xref: /freebsd/sys/fs/nfsserver/nfs_nfsdport.c (revision eb6d21b4ca6d668cf89afd99eef7baeafa712197)
1 /*-
2  * Copyright (c) 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Rick Macklem at The University of Guelph.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 4. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  */
33 
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 /*
38  * Functions that perform the vfs operations required by the routines in
39  * nfsd_serv.c. It is hoped that this change will make the server more
40  * portable.
41  */
42 
43 #include <fs/nfs/nfsport.h>
44 #include <sys/sysctl.h>
45 #include <nlm/nlm_prot.h>
46 #include <nlm/nlm.h>
47 
48 extern u_int32_t newnfs_true, newnfs_false, newnfs_xdrneg1;
49 extern int nfsv4root_set;
50 extern int nfsrv_useacl;
51 extern int newnfs_numnfsd;
52 extern struct mount nfsv4root_mnt;
53 extern struct nfsrv_stablefirst nfsrv_stablefirst;
54 extern void (*nfsd_call_servertimer)(void);
55 struct vfsoptlist nfsv4root_opt, nfsv4root_newopt;
56 NFSDLOCKMUTEX;
57 struct mtx nfs_cache_mutex;
58 struct mtx nfs_v4root_mutex;
59 struct nfsrvfh nfs_rootfh, nfs_pubfh;
60 int nfs_pubfhset = 0, nfs_rootfhset = 0;
61 static uint32_t nfsv4_sysid = 0;
62 
63 static int nfssvc_srvcall(struct thread *, struct nfssvc_args *,
64     struct ucred *);
65 
66 static int enable_crossmntpt = 1;
67 static int nfs_commit_blks;
68 static int nfs_commit_miss;
69 extern int nfsrv_issuedelegs;
70 extern int nfsrv_dolocallocks;
71 
72 SYSCTL_DECL(_vfs_newnfs);
73 SYSCTL_INT(_vfs_newnfs, OID_AUTO, mirrormnt, CTLFLAG_RW, &enable_crossmntpt,
74     0, "Enable nfsd to cross mount points");
75 SYSCTL_INT(_vfs_newnfs, OID_AUTO, commit_blks, CTLFLAG_RW, &nfs_commit_blks,
76     0, "");
77 SYSCTL_INT(_vfs_newnfs, OID_AUTO, commit_miss, CTLFLAG_RW, &nfs_commit_miss,
78     0, "");
79 SYSCTL_INT(_vfs_newnfs, OID_AUTO, issue_delegations, CTLFLAG_RW,
80     &nfsrv_issuedelegs, 0, "Enable nfsd to issue delegations");
81 SYSCTL_INT(_vfs_newnfs, OID_AUTO, enable_locallocks, CTLFLAG_RW,
82     &nfsrv_dolocallocks, 0, "Enable nfsd to acquire local locks on files");
83 
84 #define	NUM_HEURISTIC		1017
85 #define	NHUSE_INIT		64
86 #define	NHUSE_INC		16
87 #define	NHUSE_MAX		2048
88 
89 static struct nfsheur {
90 	struct vnode *nh_vp;	/* vp to match (unreferenced pointer) */
91 	off_t nh_nextr;		/* next offset for sequential detection */
92 	int nh_use;		/* use count for selection */
93 	int nh_seqcount;	/* heuristic */
94 } nfsheur[NUM_HEURISTIC];
95 
96 
97 /*
98  * Get attributes into nfsvattr structure.
99  */
100 int
101 nfsvno_getattr(struct vnode *vp, struct nfsvattr *nvap, struct ucred *cred,
102     struct thread *p)
103 {
104 	int error, lockedit = 0;
105 
106 	/* Since FreeBSD insists the vnode be locked... */
107 	if (VOP_ISLOCKED(vp) != LK_EXCLUSIVE) {
108 		lockedit = 1;
109 		NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY, p);
110 	}
111 	error = VOP_GETATTR(vp, &nvap->na_vattr, cred);
112 	if (lockedit)
113 		NFSVOPUNLOCK(vp, 0, p);
114 	return (error);
115 }
116 
117 /*
118  * Get a file handle for a vnode.
119  */
120 int
121 nfsvno_getfh(struct vnode *vp, fhandle_t *fhp, struct thread *p)
122 {
123 	int error;
124 
125 	NFSBZERO((caddr_t)fhp, sizeof(fhandle_t));
126 	fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
127 	error = VOP_VPTOFH(vp, &fhp->fh_fid);
128 	return (error);
129 }
130 
131 /*
132  * Perform access checking for vnodes obtained from file handles that would
133  * refer to files already opened by a Unix client. You cannot just use
134  * vn_writechk() and VOP_ACCESS() for two reasons.
135  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
136  * 2 - The owner is to be given access irrespective of mode bits for some
137  *     operations, so that processes that chmod after opening a file don't
138  *     break.
139  */
140 int
141 nfsvno_accchk(struct vnode *vp, u_int32_t accessbits, struct ucred *cred,
142     struct nfsexstuff *exp, struct thread *p, int override, int vpislocked)
143 {
144 	struct vattr vattr;
145 	int error = 0, getret = 0;
146 	accmode_t accmode;
147 
148 	/*
149 	 * Convert accessbits to Vxxx flags.
150 	 */
151 	if (accessbits & (NFSV4ACE_WRITEDATA | NFSV4ACE_APPENDDATA |
152 	    NFSV4ACE_ADDFILE | NFSV4ACE_ADDSUBDIRECTORY |
153 	    NFSV4ACE_DELETECHILD | NFSV4ACE_WRITEATTRIBUTES |
154 	    NFSV4ACE_DELETE | NFSV4ACE_WRITEACL | NFSV4ACE_WRITEOWNER))
155 		accmode = VWRITE;
156 	else if (accessbits & (NFSV4ACE_EXECUTE | NFSV4ACE_SEARCH))
157 		accmode = VEXEC;
158 	else
159 		accmode = VREAD;
160 
161 	if (accmode & VWRITE) {
162 		/* Just vn_writechk() changed to check rdonly */
163 		/*
164 		 * Disallow write attempts on read-only file systems;
165 		 * unless the file is a socket or a block or character
166 		 * device resident on the file system.
167 		 */
168 		if (NFSVNO_EXRDONLY(exp) ||
169 			(vp->v_mount->mnt_flag & MNT_RDONLY)) {
170 			switch (vp->v_type) {
171 			case VREG:
172 			case VDIR:
173 			case VLNK:
174 				return (EROFS);
175 			default:
176 				break;
177 			}
178 		}
179 		/*
180 		 * If there's shared text associated with
181 		 * the inode, try to free it up once.  If
182 		 * we fail, we can't allow writing.
183 		 */
184 		if (vp->v_vflag & VV_TEXT)
185 			return (ETXTBSY);
186 	}
187 	if (vpislocked == 0)
188 		NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY, p);
189 
190 #if defined(NFS4_ACL_EXTATTR_NAME) && defined(notyet)
191 	/*
192 	 * This function should be called once FFS has NFSv4 ACL support
193 	 * in it.
194 	 */
195 	/*
196 	 * Should the override still be applied when ACLs are enabled?
197 	 */
198 	if (nfsrv_useacl != 0 && NFSHASNFS4ACL(vp->v_mount))
199 		error = nfsrv_aclaccess(vp, accmode, accessbits, cred, p);
200 	else
201 #endif
202 	if (accessbits == NFSV4ACE_READATTRIBUTES)
203 		error = 0;
204 	else
205 		error = VOP_ACCESS(vp, accmode, cred, p);
206 
207 	/*
208 	 * Allow certain operations for the owner (reads and writes
209 	 * on files that are already open).
210 	 */
211 	if (override != NFSACCCHK_NOOVERRIDE &&
212 	    (error == EPERM || error == EACCES)) {
213 		if (cred->cr_uid == 0 && (override & NFSACCCHK_ALLOWROOT))
214 			error = 0;
215 		else if (override & NFSACCCHK_ALLOWOWNER) {
216 			getret = VOP_GETATTR(vp, &vattr, cred);
217 			if (getret == 0 && cred->cr_uid == vattr.va_uid)
218 				error = 0;
219 		}
220 	}
221 	if (vpislocked == 0)
222 		NFSVOPUNLOCK(vp, 0, p);
223 	return (error);
224 }
225 
226 /*
227  * Set attribute(s) vnop.
228  */
229 int
230 nfsvno_setattr(struct vnode *vp, struct nfsvattr *nvap, struct ucred *cred,
231     struct thread *p, struct nfsexstuff *exp)
232 {
233 	int error;
234 
235 	error = VOP_SETATTR(vp, &nvap->na_vattr, cred);
236 	return (error);
237 }
238 
239 /*
240  * Set up nameidata for a lookup() call and do it
241  * For the cases where we are crossing mount points
242  * (looking up the public fh path or the v4 root path when
243  *  not using a pseudo-root fs), set/release the Giant lock,
244  * as required.
245  */
246 int
247 nfsvno_namei(struct nfsrv_descript *nd, struct nameidata *ndp,
248     struct vnode *dp, int islocked, struct nfsexstuff *exp, struct thread *p,
249     struct vnode **retdirp)
250 {
251 	struct componentname *cnp = &ndp->ni_cnd;
252 	int i;
253 	struct iovec aiov;
254 	struct uio auio;
255 	int lockleaf = (cnp->cn_flags & LOCKLEAF) != 0, linklen;
256 	int error = 0, crossmnt;
257 	char *cp;
258 
259 	*retdirp = NULL;
260 	cnp->cn_nameptr = cnp->cn_pnbuf;
261 	/*
262 	 * Extract and set starting directory.
263 	 */
264 	if (dp->v_type != VDIR) {
265 		if (islocked)
266 			vput(dp);
267 		else
268 			vrele(dp);
269 		nfsvno_relpathbuf(ndp);
270 		return (ENOTDIR);
271 	}
272 	if (islocked)
273 		NFSVOPUNLOCK(dp, 0, p);
274 	VREF(dp);
275 	*retdirp = dp;
276 	if (NFSVNO_EXRDONLY(exp))
277 		cnp->cn_flags |= RDONLY;
278 	ndp->ni_segflg = UIO_SYSSPACE;
279 	crossmnt = 1;
280 
281 	if (nd->nd_flag & ND_PUBLOOKUP) {
282 		ndp->ni_loopcnt = 0;
283 		if (cnp->cn_pnbuf[0] == '/') {
284 			vrele(dp);
285 			/*
286 			 * Check for degenerate pathnames here, since lookup()
287 			 * panics on them.
288 			 */
289 			for (i = 1; i < ndp->ni_pathlen; i++)
290 				if (cnp->cn_pnbuf[i] != '/')
291 					break;
292 			if (i == ndp->ni_pathlen) {
293 				error = NFSERR_ACCES;
294 				goto out;
295 			}
296 			dp = rootvnode;
297 			VREF(dp);
298 		}
299 	} else if ((enable_crossmntpt == 0 && NFSVNO_EXPORTED(exp)) ||
300 	    (nd->nd_flag & ND_NFSV4) == 0) {
301 		/*
302 		 * Only cross mount points for NFSv4 when doing a
303 		 * mount while traversing the file system above
304 		 * the mount point, unless enable_crossmntpt is set.
305 		 */
306 		cnp->cn_flags |= NOCROSSMOUNT;
307 		crossmnt = 0;
308 	}
309 
310 	/*
311 	 * Initialize for scan, set ni_startdir and bump ref on dp again
312 	 * becuase lookup() will dereference ni_startdir.
313 	 */
314 
315 	cnp->cn_thread = p;
316 	ndp->ni_startdir = dp;
317 	ndp->ni_rootdir = rootvnode;
318 
319 	if (!lockleaf)
320 		cnp->cn_flags |= LOCKLEAF;
321 	for (;;) {
322 		cnp->cn_nameptr = cnp->cn_pnbuf;
323 		/*
324 		 * Call lookup() to do the real work.  If an error occurs,
325 		 * ndp->ni_vp and ni_dvp are left uninitialized or NULL and
326 		 * we do not have to dereference anything before returning.
327 		 * In either case ni_startdir will be dereferenced and NULLed
328 		 * out.
329 		 */
330 		if (exp->nes_vfslocked)
331 			ndp->ni_cnd.cn_flags |= GIANTHELD;
332 		error = lookup(ndp);
333 		/*
334 		 * The Giant lock should only change when
335 		 * crossing mount points.
336 		 */
337 		if (crossmnt) {
338 			exp->nes_vfslocked =
339 			    (ndp->ni_cnd.cn_flags & GIANTHELD) != 0;
340 			ndp->ni_cnd.cn_flags &= ~GIANTHELD;
341 		}
342 		if (error)
343 			break;
344 
345 		/*
346 		 * Check for encountering a symbolic link.  Trivial
347 		 * termination occurs if no symlink encountered.
348 		 */
349 		if ((cnp->cn_flags & ISSYMLINK) == 0) {
350 			if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0)
351 				nfsvno_relpathbuf(ndp);
352 			if (ndp->ni_vp && !lockleaf)
353 				NFSVOPUNLOCK(ndp->ni_vp, 0, p);
354 			break;
355 		}
356 
357 		/*
358 		 * Validate symlink
359 		 */
360 		if ((cnp->cn_flags & LOCKPARENT) && ndp->ni_pathlen == 1)
361 			NFSVOPUNLOCK(ndp->ni_dvp, 0, p);
362 		if (!(nd->nd_flag & ND_PUBLOOKUP)) {
363 			error = EINVAL;
364 			goto badlink2;
365 		}
366 
367 		if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
368 			error = ELOOP;
369 			goto badlink2;
370 		}
371 		if (ndp->ni_pathlen > 1)
372 			cp = uma_zalloc(namei_zone, M_WAITOK);
373 		else
374 			cp = cnp->cn_pnbuf;
375 		aiov.iov_base = cp;
376 		aiov.iov_len = MAXPATHLEN;
377 		auio.uio_iov = &aiov;
378 		auio.uio_iovcnt = 1;
379 		auio.uio_offset = 0;
380 		auio.uio_rw = UIO_READ;
381 		auio.uio_segflg = UIO_SYSSPACE;
382 		auio.uio_td = NULL;
383 		auio.uio_resid = MAXPATHLEN;
384 		error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred);
385 		if (error) {
386 		badlink1:
387 			if (ndp->ni_pathlen > 1)
388 				uma_zfree(namei_zone, cp);
389 		badlink2:
390 			vrele(ndp->ni_dvp);
391 			vput(ndp->ni_vp);
392 			break;
393 		}
394 		linklen = MAXPATHLEN - auio.uio_resid;
395 		if (linklen == 0) {
396 			error = ENOENT;
397 			goto badlink1;
398 		}
399 		if (linklen + ndp->ni_pathlen >= MAXPATHLEN) {
400 			error = ENAMETOOLONG;
401 			goto badlink1;
402 		}
403 
404 		/*
405 		 * Adjust or replace path
406 		 */
407 		if (ndp->ni_pathlen > 1) {
408 			NFSBCOPY(ndp->ni_next, cp + linklen, ndp->ni_pathlen);
409 			uma_zfree(namei_zone, cnp->cn_pnbuf);
410 			cnp->cn_pnbuf = cp;
411 		} else
412 			cnp->cn_pnbuf[linklen] = '\0';
413 		ndp->ni_pathlen += linklen;
414 
415 		/*
416 		 * Cleanup refs for next loop and check if root directory
417 		 * should replace current directory.  Normally ni_dvp
418 		 * becomes the new base directory and is cleaned up when
419 		 * we loop.  Explicitly null pointers after invalidation
420 		 * to clarify operation.
421 		 */
422 		vput(ndp->ni_vp);
423 		ndp->ni_vp = NULL;
424 
425 		if (cnp->cn_pnbuf[0] == '/') {
426 			vrele(ndp->ni_dvp);
427 			ndp->ni_dvp = ndp->ni_rootdir;
428 			VREF(ndp->ni_dvp);
429 		}
430 		ndp->ni_startdir = ndp->ni_dvp;
431 		ndp->ni_dvp = NULL;
432 	}
433 	if (!lockleaf)
434 		cnp->cn_flags &= ~LOCKLEAF;
435 
436 out:
437 	if (error) {
438 		uma_zfree(namei_zone, cnp->cn_pnbuf);
439 		ndp->ni_vp = NULL;
440 		ndp->ni_dvp = NULL;
441 		ndp->ni_startdir = NULL;
442 		cnp->cn_flags &= ~HASBUF;
443 	} else if ((ndp->ni_cnd.cn_flags & (WANTPARENT|LOCKPARENT)) == 0) {
444 		ndp->ni_dvp = NULL;
445 	}
446 	return (error);
447 }
448 
449 /*
450  * Set up a pathname buffer and return a pointer to it and, optionally
451  * set a hash pointer.
452  */
453 void
454 nfsvno_setpathbuf(struct nameidata *ndp, char **bufpp, u_long **hashpp)
455 {
456 	struct componentname *cnp = &ndp->ni_cnd;
457 
458 	cnp->cn_flags |= (NOMACCHECK | HASBUF);
459 	cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK);
460 	if (hashpp != NULL)
461 		*hashpp = NULL;
462 	*bufpp = cnp->cn_pnbuf;
463 }
464 
465 /*
466  * Release the above path buffer, if not released by nfsvno_namei().
467  */
468 void
469 nfsvno_relpathbuf(struct nameidata *ndp)
470 {
471 
472 	if ((ndp->ni_cnd.cn_flags & HASBUF) == 0)
473 		panic("nfsrelpath");
474 	uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf);
475 	ndp->ni_cnd.cn_flags &= ~HASBUF;
476 }
477 
478 /*
479  * Readlink vnode op into an mbuf list.
480  */
481 int
482 nfsvno_readlink(struct vnode *vp, struct ucred *cred, struct thread *p,
483     struct mbuf **mpp, struct mbuf **mpendp, int *lenp)
484 {
485 	struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
486 	struct iovec *ivp = iv;
487 	struct uio io, *uiop = &io;
488 	struct mbuf *mp, *mp2 = NULL, *mp3 = NULL;
489 	int i, len, tlen, error;
490 
491 	len = 0;
492 	i = 0;
493 	while (len < NFS_MAXPATHLEN) {
494 		NFSMGET(mp);
495 		MCLGET(mp, M_WAIT);
496 		mp->m_len = NFSMSIZ(mp);
497 		if (len == 0) {
498 			mp3 = mp2 = mp;
499 		} else {
500 			mp2->m_next = mp;
501 			mp2 = mp;
502 		}
503 		if ((len + mp->m_len) > NFS_MAXPATHLEN) {
504 			mp->m_len = NFS_MAXPATHLEN - len;
505 			len = NFS_MAXPATHLEN;
506 		} else {
507 			len += mp->m_len;
508 		}
509 		ivp->iov_base = mtod(mp, caddr_t);
510 		ivp->iov_len = mp->m_len;
511 		i++;
512 		ivp++;
513 	}
514 	uiop->uio_iov = iv;
515 	uiop->uio_iovcnt = i;
516 	uiop->uio_offset = 0;
517 	uiop->uio_resid = len;
518 	uiop->uio_rw = UIO_READ;
519 	uiop->uio_segflg = UIO_SYSSPACE;
520 	uiop->uio_td = NULL;
521 	error = VOP_READLINK(vp, uiop, cred);
522 	if (error) {
523 		m_freem(mp3);
524 		*lenp = 0;
525 		return (error);
526 	}
527 	if (uiop->uio_resid > 0) {
528 		len -= uiop->uio_resid;
529 		tlen = NFSM_RNDUP(len);
530 		nfsrv_adj(mp3, NFS_MAXPATHLEN - tlen, tlen - len);
531 	}
532 	*lenp = len;
533 	*mpp = mp3;
534 	*mpendp = mp;
535 	return (0);
536 }
537 
538 /*
539  * Read vnode op call into mbuf list.
540  */
541 int
542 nfsvno_read(struct vnode *vp, off_t off, int cnt, struct ucred *cred,
543     struct thread *p, struct mbuf **mpp, struct mbuf **mpendp)
544 {
545 	struct mbuf *m;
546 	int i;
547 	struct iovec *iv;
548 	struct iovec *iv2;
549 	int error = 0, len, left, siz, tlen, ioflag = 0, hi, try = 32;
550 	struct mbuf *m2 = NULL, *m3;
551 	struct uio io, *uiop = &io;
552 	struct nfsheur *nh;
553 
554 	/*
555 	 * Calculate seqcount for heuristic
556 	 */
557 	/*
558 	 * Locate best candidate
559 	 */
560 
561 	hi = ((int)(vm_offset_t)vp / sizeof(struct vnode)) % NUM_HEURISTIC;
562 	nh = &nfsheur[hi];
563 
564 	while (try--) {
565 		if (nfsheur[hi].nh_vp == vp) {
566 			nh = &nfsheur[hi];
567 			break;
568 		}
569 		if (nfsheur[hi].nh_use > 0)
570 			--nfsheur[hi].nh_use;
571 		hi = (hi + 1) % NUM_HEURISTIC;
572 		if (nfsheur[hi].nh_use < nh->nh_use)
573 			nh = &nfsheur[hi];
574 	}
575 
576 	if (nh->nh_vp != vp) {
577 		nh->nh_vp = vp;
578 		nh->nh_nextr = off;
579 		nh->nh_use = NHUSE_INIT;
580 		if (off == 0)
581 			nh->nh_seqcount = 4;
582 		else
583 			nh->nh_seqcount = 1;
584 	}
585 
586 	/*
587 	 * Calculate heuristic
588 	 */
589 
590 	if ((off == 0 && nh->nh_seqcount > 0) || off == nh->nh_nextr) {
591 		if (++nh->nh_seqcount > IO_SEQMAX)
592 			nh->nh_seqcount = IO_SEQMAX;
593 	} else if (nh->nh_seqcount > 1) {
594 		nh->nh_seqcount = 1;
595 	} else {
596 		nh->nh_seqcount = 0;
597 	}
598 	nh->nh_use += NHUSE_INC;
599 	if (nh->nh_use > NHUSE_MAX)
600 		nh->nh_use = NHUSE_MAX;
601 	ioflag |= nh->nh_seqcount << IO_SEQSHIFT;
602 
603 	len = left = NFSM_RNDUP(cnt);
604 	m3 = NULL;
605 	/*
606 	 * Generate the mbuf list with the uio_iov ref. to it.
607 	 */
608 	i = 0;
609 	while (left > 0) {
610 		NFSMGET(m);
611 		MCLGET(m, M_WAIT);
612 		m->m_len = 0;
613 		siz = min(M_TRAILINGSPACE(m), left);
614 		left -= siz;
615 		i++;
616 		if (m3)
617 			m2->m_next = m;
618 		else
619 			m3 = m;
620 		m2 = m;
621 	}
622 	MALLOC(iv, struct iovec *, i * sizeof (struct iovec),
623 	    M_TEMP, M_WAITOK);
624 	uiop->uio_iov = iv2 = iv;
625 	m = m3;
626 	left = len;
627 	i = 0;
628 	while (left > 0) {
629 		if (m == NULL)
630 			panic("nfsvno_read iov");
631 		siz = min(M_TRAILINGSPACE(m), left);
632 		if (siz > 0) {
633 			iv->iov_base = mtod(m, caddr_t) + m->m_len;
634 			iv->iov_len = siz;
635 			m->m_len += siz;
636 			left -= siz;
637 			iv++;
638 			i++;
639 		}
640 		m = m->m_next;
641 	}
642 	uiop->uio_iovcnt = i;
643 	uiop->uio_offset = off;
644 	uiop->uio_resid = len;
645 	uiop->uio_rw = UIO_READ;
646 	uiop->uio_segflg = UIO_SYSSPACE;
647 	error = VOP_READ(vp, uiop, IO_NODELOCKED | ioflag, cred);
648 	FREE((caddr_t)iv2, M_TEMP);
649 	if (error) {
650 		m_freem(m3);
651 		*mpp = NULL;
652 		return (error);
653 	}
654 	tlen = len - uiop->uio_resid;
655 	cnt = cnt < tlen ? cnt : tlen;
656 	tlen = NFSM_RNDUP(cnt);
657 	if (tlen == 0) {
658 		m_freem(m3);
659 		m3 = NULL;
660 	} else if (len != tlen || tlen != cnt)
661 		nfsrv_adj(m3, len - tlen, tlen - cnt);
662 	*mpp = m3;
663 	*mpendp = m2;
664 	return (0);
665 }
666 
667 /*
668  * Write vnode op from an mbuf list.
669  */
670 int
671 nfsvno_write(struct vnode *vp, off_t off, int retlen, int cnt, int stable,
672     struct mbuf *mp, char *cp, struct ucred *cred, struct thread *p)
673 {
674 	struct iovec *ivp;
675 	int i, len;
676 	struct iovec *iv;
677 	int ioflags, error;
678 	struct uio io, *uiop = &io;
679 
680 	MALLOC(ivp, struct iovec *, cnt * sizeof (struct iovec), M_TEMP,
681 	    M_WAITOK);
682 	uiop->uio_iov = iv = ivp;
683 	uiop->uio_iovcnt = cnt;
684 	i = mtod(mp, caddr_t) + mp->m_len - cp;
685 	len = retlen;
686 	while (len > 0) {
687 		if (mp == NULL)
688 			panic("nfsvno_write");
689 		if (i > 0) {
690 			i = min(i, len);
691 			ivp->iov_base = cp;
692 			ivp->iov_len = i;
693 			ivp++;
694 			len -= i;
695 		}
696 		mp = mp->m_next;
697 		if (mp) {
698 			i = mp->m_len;
699 			cp = mtod(mp, caddr_t);
700 		}
701 	}
702 
703 	if (stable == NFSWRITE_UNSTABLE)
704 		ioflags = IO_NODELOCKED;
705 	else
706 		ioflags = (IO_SYNC | IO_NODELOCKED);
707 	uiop->uio_resid = retlen;
708 	uiop->uio_rw = UIO_WRITE;
709 	uiop->uio_segflg = UIO_SYSSPACE;
710 	NFSUIOPROC(uiop, p);
711 	uiop->uio_offset = off;
712 	error = VOP_WRITE(vp, uiop, ioflags, cred);
713 	FREE((caddr_t)iv, M_TEMP);
714 	return (error);
715 }
716 
717 /*
718  * Common code for creating a regular file (plus special files for V2).
719  */
720 int
721 nfsvno_createsub(struct nfsrv_descript *nd, struct nameidata *ndp,
722     struct vnode **vpp, struct nfsvattr *nvap, int *exclusive_flagp,
723     int32_t *cverf, NFSDEV_T rdev, struct thread *p, struct nfsexstuff *exp)
724 {
725 	u_quad_t tempsize;
726 	int error;
727 
728 	error = nd->nd_repstat;
729 	if (!error && ndp->ni_vp == NULL) {
730 		if (nvap->na_type == VREG || nvap->na_type == VSOCK) {
731 			vrele(ndp->ni_startdir);
732 			error = VOP_CREATE(ndp->ni_dvp,
733 			    &ndp->ni_vp, &ndp->ni_cnd, &nvap->na_vattr);
734 			vput(ndp->ni_dvp);
735 			nfsvno_relpathbuf(ndp);
736 			if (!error) {
737 				if (*exclusive_flagp) {
738 					*exclusive_flagp = 0;
739 					NFSVNO_ATTRINIT(nvap);
740 					nvap->na_atime.tv_sec = cverf[0];
741 					nvap->na_atime.tv_nsec = cverf[1];
742 					error = VOP_SETATTR(ndp->ni_vp,
743 					    &nvap->na_vattr, nd->nd_cred);
744 				}
745 			}
746 		/*
747 		 * NFS V2 Only. nfsrvd_mknod() does this for V3.
748 		 * (This implies, just get out on an error.)
749 		 */
750 		} else if (nvap->na_type == VCHR || nvap->na_type == VBLK ||
751 			nvap->na_type == VFIFO) {
752 			if (nvap->na_type == VCHR && rdev == 0xffffffff)
753 				nvap->na_type = VFIFO;
754                         if (nvap->na_type != VFIFO &&
755 			    (error = priv_check_cred(nd->nd_cred,
756 			     PRIV_VFS_MKNOD_DEV, 0))) {
757 				vrele(ndp->ni_startdir);
758 				nfsvno_relpathbuf(ndp);
759 				vput(ndp->ni_dvp);
760 				return (error);
761 			}
762 			nvap->na_rdev = rdev;
763 			error = VOP_MKNOD(ndp->ni_dvp, &ndp->ni_vp,
764 			    &ndp->ni_cnd, &nvap->na_vattr);
765 			vput(ndp->ni_dvp);
766 			nfsvno_relpathbuf(ndp);
767 			if (error) {
768 				vrele(ndp->ni_startdir);
769 				return (error);
770 			}
771 		} else {
772 			vrele(ndp->ni_startdir);
773 			nfsvno_relpathbuf(ndp);
774 			vput(ndp->ni_dvp);
775 			return (ENXIO);
776 		}
777 		*vpp = ndp->ni_vp;
778 	} else {
779 		/*
780 		 * Handle cases where error is already set and/or
781 		 * the file exists.
782 		 * 1 - clean up the lookup
783 		 * 2 - iff !error and na_size set, truncate it
784 		 */
785 		vrele(ndp->ni_startdir);
786 		nfsvno_relpathbuf(ndp);
787 		*vpp = ndp->ni_vp;
788 		if (ndp->ni_dvp == *vpp)
789 			vrele(ndp->ni_dvp);
790 		else
791 			vput(ndp->ni_dvp);
792 		if (!error && nvap->na_size != VNOVAL) {
793 			error = nfsvno_accchk(*vpp, NFSV4ACE_ADDFILE,
794 			    nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
795 			    NFSACCCHK_VPISLOCKED);
796 			if (!error) {
797 				tempsize = nvap->na_size;
798 				NFSVNO_ATTRINIT(nvap);
799 				nvap->na_size = tempsize;
800 				error = VOP_SETATTR(*vpp,
801 				    &nvap->na_vattr, nd->nd_cred);
802 			}
803 		}
804 		if (error)
805 			vput(*vpp);
806 	}
807 	return (error);
808 }
809 
810 /*
811  * Do a mknod vnode op.
812  */
813 int
814 nfsvno_mknod(struct nameidata *ndp, struct nfsvattr *nvap, struct ucred *cred,
815     struct thread *p)
816 {
817 	int error = 0;
818 	enum vtype vtyp;
819 
820 	vtyp = nvap->na_type;
821 	/*
822 	 * Iff doesn't exist, create it.
823 	 */
824 	if (ndp->ni_vp) {
825 		vrele(ndp->ni_startdir);
826 		nfsvno_relpathbuf(ndp);
827 		vput(ndp->ni_dvp);
828 		vrele(ndp->ni_vp);
829 		return (EEXIST);
830 	}
831 	if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
832 		vrele(ndp->ni_startdir);
833 		nfsvno_relpathbuf(ndp);
834 		vput(ndp->ni_dvp);
835 		return (NFSERR_BADTYPE);
836 	}
837 	if (vtyp == VSOCK) {
838 		vrele(ndp->ni_startdir);
839 		error = VOP_CREATE(ndp->ni_dvp, &ndp->ni_vp,
840 		    &ndp->ni_cnd, &nvap->na_vattr);
841 		vput(ndp->ni_dvp);
842 		nfsvno_relpathbuf(ndp);
843 	} else {
844 		if (nvap->na_type != VFIFO &&
845 		    (error = priv_check_cred(cred, PRIV_VFS_MKNOD_DEV, 0))) {
846 			vrele(ndp->ni_startdir);
847 			nfsvno_relpathbuf(ndp);
848 			vput(ndp->ni_dvp);
849 			return (error);
850 		}
851 		error = VOP_MKNOD(ndp->ni_dvp, &ndp->ni_vp,
852 		    &ndp->ni_cnd, &nvap->na_vattr);
853 		vput(ndp->ni_dvp);
854 		nfsvno_relpathbuf(ndp);
855 		if (error)
856 			vrele(ndp->ni_startdir);
857 		/*
858 		 * Since VOP_MKNOD returns the ni_vp, I can't
859 		 * see any reason to do the lookup.
860 		 */
861 	}
862 	return (error);
863 }
864 
865 /*
866  * Mkdir vnode op.
867  */
868 int
869 nfsvno_mkdir(struct nameidata *ndp, struct nfsvattr *nvap, uid_t saved_uid,
870     struct ucred *cred, struct thread *p, struct nfsexstuff *exp)
871 {
872 	int error = 0;
873 
874 	if (ndp->ni_vp != NULL) {
875 		if (ndp->ni_dvp == ndp->ni_vp)
876 			vrele(ndp->ni_dvp);
877 		else
878 			vput(ndp->ni_dvp);
879 		vrele(ndp->ni_vp);
880 		return (EEXIST);
881 	}
882 	error = VOP_MKDIR(ndp->ni_dvp, &ndp->ni_vp, &ndp->ni_cnd,
883 	    &nvap->na_vattr);
884 	vput(ndp->ni_dvp);
885 	nfsvno_relpathbuf(ndp);
886 	return (error);
887 }
888 
889 /*
890  * symlink vnode op.
891  */
892 int
893 nfsvno_symlink(struct nameidata *ndp, struct nfsvattr *nvap, char *pathcp,
894     int pathlen, int not_v2, uid_t saved_uid, struct ucred *cred, struct thread *p,
895     struct nfsexstuff *exp)
896 {
897 	int error = 0;
898 
899 	if (ndp->ni_vp) {
900 		vrele(ndp->ni_startdir);
901 		nfsvno_relpathbuf(ndp);
902 		if (ndp->ni_dvp == ndp->ni_vp)
903 			vrele(ndp->ni_dvp);
904 		else
905 			vput(ndp->ni_dvp);
906 		vrele(ndp->ni_vp);
907 		return (EEXIST);
908 	}
909 
910 	error = VOP_SYMLINK(ndp->ni_dvp, &ndp->ni_vp, &ndp->ni_cnd,
911 	    &nvap->na_vattr, pathcp);
912 	vput(ndp->ni_dvp);
913 	vrele(ndp->ni_startdir);
914 	nfsvno_relpathbuf(ndp);
915 	/*
916 	 * Although FreeBSD still had the lookup code in
917 	 * it for 7/current, there doesn't seem to be any
918 	 * point, since VOP_SYMLINK() returns the ni_vp.
919 	 * Just vput it for v2.
920 	 */
921 	if (!not_v2 && !error)
922 		vput(ndp->ni_vp);
923 	return (error);
924 }
925 
926 /*
927  * Parse symbolic link arguments.
928  * This function has an ugly side effect. It will MALLOC() an area for
929  * the symlink and set iov_base to point to it, only if it succeeds.
930  * So, if it returns with uiop->uio_iov->iov_base != NULL, that must
931  * be FREE'd later.
932  */
933 int
934 nfsvno_getsymlink(struct nfsrv_descript *nd, struct nfsvattr *nvap,
935     struct thread *p, char **pathcpp, int *lenp)
936 {
937 	u_int32_t *tl;
938 	char *pathcp = NULL;
939 	int error = 0, len;
940 	struct nfsv2_sattr *sp;
941 
942 	*pathcpp = NULL;
943 	*lenp = 0;
944 	if ((nd->nd_flag & ND_NFSV3) &&
945 	    (error = nfsrv_sattr(nd, nvap, NULL, NULL, p)))
946 		goto nfsmout;
947 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
948 	len = fxdr_unsigned(int, *tl);
949 	if (len > NFS_MAXPATHLEN || len <= 0) {
950 		error = EBADRPC;
951 		goto nfsmout;
952 	}
953 	MALLOC(pathcp, caddr_t, len + 1, M_TEMP, M_WAITOK);
954 	error = nfsrv_mtostr(nd, pathcp, len);
955 	if (error)
956 		goto nfsmout;
957 	if (nd->nd_flag & ND_NFSV2) {
958 		NFSM_DISSECT(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
959 		nvap->na_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
960 	}
961 	*pathcpp = pathcp;
962 	*lenp = len;
963 	return (0);
964 nfsmout:
965 	if (pathcp)
966 		free(pathcp, M_TEMP);
967 	return (error);
968 }
969 
970 /*
971  * Remove a non-directory object.
972  */
973 int
974 nfsvno_removesub(struct nameidata *ndp, int is_v4, struct ucred *cred,
975     struct thread *p, struct nfsexstuff *exp)
976 {
977 	struct vnode *vp;
978 	int error = 0;
979 
980 	vp = ndp->ni_vp;
981 	if (vp->v_type == VDIR)
982 		error = NFSERR_ISDIR;
983 	else if (is_v4)
984 		error = nfsrv_checkremove(vp, 1, p);
985 	if (!error)
986 		error = VOP_REMOVE(ndp->ni_dvp, vp, &ndp->ni_cnd);
987 	if (ndp->ni_dvp == vp)
988 		vrele(ndp->ni_dvp);
989 	else
990 		vput(ndp->ni_dvp);
991 	vput(vp);
992 	return (error);
993 }
994 
995 /*
996  * Remove a directory.
997  */
998 int
999 nfsvno_rmdirsub(struct nameidata *ndp, int is_v4, struct ucred *cred,
1000     struct thread *p, struct nfsexstuff *exp)
1001 {
1002 	struct vnode *vp;
1003 	int error = 0;
1004 
1005 	vp = ndp->ni_vp;
1006 	if (vp->v_type != VDIR) {
1007 		error = ENOTDIR;
1008 		goto out;
1009 	}
1010 	/*
1011 	 * No rmdir "." please.
1012 	 */
1013 	if (ndp->ni_dvp == vp) {
1014 		error = EINVAL;
1015 		goto out;
1016 	}
1017 	/*
1018 	 * The root of a mounted filesystem cannot be deleted.
1019 	 */
1020 	if (vp->v_vflag & VV_ROOT)
1021 		error = EBUSY;
1022 out:
1023 	if (!error)
1024 		error = VOP_RMDIR(ndp->ni_dvp, vp, &ndp->ni_cnd);
1025 	if (ndp->ni_dvp == vp)
1026 		vrele(ndp->ni_dvp);
1027 	else
1028 		vput(ndp->ni_dvp);
1029 	vput(vp);
1030 	return (error);
1031 }
1032 
1033 /*
1034  * Rename vnode op.
1035  */
1036 int
1037 nfsvno_rename(struct nameidata *fromndp, struct nameidata *tondp,
1038     u_int32_t ndstat, u_int32_t ndflag, struct ucred *cred, struct thread *p)
1039 {
1040 	struct vnode *fvp, *tvp, *tdvp;
1041 	int error = 0;
1042 
1043 	fvp = fromndp->ni_vp;
1044 	if (ndstat) {
1045 		vrele(fromndp->ni_dvp);
1046 		vrele(fvp);
1047 		error = ndstat;
1048 		goto out1;
1049 	}
1050 	tdvp = tondp->ni_dvp;
1051 	tvp = tondp->ni_vp;
1052 	if (tvp != NULL) {
1053 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
1054 			error = (ndflag & ND_NFSV2) ? EISDIR : EEXIST;
1055 			goto out;
1056 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
1057 			error = (ndflag & ND_NFSV2) ? ENOTDIR : EEXIST;
1058 			goto out;
1059 		}
1060 		if (tvp->v_type == VDIR && tvp->v_mountedhere) {
1061 			error = (ndflag & ND_NFSV2) ? ENOTEMPTY : EXDEV;
1062 			goto out;
1063 		}
1064 
1065 		/*
1066 		 * A rename to '.' or '..' results in a prematurely
1067 		 * unlocked vnode on FreeBSD5, so I'm just going to fail that
1068 		 * here.
1069 		 */
1070 		if ((tondp->ni_cnd.cn_namelen == 1 &&
1071 		     tondp->ni_cnd.cn_nameptr[0] == '.') ||
1072 		    (tondp->ni_cnd.cn_namelen == 2 &&
1073 		     tondp->ni_cnd.cn_nameptr[0] == '.' &&
1074 		     tondp->ni_cnd.cn_nameptr[1] == '.')) {
1075 			error = EINVAL;
1076 			goto out;
1077 		}
1078 	}
1079 	if (fvp->v_type == VDIR && fvp->v_mountedhere) {
1080 		error = (ndflag & ND_NFSV2) ? ENOTEMPTY : EXDEV;
1081 		goto out;
1082 	}
1083 	if (fvp->v_mount != tdvp->v_mount) {
1084 		error = (ndflag & ND_NFSV2) ? ENOTEMPTY : EXDEV;
1085 		goto out;
1086 	}
1087 	if (fvp == tdvp) {
1088 		error = (ndflag & ND_NFSV2) ? ENOTEMPTY : EINVAL;
1089 		goto out;
1090 	}
1091 	if (fvp == tvp) {
1092 		/*
1093 		 * If source and destination are the same, there is nothing to
1094 		 * do. Set error to -1 to indicate this.
1095 		 */
1096 		error = -1;
1097 		goto out;
1098 	}
1099 	if (ndflag & ND_NFSV4) {
1100 		NFSVOPLOCK(fvp, LK_EXCLUSIVE | LK_RETRY, p);
1101 		error = nfsrv_checkremove(fvp, 0, p);
1102 		NFSVOPUNLOCK(fvp, 0, p);
1103 		if (tvp && !error)
1104 			error = nfsrv_checkremove(tvp, 1, p);
1105 	} else {
1106 		/*
1107 		 * For NFSv2 and NFSv3, try to get rid of the delegation, so
1108 		 * that the NFSv4 client won't be confused by the rename.
1109 		 * Since nfsd_recalldelegation() can only be called on an
1110 		 * unlocked vnode at this point and fvp is the file that will
1111 		 * still exist after the rename, just do fvp.
1112 		 */
1113 		nfsd_recalldelegation(fvp, p);
1114 	}
1115 out:
1116 	if (!error) {
1117 		error = VOP_RENAME(fromndp->ni_dvp, fromndp->ni_vp,
1118 		    &fromndp->ni_cnd, tondp->ni_dvp, tondp->ni_vp,
1119 		    &tondp->ni_cnd);
1120 	} else {
1121 		if (tdvp == tvp)
1122 			vrele(tdvp);
1123 		else
1124 			vput(tdvp);
1125 		if (tvp)
1126 			vput(tvp);
1127 		vrele(fromndp->ni_dvp);
1128 		vrele(fvp);
1129 		if (error == -1)
1130 			error = 0;
1131 	}
1132 	vrele(tondp->ni_startdir);
1133 	nfsvno_relpathbuf(tondp);
1134 out1:
1135 	vrele(fromndp->ni_startdir);
1136 	nfsvno_relpathbuf(fromndp);
1137 	return (error);
1138 }
1139 
1140 /*
1141  * Link vnode op.
1142  */
1143 int
1144 nfsvno_link(struct nameidata *ndp, struct vnode *vp, struct ucred *cred,
1145     struct thread *p, struct nfsexstuff *exp)
1146 {
1147 	struct vnode *xp;
1148 	int error = 0;
1149 
1150 	xp = ndp->ni_vp;
1151 	if (xp != NULL) {
1152 		error = EEXIST;
1153 	} else {
1154 		xp = ndp->ni_dvp;
1155 		if (vp->v_mount != xp->v_mount)
1156 			error = EXDEV;
1157 	}
1158 	if (!error) {
1159 		NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY, p);
1160 		error = VOP_LINK(ndp->ni_dvp, vp, &ndp->ni_cnd);
1161 		if (ndp->ni_dvp == vp)
1162 			vrele(ndp->ni_dvp);
1163 		else
1164 			vput(ndp->ni_dvp);
1165 		NFSVOPUNLOCK(vp, 0, p);
1166 	} else {
1167 		if (ndp->ni_dvp == ndp->ni_vp)
1168 			vrele(ndp->ni_dvp);
1169 		else
1170 			vput(ndp->ni_dvp);
1171 		if (ndp->ni_vp)
1172 			vrele(ndp->ni_vp);
1173 	}
1174 	nfsvno_relpathbuf(ndp);
1175 	return (error);
1176 }
1177 
1178 /*
1179  * Do the fsync() appropriate for the commit.
1180  */
1181 int
1182 nfsvno_fsync(struct vnode *vp, u_int64_t off, int cnt, struct ucred *cred,
1183     struct thread *td)
1184 {
1185 	int error = 0;
1186 
1187 	if (cnt > MAX_COMMIT_COUNT) {
1188 		/*
1189 		 * Give up and do the whole thing
1190 		 */
1191 		if (vp->v_object &&
1192 		   (vp->v_object->flags & OBJ_MIGHTBEDIRTY)) {
1193 			VM_OBJECT_LOCK(vp->v_object);
1194 			vm_object_page_clean(vp->v_object, 0, 0, OBJPC_SYNC);
1195 			VM_OBJECT_UNLOCK(vp->v_object);
1196 		}
1197 		error = VOP_FSYNC(vp, MNT_WAIT, td);
1198 	} else {
1199 		/*
1200 		 * Locate and synchronously write any buffers that fall
1201 		 * into the requested range.  Note:  we are assuming that
1202 		 * f_iosize is a power of 2.
1203 		 */
1204 		int iosize = vp->v_mount->mnt_stat.f_iosize;
1205 		int iomask = iosize - 1;
1206 		struct bufobj *bo;
1207 		daddr_t lblkno;
1208 
1209 		/*
1210 		 * Align to iosize boundry, super-align to page boundry.
1211 		 */
1212 		if (off & iomask) {
1213 			cnt += off & iomask;
1214 			off &= ~(u_quad_t)iomask;
1215 		}
1216 		if (off & PAGE_MASK) {
1217 			cnt += off & PAGE_MASK;
1218 			off &= ~(u_quad_t)PAGE_MASK;
1219 		}
1220 		lblkno = off / iosize;
1221 
1222 		if (vp->v_object &&
1223 		   (vp->v_object->flags & OBJ_MIGHTBEDIRTY)) {
1224 			VM_OBJECT_LOCK(vp->v_object);
1225 			vm_object_page_clean(vp->v_object, off / PAGE_SIZE, (cnt + PAGE_MASK) / PAGE_SIZE, OBJPC_SYNC);
1226 			VM_OBJECT_UNLOCK(vp->v_object);
1227 		}
1228 
1229 		bo = &vp->v_bufobj;
1230 		BO_LOCK(bo);
1231 		while (cnt > 0) {
1232 			struct buf *bp;
1233 
1234 			/*
1235 			 * If we have a buffer and it is marked B_DELWRI we
1236 			 * have to lock and write it.  Otherwise the prior
1237 			 * write is assumed to have already been committed.
1238 			 *
1239 			 * gbincore() can return invalid buffers now so we
1240 			 * have to check that bit as well (though B_DELWRI
1241 			 * should not be set if B_INVAL is set there could be
1242 			 * a race here since we haven't locked the buffer).
1243 			 */
1244 			if ((bp = gbincore(&vp->v_bufobj, lblkno)) != NULL) {
1245 				if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_SLEEPFAIL |
1246 				    LK_INTERLOCK, BO_MTX(bo)) == ENOLCK) {
1247 					BO_LOCK(bo);
1248 					continue; /* retry */
1249 				}
1250 			    	if ((bp->b_flags & (B_DELWRI|B_INVAL)) ==
1251 				    B_DELWRI) {
1252 					bremfree(bp);
1253 					bp->b_flags &= ~B_ASYNC;
1254 					bwrite(bp);
1255 					++nfs_commit_miss;
1256 				} else
1257 					BUF_UNLOCK(bp);
1258 				BO_LOCK(bo);
1259 			}
1260 			++nfs_commit_blks;
1261 			if (cnt < iosize)
1262 				break;
1263 			cnt -= iosize;
1264 			++lblkno;
1265 		}
1266 		BO_UNLOCK(bo);
1267 	}
1268 	return (error);
1269 }
1270 
1271 /*
1272  * Statfs vnode op.
1273  */
1274 int
1275 nfsvno_statfs(struct vnode *vp, struct statfs *sf)
1276 {
1277 
1278 	return (VFS_STATFS(vp->v_mount, sf));
1279 }
1280 
1281 /*
1282  * Do the vnode op stuff for Open. Similar to nfsvno_createsub(), but
1283  * must handle nfsrv_opencheck() calls after any other access checks.
1284  */
1285 void
1286 nfsvno_open(struct nfsrv_descript *nd, struct nameidata *ndp,
1287     nfsquad_t clientid, nfsv4stateid_t *stateidp, struct nfsstate *stp,
1288     int *exclusive_flagp, struct nfsvattr *nvap, int32_t *cverf, int create,
1289     NFSACL_T *aclp, nfsattrbit_t *attrbitp, struct ucred *cred, struct thread *p,
1290     struct nfsexstuff *exp, struct vnode **vpp)
1291 {
1292 	struct vnode *vp = NULL;
1293 	u_quad_t tempsize;
1294 	struct nfsexstuff nes;
1295 
1296 	if (ndp->ni_vp == NULL)
1297 		nd->nd_repstat = nfsrv_opencheck(clientid,
1298 		    stateidp, stp, NULL, nd, p, nd->nd_repstat);
1299 	if (!nd->nd_repstat) {
1300 		if (ndp->ni_vp == NULL) {
1301 			vrele(ndp->ni_startdir);
1302 			nd->nd_repstat = VOP_CREATE(ndp->ni_dvp,
1303 			    &ndp->ni_vp, &ndp->ni_cnd, &nvap->na_vattr);
1304 			vput(ndp->ni_dvp);
1305 			nfsvno_relpathbuf(ndp);
1306 			if (!nd->nd_repstat) {
1307 				if (*exclusive_flagp) {
1308 					*exclusive_flagp = 0;
1309 					NFSVNO_ATTRINIT(nvap);
1310 					nvap->na_atime.tv_sec = cverf[0];
1311 					nvap->na_atime.tv_nsec = cverf[1];
1312 					nd->nd_repstat = VOP_SETATTR(ndp->ni_vp,
1313 					    &nvap->na_vattr, cred);
1314 				} else {
1315 					nfsrv_fixattr(nd, ndp->ni_vp, nvap,
1316 					    aclp, p, attrbitp, exp);
1317 				}
1318 			}
1319 			vp = ndp->ni_vp;
1320 		} else {
1321 			if (ndp->ni_startdir)
1322 				vrele(ndp->ni_startdir);
1323 			nfsvno_relpathbuf(ndp);
1324 			vp = ndp->ni_vp;
1325 			if (create == NFSV4OPEN_CREATE) {
1326 				if (ndp->ni_dvp == vp)
1327 					vrele(ndp->ni_dvp);
1328 				else
1329 					vput(ndp->ni_dvp);
1330 			}
1331 			if (NFSVNO_ISSETSIZE(nvap) && vp->v_type == VREG) {
1332 				if (ndp->ni_cnd.cn_flags & RDONLY)
1333 					NFSVNO_SETEXRDONLY(&nes);
1334 				else
1335 					NFSVNO_EXINIT(&nes);
1336 				nd->nd_repstat = nfsvno_accchk(vp,
1337 				    NFSV4ACE_ADDFILE, cred, &nes, p,
1338 				    NFSACCCHK_NOOVERRIDE,NFSACCCHK_VPISLOCKED);
1339 				nd->nd_repstat = nfsrv_opencheck(clientid,
1340 				    stateidp, stp, vp, nd, p, nd->nd_repstat);
1341 				if (!nd->nd_repstat) {
1342 					tempsize = nvap->na_size;
1343 					NFSVNO_ATTRINIT(nvap);
1344 					nvap->na_size = tempsize;
1345 					nd->nd_repstat = VOP_SETATTR(vp,
1346 					    &nvap->na_vattr, cred);
1347 				}
1348 			} else if (vp->v_type == VREG) {
1349 				nd->nd_repstat = nfsrv_opencheck(clientid,
1350 				    stateidp, stp, vp, nd, p, nd->nd_repstat);
1351 			}
1352 		}
1353 	} else {
1354 		if (ndp->ni_cnd.cn_flags & HASBUF)
1355 			nfsvno_relpathbuf(ndp);
1356 		if (ndp->ni_startdir && create == NFSV4OPEN_CREATE) {
1357 			vrele(ndp->ni_startdir);
1358 			if (ndp->ni_dvp == ndp->ni_vp)
1359 				vrele(ndp->ni_dvp);
1360 			else
1361 				vput(ndp->ni_dvp);
1362 			if (ndp->ni_vp)
1363 				vput(ndp->ni_vp);
1364 		}
1365 	}
1366 	*vpp = vp;
1367 }
1368 
1369 /*
1370  * Updates the file rev and sets the mtime and ctime
1371  * to the current clock time, returning the va_filerev and va_Xtime
1372  * values.
1373  */
1374 void
1375 nfsvno_updfilerev(struct vnode *vp, struct nfsvattr *nvap,
1376     struct ucred *cred, struct thread *p)
1377 {
1378 	struct vattr va;
1379 
1380 	VATTR_NULL(&va);
1381 	getnanotime(&va.va_mtime);
1382 	(void) VOP_SETATTR(vp, &va, cred);
1383 	(void) nfsvno_getattr(vp, nvap, cred, p);
1384 }
1385 
1386 /*
1387  * Glue routine to nfsv4_fillattr().
1388  */
1389 int
1390 nfsvno_fillattr(struct nfsrv_descript *nd, struct vnode *vp,
1391     struct nfsvattr *nvap, fhandle_t *fhp, int rderror, nfsattrbit_t *attrbitp,
1392     struct ucred *cred, struct thread *p, int isdgram, int reterr)
1393 {
1394 	int error;
1395 
1396 	error = nfsv4_fillattr(nd, vp, NULL, &nvap->na_vattr, fhp, rderror,
1397 	    attrbitp, cred, p, isdgram, reterr);
1398 	return (error);
1399 }
1400 
1401 /* Since the Readdir vnode ops vary, put the entire functions in here. */
1402 /*
1403  * nfs readdir service
1404  * - mallocs what it thinks is enough to read
1405  *	count rounded up to a multiple of DIRBLKSIZ <= NFS_MAXREADDIR
1406  * - calls nfsvno_readdir()
1407  * - loops around building the reply
1408  *	if the output generated exceeds count break out of loop
1409  *	The NFSM_CLGET macro is used here so that the reply will be packed
1410  *	tightly in mbuf clusters.
1411  * - it only knows that it has encountered eof when the nfsvno_readdir()
1412  *	reads nothing
1413  * - as such one readdir rpc will return eof false although you are there
1414  *	and then the next will return eof
1415  * - it trims out records with d_fileno == 0
1416  *	this doesn't matter for Unix clients, but they might confuse clients
1417  *	for other os'.
1418  * - it trims out records with d_type == DT_WHT
1419  *	these cannot be seen through NFS (unless we extend the protocol)
1420  * NB: It is tempting to set eof to true if the nfsvno_readdir() reads less
1421  *	than requested, but this may not apply to all filesystems. For
1422  *	example, client NFS does not { although it is never remote mounted
1423  *	anyhow }
1424  *     The alternate call nfsrvd_readdirplus() does lookups as well.
1425  * PS: The NFS protocol spec. does not clarify what the "count" byte
1426  *	argument is a count of.. just name strings and file id's or the
1427  *	entire reply rpc or ...
1428  *	I tried just file name and id sizes and it confused the Sun client,
1429  *	so I am using the full rpc size now. The "paranoia.." comment refers
1430  *	to including the status longwords that are not a part of the dir.
1431  *	"entry" structures, but are in the rpc.
1432  */
1433 int
1434 nfsrvd_readdir(struct nfsrv_descript *nd, int isdgram,
1435     struct vnode *vp, struct thread *p, struct nfsexstuff *exp)
1436 {
1437 	struct dirent *dp;
1438 	u_int32_t *tl;
1439 	int dirlen;
1440 	char *cpos, *cend, *rbuf;
1441 	struct nfsvattr at;
1442 	int nlen, error = 0, getret = 1;
1443 	int siz, cnt, fullsiz, eofflag, ncookies;
1444 	u_int64_t off, toff, verf;
1445 	u_long *cookies = NULL, *cookiep;
1446 	struct uio io;
1447 	struct iovec iv;
1448 
1449 	if (nd->nd_repstat) {
1450 		nfsrv_postopattr(nd, getret, &at);
1451 		return (0);
1452 	}
1453 	if (nd->nd_flag & ND_NFSV2) {
1454 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1455 		off = fxdr_unsigned(u_quad_t, *tl++);
1456 	} else {
1457 		NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1458 		off = fxdr_hyper(tl);
1459 		tl += 2;
1460 		verf = fxdr_hyper(tl);
1461 		tl += 2;
1462 	}
1463 	toff = off;
1464 	cnt = fxdr_unsigned(int, *tl);
1465 	if (cnt > NFS_SRVMAXDATA(nd))
1466 		cnt = NFS_SRVMAXDATA(nd);
1467 	siz = ((cnt + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
1468 	fullsiz = siz;
1469 	if (nd->nd_flag & ND_NFSV3) {
1470 		nd->nd_repstat = getret = nfsvno_getattr(vp, &at, nd->nd_cred,
1471 		    p);
1472 #if 0
1473 		/*
1474 		 * va_filerev is not sufficient as a cookie verifier,
1475 		 * since it is not supposed to change when entries are
1476 		 * removed/added unless that offset cookies returned to
1477 		 * the client are no longer valid.
1478 		 */
1479 		if (!nd->nd_repstat && toff && verf != at.na_filerev)
1480 			nd->nd_repstat = NFSERR_BAD_COOKIE;
1481 #endif
1482 	}
1483 	if (!nd->nd_repstat)
1484 		nd->nd_repstat = nfsvno_accchk(vp, NFSV4ACE_SEARCH,
1485 		    nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
1486 		    NFSACCCHK_VPISLOCKED);
1487 	if (nd->nd_repstat) {
1488 		vput(vp);
1489 		if (nd->nd_flag & ND_NFSV3)
1490 			nfsrv_postopattr(nd, getret, &at);
1491 		return (0);
1492 	}
1493 	NFSVOPUNLOCK(vp, 0, p);
1494 	MALLOC(rbuf, caddr_t, siz, M_TEMP, M_WAITOK);
1495 again:
1496 	eofflag = 0;
1497 	if (cookies) {
1498 		free((caddr_t)cookies, M_TEMP);
1499 		cookies = NULL;
1500 	}
1501 
1502 	iv.iov_base = rbuf;
1503 	iv.iov_len = siz;
1504 	io.uio_iov = &iv;
1505 	io.uio_iovcnt = 1;
1506 	io.uio_offset = (off_t)off;
1507 	io.uio_resid = siz;
1508 	io.uio_segflg = UIO_SYSSPACE;
1509 	io.uio_rw = UIO_READ;
1510 	io.uio_td = NULL;
1511 	NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY, p);
1512 	nd->nd_repstat = VOP_READDIR(vp, &io, nd->nd_cred, &eofflag, &ncookies,
1513 	    &cookies);
1514 	NFSVOPUNLOCK(vp, 0, p);
1515 	off = (u_int64_t)io.uio_offset;
1516 	if (io.uio_resid)
1517 		siz -= io.uio_resid;
1518 
1519 	if (!cookies && !nd->nd_repstat)
1520 		nd->nd_repstat = NFSERR_PERM;
1521 	if (nd->nd_flag & ND_NFSV3) {
1522 		getret = nfsvno_getattr(vp, &at, nd->nd_cred, p);
1523 		if (!nd->nd_repstat)
1524 			nd->nd_repstat = getret;
1525 	}
1526 
1527 	/*
1528 	 * Handles the failed cases. nd->nd_repstat == 0 past here.
1529 	 */
1530 	if (nd->nd_repstat) {
1531 		vrele(vp);
1532 		free((caddr_t)rbuf, M_TEMP);
1533 		if (cookies)
1534 			free((caddr_t)cookies, M_TEMP);
1535 		if (nd->nd_flag & ND_NFSV3)
1536 			nfsrv_postopattr(nd, getret, &at);
1537 		return (0);
1538 	}
1539 	/*
1540 	 * If nothing read, return eof
1541 	 * rpc reply
1542 	 */
1543 	if (siz == 0) {
1544 		vrele(vp);
1545 		if (nd->nd_flag & ND_NFSV2) {
1546 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1547 		} else {
1548 			nfsrv_postopattr(nd, getret, &at);
1549 			NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1550 			txdr_hyper(at.na_filerev, tl);
1551 			tl += 2;
1552 		}
1553 		*tl++ = newnfs_false;
1554 		*tl = newnfs_true;
1555 		FREE((caddr_t)rbuf, M_TEMP);
1556 		FREE((caddr_t)cookies, M_TEMP);
1557 		return (0);
1558 	}
1559 
1560 	/*
1561 	 * Check for degenerate cases of nothing useful read.
1562 	 * If so go try again
1563 	 */
1564 	cpos = rbuf;
1565 	cend = rbuf + siz;
1566 	dp = (struct dirent *)cpos;
1567 	cookiep = cookies;
1568 
1569 	/*
1570 	 * For some reason FreeBSD's ufs_readdir() chooses to back the
1571 	 * directory offset up to a block boundary, so it is necessary to
1572 	 * skip over the records that precede the requested offset. This
1573 	 * requires the assumption that file offset cookies monotonically
1574 	 * increase.
1575 	 */
1576 	while (cpos < cend && ncookies > 0 &&
1577 	    (dp->d_fileno == 0 || dp->d_type == DT_WHT ||
1578 	     ((u_quad_t)(*cookiep)) <= toff)) {
1579 		cpos += dp->d_reclen;
1580 		dp = (struct dirent *)cpos;
1581 		cookiep++;
1582 		ncookies--;
1583 	}
1584 	if (cpos >= cend || ncookies == 0) {
1585 		siz = fullsiz;
1586 		toff = off;
1587 		goto again;
1588 	}
1589 
1590 	/*
1591 	 * dirlen is the size of the reply, including all XDR and must
1592 	 * not exceed cnt. For NFSv2, RFC1094 didn't clearly indicate
1593 	 * if the XDR should be included in "count", but to be safe, we do.
1594 	 * (Include the two booleans at the end of the reply in dirlen now.)
1595 	 */
1596 	if (nd->nd_flag & ND_NFSV3) {
1597 		nfsrv_postopattr(nd, getret, &at);
1598 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1599 		txdr_hyper(at.na_filerev, tl);
1600 		dirlen = NFSX_V3POSTOPATTR + NFSX_VERF + 2 * NFSX_UNSIGNED;
1601 	} else {
1602 		dirlen = 2 * NFSX_UNSIGNED;
1603 	}
1604 
1605 	/* Loop through the records and build reply */
1606 	while (cpos < cend && ncookies > 0) {
1607 		nlen = dp->d_namlen;
1608 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT &&
1609 			nlen <= NFS_MAXNAMLEN) {
1610 			if (nd->nd_flag & ND_NFSV3)
1611 				dirlen += (6*NFSX_UNSIGNED + NFSM_RNDUP(nlen));
1612 			else
1613 				dirlen += (4*NFSX_UNSIGNED + NFSM_RNDUP(nlen));
1614 			if (dirlen > cnt) {
1615 				eofflag = 0;
1616 				break;
1617 			}
1618 
1619 			/*
1620 			 * Build the directory record xdr from
1621 			 * the dirent entry.
1622 			 */
1623 			if (nd->nd_flag & ND_NFSV3) {
1624 				NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
1625 				*tl++ = newnfs_true;
1626 				*tl++ = 0;
1627 			} else {
1628 				NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1629 				*tl++ = newnfs_true;
1630 			}
1631 			*tl = txdr_unsigned(dp->d_fileno);
1632 			(void) nfsm_strtom(nd, dp->d_name, nlen);
1633 			if (nd->nd_flag & ND_NFSV3) {
1634 				NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1635 				*tl++ = 0;
1636 			} else
1637 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
1638 			*tl = txdr_unsigned(*cookiep);
1639 		}
1640 		cpos += dp->d_reclen;
1641 		dp = (struct dirent *)cpos;
1642 		cookiep++;
1643 		ncookies--;
1644 	}
1645 	if (cpos < cend)
1646 		eofflag = 0;
1647 	vrele(vp);
1648 	NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1649 	*tl++ = newnfs_false;
1650 	if (eofflag)
1651 		*tl = newnfs_true;
1652 	else
1653 		*tl = newnfs_false;
1654 	FREE((caddr_t)rbuf, M_TEMP);
1655 	FREE((caddr_t)cookies, M_TEMP);
1656 	return (0);
1657 nfsmout:
1658 	vput(vp);
1659 	return (error);
1660 }
1661 
1662 /*
1663  * Readdirplus for V3 and Readdir for V4.
1664  */
1665 int
1666 nfsrvd_readdirplus(struct nfsrv_descript *nd, int isdgram,
1667     struct vnode *vp, struct thread *p, struct nfsexstuff *exp)
1668 {
1669 	struct dirent *dp;
1670 	u_int32_t *tl;
1671 	int dirlen;
1672 	char *cpos, *cend, *rbuf;
1673 	struct vnode *nvp;
1674 	fhandle_t nfh;
1675 	struct nfsvattr nva, at, *nvap = &nva;
1676 	struct mbuf *mb0, *mb1;
1677 	struct nfsreferral *refp;
1678 	int nlen, r, error = 0, getret = 1, usevget = 1;
1679 	int siz, cnt, fullsiz, eofflag, ncookies, entrycnt;
1680 	caddr_t bpos0, bpos1;
1681 	u_int64_t off, toff, verf;
1682 	u_long *cookies = NULL, *cookiep;
1683 	nfsattrbit_t attrbits, rderrbits, savbits;
1684 	struct uio io;
1685 	struct iovec iv;
1686 	struct componentname cn;
1687 
1688 	if (nd->nd_repstat) {
1689 		nfsrv_postopattr(nd, getret, &at);
1690 		return (0);
1691 	}
1692 	NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
1693 	off = fxdr_hyper(tl);
1694 	toff = off;
1695 	tl += 2;
1696 	verf = fxdr_hyper(tl);
1697 	tl += 2;
1698 	siz = fxdr_unsigned(int, *tl++);
1699 	cnt = fxdr_unsigned(int, *tl);
1700 
1701 	/*
1702 	 * Use the server's maximum data transfer size as the upper bound
1703 	 * on reply datalen.
1704 	 */
1705 	if (cnt > NFS_SRVMAXDATA(nd))
1706 		cnt = NFS_SRVMAXDATA(nd);
1707 
1708 	/*
1709 	 * siz is a "hint" of how much directory information (name, fileid,
1710 	 * cookie) should be in the reply. At least one client "hints" 0,
1711 	 * so I set it to cnt for that case. I also round it up to the
1712 	 * next multiple of DIRBLKSIZ.
1713 	 */
1714 	if (siz == 0)
1715 		siz = cnt;
1716 	siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
1717 
1718 	if (nd->nd_flag & ND_NFSV4) {
1719 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
1720 		if (error)
1721 			goto nfsmout;
1722 		NFSSET_ATTRBIT(&savbits, &attrbits);
1723 		NFSCLRNOTFILLABLE_ATTRBIT(&attrbits);
1724 		NFSZERO_ATTRBIT(&rderrbits);
1725 		NFSSETBIT_ATTRBIT(&rderrbits, NFSATTRBIT_RDATTRERROR);
1726 	} else {
1727 		NFSZERO_ATTRBIT(&attrbits);
1728 	}
1729 	fullsiz = siz;
1730 	nd->nd_repstat = getret = nfsvno_getattr(vp, &at, nd->nd_cred, p);
1731 	if (!nd->nd_repstat) {
1732 	    if (off && verf != at.na_filerev) {
1733 		/*
1734 		 * va_filerev is not sufficient as a cookie verifier,
1735 		 * since it is not supposed to change when entries are
1736 		 * removed/added unless that offset cookies returned to
1737 		 * the client are no longer valid.
1738 		 */
1739 #if 0
1740 		if (nd->nd_flag & ND_NFSV4) {
1741 			nd->nd_repstat = NFSERR_NOTSAME;
1742 		} else {
1743 			nd->nd_repstat = NFSERR_BAD_COOKIE;
1744 		}
1745 #endif
1746 	    } else if ((nd->nd_flag & ND_NFSV4) && off == 0 && verf != 0) {
1747 		nd->nd_repstat = NFSERR_BAD_COOKIE;
1748 	    }
1749 	}
1750 	if (!nd->nd_repstat && vp->v_type != VDIR)
1751 		nd->nd_repstat = NFSERR_NOTDIR;
1752 	if (!nd->nd_repstat && cnt == 0)
1753 		nd->nd_repstat = NFSERR_TOOSMALL;
1754 	if (!nd->nd_repstat)
1755 		nd->nd_repstat = nfsvno_accchk(vp, NFSV4ACE_SEARCH,
1756 		    nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
1757 		    NFSACCCHK_VPISLOCKED);
1758 	if (nd->nd_repstat) {
1759 		vput(vp);
1760 		if (nd->nd_flag & ND_NFSV3)
1761 			nfsrv_postopattr(nd, getret, &at);
1762 		return (0);
1763 	}
1764 
1765 	MALLOC(rbuf, caddr_t, siz, M_TEMP, M_WAITOK);
1766 again:
1767 	eofflag = 0;
1768 	if (cookies) {
1769 		free((caddr_t)cookies, M_TEMP);
1770 		cookies = NULL;
1771 	}
1772 
1773 	iv.iov_base = rbuf;
1774 	iv.iov_len = siz;
1775 	io.uio_iov = &iv;
1776 	io.uio_iovcnt = 1;
1777 	io.uio_offset = (off_t)off;
1778 	io.uio_resid = siz;
1779 	io.uio_segflg = UIO_SYSSPACE;
1780 	io.uio_rw = UIO_READ;
1781 	io.uio_td = NULL;
1782 	nd->nd_repstat = VOP_READDIR(vp, &io, nd->nd_cred, &eofflag, &ncookies,
1783 	    &cookies);
1784 	off = (u_int64_t)io.uio_offset;
1785 	if (io.uio_resid)
1786 		siz -= io.uio_resid;
1787 
1788 	getret = nfsvno_getattr(vp, &at, nd->nd_cred, p);
1789 
1790 	if (!cookies && !nd->nd_repstat)
1791 		nd->nd_repstat = NFSERR_PERM;
1792 	if (!nd->nd_repstat)
1793 		nd->nd_repstat = getret;
1794 	if (nd->nd_repstat) {
1795 		vput(vp);
1796 		if (cookies)
1797 			free((caddr_t)cookies, M_TEMP);
1798 		free((caddr_t)rbuf, M_TEMP);
1799 		if (nd->nd_flag & ND_NFSV3)
1800 			nfsrv_postopattr(nd, getret, &at);
1801 		return (0);
1802 	}
1803 	/*
1804 	 * If nothing read, return eof
1805 	 * rpc reply
1806 	 */
1807 	if (siz == 0) {
1808 		vput(vp);
1809 		if (nd->nd_flag & ND_NFSV3)
1810 			nfsrv_postopattr(nd, getret, &at);
1811 		NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1812 		txdr_hyper(at.na_filerev, tl);
1813 		tl += 2;
1814 		*tl++ = newnfs_false;
1815 		*tl = newnfs_true;
1816 		free((caddr_t)cookies, M_TEMP);
1817 		free((caddr_t)rbuf, M_TEMP);
1818 		return (0);
1819 	}
1820 
1821 	/*
1822 	 * Check for degenerate cases of nothing useful read.
1823 	 * If so go try again
1824 	 */
1825 	cpos = rbuf;
1826 	cend = rbuf + siz;
1827 	dp = (struct dirent *)cpos;
1828 	cookiep = cookies;
1829 
1830 	/*
1831 	 * For some reason FreeBSD's ufs_readdir() chooses to back the
1832 	 * directory offset up to a block boundary, so it is necessary to
1833 	 * skip over the records that precede the requested offset. This
1834 	 * requires the assumption that file offset cookies monotonically
1835 	 * increase.
1836 	 */
1837 	while (cpos < cend && ncookies > 0 &&
1838 	  (dp->d_fileno == 0 || dp->d_type == DT_WHT ||
1839 	   ((u_quad_t)(*cookiep)) <= toff ||
1840 	   ((nd->nd_flag & ND_NFSV4) &&
1841 	    ((dp->d_namlen == 1 && dp->d_name[0] == '.') ||
1842 	     (dp->d_namlen==2 && dp->d_name[0]=='.' && dp->d_name[1]=='.'))))) {
1843 		cpos += dp->d_reclen;
1844 		dp = (struct dirent *)cpos;
1845 		cookiep++;
1846 		ncookies--;
1847 	}
1848 	if (cpos >= cend || ncookies == 0) {
1849 		siz = fullsiz;
1850 		toff = off;
1851 		goto again;
1852 	}
1853 	NFSVOPUNLOCK(vp, 0, p);
1854 
1855 	/*
1856 	 * Save this position, in case there is an error before one entry
1857 	 * is created.
1858 	 */
1859 	mb0 = nd->nd_mb;
1860 	bpos0 = nd->nd_bpos;
1861 
1862 	/*
1863 	 * Fill in the first part of the reply.
1864 	 * dirlen is the reply length in bytes and cannot exceed cnt.
1865 	 * (Include the two booleans at the end of the reply in dirlen now,
1866 	 *  so we recognize when we have exceeded cnt.)
1867 	 */
1868 	if (nd->nd_flag & ND_NFSV3) {
1869 		dirlen = NFSX_V3POSTOPATTR + NFSX_VERF + 2 * NFSX_UNSIGNED;
1870 		nfsrv_postopattr(nd, getret, &at);
1871 	} else {
1872 		dirlen = NFSX_VERF + 2 * NFSX_UNSIGNED;
1873 	}
1874 	NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
1875 	txdr_hyper(at.na_filerev, tl);
1876 
1877 	/*
1878 	 * Save this position, in case there is an empty reply needed.
1879 	 */
1880 	mb1 = nd->nd_mb;
1881 	bpos1 = nd->nd_bpos;
1882 
1883 	/* Loop through the records and build reply */
1884 	entrycnt = 0;
1885 	while (cpos < cend && ncookies > 0 && dirlen < cnt) {
1886 		nlen = dp->d_namlen;
1887 		if (dp->d_fileno != 0 && dp->d_type != DT_WHT &&
1888 		    nlen <= NFS_MAXNAMLEN &&
1889 		    ((nd->nd_flag & ND_NFSV3) || nlen > 2 ||
1890 		     (nlen==2 && (dp->d_name[0]!='.' || dp->d_name[1]!='.'))
1891 		      || (nlen == 1 && dp->d_name[0] != '.'))) {
1892 			/*
1893 			 * Save the current position in the reply, in case
1894 			 * this entry exceeds cnt.
1895 			 */
1896 			mb1 = nd->nd_mb;
1897 			bpos1 = nd->nd_bpos;
1898 
1899 			/*
1900 			 * For readdir_and_lookup get the vnode using
1901 			 * the file number.
1902 			 */
1903 			nvp = NULL;
1904 			refp = NULL;
1905 			r = 0;
1906 			if ((nd->nd_flag & ND_NFSV3) ||
1907 			    NFSNONZERO_ATTRBIT(&savbits)) {
1908 				if (nd->nd_flag & ND_NFSV4)
1909 					refp = nfsv4root_getreferral(NULL,
1910 					    vp, dp->d_fileno);
1911 				if (refp == NULL) {
1912 					if (usevget)
1913 						r = VFS_VGET(vp->v_mount,
1914 						    dp->d_fileno, LK_EXCLUSIVE,
1915 						    &nvp);
1916 					else
1917 						r = EOPNOTSUPP;
1918 					if (r == EOPNOTSUPP) {
1919 						if (usevget) {
1920 							usevget = 0;
1921 							cn.cn_nameiop = LOOKUP;
1922 							cn.cn_lkflags =
1923 							    LK_EXCLUSIVE |
1924 							    LK_RETRY;
1925 							cn.cn_cred =
1926 							    nd->nd_cred;
1927 							cn.cn_thread = p;
1928 						}
1929 						cn.cn_nameptr = dp->d_name;
1930 						cn.cn_namelen = nlen;
1931 						cn.cn_flags = ISLASTCN |
1932 						    NOFOLLOW | LOCKLEAF |
1933 						    MPSAFE;
1934 						if (nlen == 2 &&
1935 						    dp->d_name[0] == '.' &&
1936 						    dp->d_name[1] == '.')
1937 							cn.cn_flags |=
1938 							    ISDOTDOT;
1939 						if (!VOP_ISLOCKED(vp))
1940 							vn_lock(vp,
1941 							    LK_EXCLUSIVE |
1942 							    LK_RETRY);
1943 						r = VOP_LOOKUP(vp, &nvp, &cn);
1944 					}
1945 				}
1946 				if (!r) {
1947 				    if (refp == NULL &&
1948 					((nd->nd_flag & ND_NFSV3) ||
1949 					 NFSNONZERO_ATTRBIT(&attrbits))) {
1950 					r = nfsvno_getfh(nvp, &nfh, p);
1951 					if (!r)
1952 					    r = nfsvno_getattr(nvp, nvap,
1953 						nd->nd_cred, p);
1954 				    }
1955 				} else {
1956 				    nvp = NULL;
1957 				}
1958 				if (r) {
1959 					if (!NFSISSET_ATTRBIT(&attrbits,
1960 					    NFSATTRBIT_RDATTRERROR)) {
1961 						if (nvp != NULL)
1962 							vput(nvp);
1963 						nd->nd_repstat = r;
1964 						break;
1965 					}
1966 				}
1967 			}
1968 
1969 			/*
1970 			 * Build the directory record xdr
1971 			 */
1972 			if (nd->nd_flag & ND_NFSV3) {
1973 				NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
1974 				*tl++ = newnfs_true;
1975 				*tl++ = 0;
1976 				*tl = txdr_unsigned(dp->d_fileno);
1977 				dirlen += nfsm_strtom(nd, dp->d_name, nlen);
1978 				NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1979 				*tl++ = 0;
1980 				*tl = txdr_unsigned(*cookiep);
1981 				nfsrv_postopattr(nd, 0, nvap);
1982 				dirlen += nfsm_fhtom(nd,(u_int8_t *)&nfh,0,1);
1983 				dirlen += (5*NFSX_UNSIGNED+NFSX_V3POSTOPATTR);
1984 				if (nvp != NULL)
1985 					vput(nvp);
1986 			} else {
1987 				NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
1988 				*tl++ = newnfs_true;
1989 				*tl++ = 0;
1990 				*tl = txdr_unsigned(*cookiep);
1991 				dirlen += nfsm_strtom(nd, dp->d_name, nlen);
1992 				if (nvp != NULL)
1993 					NFSVOPUNLOCK(nvp, 0, p);
1994 				if (refp != NULL) {
1995 					dirlen += nfsrv_putreferralattr(nd,
1996 					    &savbits, refp, 0,
1997 					    &nd->nd_repstat);
1998 					if (nd->nd_repstat) {
1999 						if (nvp != NULL)
2000 							vrele(nvp);
2001 						break;
2002 					}
2003 				} else if (r) {
2004 					dirlen += nfsvno_fillattr(nd, nvp, nvap,
2005 					    &nfh, r, &rderrbits, nd->nd_cred,
2006 					    p, isdgram, 0);
2007 				} else {
2008 					dirlen += nfsvno_fillattr(nd, nvp, nvap,
2009 					    &nfh, r, &attrbits, nd->nd_cred,
2010 					    p, isdgram, 0);
2011 				}
2012 				if (nvp != NULL)
2013 					vrele(nvp);
2014 				dirlen += (3 * NFSX_UNSIGNED);
2015 			}
2016 			if (dirlen <= cnt)
2017 				entrycnt++;
2018 		}
2019 		cpos += dp->d_reclen;
2020 		dp = (struct dirent *)cpos;
2021 		cookiep++;
2022 		ncookies--;
2023 	}
2024 	if (!usevget && VOP_ISLOCKED(vp))
2025 		vput(vp);
2026 	else
2027 		vrele(vp);
2028 
2029 	/*
2030 	 * If dirlen > cnt, we must strip off the last entry. If that
2031 	 * results in an empty reply, report NFSERR_TOOSMALL.
2032 	 */
2033 	if (dirlen > cnt || nd->nd_repstat) {
2034 		if (!nd->nd_repstat && entrycnt == 0)
2035 			nd->nd_repstat = NFSERR_TOOSMALL;
2036 		if (nd->nd_repstat)
2037 			newnfs_trimtrailing(nd, mb0, bpos0);
2038 		else
2039 			newnfs_trimtrailing(nd, mb1, bpos1);
2040 		eofflag = 0;
2041 	} else if (cpos < cend)
2042 		eofflag = 0;
2043 	if (!nd->nd_repstat) {
2044 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2045 		*tl++ = newnfs_false;
2046 		if (eofflag)
2047 			*tl = newnfs_true;
2048 		else
2049 			*tl = newnfs_false;
2050 	}
2051 	FREE((caddr_t)cookies, M_TEMP);
2052 	FREE((caddr_t)rbuf, M_TEMP);
2053 	return (0);
2054 nfsmout:
2055 	vput(vp);
2056 	return (error);
2057 }
2058 
2059 /*
2060  * Get the settable attributes out of the mbuf list.
2061  * (Return 0 or EBADRPC)
2062  */
2063 int
2064 nfsrv_sattr(struct nfsrv_descript *nd, struct nfsvattr *nvap,
2065     nfsattrbit_t *attrbitp, NFSACL_T *aclp, struct thread *p)
2066 {
2067 	u_int32_t *tl;
2068 	struct nfsv2_sattr *sp;
2069 	struct timeval curtime;
2070 	int error = 0, toclient = 0;
2071 
2072 	switch (nd->nd_flag & (ND_NFSV2 | ND_NFSV3 | ND_NFSV4)) {
2073 	case ND_NFSV2:
2074 		NFSM_DISSECT(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
2075 		/*
2076 		 * Some old clients didn't fill in the high order 16bits.
2077 		 * --> check the low order 2 bytes for 0xffff
2078 		 */
2079 		if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
2080 			nvap->na_mode = nfstov_mode(sp->sa_mode);
2081 		if (sp->sa_uid != newnfs_xdrneg1)
2082 			nvap->na_uid = fxdr_unsigned(uid_t, sp->sa_uid);
2083 		if (sp->sa_gid != newnfs_xdrneg1)
2084 			nvap->na_gid = fxdr_unsigned(gid_t, sp->sa_gid);
2085 		if (sp->sa_size != newnfs_xdrneg1)
2086 			nvap->na_size = fxdr_unsigned(u_quad_t, sp->sa_size);
2087 		if (sp->sa_atime.nfsv2_sec != newnfs_xdrneg1) {
2088 #ifdef notyet
2089 			fxdr_nfsv2time(&sp->sa_atime, &nvap->na_atime);
2090 #else
2091 			nvap->na_atime.tv_sec =
2092 				fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
2093 			nvap->na_atime.tv_nsec = 0;
2094 #endif
2095 		}
2096 		if (sp->sa_mtime.nfsv2_sec != newnfs_xdrneg1)
2097 			fxdr_nfsv2time(&sp->sa_mtime, &nvap->na_mtime);
2098 		break;
2099 	case ND_NFSV3:
2100 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2101 		if (*tl == newnfs_true) {
2102 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2103 			nvap->na_mode = nfstov_mode(*tl);
2104 		}
2105 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2106 		if (*tl == newnfs_true) {
2107 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2108 			nvap->na_uid = fxdr_unsigned(uid_t, *tl);
2109 		}
2110 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2111 		if (*tl == newnfs_true) {
2112 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2113 			nvap->na_gid = fxdr_unsigned(gid_t, *tl);
2114 		}
2115 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2116 		if (*tl == newnfs_true) {
2117 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2118 			nvap->na_size = fxdr_hyper(tl);
2119 		}
2120 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2121 		switch (fxdr_unsigned(int, *tl)) {
2122 		case NFSV3SATTRTIME_TOCLIENT:
2123 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2124 			fxdr_nfsv3time(tl, &nvap->na_atime);
2125 			toclient = 1;
2126 			break;
2127 		case NFSV3SATTRTIME_TOSERVER:
2128 			NFSGETTIME(&curtime);
2129 			nvap->na_atime.tv_sec = curtime.tv_sec;
2130 			nvap->na_atime.tv_nsec = curtime.tv_usec * 1000;
2131 			nvap->na_vaflags |= VA_UTIMES_NULL;
2132 			break;
2133 		};
2134 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2135 		switch (fxdr_unsigned(int, *tl)) {
2136 		case NFSV3SATTRTIME_TOCLIENT:
2137 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2138 			fxdr_nfsv3time(tl, &nvap->na_mtime);
2139 			nvap->na_vaflags &= ~VA_UTIMES_NULL;
2140 			break;
2141 		case NFSV3SATTRTIME_TOSERVER:
2142 			NFSGETTIME(&curtime);
2143 			nvap->na_mtime.tv_sec = curtime.tv_sec;
2144 			nvap->na_mtime.tv_nsec = curtime.tv_usec * 1000;
2145 			if (!toclient)
2146 				nvap->na_vaflags |= VA_UTIMES_NULL;
2147 			break;
2148 		};
2149 		break;
2150 	case ND_NFSV4:
2151 		error = nfsv4_sattr(nd, nvap, attrbitp, aclp, p);
2152 	};
2153 nfsmout:
2154 	return (error);
2155 }
2156 
2157 /*
2158  * Handle the setable attributes for V4.
2159  * Returns NFSERR_BADXDR if it can't be parsed, 0 otherwise.
2160  */
2161 int
2162 nfsv4_sattr(struct nfsrv_descript *nd, struct nfsvattr *nvap,
2163     nfsattrbit_t *attrbitp, NFSACL_T *aclp, struct thread *p)
2164 {
2165 	u_int32_t *tl;
2166 	int attrsum = 0;
2167 	int i, j;
2168 	int error, attrsize, bitpos, aclsize, aceerr, retnotsup = 0;
2169 	int toclient = 0;
2170 	u_char *cp, namestr[NFSV4_SMALLSTR + 1];
2171 	uid_t uid;
2172 	gid_t gid;
2173 	struct timeval curtime;
2174 
2175 	error = nfsrv_getattrbits(nd, attrbitp, NULL, &retnotsup);
2176 	if (error)
2177 		return (error);
2178 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2179 	attrsize = fxdr_unsigned(int, *tl);
2180 
2181 	/*
2182 	 * Loop around getting the setable attributes. If an unsupported
2183 	 * one is found, set nd_repstat == NFSERR_ATTRNOTSUPP and return.
2184 	 */
2185 	if (retnotsup) {
2186 		nd->nd_repstat = NFSERR_ATTRNOTSUPP;
2187 		bitpos = NFSATTRBIT_MAX;
2188 	} else {
2189 		bitpos = 0;
2190 	}
2191 	for (; bitpos < NFSATTRBIT_MAX; bitpos++) {
2192 	    if (attrsum > attrsize) {
2193 		error = NFSERR_BADXDR;
2194 		goto nfsmout;
2195 	    }
2196 	    if (NFSISSET_ATTRBIT(attrbitp, bitpos))
2197 		switch (bitpos) {
2198 		case NFSATTRBIT_SIZE:
2199 			NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
2200 			nvap->na_size = fxdr_hyper(tl);
2201 			attrsum += NFSX_HYPER;
2202 			break;
2203 		case NFSATTRBIT_ACL:
2204 			error = nfsrv_dissectacl(nd, aclp, &aceerr, &aclsize,
2205 			    p);
2206 			if (error)
2207 				goto nfsmout;
2208 			if (aceerr && !nd->nd_repstat)
2209 				nd->nd_repstat = NFSERR_ATTRNOTSUPP;
2210 			attrsum += aclsize;
2211 			break;
2212 		case NFSATTRBIT_ARCHIVE:
2213 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2214 			if (!nd->nd_repstat)
2215 				nd->nd_repstat = NFSERR_ATTRNOTSUPP;
2216 			attrsum += NFSX_UNSIGNED;
2217 			break;
2218 		case NFSATTRBIT_HIDDEN:
2219 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2220 			if (!nd->nd_repstat)
2221 				nd->nd_repstat = NFSERR_ATTRNOTSUPP;
2222 			attrsum += NFSX_UNSIGNED;
2223 			break;
2224 		case NFSATTRBIT_MIMETYPE:
2225 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2226 			i = fxdr_unsigned(int, *tl);
2227 			error = nfsm_advance(nd, NFSM_RNDUP(i), -1);
2228 			if (error)
2229 				goto nfsmout;
2230 			if (!nd->nd_repstat)
2231 				nd->nd_repstat = NFSERR_ATTRNOTSUPP;
2232 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(i));
2233 			break;
2234 		case NFSATTRBIT_MODE:
2235 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2236 			nvap->na_mode = nfstov_mode(*tl);
2237 			attrsum += NFSX_UNSIGNED;
2238 			break;
2239 		case NFSATTRBIT_OWNER:
2240 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2241 			j = fxdr_unsigned(int, *tl);
2242 			if (j < 0)
2243 				return (NFSERR_BADXDR);
2244 			if (j > NFSV4_SMALLSTR)
2245 				cp = malloc(j + 1, M_NFSSTRING, M_WAITOK);
2246 			else
2247 				cp = namestr;
2248 			error = nfsrv_mtostr(nd, cp, j);
2249 			if (error) {
2250 				if (j > NFSV4_SMALLSTR)
2251 					free(cp, M_NFSSTRING);
2252 				return (error);
2253 			}
2254 			if (!nd->nd_repstat) {
2255 				nd->nd_repstat = nfsv4_strtouid(cp,j,&uid,p);
2256 				if (!nd->nd_repstat)
2257 					nvap->na_uid = uid;
2258 			}
2259 			if (j > NFSV4_SMALLSTR)
2260 				free(cp, M_NFSSTRING);
2261 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(j));
2262 			break;
2263 		case NFSATTRBIT_OWNERGROUP:
2264 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2265 			j = fxdr_unsigned(int, *tl);
2266 			if (j < 0)
2267 				return (NFSERR_BADXDR);
2268 			if (j > NFSV4_SMALLSTR)
2269 				cp = malloc(j + 1, M_NFSSTRING, M_WAITOK);
2270 			else
2271 				cp = namestr;
2272 			error = nfsrv_mtostr(nd, cp, j);
2273 			if (error) {
2274 				if (j > NFSV4_SMALLSTR)
2275 					free(cp, M_NFSSTRING);
2276 				return (error);
2277 			}
2278 			if (!nd->nd_repstat) {
2279 				nd->nd_repstat = nfsv4_strtogid(cp,j,&gid,p);
2280 				if (!nd->nd_repstat)
2281 					nvap->na_gid = gid;
2282 			}
2283 			if (j > NFSV4_SMALLSTR)
2284 				free(cp, M_NFSSTRING);
2285 			attrsum += (NFSX_UNSIGNED + NFSM_RNDUP(j));
2286 			break;
2287 		case NFSATTRBIT_SYSTEM:
2288 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2289 			if (!nd->nd_repstat)
2290 				nd->nd_repstat = NFSERR_ATTRNOTSUPP;
2291 			attrsum += NFSX_UNSIGNED;
2292 			break;
2293 		case NFSATTRBIT_TIMEACCESSSET:
2294 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2295 			attrsum += NFSX_UNSIGNED;
2296 			if (fxdr_unsigned(int, *tl)==NFSV4SATTRTIME_TOCLIENT) {
2297 			    NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2298 			    fxdr_nfsv4time(tl, &nvap->na_atime);
2299 			    toclient = 1;
2300 			    attrsum += NFSX_V4TIME;
2301 			} else {
2302 			    NFSGETTIME(&curtime);
2303 			    nvap->na_atime.tv_sec = curtime.tv_sec;
2304 			    nvap->na_atime.tv_nsec = curtime.tv_usec * 1000;
2305 			    nvap->na_vaflags |= VA_UTIMES_NULL;
2306 			}
2307 			break;
2308 		case NFSATTRBIT_TIMEBACKUP:
2309 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2310 			if (!nd->nd_repstat)
2311 				nd->nd_repstat = NFSERR_ATTRNOTSUPP;
2312 			attrsum += NFSX_V4TIME;
2313 			break;
2314 		case NFSATTRBIT_TIMECREATE:
2315 			NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2316 			if (!nd->nd_repstat)
2317 				nd->nd_repstat = NFSERR_ATTRNOTSUPP;
2318 			attrsum += NFSX_V4TIME;
2319 			break;
2320 		case NFSATTRBIT_TIMEMODIFYSET:
2321 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2322 			attrsum += NFSX_UNSIGNED;
2323 			if (fxdr_unsigned(int, *tl)==NFSV4SATTRTIME_TOCLIENT) {
2324 			    NFSM_DISSECT(tl, u_int32_t *, NFSX_V4TIME);
2325 			    fxdr_nfsv4time(tl, &nvap->na_mtime);
2326 			    nvap->na_vaflags &= ~VA_UTIMES_NULL;
2327 			    attrsum += NFSX_V4TIME;
2328 			} else {
2329 			    NFSGETTIME(&curtime);
2330 			    nvap->na_mtime.tv_sec = curtime.tv_sec;
2331 			    nvap->na_mtime.tv_nsec = curtime.tv_usec * 1000;
2332 			    if (!toclient)
2333 				nvap->na_vaflags |= VA_UTIMES_NULL;
2334 			}
2335 			break;
2336 		default:
2337 			nd->nd_repstat = NFSERR_ATTRNOTSUPP;
2338 			/*
2339 			 * set bitpos so we drop out of the loop.
2340 			 */
2341 			bitpos = NFSATTRBIT_MAX;
2342 			break;
2343 		};
2344 	}
2345 
2346 	/*
2347 	 * some clients pad the attrlist, so we need to skip over the
2348 	 * padding.
2349 	 */
2350 	if (attrsum > attrsize) {
2351 		error = NFSERR_BADXDR;
2352 	} else {
2353 		attrsize = NFSM_RNDUP(attrsize);
2354 		if (attrsum < attrsize)
2355 			error = nfsm_advance(nd, attrsize - attrsum, -1);
2356 	}
2357 nfsmout:
2358 	return (error);
2359 }
2360 
2361 /*
2362  * Check/setup export credentials.
2363  */
2364 int
2365 nfsd_excred(struct nfsrv_descript *nd, struct nfsexstuff *exp,
2366     struct ucred *credanon)
2367 {
2368 	int error = 0;
2369 
2370 	/*
2371 	 * Check/setup credentials.
2372 	 */
2373 	if (nd->nd_flag & ND_GSS)
2374 		exp->nes_exflag &= ~MNT_EXPORTANON;
2375 
2376 	/*
2377 	 * Check to see if the operation is allowed for this security flavor.
2378 	 * RFC2623 suggests that the NFSv3 Fsinfo RPC be allowed to
2379 	 * AUTH_NONE or AUTH_SYS for file systems requiring RPCSEC_GSS.
2380 	 * Also, allow Secinfo, so that it can acquire the correct flavor(s).
2381 	 */
2382 	if (nfsvno_testexp(nd, exp) &&
2383 	    nd->nd_procnum != NFSV4OP_SECINFO &&
2384 	    nd->nd_procnum != NFSPROC_FSINFO) {
2385 		if (nd->nd_flag & ND_NFSV4)
2386 			error = NFSERR_WRONGSEC;
2387 		else
2388 			error = (NFSERR_AUTHERR | AUTH_TOOWEAK);
2389 		return (error);
2390 	}
2391 
2392 	/*
2393 	 * Check to see if the file system is exported V4 only.
2394 	 */
2395 	if (NFSVNO_EXV4ONLY(exp) && !(nd->nd_flag & ND_NFSV4))
2396 		return (NFSERR_PROGNOTV4);
2397 
2398 	/*
2399 	 * Now, map the user credentials.
2400 	 * (Note that ND_AUTHNONE will only be set for an NFSv3
2401 	 *  Fsinfo RPC. If set for anything else, this code might need
2402 	 *  to change.)
2403 	 */
2404 	if (NFSVNO_EXPORTED(exp) &&
2405 	    ((!(nd->nd_flag & ND_GSS) && nd->nd_cred->cr_uid == 0) ||
2406 	     NFSVNO_EXPORTANON(exp) ||
2407 	     (nd->nd_flag & ND_AUTHNONE))) {
2408 		nd->nd_cred->cr_uid = credanon->cr_uid;
2409 		nd->nd_cred->cr_gid = credanon->cr_gid;
2410 		crsetgroups(nd->nd_cred, credanon->cr_ngroups,
2411 		    credanon->cr_groups);
2412 	}
2413 	return (0);
2414 }
2415 
2416 /*
2417  * Check exports.
2418  */
2419 int
2420 nfsvno_checkexp(struct mount *mp, struct sockaddr *nam, struct nfsexstuff *exp,
2421     struct ucred **credp)
2422 {
2423 	int i, error, *secflavors;
2424 
2425 	error = VFS_CHECKEXP(mp, nam, &exp->nes_exflag, credp,
2426 	    &exp->nes_numsecflavor, &secflavors);
2427 	if (error) {
2428 		if (nfs_rootfhset) {
2429 			exp->nes_exflag = 0;
2430 			exp->nes_numsecflavor = 0;
2431 			error = 0;
2432 		}
2433 	} else {
2434 		/* Copy the security flavors. */
2435 		for (i = 0; i < exp->nes_numsecflavor; i++)
2436 			exp->nes_secflavors[i] = secflavors[i];
2437 	}
2438 	return (error);
2439 }
2440 
2441 /*
2442  * Get a vnode for a file handle and export stuff.
2443  */
2444 int
2445 nfsvno_fhtovp(struct mount *mp, fhandle_t *fhp, struct sockaddr *nam,
2446     struct vnode **vpp, struct nfsexstuff *exp, struct ucred **credp)
2447 {
2448 	int i, error, *secflavors;
2449 
2450 	*credp = NULL;
2451 	exp->nes_numsecflavor = 0;
2452 	error = VFS_FHTOVP(mp, &fhp->fh_fid, vpp);
2453 	if (nam && !error) {
2454 		error = VFS_CHECKEXP(mp, nam, &exp->nes_exflag, credp,
2455 		    &exp->nes_numsecflavor, &secflavors);
2456 		if (error) {
2457 			if (nfs_rootfhset) {
2458 				exp->nes_exflag = 0;
2459 				exp->nes_numsecflavor = 0;
2460 				error = 0;
2461 			} else {
2462 				vput(*vpp);
2463 			}
2464 		} else {
2465 			/* Copy the security flavors. */
2466 			for (i = 0; i < exp->nes_numsecflavor; i++)
2467 				exp->nes_secflavors[i] = secflavors[i];
2468 		}
2469 	}
2470 	return (error);
2471 }
2472 
2473 /*
2474  * Do the pathconf vnode op.
2475  */
2476 int
2477 nfsvno_pathconf(struct vnode *vp, int flag, register_t *retf,
2478     struct ucred *cred, struct thread *p)
2479 {
2480 	int error;
2481 
2482 	error = VOP_PATHCONF(vp, flag, retf);
2483 	return (error);
2484 }
2485 
2486 /*
2487  * nfsd_fhtovp() - convert a fh to a vnode ptr
2488  * 	- look up fsid in mount list (if not found ret error)
2489  *	- get vp and export rights by calling nfsvno_fhtovp()
2490  *	- if cred->cr_uid == 0 or MNT_EXPORTANON set it to credanon
2491  *	  for AUTH_SYS
2492  * Also handle getting the Giant lock for the file system,
2493  * as required:
2494  * - if same mount point as *mpp
2495  *       do nothing
2496  *   else if *mpp == NULL
2497  *       if already locked
2498  *           leave it locked
2499  *       else
2500  *           call VFS_LOCK_GIANT()
2501  *   else
2502  *       if already locked
2503  *            unlock Giant
2504  *       call VFS_LOCK_GIANT()
2505  */
2506 void
2507 nfsd_fhtovp(struct nfsrv_descript *nd, struct nfsrvfh *nfp,
2508     struct vnode **vpp, struct nfsexstuff *exp,
2509     struct mount **mpp, int startwrite, struct thread *p)
2510 {
2511 	struct mount *mp;
2512 	struct ucred *credanon;
2513 	fhandle_t *fhp;
2514 
2515 	fhp = (fhandle_t *)nfp->nfsrvfh_data;
2516 	/*
2517 	 * Check for the special case of the nfsv4root_fh.
2518 	 */
2519 	mp = vfs_getvfs(&fhp->fh_fsid);
2520 	if (!mp) {
2521 		*vpp = NULL;
2522 		nd->nd_repstat = ESTALE;
2523 		if (*mpp && exp->nes_vfslocked)
2524 			VFS_UNLOCK_GIANT(*mpp);
2525 		*mpp = NULL;
2526 		exp->nes_vfslocked = 0;
2527 		return;
2528 	}
2529 
2530 	/*
2531 	 * Now, handle Giant for the file system.
2532 	 */
2533 	if (*mpp != NULL && *mpp != mp && exp->nes_vfslocked) {
2534 		VFS_UNLOCK_GIANT(*mpp);
2535 		exp->nes_vfslocked = 0;
2536 	}
2537 	if (!exp->nes_vfslocked && *mpp != mp)
2538 		exp->nes_vfslocked = VFS_LOCK_GIANT(mp);
2539 
2540 	*mpp = mp;
2541 	if (startwrite)
2542 		vn_start_write(NULL, mpp, V_WAIT);
2543 
2544 	nd->nd_repstat = nfsvno_fhtovp(mp, fhp, nd->nd_nam, vpp, exp,
2545 	    &credanon);
2546 
2547 	/*
2548 	 * For NFSv4 without a pseudo root fs, unexported file handles
2549 	 * can be returned, so that Lookup works everywhere.
2550 	 */
2551 	if (!nd->nd_repstat && exp->nes_exflag == 0 &&
2552 	    !(nd->nd_flag & ND_NFSV4)) {
2553 		vput(*vpp);
2554 		nd->nd_repstat = EACCES;
2555 	}
2556 
2557 	/*
2558 	 * Personally, I've never seen any point in requiring a
2559 	 * reserved port#, since only in the rare case where the
2560 	 * clients are all boxes with secure system priviledges,
2561 	 * does it provide any enhanced security, but... some people
2562 	 * believe it to be useful and keep putting this code back in.
2563 	 * (There is also some "security checker" out there that
2564 	 *  complains if the nfs server doesn't enforce this.)
2565 	 * However, note the following:
2566 	 * RFC3530 (NFSv4) specifies that a reserved port# not be
2567 	 *	required.
2568 	 * RFC2623 recommends that, if a reserved port# is checked for,
2569 	 *	that there be a way to turn that off--> ifdef'd.
2570 	 */
2571 #ifdef NFS_REQRSVPORT
2572 	if (!nd->nd_repstat) {
2573 		struct sockaddr_in *saddr;
2574 		struct sockaddr_in6 *saddr6;
2575 
2576 		saddr = NFSSOCKADDR(nd->nd_nam, struct sockaddr_in *);
2577 		saddr6 = NFSSOCKADDR(nd->nd_nam, struct sockaddr_in6 *);
2578 		if (!(nd->nd_flag & ND_NFSV4) &&
2579 		    ((saddr->sin_family == AF_INET &&
2580 		      ntohs(saddr->sin_port) >= IPPORT_RESERVED) ||
2581 		     (saddr6->sin6_family == AF_INET6 &&
2582 		      ntohs(saddr6->sin6_port) >= IPPORT_RESERVED))) {
2583 			vput(*vpp);
2584 			nd->nd_repstat = (NFSERR_AUTHERR | AUTH_TOOWEAK);
2585 		}
2586 	}
2587 #endif	/* NFS_REQRSVPORT */
2588 
2589 	/*
2590 	 * Check/setup credentials.
2591 	 */
2592 	if (!nd->nd_repstat) {
2593 		nd->nd_saveduid = nd->nd_cred->cr_uid;
2594 		nd->nd_repstat = nfsd_excred(nd, exp, credanon);
2595 		if (nd->nd_repstat)
2596 			vput(*vpp);
2597 	}
2598 	if (credanon != NULL)
2599 		crfree(credanon);
2600 	if (nd->nd_repstat) {
2601 		if (startwrite)
2602 			vn_finished_write(mp);
2603 		if (exp->nes_vfslocked) {
2604 			VFS_UNLOCK_GIANT(mp);
2605 			exp->nes_vfslocked = 0;
2606 		}
2607 		vfs_rel(mp);
2608 		*vpp = NULL;
2609 		*mpp = NULL;
2610 	} else {
2611 		vfs_rel(mp);
2612 	}
2613 }
2614 
2615 /*
2616  * glue for fp.
2617  */
2618 int
2619 fp_getfvp(struct thread *p, int fd, struct file **fpp, struct vnode **vpp)
2620 {
2621 	struct filedesc *fdp;
2622 	struct file *fp;
2623 
2624 	fdp = p->td_proc->p_fd;
2625 	if (fd >= fdp->fd_nfiles ||
2626 	    (fp = fdp->fd_ofiles[fd]) == NULL)
2627 		return (EBADF);
2628 	*fpp = fp;
2629 	return (0);
2630 }
2631 
2632 /*
2633  * Called from nfssvc() to update the exports list. Just call
2634  * vfs_export(). This has to be done, since the v4 root fake fs isn't
2635  * in the mount list.
2636  */
2637 int
2638 nfsrv_v4rootexport(void *argp, struct ucred *cred, struct thread *p)
2639 {
2640 	struct nfsex_args *nfsexargp = (struct nfsex_args *)argp;
2641 	int error;
2642 	struct nameidata nd;
2643 	fhandle_t fh;
2644 
2645 	error = vfs_export(&nfsv4root_mnt, &nfsexargp->export);
2646 	if ((nfsexargp->export.ex_flags & MNT_DELEXPORT)) {
2647 		nfs_rootfhset = 0;
2648 		nfsv4root_set = 0;
2649 	} else if (error == 0) {
2650 		if (nfsexargp->fspec == NULL)
2651 			return (EPERM);
2652 		/*
2653 		 * If fspec != NULL, this is the v4root path.
2654 		 */
2655 		NDINIT(&nd, LOOKUP, FOLLOW | MPSAFE, UIO_USERSPACE,
2656 		    nfsexargp->fspec, p);
2657 		if ((error = namei(&nd)) != 0)
2658 			return (error);
2659 		error = nfsvno_getfh(nd.ni_vp, &fh, p);
2660 		vrele(nd.ni_vp);
2661 		if (!error) {
2662 			nfs_rootfh.nfsrvfh_len = NFSX_MYFH;
2663 			NFSBCOPY((caddr_t)&fh,
2664 			    nfs_rootfh.nfsrvfh_data,
2665 			    sizeof (fhandle_t));
2666 			nfs_rootfhset = 1;
2667 		}
2668 	}
2669 	return (error);
2670 }
2671 
2672 /*
2673  * Get the tcp socket sequence numbers we need.
2674  * (Maybe this should be moved to the tcp sources?)
2675  */
2676 int
2677 nfsrv_getsocksndseq(struct socket *so, tcp_seq *maxp, tcp_seq *unap)
2678 {
2679 	struct inpcb *inp;
2680 	struct tcpcb *tp;
2681 	int error = EPIPE;
2682 
2683 	INP_INFO_RLOCK(&V_tcbinfo);
2684 	inp = sotoinpcb(so);
2685 	if (inp == NULL) {
2686 		INP_INFO_RUNLOCK(&V_tcbinfo);
2687 		return (error);
2688 	}
2689 	INP_RLOCK(inp);
2690 	INP_INFO_RUNLOCK(&V_tcbinfo);
2691 	tp = intotcpcb(inp);
2692 	if (tp != NULL && tp->t_state == TCPS_ESTABLISHED) {
2693 		*maxp = tp->snd_max;
2694 		*unap = tp->snd_una;
2695 		error = 0;
2696 	}
2697 	INP_RUNLOCK(inp);
2698 	return (error);
2699 }
2700 
2701 /*
2702  * This function needs to test to see if the system is near its limit
2703  * for memory allocation via malloc() or mget() and return True iff
2704  * either of these resources are near their limit.
2705  * XXX (For now, this is just a stub.)
2706  */
2707 int nfsrv_testmalloclimit = 0;
2708 int
2709 nfsrv_mallocmget_limit(void)
2710 {
2711 	static int printmesg = 0;
2712 	static int testval = 1;
2713 
2714 	if (nfsrv_testmalloclimit && (testval++ % 1000) == 0) {
2715 		if ((printmesg++ % 100) == 0)
2716 			printf("nfsd: malloc/mget near limit\n");
2717 		return (1);
2718 	}
2719 	return (0);
2720 }
2721 
2722 /*
2723  * BSD specific initialization of a mount point.
2724  */
2725 void
2726 nfsd_mntinit(void)
2727 {
2728 	static int inited = 0;
2729 
2730 	if (inited)
2731 		return;
2732 	inited = 1;
2733 	nfsv4root_mnt.mnt_flag = (MNT_RDONLY | MNT_EXPORTED);
2734 	TAILQ_INIT(&nfsv4root_mnt.mnt_nvnodelist);
2735 	nfsv4root_mnt.mnt_export = NULL;
2736 	TAILQ_INIT(&nfsv4root_opt);
2737 	TAILQ_INIT(&nfsv4root_newopt);
2738 	nfsv4root_mnt.mnt_opt = &nfsv4root_opt;
2739 	nfsv4root_mnt.mnt_optnew = &nfsv4root_newopt;
2740 	nfsv4root_mnt.mnt_nvnodelistsize = 0;
2741 }
2742 
2743 /*
2744  * Get a vnode for a file handle, without checking exports, etc.
2745  */
2746 struct vnode *
2747 nfsvno_getvp(fhandle_t *fhp)
2748 {
2749 	struct mount *mp;
2750 	struct vnode *vp;
2751 	int error;
2752 
2753 	mp = vfs_getvfs(&fhp->fh_fsid);
2754 	if (mp == NULL)
2755 		return (NULL);
2756 	error = VFS_FHTOVP(mp, &fhp->fh_fid, &vp);
2757 	if (error)
2758 		return (NULL);
2759 	return (vp);
2760 }
2761 
2762 /*
2763  * Check to see it a byte range lock held by a process running
2764  * locally on the server conflicts with the new lock.
2765  */
2766 int
2767 nfsvno_localconflict(struct vnode *vp, int ftype, u_int64_t first,
2768     u_int64_t end, struct nfslockconflict *cfp, struct thread *td)
2769 {
2770 	int error;
2771 	struct flock fl;
2772 
2773 	if (!nfsrv_dolocallocks)
2774 		return (0);
2775 	fl.l_whence = SEEK_SET;
2776 	fl.l_type = ftype;
2777 	fl.l_start = (off_t)first;
2778 	if (end == NFS64BITSSET)
2779 		fl.l_len = 0;
2780 	else
2781 		fl.l_len = (off_t)(end - first);
2782 	/*
2783 	 * For FreeBSD8, the l_pid and l_sysid must be set to the same
2784 	 * values for all calls, so that all locks will be held by the
2785 	 * nfsd server. (The nfsd server handles conflicts between the
2786 	 * various clients.)
2787 	 * Since an NFSv4 lockowner is a ClientID plus an array of up to 1024
2788 	 * bytes, so it can't be put in l_sysid.
2789 	 */
2790 	if (nfsv4_sysid == 0)
2791 		nfsv4_sysid = nlm_acquire_next_sysid();
2792 	fl.l_pid = (pid_t)0;
2793 	fl.l_sysid = (int)nfsv4_sysid;
2794 
2795 	NFSVOPUNLOCK(vp, 0, td);
2796 	error = VOP_ADVLOCK(vp, (caddr_t)td->td_proc, F_GETLK, &fl,
2797 	    (F_POSIX | F_REMOTE));
2798 	NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY, td);
2799 	if (error)
2800 		return (error);
2801 	if (fl.l_type == F_UNLCK)
2802 		return (0);
2803 	if (cfp != NULL) {
2804 		cfp->cl_clientid.lval[0] = cfp->cl_clientid.lval[1] = 0;
2805 		cfp->cl_first = (u_int64_t)fl.l_start;
2806 		if (fl.l_len == 0)
2807 			cfp->cl_end = NFS64BITSSET;
2808 		else
2809 			cfp->cl_end = (u_int64_t)
2810 			    (fl.l_start + fl.l_len);
2811 		if (fl.l_type == F_WRLCK)
2812 			cfp->cl_flags = NFSLCK_WRITE;
2813 		else
2814 			cfp->cl_flags = NFSLCK_READ;
2815 		sprintf(cfp->cl_owner, "LOCALID%d", fl.l_pid);
2816 		cfp->cl_ownerlen = strlen(cfp->cl_owner);
2817 		return (NFSERR_DENIED);
2818 	}
2819 	return (NFSERR_INVAL);
2820 }
2821 
2822 /*
2823  * Do a local VOP_ADVLOCK().
2824  */
2825 int
2826 nfsvno_advlock(struct vnode *vp, int ftype, u_int64_t first,
2827     u_int64_t end, struct thread *td)
2828 {
2829 	int error;
2830 	struct flock fl;
2831 	u_int64_t tlen;
2832 
2833 	if (!nfsrv_dolocallocks)
2834 		return (0);
2835 	fl.l_whence = SEEK_SET;
2836 	fl.l_type = ftype;
2837 	fl.l_start = (off_t)first;
2838 	if (end == NFS64BITSSET) {
2839 		fl.l_len = 0;
2840 	} else {
2841 		tlen = end - first;
2842 		fl.l_len = (off_t)tlen;
2843 	}
2844 	/*
2845 	 * For FreeBSD8, the l_pid and l_sysid must be set to the same
2846 	 * values for all calls, so that all locks will be held by the
2847 	 * nfsd server. (The nfsd server handles conflicts between the
2848 	 * various clients.)
2849 	 * Since an NFSv4 lockowner is a ClientID plus an array of up to 1024
2850 	 * bytes, so it can't be put in l_sysid.
2851 	 */
2852 	if (nfsv4_sysid == 0)
2853 		nfsv4_sysid = nlm_acquire_next_sysid();
2854 	fl.l_pid = (pid_t)0;
2855 	fl.l_sysid = (int)nfsv4_sysid;
2856 
2857 	NFSVOPUNLOCK(vp, 0, td);
2858 	error = VOP_ADVLOCK(vp, (caddr_t)td->td_proc, F_SETLK, &fl,
2859 	    (F_POSIX | F_REMOTE));
2860 	NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY, td);
2861 	return (error);
2862 }
2863 
2864 /*
2865  * Unlock an underlying local file system.
2866  */
2867 void
2868 nfsvno_unlockvfs(struct mount *mp)
2869 {
2870 
2871 	VFS_UNLOCK_GIANT(mp);
2872 }
2873 
2874 /*
2875  * Lock an underlying file system, as required, and return
2876  * whether or not it is locked.
2877  */
2878 int
2879 nfsvno_lockvfs(struct mount *mp)
2880 {
2881 	int ret;
2882 
2883 	ret = VFS_LOCK_GIANT(mp);
2884 	return (ret);
2885 }
2886 
2887 /*
2888  * Check the nfsv4 root exports.
2889  */
2890 int
2891 nfsvno_v4rootexport(struct nfsrv_descript *nd)
2892 {
2893 	struct ucred *credanon;
2894 	int exflags, error, numsecflavor, *secflavors, i;
2895 
2896 	error = vfs_stdcheckexp(&nfsv4root_mnt, nd->nd_nam, &exflags,
2897 	    &credanon, &numsecflavor, &secflavors);
2898 	if (error)
2899 		return (NFSERR_PROGUNAVAIL);
2900 	if (credanon != NULL)
2901 		crfree(credanon);
2902 	for (i = 0; i < numsecflavor; i++) {
2903 		if (secflavors[i] == AUTH_SYS)
2904 			nd->nd_flag |= ND_EXAUTHSYS;
2905 		else if (secflavors[i] == RPCSEC_GSS_KRB5)
2906 			nd->nd_flag |= ND_EXGSS;
2907 		else if (secflavors[i] == RPCSEC_GSS_KRB5I)
2908 			nd->nd_flag |= ND_EXGSSINTEGRITY;
2909 		else if (secflavors[i] == RPCSEC_GSS_KRB5P)
2910 			nd->nd_flag |= ND_EXGSSPRIVACY;
2911 	}
2912 	return (0);
2913 }
2914 
2915 /*
2916  * Nfs server psuedo system call for the nfsd's
2917  */
2918 /*
2919  * MPSAFE
2920  */
2921 static int
2922 nfssvc_nfsd(struct thread *td, struct nfssvc_args *uap)
2923 {
2924 	struct file *fp;
2925 	struct nfsd_addsock_args sockarg;
2926 	struct nfsd_nfsd_args nfsdarg;
2927 	int error;
2928 
2929 	if (uap->flag & NFSSVC_NFSDADDSOCK) {
2930 		error = copyin(uap->argp, (caddr_t)&sockarg, sizeof (sockarg));
2931 		if (error)
2932 			return (error);
2933 		if ((error = fget(td, sockarg.sock, &fp)) != 0) {
2934 			return (error);
2935 		}
2936 		if (fp->f_type != DTYPE_SOCKET) {
2937 			fdrop(fp, td);
2938 			return (EPERM);
2939 		}
2940 		error = nfsrvd_addsock(fp);
2941 		fdrop(fp, td);
2942 	} else if (uap->flag & NFSSVC_NFSDNFSD) {
2943 		if (uap->argp == NULL)
2944 			return (EINVAL);
2945 		error = copyin(uap->argp, (caddr_t)&nfsdarg,
2946 		    sizeof (nfsdarg));
2947 		if (error)
2948 			return (error);
2949 		error = nfsrvd_nfsd(td, &nfsdarg);
2950 	} else {
2951 		error = nfssvc_srvcall(td, uap, td->td_ucred);
2952 	}
2953 	return (error);
2954 }
2955 
2956 static int
2957 nfssvc_srvcall(struct thread *p, struct nfssvc_args *uap, struct ucred *cred)
2958 {
2959 	struct nfsex_args export;
2960 	struct file *fp = NULL;
2961 	int stablefd, len;
2962 	struct nfsd_clid adminrevoke;
2963 	struct nfsd_dumplist dumplist;
2964 	struct nfsd_dumpclients *dumpclients;
2965 	struct nfsd_dumplocklist dumplocklist;
2966 	struct nfsd_dumplocks *dumplocks;
2967 	struct nameidata nd;
2968 	vnode_t vp;
2969 	int error = EINVAL;
2970 
2971 	if (uap->flag & NFSSVC_PUBLICFH) {
2972 		NFSBZERO((caddr_t)&nfs_pubfh.nfsrvfh_data,
2973 		    sizeof (fhandle_t));
2974 		error = copyin(uap->argp,
2975 		    &nfs_pubfh.nfsrvfh_data, sizeof (fhandle_t));
2976 		if (!error)
2977 			nfs_pubfhset = 1;
2978 	} else if (uap->flag & NFSSVC_V4ROOTEXPORT) {
2979 		error = copyin(uap->argp,(caddr_t)&export,
2980 		    sizeof (struct nfsex_args));
2981 		if (!error)
2982 			error = nfsrv_v4rootexport(&export, cred, p);
2983 	} else if (uap->flag & NFSSVC_NOPUBLICFH) {
2984 		nfs_pubfhset = 0;
2985 		error = 0;
2986 	} else if (uap->flag & NFSSVC_STABLERESTART) {
2987 		error = copyin(uap->argp, (caddr_t)&stablefd,
2988 		    sizeof (int));
2989 		if (!error)
2990 			error = fp_getfvp(p, stablefd, &fp, &vp);
2991 		if (!error && (NFSFPFLAG(fp) & (FREAD | FWRITE)) != (FREAD | FWRITE))
2992 			error = EBADF;
2993 		if (!error && newnfs_numnfsd != 0)
2994 			error = EPERM;
2995 		if (!error) {
2996 			nfsrv_stablefirst.nsf_fp = fp;
2997 			nfsrv_setupstable(p);
2998 		}
2999 	} else if (uap->flag & NFSSVC_ADMINREVOKE) {
3000 		error = copyin(uap->argp, (caddr_t)&adminrevoke,
3001 		    sizeof (struct nfsd_clid));
3002 		if (!error)
3003 			error = nfsrv_adminrevoke(&adminrevoke, p);
3004 	} else if (uap->flag & NFSSVC_DUMPCLIENTS) {
3005 		error = copyin(uap->argp, (caddr_t)&dumplist,
3006 		    sizeof (struct nfsd_dumplist));
3007 		if (!error && (dumplist.ndl_size < 1 ||
3008 			dumplist.ndl_size > NFSRV_MAXDUMPLIST))
3009 			error = EPERM;
3010 		if (!error) {
3011 		    len = sizeof (struct nfsd_dumpclients) * dumplist.ndl_size;
3012 		    dumpclients = (struct nfsd_dumpclients *)malloc(len,
3013 			M_TEMP, M_WAITOK);
3014 		    nfsrv_dumpclients(dumpclients, dumplist.ndl_size);
3015 		    error = copyout(dumpclients,
3016 			CAST_USER_ADDR_T(dumplist.ndl_list), len);
3017 		    free((caddr_t)dumpclients, M_TEMP);
3018 		}
3019 	} else if (uap->flag & NFSSVC_DUMPLOCKS) {
3020 		error = copyin(uap->argp, (caddr_t)&dumplocklist,
3021 		    sizeof (struct nfsd_dumplocklist));
3022 		if (!error && (dumplocklist.ndllck_size < 1 ||
3023 			dumplocklist.ndllck_size > NFSRV_MAXDUMPLIST))
3024 			error = EPERM;
3025 		if (!error)
3026 			error = nfsrv_lookupfilename(&nd,
3027 				dumplocklist.ndllck_fname, p);
3028 		if (!error) {
3029 			len = sizeof (struct nfsd_dumplocks) *
3030 				dumplocklist.ndllck_size;
3031 			dumplocks = (struct nfsd_dumplocks *)malloc(len,
3032 				M_TEMP, M_WAITOK);
3033 			nfsrv_dumplocks(nd.ni_vp, dumplocks,
3034 			    dumplocklist.ndllck_size, p);
3035 			vput(nd.ni_vp);
3036 			error = copyout(dumplocks,
3037 			    CAST_USER_ADDR_T(dumplocklist.ndllck_list), len);
3038 			free((caddr_t)dumplocks, M_TEMP);
3039 		}
3040 	}
3041 	return (error);
3042 }
3043 
3044 /*
3045  * Check exports.
3046  * Returns 0 if ok, 1 otherwise.
3047  */
3048 int
3049 nfsvno_testexp(struct nfsrv_descript *nd, struct nfsexstuff *exp)
3050 {
3051 	int i;
3052 
3053 	/*
3054 	 * This seems odd, but allow the case where the security flavor
3055 	 * list is empty. This happens when NFSv4 is traversing non-exported
3056 	 * file systems. Exported file systems should always have a non-empty
3057 	 * security flavor list.
3058 	 */
3059 	if (exp->nes_numsecflavor == 0)
3060 		return (0);
3061 
3062 	for (i = 0; i < exp->nes_numsecflavor; i++) {
3063 		/*
3064 		 * The tests for privacy and integrity must be first,
3065 		 * since ND_GSS is set for everything but AUTH_SYS.
3066 		 */
3067 		if (exp->nes_secflavors[i] == RPCSEC_GSS_KRB5P &&
3068 		    (nd->nd_flag & ND_GSSPRIVACY))
3069 			return (0);
3070 		if (exp->nes_secflavors[i] == RPCSEC_GSS_KRB5I &&
3071 		    (nd->nd_flag & ND_GSSINTEGRITY))
3072 			return (0);
3073 		if (exp->nes_secflavors[i] == RPCSEC_GSS_KRB5 &&
3074 		    (nd->nd_flag & ND_GSS))
3075 			return (0);
3076 		if (exp->nes_secflavors[i] == AUTH_SYS &&
3077 		    (nd->nd_flag & ND_GSS) == 0)
3078 			return (0);
3079 	}
3080 	return (1);
3081 }
3082 
3083 extern int (*nfsd_call_nfsd)(struct thread *, struct nfssvc_args *);
3084 
3085 /*
3086  * Called once to initialize data structures...
3087  */
3088 static int
3089 nfsd_modevent(module_t mod, int type, void *data)
3090 {
3091 	int error = 0;
3092 	static int loaded = 0;
3093 
3094 	switch (type) {
3095 	case MOD_LOAD:
3096 		if (loaded)
3097 			return (0);
3098 		newnfs_portinit();
3099 		mtx_init(&nfs_cache_mutex, "nfs_cache_mutex", NULL, MTX_DEF);
3100 		mtx_init(&nfs_v4root_mutex, "nfs_v4root_mutex", NULL, MTX_DEF);
3101 		mtx_init(&nfsv4root_mnt.mnt_mtx, "struct mount mtx", NULL,
3102 		    MTX_DEF);
3103 		lockinit(&nfsv4root_mnt.mnt_explock, PVFS, "explock", 0, 0);
3104 		nfsrvd_initcache();
3105 		nfsd_init();
3106 		NFSD_LOCK();
3107 		nfsrvd_init(0);
3108 		NFSD_UNLOCK();
3109 		nfsd_mntinit();
3110 #ifdef VV_DISABLEDELEG
3111 		vn_deleg_ops.vndeleg_recall = nfsd_recalldelegation;
3112 		vn_deleg_ops.vndeleg_disable = nfsd_disabledelegation;
3113 #endif
3114 		nfsd_call_servertimer = nfsrv_servertimer;
3115 		nfsd_call_nfsd = nfssvc_nfsd;
3116 		loaded = 1;
3117 		break;
3118 
3119 	case MOD_UNLOAD:
3120 		if (newnfs_numnfsd != 0) {
3121 			error = EBUSY;
3122 			break;
3123 		}
3124 
3125 #ifdef VV_DISABLEDELEG
3126 		vn_deleg_ops.vndeleg_recall = NULL;
3127 		vn_deleg_ops.vndeleg_disable = NULL;
3128 #endif
3129 		nfsd_call_servertimer = NULL;
3130 		nfsd_call_nfsd = NULL;
3131 		/* and get rid of the locks */
3132 		mtx_destroy(&nfs_cache_mutex);
3133 		mtx_destroy(&nfs_v4root_mutex);
3134 		mtx_destroy(&nfsv4root_mnt.mnt_mtx);
3135 		lockdestroy(&nfsv4root_mnt.mnt_explock);
3136 		loaded = 0;
3137 		break;
3138 	default:
3139 		error = EOPNOTSUPP;
3140 		break;
3141 	}
3142 	return error;
3143 }
3144 static moduledata_t nfsd_mod = {
3145 	"nfsd",
3146 	nfsd_modevent,
3147 	NULL,
3148 };
3149 DECLARE_MODULE(nfsd, nfsd_mod, SI_SUB_VFS, SI_ORDER_ANY);
3150 
3151 /* So that loader and kldload(2) can find us, wherever we are.. */
3152 MODULE_VERSION(nfsd, 1);
3153 MODULE_DEPEND(nfsd, nfscommon, 1, 1, 1);
3154 MODULE_DEPEND(nfsd, nfslockd, 1, 1, 1);
3155 
3156