sigintr(nmp, rep, rep->r_procp)) {
1252 			rep->r_flags |= R_SOFTTERM;
1253 			continue;
1254 		}
1255 		if (rep->r_rtt >= 0) {
1256 			rep->r_rtt++;
1257 			if (nmp->nm_flag & NFSMNT_DUMBTIMR)
1258 				timeo = nmp->nm_timeo;
1259 			else
1260 				timeo = NFS_RTO(nmp, proct[rep->r_procnum]);
1261 			if (nmp->nm_timeouts > 0)
1262 				timeo *= nfs_backoff[nmp->nm_timeouts - 1];
1263 			if (rep->r_rtt <= timeo)
1264 				continue;
1265 			if (nmp->nm_timeouts < 8)
1266 				nmp->nm_timeouts++;
1267 		}
1268 		/*
1269 		 * Check for server not responding
1270 		 */
1271 		if ((rep->r_flags & R_TPRINTFMSG) == 0 &&
1272 		     rep->r_rexmit > nmp->nm_deadthresh) {
1273 			nfs_msg(rep->r_procp,
1274 			    nmp->nm_mountp->mnt_stat.f_mntfromname,
1275 			    "not responding");
1276 			rep->r_flags |= R_TPRINTFMSG;
1277 		}
1278 		if (rep->r_rexmit >= rep->r_retry) {	/* too many */
1279 			nfsstats.rpctimeouts++;
1280 			rep->r_flags |= R_SOFTTERM;
1281 			continue;
1282 		}
1283 		if (nmp->nm_sotype != SOCK_DGRAM) {
1284 			if (++rep->r_rexmit > NFS_MAXREXMIT)
1285 				rep->r_rexmit = NFS_MAXREXMIT;
1286 			continue;
1287 		}
1288 		if ((so = nmp->nm_so) == NULL)
1289 			continue;
1290 
1291 		/*
1292 		 * If there is enough space and the window allows..
1293 		 *	Resend it
1294 		 * Set r_rtt to -1 in case we fail to send it now.
1295 		 */
1296 		rep->r_rtt = -1;
1297 		if (sbspace(&so->so_snd) >= rep->r_mreq->m_pkthdr.len &&
1298 		   ((nmp->nm_flag & NFSMNT_DUMBTIMR) ||
1299 		    (rep->r_flags & R_SENT) ||
1300 		    nmp->nm_sent < nmp->nm_cwnd) &&
1301 		   (m = m_copym(rep->r_mreq, 0, M_COPYALL, M_DONTWAIT))){
1302 			if ((nmp->nm_flag & NFSMNT_NOCONN) == 0)
1303 			    error = (*so->so_proto->pr_usrreq)(so, PRU_SEND, m,
1304 			    (struct mbuf *)0, (struct mbuf *)0);
1305 			else
1306 			    error = (*so->so_proto->pr_usrreq)(so, PRU_SEND, m,
1307 			    nmp->nm_nam, (struct mbuf *)0);
1308 			if (error) {
1309 				if (NFSIGNORE_SOERROR(nmp->nm_soflags, error))
1310 					so->so_error = 0;
1311 			} else {
1312 				/*
1313 				 * Iff first send, start timing
1314 				 * else turn timing off, backoff timer
1315 				 * and divide congestion window by 2.
1316 				 */
1317 				if (rep->r_flags & R_SENT) {
1318 					rep->r_flags &= ~R_TIMING;
1319 					if (++rep->r_rexmit > NFS_MAXREXMIT)
1320 						rep->r_rexmit = NFS_MAXREXMIT;
1321 					nmp->nm_cwnd >>= 1;
1322 					if (nmp->nm_cwnd < NFS_CWNDSCALE)
1323 						nmp->nm_cwnd = NFS_CWNDSCALE;
1324 					nfsstats.rpcretries++;
1325 				} else {
1326 					rep->r_flags |= R_SENT;
1327 					nmp->nm_sent += NFS_CWNDSCALE;
1328 				}
1329 				rep->r_rtt = 0;
1330 			}
1331 		}
1332 	}
1333 
1334 #ifdef NFSSERVER
1335 	/*
1336 	 * Call the nqnfs server timer once a second to handle leases.
1337 	 */
1338 	if (lasttime != time.tv_sec) {
1339 		lasttime = time.tv_sec;
1340 		nqnfs_serverd();
1341 	}
1342 
1343 	/*
1344 	 * Scan the write gathering queues for writes that need to be
1345 	 * completed now.
1346 	 */
1347 	cur_usec = (u_quad_t)time.tv_sec * 1000000 + (u_quad_t)time.tv_usec;
1348 	for (slp = nfssvc_sockhead.tqh_first; slp != 0;
1349 	    slp = slp->ns_chain.tqe_next) {
1350 	    if (slp->ns_tq.lh_first && slp->ns_tq.lh_first->nd_time<=cur_usec)
1351 		nfsrv_wakenfsd(slp);
1352 	}
1353 #endif /* NFSSERVER */
1354 	splx(s);
1355 	timeout(nfs_timer, (void *)0, nfs_ticks);
1356 }
1357 
1358 /*
1359  * Test for a termination condition pending on the process.
1360  * This is used for NFSMNT_INT mounts.
1361  */
1362 int
1363 nfs_sigintr(nmp, rep, p)
1364 	struct nfsmount *nmp;
1365 	struct nfsreq *rep;
1366 	register struct proc *p;
1367 {
1368 
1369 	if (rep && (rep->r_flags & R_SOFTTERM))
1370 		return (EINTR);
1371 	if (!(nmp->nm_flag & NFSMNT_INT))
1372 		return (0);
1373 	if (p && p->p_siglist &&
1374 	    (((p->p_siglist & ~p->p_sigmask) & ~p->p_sigignore) &
1375 	    NFSINT_SIGMASK))
1376 		return (EINTR);
1377 	return (0);
1378 }
1379 
1380 /*
1381  * Lock a socket against others.
1382  * Necessary for STREAM sockets to ensure you get an entire rpc request/reply
1383  * and also to avoid race conditions between the processes with nfs requests
1384  * in progress when a reconnect is necessary.
1385  */
1386 int
1387 nfs_sndlock(flagp, rep)
1388 	register int *flagp;
1389 	struct nfsreq *rep;
1390 {
1391 	struct proc *p;
1392 	int slpflag = 0, slptimeo = 0;
1393 
1394 	if (rep) {
1395 		p = rep->r_procp;
1396 		if (rep->r_nmp->nm_flag & NFSMNT_INT)
1397 			slpflag = PCATCH;
1398 	} else
1399 		p = (struct proc *)0;
1400 	while (*flagp & NFSMNT_SNDLOCK) {
1401 		if (nfs_sigintr(rep->r_nmp, rep, p))
1402 			return (EINTR);
1403 		*flagp |= NFSMNT_WANTSND;
1404 		(void) tsleep((caddr_t)flagp, slpflag | (PZERO - 1), "nfsndlck",
1405 			slptimeo);
1406 		if (slpflag == PCATCH) {
1407 			slpflag = 0;
1408 			slptimeo = 2 * hz;
1409 		}
1410 	}
1411 	*flagp |= NFSMNT_SNDLOCK;
1412 	return (0);
1413 }
1414 
1415 /*
1416  * Unlock the stream socket for others.
1417  */
1418 void
1419 nfs_sndunlock(flagp)
1420 	register int *flagp;
1421 {
1422 
1423 	if ((*flagp & NFSMNT_SNDLOCK) == 0)
1424 		panic("nfs sndunlock");
1425 	*flagp &= ~NFSMNT_SNDLOCK;
1426 	if (*flagp & NFSMNT_WANTSND) {
1427 		*flagp &= ~NFSMNT_WANTSND;
1428 		wakeup((caddr_t)flagp);
1429 	}
1430 }
1431 
1432 int
1433 nfs_rcvlock(rep)
1434 	register struct nfsreq *rep;
1435 {
1436 	register int *flagp = &rep->r_nmp->nm_flag;
1437 	int slpflag, slptimeo = 0;
1438 
1439 	if (*flagp & NFSMNT_INT)
1440 		slpflag = PCATCH;
1441 	else
1442 		slpflag = 0;
1443 	while (*flagp & NFSMNT_RCVLOCK) {
1444 		if (nfs_sigintr(rep->r_nmp, rep, rep->r_procp))
1445 			return (EINTR);
1446 		*flagp |= NFSMNT_WANTRCV;
1447 		(void) tsleep((caddr_t)flagp, slpflag | (PZERO - 1), "nfsrcvlk",
1448 			slptimeo);
1449 		if (slpflag == PCATCH) {
1450 			slpflag = 0;
1451 			slptimeo = 2 * hz;
1452 		}
1453 	}
1454 	*flagp |= NFSMNT_RCVLOCK;
1455 	return (0);
1456 }
1457 
1458 /*
1459  * Unlock the stream socket for others.
1460  */
1461 void
1462 nfs_rcvunlock(flagp)
1463 	register int *flagp;
1464 {
1465 
1466 	if ((*flagp & NFSMNT_RCVLOCK) == 0)
1467 		panic("nfs rcvunlock");
1468 	*flagp &= ~NFSMNT_RCVLOCK;
1469 	if (*flagp & NFSMNT_WANTRCV) {
1470 		*flagp &= ~NFSMNT_WANTRCV;
1471 		wakeup((caddr_t)flagp);
1472 	}
1473 }
1474 
1475 /*
1476  * Check for badly aligned mbuf data areas and
1477  * realign data in an mbuf list by copying the data areas up, as required.
1478  */
1479 void
1480 nfs_realign(m, hsiz)
1481 	register struct mbuf *m;
1482 	int hsiz;
1483 {
1484 	register struct mbuf *m2;
1485 	register int siz, mlen, olen;
1486 	register caddr_t tcp, fcp;
1487 	struct mbuf *mnew;
1488 
1489 	while (m) {
1490 	    /*
1491 	     * This never happens for UDP, rarely happens for TCP
1492 	     * but frequently happens for iso transport.
1493 	     */
1494 	    if ((m->m_len & 0x3) || (mtod(m, long) & 0x3)) {
1495 		olen = m->m_len;
1496 		fcp = mtod(m, caddr_t);
1497 		if ((long)fcp & 0x3) {
1498 			m->m_flags &= ~M_PKTHDR;
1499 			if (m->m_flags & M_EXT)
1500 				m->m_data = m->m_ext.ext_buf +
1501 					((m->m_ext.ext_size - olen) & ~0x3);
1502 			else
1503 				m->m_data = m->m_dat;
1504 		}
1505 		m->m_len = 0;
1506 		tcp = mtod(m, caddr_t);
1507 		mnew = m;
1508 		m2 = m->m_next;
1509 
1510 		/*
1511 		 * If possible, only put the first invariant part
1512 		 * of the RPC header in the first mbuf.
1513 		 */
1514 		mlen = M_TRAILINGSPACE(m);
1515 		if (olen <= hsiz && mlen > hsiz)
1516 			mlen = hsiz;
1517 
1518 		/*
1519 		 * Loop through the mbuf list consolidating data.
1520 		 */
1521 		while (m) {
1522 			while (olen > 0) {
1523 				if (mlen == 0) {
1524 					m2->m_flags &= ~M_PKTHDR;
1525 					if (m2->m_flags & M_EXT)
1526 						m2->m_data = m2->m_ext.ext_buf;
1527 					else
1528 						m2->m_data = m2->m_dat;
1529 					m2->m_len = 0;
1530 					mlen = M_TRAILINGSPACE(m2);
1531 					tcp = mtod(m2, caddr_t);
1532 					mnew = m2;
1533 					m2 = m2->m_next;
1534 				}
1535 				siz = min(mlen, olen);
1536 				if (tcp != fcp)
1537 					bcopy(fcp, tcp, siz);
1538 				mnew->m_len += siz;
1539 				mlen -= siz;
1540 				olen -= siz;
1541 				tcp += siz;
1542 				fcp += siz;
1543 			}
1544 			m = m->m_next;
1545 			if (m) {
1546 				olen = m->m_len;
1547 				fcp = mtod(m, caddr_t);
1548 			}
1549 		}
1550 
1551 		/*
1552 		 * Finally, set m_len == 0 for any trailing mbufs that have
1553 		 * been copied out of.
1554 		 */
1555 		while (m2) {
1556 			m2->m_len = 0;
1557 			m2 = m2->m_next;
1558 		}
1559 		return;
1560 	    }
1561 	    m = m->m_next;
1562 	}
1563 }
1564 
1565 /*
1566  * Parse an RPC request
1567  * - verify it
1568  * - fill in the cred struct.
1569  */
1570 int
1571 nfs_getreq(nd, nfsd, has_header)
1572 	register struct nfsrv_descript *nd;
1573 	struct nfsd *nfsd;
1574 	int has_header;
1575 {
1576 	register int len, i;
1577 	register u_int32_t *tl;
1578 	register int32_t t1;
1579 	struct uio uio;
1580 	struct iovec iov;
1581 	caddr_t dpos, cp2, cp;
1582 	u_int32_t nfsvers, auth_type;
1583 	uid_t nickuid;
1584 	int error = 0, nqnfs = 0, ticklen;
1585 	struct mbuf *mrep, *md;
1586 	register struct nfsuid *nuidp;
1587 	struct timeval tvin, tvout;
1588 
1589 	mrep = nd->nd_mrep;
1590 	md = nd->nd_md;
1591 	dpos = nd->nd_dpos;
1592 	if (has_header) {
1593 		nfsm_dissect(tl, u_int32_t *, 10 * NFSX_UNSIGNED);
1594 		nd->nd_retxid = fxdr_unsigned(u_int32_t, *tl++);
1595 		if (*tl++ != rpc_call) {
1596 			m_freem(mrep);
1597 			return (EBADRPC);
1598 		}
1599 	} else
1600 		nfsm_dissect(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
1601 	nd->nd_repstat = 0;
1602 	nd->nd_flag = 0;
1603 	if (*tl++ != rpc_vers) {
1604 		nd->nd_repstat = ERPCMISMATCH;
1605 		nd->nd_procnum = NFSPROC_NOOP;
1606 		return (0);
1607 	}
1608 	if (*tl != nfs_prog) {
1609 		if (*tl == nqnfs_prog)
1610 			nqnfs++;
1611 		else {
1612 			nd->nd_repstat = EPROGUNAVAIL;
1613 			nd->nd_procnum = NFSPROC_NOOP;
1614 			return (0);
1615 		}
1616 	}
1617 	tl++;
1618 	nfsvers = fxdr_unsigned(u_int32_t, *tl++);
1619 	if (((nfsvers < NFS_VER2 || nfsvers > NFS_VER3) && !nqnfs) ||
1620 		(nfsvers != NQNFS_VER3 && nqnfs)) {
1621 		nd->nd_repstat = EPROGMISMATCH;
1622 		nd->nd_procnum = NFSPROC_NOOP;
1623 		return (0);
1624 	}
1625 	if (nqnfs)
1626 		nd->nd_flag = (ND_NFSV3 | ND_NQNFS);
1627 	else if (nfsvers == NFS_VER3)
1628 		nd->nd_flag = ND_NFSV3;
1629 	nd->nd_procnum = fxdr_unsigned(u_int32_t, *tl++);
1630 	if (nd->nd_procnum == NFSPROC_NULL)
1631 		return (0);
1632 	if (nd->nd_procnum >= NFS_NPROCS ||
1633 		(!nqnfs && nd->nd_procnum >= NQNFSPROC_GETLEASE) ||
1634 		(!nd->nd_flag && nd->nd_procnum > NFSV2PROC_STATFS)) {
1635 		nd->nd_repstat = EPROCUNAVAIL;
1636 		nd->nd_procnum = NFSPROC_NOOP;
1637 		return (0);
1638 	}
1639 	if ((nd->nd_flag & ND_NFSV3) == 0)
1640 		nd->nd_procnum = nfsv3_procid[nd->nd_procnum];
1641 	auth_type = *tl++;
1642 	len = fxdr_unsigned(int, *tl++);
1643 	if (len < 0 || len > RPCAUTH_MAXSIZ) {
1644 		m_freem(mrep);
1645 		return (EBADRPC);
1646 	}
1647 
1648 	nd->nd_flag &= ~ND_KERBAUTH;
1649 	/*
1650 	 * Handle auth_unix or auth_kerb.
1651 	 */
1652 	if (auth_type == rpc_auth_unix) {
1653 		len = fxdr_unsigned(int, *++tl);
1654 		if (len < 0 || len > NFS_MAXNAMLEN) {
1655 			m_freem(mrep);
1656 			return (EBADRPC);
1657 		}
1658 		nfsm_adv(nfsm_rndup(len));
1659 		nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
1660 		bzero((caddr_t)&nd->nd_cr, sizeof (struct ucred));
1661 		nd->nd_cr.cr_ref = 1;
1662 		nd->nd_cr.cr_uid = fxdr_unsigned(uid_t, *tl++);
1663 		nd->nd_cr.cr_gid = fxdr_unsigned(gid_t, *tl++);
1664 		len = fxdr_unsigned(int, *tl);
1665 		if (len < 0 || len > RPCAUTH_UNIXGIDS) {
1666 			m_freem(mrep);
1667 			return (EBADRPC);
1668 		}
1669 		nfsm_dissect(tl, u_int32_t *, (len + 2) * NFSX_UNSIGNED);
1670 		for (i = 0; i < len; i++)
1671 		    if (i < NGROUPS)
1672 			nd->nd_cr.cr_groups[i] = fxdr_unsigned(gid_t, *tl++);
1673 		    else
1674 			tl++;
1675 		nd->nd_cr.cr_ngroups = (len > NGROUPS) ? NGROUPS : len;
1676 		if (nd->nd_cr.cr_ngroups > 1)
1677 		    nfsrvw_sort(nd->nd_cr.cr_groups, nd->nd_cr.cr_ngroups);
1678 		len = fxdr_unsigned(int, *++tl);
1679 		if (len < 0 || len > RPCAUTH_MAXSIZ) {
1680 			m_freem(mrep);
1681 			return (EBADRPC);
1682 		}
1683 		if (len > 0)
1684 			nfsm_adv(nfsm_rndup(len));
1685 	} else if (auth_type == rpc_auth_kerb) {
1686 		switch (fxdr_unsigned(int, *tl++)) {
1687 		case RPCAKN_FULLNAME:
1688 			ticklen = fxdr_unsigned(int, *tl);
1689 			*((u_int32_t *)nfsd->nfsd_authstr) = *tl;
1690 			uio.uio_resid = nfsm_rndup(ticklen) + NFSX_UNSIGNED;
1691 			nfsd->nfsd_authlen = uio.uio_resid + NFSX_UNSIGNED;
1692 			if (uio.uio_resid > (len - 2 * NFSX_UNSIGNED)) {
1693 				m_freem(mrep);
1694 				return (EBADRPC);
1695 			}
1696 			uio.uio_offset = 0;
1697 			uio.uio_iov = &iov;
1698 			uio.uio_iovcnt = 1;
1699 			uio.uio_segflg = UIO_SYSSPACE;
1700 			iov.iov_base = (caddr_t)&nfsd->nfsd_authstr[4];
1701 			iov.iov_len = RPCAUTH_MAXSIZ - 4;
1702 			nfsm_mtouio(&uio, uio.uio_resid);
1703 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1704 			if (*tl++ != rpc_auth_kerb ||
1705 				fxdr_unsigned(int, *tl) != 4 * NFSX_UNSIGNED) {
1706 				printf("Bad kerb verifier\n");
1707 				nd->nd_repstat = (NFSERR_AUTHERR|AUTH_BADVERF);
1708 				nd->nd_procnum = NFSPROC_NOOP;
1709 				return (0);
1710 			}
1711 			nfsm_dissect(cp, caddr_t, 4 * NFSX_UNSIGNED);
1712 			tl = (u_int32_t *)cp;
1713 			if (fxdr_unsigned(int, *tl) != RPCAKN_FULLNAME) {
1714 				printf("Not fullname kerb verifier\n");
1715 				nd->nd_repstat = (NFSERR_AUTHERR|AUTH_BADVERF);
1716 				nd->nd_procnum = NFSPROC_NOOP;
1717 				return (0);
1718 			}
1719 			cp += NFSX_UNSIGNED;
1720 			bcopy(cp, nfsd->nfsd_verfstr, 3 * NFSX_UNSIGNED);
1721 			nfsd->nfsd_verflen = 3 * NFSX_UNSIGNED;
1722 			nd->nd_flag |= ND_KERBFULL;
1723 			nfsd->nfsd_flag |= NFSD_NEEDAUTH;
1724 			break;
1725 		case RPCAKN_NICKNAME:
1726 			if (len != 2 * NFSX_UNSIGNED) {
1727 				printf("Kerb nickname short\n");
1728 				nd->nd_repstat = (NFSERR_AUTHERR|AUTH_BADCRED);
1729 				nd->nd_procnum = NFSPROC_NOOP;
1730 				return (0);
1731 			}
1732 			nickuid = fxdr_unsigned(uid_t, *tl);
1733 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1734 			if (*tl++ != rpc_auth_kerb ||
1735 				fxdr_unsigned(int, *tl) != 3 * NFSX_UNSIGNED) {
1736 				printf("Kerb nick verifier bad\n");
1737 				nd->nd_repstat = (NFSERR_AUTHERR|AUTH_BADVERF);
1738 				nd->nd_procnum = NFSPROC_NOOP;
1739 				return (0);
1740 			}
1741 			nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
1742 			tvin.tv_sec = *tl++;
1743 			tvin.tv_usec = *tl;
1744 
1745 			for (nuidp = NUIDHASH(nfsd->nfsd_slp,nickuid)->lh_first;
1746 			    nuidp != 0; nuidp = nuidp->nu_hash.le_next) {
1747 				if (nuidp->nu_cr.cr_uid == nickuid &&
1748 				    (!nd->nd_nam2 ||
1749 				     netaddr_match(NU_NETFAM(nuidp),
1750 				      &nuidp->nu_haddr, nd->nd_nam2)))
1751 					break;
1752 			}
1753 			if (!nuidp) {
1754 				nd->nd_repstat =
1755 					(NFSERR_AUTHERR|AUTH_REJECTCRED);
1756 				nd->nd_procnum = NFSPROC_NOOP;
1757 				return (0);
1758 			}
1759 
1760 			/*
1761 			 * Now, decrypt the timestamp using the session key
1762 			 * and validate it.
1763 			 */
1764 #ifdef NFSKERB
1765 			XXX
1766 #endif
1767 
1768 			tvout.tv_sec = fxdr_unsigned(long, tvout.tv_sec);
1769 			tvout.tv_usec = fxdr_unsigned(long, tvout.tv_usec);
1770 			if (nuidp->nu_expire < time.tv_sec ||
1771 			    nuidp->nu_timestamp.tv_sec > tvout.tv_sec ||
1772 			    (nuidp->nu_timestamp.tv_sec == tvout.tv_sec &&
1773 			     nuidp->nu_timestamp.tv_usec > tvout.tv_usec)) {
1774 				nuidp->nu_expire = 0;
1775 				nd->nd_repstat =
1776 				    (NFSERR_AUTHERR|AUTH_REJECTVERF);
1777 				nd->nd_procnum = NFSPROC_NOOP;
1778 				return (0);
1779 			}
1780 			nfsrv_setcred(&nuidp->nu_cr, &nd->nd_cr);
1781 			nd->nd_flag |= ND_KERBNICK;
1782 		};
1783 	} else {
1784 		nd->nd_repstat = (NFSERR_AUTHERR | AUTH_REJECTCRED);
1785 		nd->nd_procnum = NFSPROC_NOOP;
1786 		return (0);
1787 	}
1788 
1789 	/*
1790 	 * For nqnfs, get piggybacked lease request.
1791 	 */
1792 	if (nqnfs && nd->nd_procnum != NQNFSPROC_EVICTED) {
1793 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1794 		nd->nd_flag |= fxdr_unsigned(int, *tl);
1795 		if (nd->nd_flag & ND_LEASE) {
1796 			nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1797 			nd->nd_duration = fxdr_unsigned(u_int32_t, *tl);
1798 		} else
1799 			nd->nd_duration = NQ_MINLEASE;
1800 	} else
1801 		nd->nd_duration = NQ_MINLEASE;
1802 	nd->nd_md = md;
1803 	nd->nd_dpos = dpos;
1804 	return (0);
1805 nfsmout:
1806 	return (error);
1807 }
1808 
1809 int
1810 nfs_msg(p, server, msg)
1811 	struct proc *p;
1812 	char *server, *msg;
1813 {
1814 	tpr_t tpr;
1815 
1816 	if (p)
1817 		tpr = tprintf_open(p);
1818 	else
1819 		tpr = NULL;
1820 	tprintf(tpr, "nfs server %s: %s\n", server, msg);
1821 	tprintf_close(tpr);
1822 	return (0);
1823 }
1824 
1825 #ifdef NFSSERVER
1826 int (*nfsrv3_procs[NFS_NPROCS]) __P((struct nfsrv_descript *,
1827 				    struct nfssvc_sock *, struct proc *,
1828 				    struct mbuf **)) = {
1829 	nfsrv_null,
1830 	nfsrv_getattr,
1831 	nfsrv_setattr,
1832 	nfsrv_lookup,
1833 	nfsrv3_access,
1834 	nfsrv_readlink,
1835 	nfsrv_read,
1836 	nfsrv_write,
1837 	nfsrv_create,
1838 	nfsrv_mkdir,
1839 	nfsrv_symlink,
1840 	nfsrv_mknod,
1841 	nfsrv_remove,
1842 	nfsrv_rmdir,
1843 	nfsrv_rename,
1844 	nfsrv_link,
1845 	nfsrv_readdir,
1846 	nfsrv_readdirplus,
1847 	nfsrv_statfs,
1848 	nfsrv_fsinfo,
1849 	nfsrv_pathconf,
1850 	nfsrv_commit,
1851 	nqnfsrv_getlease,
1852 	nqnfsrv_vacated,
1853 	nfsrv_noop,
1854 	nfsrv_noop
1855 };
1856 
1857 /*
1858  * Socket upcall routine for the nfsd sockets.
1859  * The caddr_t arg is a pointer to the "struct nfssvc_sock".
1860  * Essentially do as much as possible non-blocking, else punt and it will
1861  * be called with M_WAIT from an nfsd.
1862  */
1863 void
1864 nfsrv_rcv(so, arg, waitflag)
1865 	struct socket *so;
1866 	caddr_t arg;
1867 	int waitflag;
1868 {
1869 	register struct nfssvc_sock *slp = (struct nfssvc_sock *)arg;
1870 	register struct mbuf *m;
1871 	struct mbuf *mp, *nam;
1872 	struct uio auio;
1873 	int flags, error;
1874 
1875 	if ((slp->ns_flag & SLP_VALID) == 0)
1876 		return;
1877 #ifdef notdef
1878 	/*
1879 	 * Define this to test for nfsds handling this under heavy load.
1880 	 */
1881 	if (waitflag == M_DONTWAIT) {
1882 		slp->ns_flag |= SLP_NEEDQ; goto dorecs;
1883 	}
1884 #endif
1885 	auio.uio_procp = NULL;
1886 	if (so->so_type == SOCK_STREAM) {
1887 		/*
1888 		 * If there are already records on the queue, defer soreceive()
1889 		 * to an nfsd so that there is feedback to the TCP layer that
1890 		 * the nfs servers are heavily loaded.
1891 		 */
1892 		if (slp->ns_rec && waitflag == M_DONTWAIT) {
1893 			slp->ns_flag |= SLP_NEEDQ;
1894 			goto dorecs;
1895 		}
1896 
1897 		/*
1898 		 * Do soreceive().
1899 		 */
1900 		auio.uio_resid = 1000000000;
1901 		flags = MSG_DONTWAIT;
1902 		error = soreceive(so, &nam, &auio, &mp, (struct mbuf **)0, &flags);
1903 		if (error || mp == (struct mbuf *)0) {
1904 			if (error == EWOULDBLOCK)
1905 				slp->ns_flag |= SLP_NEEDQ;
1906 			else
1907 				slp->ns_flag |= SLP_DISCONN;
1908 			goto dorecs;
1909 		}
1910 		m = mp;
1911 		if (slp->ns_rawend) {
1912 			slp->ns_rawend->m_next = m;
1913 			slp->ns_cc += 1000000000 - auio.uio_resid;
1914 		} else {
1915 			slp->ns_raw = m;
1916 			slp->ns_cc = 1000000000 - auio.uio_resid;
1917 		}
1918 		while (m->m_next)
1919 			m = m->m_next;
1920 		slp->ns_rawend = m;
1921 
1922 		/*
1923 		 * Now try and parse record(s) out of the raw stream data.
1924 		 */
1925 		error = nfsrv_getstream(slp, waitflag);
1926 		if (error) {
1927 			if (error == EPERM)
1928 				slp->ns_flag |= SLP_DISCONN;
1929 			else
1930 				slp->ns_flag |= SLP_NEEDQ;
1931 		}
1932 	} else {
1933 		do {
1934 			auio.uio_resid = 1000000000;
1935 			flags = MSG_DONTWAIT;
1936 			error = soreceive(so, &nam, &auio, &mp,
1937 						(struct mbuf **)0, &flags);
1938 			if (mp) {
1939 				nfs_realign(mp, 10 * NFSX_UNSIGNED);
1940 				if (nam) {
1941 					m = nam;
1942 					m->m_next = mp;
1943 				} else
1944 					m = mp;
1945 				if (slp->ns_recend)
1946 					slp->ns_recend->m_nextpkt = m;
1947 				else
1948 					slp->ns_rec = m;
1949 				slp->ns_recend = m;
1950 				m->m_nextpkt = (struct mbuf *)0;
1951 			}
1952 			if (error) {
1953 				if ((so->so_proto->pr_flags & PR_CONNREQUIRED)
1954 					&& error != EWOULDBLOCK) {
1955 					slp->ns_flag |= SLP_DISCONN;
1956 					goto dorecs;
1957 				}
1958 			}
1959 		} while (mp);
1960 	}
1961 
1962 	/*
1963 	 * Now try and process the request records, non-blocking.
1964 	 */
1965 dorecs:
1966 	if (waitflag == M_DONTWAIT &&
1967 		(slp->ns_rec || (slp->ns_flag & (SLP_NEEDQ | SLP_DISCONN))))
1968 		nfsrv_wakenfsd(slp);
1969 }
1970 
1971 /*
1972  * Try and extract an RPC request from the mbuf data list received on a
1973  * stream socket. The "waitflag" argument indicates whether or not it
1974  * can sleep.
1975  */
1976 int
1977 nfsrv_getstream(slp, waitflag)
1978 	register struct nfssvc_sock *slp;
1979 	int waitflag;
1980 {
1981 	register struct mbuf *m, **mpp;
1982 	register char *cp1, *cp2;
1983 	register int len;
1984 	struct mbuf *om, *m2, *recm = NULL;
1985 	u_int32_t recmark;
1986 
1987 	if (slp->ns_flag & SLP_GETSTREAM)
1988 		panic("nfs getstream");
1989 	slp->ns_flag |= SLP_GETSTREAM;
1990 	for (;;) {
1991 	    if (slp->ns_reclen == 0) {
1992 		if (slp->ns_cc < NFSX_UNSIGNED) {
1993 			slp->ns_flag &= ~SLP_GETSTREAM;
1994 			return (0);
1995 		}
1996 		m = slp->ns_raw;
1997 		if (m->m_len >= NFSX_UNSIGNED) {
1998 			bcopy(mtod(m, caddr_t), (caddr_t)&recmark, NFSX_UNSIGNED);
1999 			m->m_data += NFSX_UNSIGNED;
2000 			m->m_len -= NFSX_UNSIGNED;
2001 		} else {
2002 			cp1 = (caddr_t)&recmark;
2003 			cp2 = mtod(m, caddr_t);
2004 			while (cp1 < ((caddr_t)&recmark) + NFSX_UNSIGNED) {
2005 				while (m->m_len == 0) {
2006 					m = m->m_next;
2007 					cp2 = mtod(m, caddr_t);
2008 				}
2009 				*cp1++ = *cp2++;
2010 				m->m_data++;
2011 				m->m_len--;
2012 			}
2013 		}
2014 		slp->ns_cc -= NFSX_UNSIGNED;
2015 		recmark = ntohl(recmark);
2016 		slp->ns_reclen = recmark & ~0x80000000;
2017 		if (recmark & 0x80000000)
2018 			slp->ns_flag |= SLP_LASTFRAG;
2019 		else
2020 			slp->ns_flag &= ~SLP_LASTFRAG;
2021 		if (slp->ns_reclen > NFS_MAXPACKET) {
2022 			slp->ns_flag &= ~SLP_GETSTREAM;
2023 			return (EPERM);
2024 		}
2025 	    }
2026 
2027 	    /*
2028 	     * Now get the record part.
2029 	     */
2030 	    if (slp->ns_cc == slp->ns_reclen) {
2031 		recm = slp->ns_raw;
2032 		slp->ns_raw = slp->ns_rawend = (struct mbuf *)0;
2033 		slp->ns_cc = slp->ns_reclen = 0;
2034 	    } else if (slp->ns_cc > slp->ns_reclen) {
2035 		len = 0;
2036 		m = slp->ns_raw;
2037 		om = (struct mbuf *)0;
2038 		while (len < slp->ns_reclen) {
2039 			if ((len + m->m_len) > slp->ns_reclen) {
2040 				m2 = m_copym(m, 0, slp->ns_reclen - len,
2041 					waitflag);
2042 				if (m2) {
2043 					if (om) {
2044 						om->m_next = m2;
2045 						recm = slp->ns_raw;
2046 					} else
2047 						recm = m2;
2048 					m->m_data += slp->ns_reclen - len;
2049 					m->m_len -= slp->ns_reclen - len;
2050 					len = slp->ns_reclen;
2051 				} else {
2052 					slp->ns_flag &= ~SLP_GETSTREAM;
2053 					return (EWOULDBLOCK);
2054 				}
2055 			} else if ((len + m->m_len) == slp->ns_reclen) {
2056 				om = m;
2057 				len += m->m_len;
2058 				m = m->m_next;
2059 				recm = slp->ns_raw;
2060 				om->m_next = (struct mbuf *)0;
2061 			} else {
2062 				om = m;
2063 				len += m->m_len;
2064 				m = m->m_next;
2065 			}
2066 		}
2067 		slp->ns_raw = m;
2068 		slp->ns_cc -= len;
2069 		slp->ns_reclen = 0;
2070 	    } else {
2071 		slp->ns_flag &= ~SLP_GETSTREAM;
2072 		return (0);
2073 	    }
2074 
2075 	    /*
2076 	     * Accumulate the fragments into a record.
2077 	     */
2078 	    mpp = &slp->ns_frag;
2079 	    while (*mpp)
2080 		mpp = &((*mpp)->m_next);
2081 	    *mpp = recm;
2082 	    if (slp->ns_flag & SLP_LASTFRAG) {
2083 		nfs_realign(slp->ns_frag, 10 * NFSX_UNSIGNED);
2084 		if (slp->ns_recend)
2085 		    slp->ns_recend->m_nextpkt = slp->ns_frag;
2086 		else
2087 		    slp->ns_rec = slp->ns_frag;
2088 		slp->ns_recend = slp->ns_frag;
2089 		slp->ns_frag = (struct mbuf *)0;
2090 	    }
2091 	}
2092 }
2093 
2094 /*
2095  * Parse an RPC header.
2096  */
2097 int
2098 nfsrv_dorec(slp, nfsd, ndp)
2099 	register struct nfssvc_sock *slp;
2100 	struct nfsd *nfsd;
2101 	struct nfsrv_descript **ndp;
2102 {
2103 	register struct mbuf *m, *nam;
2104 	register struct nfsrv_descript *nd;
2105 	int error;
2106 
2107 	*ndp = NULL;
2108 	if ((slp->ns_flag & SLP_VALID) == 0 ||
2109 	    (m = slp->ns_rec) == (struct mbuf *)0)
2110 		return (ENOBUFS);
2111 	slp->ns_rec = m->m_nextpkt;
2112 	if (slp->ns_rec)
2113 		m->m_nextpkt = (struct mbuf *)0;
2114 	else
2115 		slp->ns_recend = (struct mbuf *)0;
2116 	if (m->m_type == MT_SONAME) {
2117 		nam = m;
2118 		m = m->m_next;
2119 		nam->m_next = NULL;
2120 	} else
2121 		nam = NULL;
2122 	MALLOC(nd, struct nfsrv_descript *, sizeof (struct nfsrv_descript),
2123 		M_NFSRVDESC, M_WAITOK);
2124 	nd->nd_md = nd->nd_mrep = m;
2125 	nd->nd_nam2 = nam;
2126 	nd->nd_dpos = mtod(m, caddr_t);
2127 	error = nfs_getreq(nd, nfsd, TRUE);
2128 	if (error) {
2129 		m_freem(nam);
2130 		free((caddr_t)nd, M_NFSRVDESC);
2131 		return (error);
2132 	}
2133 	*ndp = nd;
2134 	nfsd->nfsd_nd = nd;
2135 	return (0);
2136 }
2137 
2138 
2139 /*
2140  * Search for a sleeping nfsd and wake it up.
2141  * SIDE EFFECT: If none found, set NFSD_CHECKSLP flag, so that one of the
2142  * running nfsds will go look for the work in the nfssvc_sock list.
2143  */
2144 void
2145 nfsrv_wakenfsd(slp)
2146 	struct nfssvc_sock *slp;
2147 {
2148 	register struct nfsd *nd;
2149 
2150 	if ((slp->ns_flag & SLP_VALID) == 0)
2151 		return;
2152 	for (nd = nfsd_head.tqh_first; nd != 0; nd = nd->nfsd_chain.tqe_next) {
2153 		if (nd->nfsd_flag & NFSD_WAITING) {
2154 			nd->nfsd_flag &= ~NFSD_WAITING;
2155 			if (nd->nfsd_slp)
2156 				panic("nfsd wakeup");
2157 			slp->ns_sref++;
2158 			nd->nfsd_slp = slp;
2159 			wakeup((caddr_t)nd);
2160 			return;
2161 		}
2162 	}
2163 	slp->ns_flag |= SLP_DOREC;
2164 	nfsd_head_flag |= NFSD_CHECKSLP;
2165 }
2166 #endif /* NFSSERVER */
2167