xref: /openbsd/sys/nfs/nfs_serv.c (revision 36bb23f1)
1 /*	$OpenBSD: nfs_serv.c,v 1.113 2018/04/28 03:13:05 visa Exp $	*/
2 /*     $NetBSD: nfs_serv.c,v 1.34 1997/05/12 23:37:12 fvdl Exp $       */
3 
4 /*
5  * Copyright (c) 1989, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * This code is derived from software contributed to Berkeley by
9  * Rick Macklem at The University of Guelph.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. Neither the name of the University nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  *
35  *	@(#)nfs_serv.c	8.7 (Berkeley) 5/14/95
36  */
37 
38 /*
39  * nfs version 2 and 3 server calls to vnode ops
40  * - these routines generally have 3 phases
41  *   1 - break down and validate rpc request in mbuf list
42  *   2 - do the vnode ops for the request
43  *       (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
44  *   3 - build the rpc reply in an mbuf list
45  *   nb:
46  *	- do not mix the phases, since the nfsm_?? macros can return failures
47  *	  on a bad rpc or similar and do not do any vrele() or vput()'s
48  *
49  *      - the nfsm_reply() macro generates an nfs rpc reply with the nfs
50  *	error number iff error != 0 whereas
51  *	returning an error from the server function implies a fatal error
52  *	such as a badly constructed rpc request that should be dropped without
53  *	a reply.
54  *	For Version 3, nfsm_reply() does not return for the error case, since
55  *	most version 3 rpcs return more than the status for error cases.
56  */
57 
58 #include <sys/param.h>
59 #include <sys/systm.h>
60 #include <sys/proc.h>
61 #include <sys/namei.h>
62 #include <sys/vnode.h>
63 #include <sys/lock.h>
64 #include <sys/mount.h>
65 #include <sys/socket.h>
66 #include <sys/socketvar.h>
67 #include <sys/mbuf.h>
68 #include <sys/dirent.h>
69 #include <sys/stat.h>
70 #include <sys/kernel.h>
71 #include <sys/pool.h>
72 #include <sys/queue.h>
73 #include <sys/unistd.h>
74 
75 #include <ufs/ufs/dir.h>
76 
77 #include <nfs/nfsproto.h>
78 #include <nfs/nfs.h>
79 #include <nfs/xdr_subs.h>
80 #include <nfs/nfsm_subs.h>
81 #include <nfs/nfs_var.h>
82 
83 /* Global vars */
84 extern u_int32_t nfs_xdrneg1;
85 extern u_int32_t nfs_false, nfs_true;
86 extern enum vtype nv3tov_type[8];
87 extern struct nfsstats nfsstats;
88 extern nfstype nfsv2_type[9];
89 extern nfstype nfsv3_type[9];
90 
91 int nfsrv_access(struct vnode *, int, struct ucred *, int, struct proc *, int);
92 
93 /*
94  * nfs v3 access service
95  */
96 int
97 nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
98     struct proc *procp, struct mbuf **mrq)
99 {
100 	struct mbuf *nam = nfsd->nd_nam;
101 	struct nfsm_info	info;
102 	struct ucred *cred = &nfsd->nd_cr;
103 	struct vnode *vp;
104 	nfsfh_t nfh;
105 	fhandle_t *fhp;
106 	u_int32_t *tl;
107 	int32_t t1;
108 	int error = 0, rdonly, getret;
109 	char *cp2;
110 	struct vattr va;
111 	u_long testmode, nfsmode;
112 
113 	info.nmi_mreq = NULL;
114 	info.nmi_mrep = nfsd->nd_mrep;
115 	info.nmi_md = nfsd->nd_md;
116 	info.nmi_dpos = nfsd->nd_dpos;
117 
118 	fhp = &nfh.fh_generic;
119 	nfsm_srvmtofh(fhp);
120 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
121 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
122 	if (error) {
123 		nfsm_reply(NFSX_UNSIGNED);
124 		nfsm_srvpostop_attr(nfsd, 1, NULL, &info);
125 		error = 0;
126 		goto nfsmout;
127 	}
128 	nfsmode = fxdr_unsigned(u_int32_t, *tl);
129 	if ((nfsmode & NFSV3ACCESS_READ) &&
130 		nfsrv_access(vp, VREAD, cred, rdonly, procp, 0))
131 		nfsmode &= ~NFSV3ACCESS_READ;
132 	if (vp->v_type == VDIR)
133 		testmode = (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
134 			NFSV3ACCESS_DELETE);
135 	else
136 		testmode = (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
137 	if ((nfsmode & testmode) &&
138 		nfsrv_access(vp, VWRITE, cred, rdonly, procp, 0))
139 		nfsmode &= ~testmode;
140 	if (vp->v_type == VDIR)
141 		testmode = NFSV3ACCESS_LOOKUP;
142 	else
143 		testmode = NFSV3ACCESS_EXECUTE;
144 	if ((nfsmode & testmode) &&
145 		nfsrv_access(vp, VEXEC, cred, rdonly, procp, 0))
146 		nfsmode &= ~testmode;
147 	getret = VOP_GETATTR(vp, &va, cred, procp);
148 	vput(vp);
149 	nfsm_reply(NFSX_POSTOPATTR(1) + NFSX_UNSIGNED);
150 	nfsm_srvpostop_attr(nfsd, getret, &va, &info);
151 	tl = nfsm_build(&info.nmi_mb, NFSX_UNSIGNED);
152 	*tl = txdr_unsigned(nfsmode);
153 nfsmout:
154 	return(error);
155 }
156 
157 /*
158  * nfs getattr service
159  */
160 int
161 nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
162     struct proc *procp, struct mbuf **mrq)
163 {
164 	struct mbuf *nam = nfsd->nd_nam;
165 	struct nfsm_info	info;
166 	struct ucred *cred = &nfsd->nd_cr;
167 	struct nfs_fattr *fp;
168 	struct vattr va;
169 	struct vnode *vp;
170 	nfsfh_t nfh;
171 	fhandle_t *fhp;
172 	u_int32_t *tl;
173 	int32_t t1;
174 	int error = 0, rdonly;
175 	char *cp2;
176 
177 	info.nmi_mreq = NULL;
178 	info.nmi_mrep = nfsd->nd_mrep;
179 	info.nmi_md = nfsd->nd_md;
180 	info.nmi_dpos = nfsd->nd_dpos;
181 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
182 
183 	fhp = &nfh.fh_generic;
184 	nfsm_srvmtofh(fhp);
185 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
186 	if (error) {
187 		nfsm_reply(0);
188 		error = 0;
189 		goto nfsmout;
190 	}
191 	error = VOP_GETATTR(vp, &va, cred, procp);
192 	vput(vp);
193 	nfsm_reply(NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
194 	if (error) {
195 		error = 0;
196 		goto nfsmout;
197 	}
198 	fp = nfsm_build(&info.nmi_mb, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
199 	nfsm_srvfattr(nfsd, &va, fp);
200 nfsmout:
201 	return(error);
202 }
203 
204 /*
205  * nfs setattr service
206  */
207 int
208 nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
209     struct proc *procp, struct mbuf **mrq)
210 {
211 	struct mbuf *nam = nfsd->nd_nam;
212 	struct nfsm_info	info;
213 	struct ucred *cred = &nfsd->nd_cr;
214 	struct vattr va, preat;
215 	struct nfsv2_sattr *sp;
216 	struct nfs_fattr *fp;
217 	struct vnode *vp;
218 	nfsfh_t nfh;
219 	fhandle_t *fhp;
220 	u_int32_t *tl;
221 	int32_t t1;
222 	int error = 0, rdonly, preat_ret = 1, postat_ret = 1;
223 	int gcheck = 0;
224 	char *cp2;
225 	struct timespec guard;
226 
227 	info.nmi_mreq = NULL;
228 	info.nmi_mrep = nfsd->nd_mrep;
229 	info.nmi_md = nfsd->nd_md;
230 	info.nmi_dpos = nfsd->nd_dpos;
231 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
232 
233 	fhp = &nfh.fh_generic;
234 	nfsm_srvmtofh(fhp);
235 	VATTR_NULL(&va);
236 	if (info.nmi_v3) {
237 		va.va_vaflags |= VA_UTIMES_NULL;
238 		error = nfsm_srvsattr(&info.nmi_md, &va, info.nmi_mrep, &info.nmi_dpos);
239 		if (error)
240 			goto nfsmout;
241 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
242 		gcheck = fxdr_unsigned(int, *tl);
243 		if (gcheck) {
244 			nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
245 			fxdr_nfsv3time(tl, &guard);
246 		}
247 	} else {
248 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
249 		/*
250 		 * Nah nah nah nah na nah
251 		 * There is a bug in the Sun client that puts 0xffff in the mode
252 		 * field of sattr when it should put in 0xffffffff. The u_short
253 		 * doesn't sign extend.
254 		 * --> check the low order 2 bytes for 0xffff
255 		 */
256 		if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
257 			va.va_mode = nfstov_mode(sp->sa_mode);
258 		if (sp->sa_uid != nfs_xdrneg1)
259 			va.va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
260 		if (sp->sa_gid != nfs_xdrneg1)
261 			va.va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
262 		if (sp->sa_size != nfs_xdrneg1)
263 			va.va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
264 		if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
265 #ifdef notyet
266 			fxdr_nfsv2time(&sp->sa_atime, &va.va_atime);
267 #else
268 			va.va_atime.tv_sec =
269 				fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
270 			va.va_atime.tv_nsec = 0;
271 #endif
272 		}
273 		if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
274 			fxdr_nfsv2time(&sp->sa_mtime, &va.va_mtime);
275 
276 	}
277 
278 	/*
279 	 * Now that we have all the fields, lets do it.
280 	 */
281 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
282 	if (error) {
283 		nfsm_reply(2 * NFSX_UNSIGNED);
284 		nfsm_srvwcc(nfsd, preat_ret, &preat, postat_ret, &va, &info);
285 		error = 0;
286 		goto nfsmout;
287 	}
288 	if (info.nmi_v3) {
289 		error = preat_ret = VOP_GETATTR(vp, &preat, cred, procp);
290 		if (!error && gcheck &&
291 			(preat.va_ctime.tv_sec != guard.tv_sec ||
292 			 preat.va_ctime.tv_nsec != guard.tv_nsec))
293 			error = NFSERR_NOT_SYNC;
294 		if (error) {
295 			vput(vp);
296 			nfsm_reply(NFSX_WCCDATA(info.nmi_v3));
297 			nfsm_srvwcc(nfsd, preat_ret, &preat, postat_ret, &va,
298 			    &info);
299 			error = 0;
300 			goto nfsmout;
301 		}
302 	}
303 
304 	/*
305 	 * If the size is being changed write acces is required, otherwise
306 	 * just check for a read only file system.
307 	 */
308 	if (va.va_size == ((u_quad_t)((quad_t) -1))) {
309 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
310 			error = EROFS;
311 			goto out;
312 		}
313 	} else {
314 		if (vp->v_type == VDIR) {
315 			error = EISDIR;
316 			goto out;
317 		} else if ((error = nfsrv_access(vp, VWRITE, cred, rdonly,
318 			procp, 1)) != 0)
319 			goto out;
320 	}
321 	error = VOP_SETATTR(vp, &va, cred, procp);
322 	postat_ret = VOP_GETATTR(vp, &va, cred, procp);
323 	if (!error)
324 		error = postat_ret;
325 out:
326 	vput(vp);
327 	nfsm_reply(NFSX_WCCORFATTR(info.nmi_v3));
328 	if (info.nmi_v3) {
329 		nfsm_srvwcc(nfsd, preat_ret, &preat, postat_ret, &va,
330 		    &info);
331 		error = 0;
332 		goto nfsmout;
333 	} else {
334 		fp = nfsm_build(&info.nmi_mb, NFSX_V2FATTR);
335 		nfsm_srvfattr(nfsd, &va, fp);
336 	}
337 nfsmout:
338 	return(error);
339 }
340 
341 /*
342  * nfs lookup rpc
343  */
344 int
345 nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
346     struct proc *procp, struct mbuf **mrq)
347 {
348 	struct mbuf *nam = nfsd->nd_nam;
349 	struct ucred *cred = &nfsd->nd_cr;
350 	struct nfs_fattr *fp;
351 	struct nameidata nd;
352 	struct vnode *vp, *dirp;
353 	struct nfsm_info	info;
354 	nfsfh_t nfh;
355 	fhandle_t *fhp;
356 	u_int32_t *tl;
357 	int32_t t1;
358 	int error = 0, len, dirattr_ret = 1;
359 	int v3 = (nfsd->nd_flag & ND_NFSV3);
360 	char *cp2;
361 	struct vattr va, dirattr;
362 
363 	info.nmi_mrep = nfsd->nd_mrep;
364 	info.nmi_mreq = NULL;
365 	info.nmi_md = nfsd->nd_md;
366 	info.nmi_dpos = nfsd->nd_dpos;
367 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
368 
369 	fhp = &nfh.fh_generic;
370 	nfsm_srvmtofh(fhp);
371 	nfsm_srvnamesiz(len);
372 
373 	NDINIT(&nd, LOOKUP, LOCKLEAF | SAVESTART, UIO_SYSSPACE, NULL, procp);
374 	nd.ni_cnd.cn_cred = cred;
375 	error = nfs_namei(&nd, fhp, len, slp, nam, &info.nmi_md, &info.nmi_dpos, &dirp, procp);
376 	if (dirp) {
377 		if (info.nmi_v3)
378 			dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred,
379 				procp);
380 		vrele(dirp);
381 	}
382 	if (error) {
383 		nfsm_reply(NFSX_POSTOPATTR(info.nmi_v3));
384 		nfsm_srvpostop_attr(nfsd, dirattr_ret, &dirattr, &info);
385 		return (0);
386 	}
387 	vrele(nd.ni_startdir);
388 	pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
389 	vp = nd.ni_vp;
390 	memset(fhp, 0, sizeof(nfh));
391 	fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
392 	error = VFS_VPTOFH(vp, &fhp->fh_fid);
393 	if (!error)
394 		error = VOP_GETATTR(vp, &va, cred, procp);
395 	vput(vp);
396 	nfsm_reply(NFSX_SRVFH(info.nmi_v3) + NFSX_POSTOPORFATTR(info.nmi_v3)
397 	    + NFSX_POSTOPATTR(info.nmi_v3));
398 	if (error) {
399 		nfsm_srvpostop_attr(nfsd, dirattr_ret, &dirattr, &info);
400 		error = 0;
401 		goto nfsmout;
402 	}
403 	nfsm_srvfhtom(&info.nmi_mb, fhp, info.nmi_v3);
404 	if (v3) {
405 		nfsm_srvpostop_attr(nfsd, 0, &va, &info);
406 		nfsm_srvpostop_attr(nfsd, dirattr_ret, &dirattr, &info);
407 	} else {
408 		fp = nfsm_build(&info.nmi_mb, NFSX_V2FATTR);
409 		nfsm_srvfattr(nfsd, &va, fp);
410 	}
411 nfsmout:
412 	return(error);
413 }
414 
415 /*
416  * nfs readlink service
417  */
418 int
419 nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
420     struct proc *procp, struct mbuf **mrq)
421 {
422 	struct mbuf *nam = nfsd->nd_nam;
423 	struct ucred *cred = &nfsd->nd_cr;
424 	struct iovec iov;
425 	struct mbuf *mp = NULL;
426 	struct nfsm_info	info;
427 	u_int32_t *tl;
428 	int32_t t1;
429 	int error = 0, rdonly, tlen, len = 0, getret;
430 	char *cp2;
431 	struct vnode *vp;
432 	struct vattr attr;
433 	nfsfh_t nfh;
434 	fhandle_t *fhp;
435 	struct uio uio;
436 
437 	info.nmi_mreq = NULL;
438 	info.nmi_mrep = nfsd->nd_mrep;
439 	info.nmi_md = nfsd->nd_md;
440 	info.nmi_dpos = nfsd->nd_dpos;
441 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
442 
443 	memset(&uio, 0, sizeof(uio));
444 
445 	fhp = &nfh.fh_generic;
446 	nfsm_srvmtofh(fhp);
447 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
448 	if (error) {
449 		nfsm_reply(2 * NFSX_UNSIGNED);
450 		nfsm_srvpostop_attr(nfsd, 1, NULL, &info);
451 		error = 0;
452 		goto nfsmout;
453 	}
454 	if (vp->v_type != VLNK) {
455 		if (info.nmi_v3)
456 			error = EINVAL;
457 		else
458 			error = ENXIO;
459 		goto out;
460 	}
461 
462 	MGET(mp, M_WAIT, MT_DATA);
463 	MCLGET(mp, M_WAIT);		/* MLEN < NFS_MAXPATHLEN < MCLBYTES */
464 	mp->m_len = NFS_MAXPATHLEN;
465 	len = NFS_MAXPATHLEN;
466 	iov.iov_base = mtod(mp, caddr_t);
467 	iov.iov_len = mp->m_len;
468 
469 	uio.uio_iov = &iov;
470 	uio.uio_iovcnt = 1;
471 	uio.uio_offset = 0;
472 	uio.uio_resid = NFS_MAXPATHLEN;
473 	uio.uio_rw = UIO_READ;
474 	uio.uio_segflg = UIO_SYSSPACE;
475 	uio.uio_procp = NULL;
476 
477 	error = VOP_READLINK(vp, &uio, cred);
478 out:
479 	getret = VOP_GETATTR(vp, &attr, cred, procp);
480 	vput(vp);
481 	if (error)
482 		m_freem(mp);
483 	nfsm_reply(NFSX_POSTOPATTR(info.nmi_v3) + NFSX_UNSIGNED);
484 	if (info.nmi_v3) {
485 		nfsm_srvpostop_attr(nfsd, getret, &attr, &info);
486 		if (error) {
487 			error = 0;
488 			goto nfsmout;
489 		}
490 	}
491 	if (uio.uio_resid > 0) {
492 		len -= uio.uio_resid;
493 		tlen = nfsm_rndup(len);
494 		nfsm_adj(mp, NFS_MAXPATHLEN-tlen, tlen-len);
495 	}
496 	tl = nfsm_build(&info.nmi_mb, NFSX_UNSIGNED);
497 	*tl = txdr_unsigned(len);
498 	info.nmi_mb->m_next = mp;
499 
500 nfsmout:
501 	return (error);
502 }
503 
504 /*
505  * nfs read service
506  */
507 int
508 nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
509     struct proc *procp, struct mbuf **mrq)
510 {
511 	struct mbuf *nam = nfsd->nd_nam;
512 	struct ucred *cred = &nfsd->nd_cr;
513 	struct mbuf *m;
514 	struct nfs_fattr *fp;
515 	struct nfsm_info	info;
516 	u_int32_t *tl;
517 	int32_t t1;
518 	int i, reqlen;
519 	int error = 0, rdonly, cnt, len, left, siz, tlen, getret = 1;
520 	char *cp2;
521 	struct mbuf *m2;
522 	struct vnode *vp;
523 	nfsfh_t nfh;
524 	fhandle_t *fhp;
525 	struct uio io, *uiop = &io;
526 	struct vattr va;
527 	off_t off;
528 
529 	info.nmi_mreq = NULL;
530 	info.nmi_mrep = nfsd->nd_mrep;
531 	info.nmi_md = nfsd->nd_md;
532 	info.nmi_dpos = nfsd->nd_dpos;
533 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
534 
535 	fhp = &nfh.fh_generic;
536 	nfsm_srvmtofh(fhp);
537 	if (info.nmi_v3) {
538 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
539 		off = fxdr_hyper(tl);
540 	} else {
541 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
542 		off = (off_t)fxdr_unsigned(u_int32_t, *tl);
543 	}
544 
545 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
546 	reqlen = fxdr_unsigned(int32_t, *tl);
547 	if (reqlen > (NFS_SRVMAXDATA(nfsd)) || reqlen <= 0) {
548 		error = EBADRPC;
549 		nfsm_reply(0);
550 	}
551 
552 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
553 	if (error)
554 		goto bad;
555 
556 	if (vp->v_type != VREG) {
557 		if (info.nmi_v3)
558 			error = EINVAL;
559 		else
560 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
561 	}
562 	if (!error) {
563 	    if ((error = nfsrv_access(vp, VREAD, cred, rdonly, procp, 1)) != 0)
564 		error = nfsrv_access(vp, VEXEC, cred, rdonly, procp, 1);
565 	}
566 	getret = VOP_GETATTR(vp, &va, cred, procp);
567 	if (!error)
568 		error = getret;
569 	if (error)
570 		goto vbad;
571 
572 	if (off >= va.va_size)
573 		cnt = 0;
574 	else if ((off + reqlen) > va.va_size)
575 		cnt = va.va_size - off;
576 	else
577 		cnt = reqlen;
578 	nfsm_reply(NFSX_POSTOPORFATTR(info.nmi_v3) + 3 * NFSX_UNSIGNED+nfsm_rndup(cnt));
579 	if (info.nmi_v3) {
580 		tl = nfsm_build(&info.nmi_mb, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
581 		*tl++ = nfs_true;
582 		fp = (struct nfs_fattr *)tl;
583 		tl += (NFSX_V3FATTR / sizeof (u_int32_t));
584 	} else {
585 		tl = nfsm_build(&info.nmi_mb, NFSX_V2FATTR + NFSX_UNSIGNED);
586 		fp = (struct nfs_fattr *)tl;
587 		tl += (NFSX_V2FATTR / sizeof (u_int32_t));
588 	}
589 	len = left = nfsm_rndup (cnt);
590 	if (cnt > 0) {
591 		struct iovec *iv, *iv2;
592 		size_t ivlen;
593 		/*
594 		 * Generate the mbuf list with the uio_iov ref. to it.
595 		 */
596 		i = 0;
597 		m = m2 = info.nmi_mb;
598 		while (left > 0) {
599 			siz = min(M_TRAILINGSPACE(m), left);
600 			if (siz > 0) {
601 				left -= siz;
602 				i++;
603 			}
604 			if (left > 0) {
605 				MGET(m, M_WAIT, MT_DATA);
606 				if (left >= MINCLSIZE)
607 					MCLGET(m, M_WAIT);
608 				m->m_len = 0;
609 				m2->m_next = m;
610 				m2 = m;
611 			}
612 		}
613 		iv = mallocarray(i, sizeof(*iv), M_TEMP, M_WAITOK);
614 		ivlen = i * sizeof(*iv);
615 		uiop->uio_iov = iv2 = iv;
616 		m = info.nmi_mb;
617 		left = len;
618 		i = 0;
619 		while (left > 0) {
620 			if (m == NULL)
621 				panic("nfsrv_read iov");
622 			siz = min(M_TRAILINGSPACE(m), left);
623 			if (siz > 0) {
624 				iv->iov_base = mtod(m, caddr_t) + m->m_len;
625 				iv->iov_len = siz;
626 				m->m_len += siz;
627 				left -= siz;
628 				iv++;
629 				i++;
630 			}
631 			m = m->m_next;
632 		}
633 		uiop->uio_iovcnt = i;
634 		uiop->uio_offset = off;
635 		uiop->uio_resid = len;
636 		uiop->uio_rw = UIO_READ;
637 		uiop->uio_segflg = UIO_SYSSPACE;
638 		error = VOP_READ(vp, uiop, IO_NODELOCKED, cred);
639 		off = uiop->uio_offset;
640 		free(iv2, M_TEMP, ivlen);
641 		if (error || (getret = VOP_GETATTR(vp, &va, cred, procp)) != 0){
642 			if (!error)
643 				error = getret;
644 			m_freem(info.nmi_mreq);
645 			goto vbad;
646 		}
647 	} else
648 		uiop->uio_resid = 0;
649 	vput(vp);
650 	nfsm_srvfattr(nfsd, &va, fp);
651 	tlen = len - uiop->uio_resid;
652 	cnt = cnt < tlen ? cnt : tlen;
653 	tlen = nfsm_rndup (cnt);
654 	if (len != tlen || tlen != cnt)
655 		nfsm_adj(info.nmi_mb, len - tlen, tlen - cnt);
656 	if (info.nmi_v3) {
657 		*tl++ = txdr_unsigned(cnt);
658 		if (len < reqlen)
659 			*tl++ = nfs_true;
660 		else
661 			*tl++ = nfs_false;
662 	}
663 	*tl = txdr_unsigned(cnt);
664 nfsmout:
665 	return(error);
666 
667 vbad:
668 	vput(vp);
669 bad:
670 	nfsm_reply(0);
671 	nfsm_srvpostop_attr(nfsd, getret, &va, &info);
672 	return (0);
673 }
674 
675 /*
676  * nfs write service
677  */
678 int
679 nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
680     struct proc *procp, struct mbuf **mrq)
681 {
682 	struct mbuf *nam = nfsd->nd_nam;
683 	struct ucred *cred = &nfsd->nd_cr;
684 	struct nfsm_info	info;
685 	int i, cnt;
686 	struct mbuf *mp;
687 	struct nfs_fattr *fp;
688 	struct vattr va, forat;
689 	u_int32_t *tl;
690 	int32_t t1;
691 	int error = 0, rdonly, len, forat_ret = 1;
692 	int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
693 	int stable = NFSV3WRITE_FILESYNC;
694 	char *cp2;
695 	struct vnode *vp;
696 	nfsfh_t nfh;
697 	fhandle_t *fhp;
698 	struct uio io, *uiop = &io;
699 	off_t off;
700 
701 	info.nmi_mreq = NULL;
702 	info.nmi_mrep = nfsd->nd_mrep;
703 	info.nmi_md = nfsd->nd_md;
704 	info.nmi_dpos = nfsd->nd_dpos;
705 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
706 
707 	if (info.nmi_mrep == NULL) {
708 		*mrq = NULL;
709 		return (0);
710 	}
711 	fhp = &nfh.fh_generic;
712 	nfsm_srvmtofh(fhp);
713 	if (info.nmi_v3) {
714 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
715 		off = fxdr_hyper(tl);
716 		tl += 3;
717 		stable = fxdr_unsigned(int, *tl++);
718 	} else {
719 		nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
720 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
721 		tl += 2;
722 	}
723 	retlen = len = fxdr_unsigned(int32_t, *tl);
724 	cnt = i = 0;
725 
726 	/*
727 	 * For NFS Version 2, it is not obvious what a write of zero length
728 	 * should do, but I might as well be consistent with Version 3,
729 	 * which is to return ok so long as there are no permission problems.
730 	 */
731 	if (len > 0) {
732 	    zeroing = 1;
733 	    mp = info.nmi_mrep;
734 	    while (mp) {
735 		if (mp == info.nmi_md) {
736 			zeroing = 0;
737 			adjust = info.nmi_dpos - mtod(mp, caddr_t);
738 			mp->m_len -= adjust;
739 			if (mp->m_len > 0 && adjust > 0)
740 				mp->m_data += adjust;
741 		}
742 		if (zeroing)
743 			mp->m_len = 0;
744 		else if (mp->m_len > 0) {
745 			i += mp->m_len;
746 			if (i > len) {
747 				mp->m_len -= (i - len);
748 				zeroing	= 1;
749 			}
750 			if (mp->m_len > 0)
751 				cnt++;
752 		}
753 		mp = mp->m_next;
754 	    }
755 	}
756 	if (len > NFS_MAXDATA || len < 0 || i < len) {
757 		error = EIO;
758 		goto bad;
759 	}
760 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
761 	if (error)
762 		goto bad;
763 	if (info.nmi_v3)
764 		forat_ret = VOP_GETATTR(vp, &forat, cred, procp);
765 	if (vp->v_type != VREG) {
766 		if (info.nmi_v3)
767 			error = EINVAL;
768 		else
769 			error = (vp->v_type == VDIR) ? EISDIR : EACCES;
770 		goto vbad;
771 	}
772 	error = nfsrv_access(vp, VWRITE, cred, rdonly, procp, 1);
773 	if (error)
774 		goto vbad;
775 
776 	if (len > 0) {
777 	    struct iovec *iv, *ivp;
778 	    size_t ivlen;
779 
780 	    ivp = mallocarray(cnt, sizeof(*ivp), M_TEMP, M_WAITOK);
781 	    ivlen = cnt * sizeof(*ivp);
782 	    uiop->uio_iov = iv = ivp;
783 	    uiop->uio_iovcnt = cnt;
784 	    mp = info.nmi_mrep;
785 	    while (mp) {
786 		if (mp->m_len > 0) {
787 			ivp->iov_base = mtod(mp, caddr_t);
788 			ivp->iov_len = mp->m_len;
789 			ivp++;
790 		}
791 		mp = mp->m_next;
792 	    }
793 
794 	    if (stable == NFSV3WRITE_UNSTABLE)
795 		ioflags = IO_NODELOCKED;
796 	    else if (stable == NFSV3WRITE_DATASYNC)
797 		ioflags = (IO_SYNC | IO_NODELOCKED);
798 	    else
799 		ioflags = (IO_SYNC | IO_NODELOCKED);
800 	    uiop->uio_resid = len;
801 	    uiop->uio_rw = UIO_WRITE;
802 	    uiop->uio_segflg = UIO_SYSSPACE;
803 	    uiop->uio_procp = NULL;
804 	    uiop->uio_offset = off;
805 	    error = VOP_WRITE(vp, uiop, ioflags, cred);
806 	    nfsstats.srvvop_writes++;
807 	    free(iv, M_TEMP, ivlen);
808 	}
809 	aftat_ret = VOP_GETATTR(vp, &va, cred, procp);
810 	vput(vp);
811 	if (!error)
812 		error = aftat_ret;
813 	nfsm_reply(NFSX_PREOPATTR(info.nmi_v3) + NFSX_POSTOPORFATTR(info.nmi_v3) +
814 		2 * NFSX_UNSIGNED + NFSX_WRITEVERF(info.nmi_v3));
815 	if (info.nmi_v3) {
816 		nfsm_srvwcc(nfsd, forat_ret, &forat, aftat_ret, &va, &info);
817 		if (error) {
818 			error = 0;
819 			goto nfsmout;
820 		}
821 		tl = nfsm_build(&info.nmi_mb, 4 * NFSX_UNSIGNED);
822 		*tl++ = txdr_unsigned(retlen);
823 		if (stable == NFSV3WRITE_UNSTABLE)
824 			*tl++ = txdr_unsigned(stable);
825 		else
826 			*tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
827 		/*
828 		 * Actually, there is no need to txdr these fields,
829 		 * but it may make the values more human readable,
830 		 * for debugging purposes.
831 		 */
832 		*tl++ = txdr_unsigned(boottime.tv_sec);
833 		*tl = txdr_unsigned(boottime.tv_nsec/1000);
834 	} else {
835 		fp = nfsm_build(&info.nmi_mb, NFSX_V2FATTR);
836 		nfsm_srvfattr(nfsd, &va, fp);
837 	}
838 nfsmout:
839 	return(error);
840 
841 vbad:
842 	vput(vp);
843 bad:
844 	nfsm_reply(0);
845 	nfsm_srvwcc(nfsd, forat_ret, &forat, aftat_ret, &va, &info);
846 	return (0);
847 }
848 
849 /*
850  * nfs create service
851  * now does a truncate to 0 length via. setattr if it already exists
852  */
853 int
854 nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
855     struct proc *procp, struct mbuf **mrq)
856 {
857 	struct mbuf *nam = nfsd->nd_nam;
858 	struct ucred *cred = &nfsd->nd_cr;
859 	struct nfs_fattr *fp;
860 	struct vattr va, dirfor, diraft;
861 	struct nfsv2_sattr *sp;
862 	struct nfsm_info	info;
863 	u_int32_t *tl;
864 	struct nameidata nd;
865 	caddr_t cp;
866 	int32_t t1;
867 	int error = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
868 	dev_t rdev = 0;
869 	int how, exclusive_flag = 0;
870 	char *cp2;
871 	struct vnode *vp = NULL, *dirp = NULL;
872 	nfsfh_t nfh;
873 	fhandle_t *fhp;
874 	u_quad_t tempsize;
875 	u_char cverf[NFSX_V3CREATEVERF];
876 
877 	info.nmi_mreq = NULL;
878 	info.nmi_mrep = nfsd->nd_mrep;
879 	info.nmi_md = nfsd->nd_md;
880 	info.nmi_dpos = nfsd->nd_dpos;
881 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
882 
883 	fhp = &nfh.fh_generic;
884 	nfsm_srvmtofh(fhp);
885 	nfsm_srvnamesiz(len);
886 
887 	NDINIT(&nd, CREATE, LOCKPARENT | LOCKLEAF | SAVESTART, UIO_SYSSPACE,
888 	    NULL, procp);
889 	nd.ni_cnd.cn_cred = cred;
890 	error = nfs_namei(&nd, fhp, len, slp, nam, &info.nmi_md,
891 	    &info.nmi_dpos, &dirp, procp);
892 	if (dirp) {
893 		if (info.nmi_v3)
894 			dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred, procp);
895 		else {
896 			vrele(dirp);
897 			dirp = NULL;
898 		}
899 	}
900 	if (error) {
901 		nfsm_reply(NFSX_WCCDATA(info.nmi_v3));
902 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
903 		    &info);
904 		if (dirp)
905 			vrele(dirp);
906 		return (0);
907 	}
908 
909 	VATTR_NULL(&va);
910 	if (info.nmi_v3) {
911 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
912 		how = fxdr_unsigned(int, *tl);
913 		switch (how) {
914 		case NFSV3CREATE_GUARDED:
915 			if (nd.ni_vp) {
916 				error = EEXIST;
917 				break;
918 			}
919 		case NFSV3CREATE_UNCHECKED:
920 			error = nfsm_srvsattr(&info.nmi_md, &va, info.nmi_mrep,
921 			    &info.nmi_dpos);
922 			if (error)
923 				goto nfsmout;
924 			break;
925 		case NFSV3CREATE_EXCLUSIVE:
926 			nfsm_dissect(cp, caddr_t, NFSX_V3CREATEVERF);
927 			bcopy(cp, cverf, NFSX_V3CREATEVERF);
928 			exclusive_flag = 1;
929 			if (nd.ni_vp == NULL)
930 				va.va_mode = 0;
931 			break;
932 		};
933 		va.va_type = VREG;
934 	} else {
935 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
936 		va.va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
937 		if (va.va_type == VNON)
938 			va.va_type = VREG;
939 		va.va_mode = nfstov_mode(sp->sa_mode);
940 		switch (va.va_type) {
941 		case VREG:
942 			tsize = fxdr_unsigned(int32_t, sp->sa_size);
943 			if (tsize != -1)
944 				va.va_size = (u_quad_t)tsize;
945 			break;
946 		case VCHR:
947 		case VBLK:
948 		case VFIFO:
949 			rdev = (dev_t)fxdr_unsigned(int32_t, sp->sa_size);
950 			break;
951 		default:
952 			break;
953 		};
954 	}
955 
956 	/*
957 	 * Iff doesn't exist, create it
958 	 * otherwise just truncate to 0 length
959 	 *   should I set the mode too ??
960 	 */
961 	if (nd.ni_vp == NULL) {
962 		if (va.va_type == VREG || va.va_type == VSOCK) {
963 			vrele(nd.ni_startdir);
964 			error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
965 			if (!error) {
966 				pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
967 				if (exclusive_flag) {
968 					exclusive_flag = 0;
969 					VATTR_NULL(&va);
970 					bcopy(cverf, (caddr_t)&va.va_atime,
971 						NFSX_V3CREATEVERF);
972 					error = VOP_SETATTR(nd.ni_vp, &va, cred,
973 						procp);
974 				}
975 			}
976 		} else if (va.va_type == VCHR || va.va_type == VBLK ||
977 			va.va_type == VFIFO) {
978 			if (va.va_type == VCHR && rdev == 0xffffffff)
979 				va.va_type = VFIFO;
980 			if (va.va_type != VFIFO &&
981 			    (error = suser_ucred(cred))) {
982 				vrele(nd.ni_startdir);
983 				if (nd.ni_cnd.cn_flags & HASBUF) {
984 					pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
985 					nd.ni_cnd.cn_flags &= ~HASBUF;
986 				}
987 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
988 				vput(nd.ni_dvp);
989 				nfsm_reply(0);
990 				error = 0;
991 				goto nfsmout;
992 			} else
993 				va.va_rdev = (dev_t)rdev;
994 			error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd,
995 			    &va);
996 			if (error) {
997 				vrele(nd.ni_startdir);
998 				if (nd.ni_cnd.cn_flags & HASBUF) {
999 					pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1000 					nd.ni_cnd.cn_flags &= ~HASBUF;
1001 				}
1002 				nfsm_reply(0);
1003 				error = 0;
1004 				goto nfsmout;
1005 			}
1006 			nd.ni_cnd.cn_nameiop = LOOKUP;
1007 			nd.ni_cnd.cn_flags &= ~(LOCKPARENT | SAVESTART);
1008 			nd.ni_cnd.cn_proc = procp;
1009 			nd.ni_cnd.cn_cred = cred;
1010 			if ((error = vfs_lookup(&nd)) != 0) {
1011 				if (nd.ni_cnd.cn_flags & HASBUF) {
1012 					pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1013 					nd.ni_cnd.cn_flags &= ~HASBUF;
1014 				}
1015 				nfsm_reply(0);
1016 				error = 0;
1017 				goto nfsmout;
1018 			}
1019 
1020 			pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1021 			if (nd.ni_cnd.cn_flags & ISSYMLINK) {
1022 				vrele(nd.ni_dvp);
1023 				vput(nd.ni_vp);
1024 				VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1025 				error = EINVAL;
1026 				nfsm_reply(0);
1027 				error = 0;
1028 				goto nfsmout;
1029 			}
1030 		} else {
1031 			vrele(nd.ni_startdir);
1032 			pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1033 			nd.ni_cnd.cn_flags &= ~HASBUF;
1034 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1035 			vput(nd.ni_dvp);
1036 			error = ENXIO;
1037 		}
1038 		vp = nd.ni_vp;
1039 	} else {
1040 		vrele(nd.ni_startdir);
1041 		pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1042 		nd.ni_cnd.cn_flags &= ~HASBUF;
1043 		vp = nd.ni_vp;
1044 		if (nd.ni_dvp == vp)
1045 			vrele(nd.ni_dvp);
1046 		else
1047 			vput(nd.ni_dvp);
1048 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1049 		if (va.va_size != -1) {
1050 			error = nfsrv_access(vp, VWRITE, cred,
1051 			    (nd.ni_cnd.cn_flags & RDONLY), procp, 0);
1052 			if (!error) {
1053 				tempsize = va.va_size;
1054 				VATTR_NULL(&va);
1055 				va.va_size = tempsize;
1056 				error = VOP_SETATTR(vp, &va, cred,
1057 					 procp);
1058 			}
1059 			if (error)
1060 				vput(vp);
1061 		}
1062 	}
1063 	if (!error) {
1064 		memset(fhp, 0, sizeof(nfh));
1065 		fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
1066 		error = VFS_VPTOFH(vp, &fhp->fh_fid);
1067 		if (!error)
1068 			error = VOP_GETATTR(vp, &va, cred, procp);
1069 		vput(vp);
1070 	}
1071 	if (info.nmi_v3) {
1072 		if (exclusive_flag && !error &&
1073 			bcmp(cverf, (caddr_t)&va.va_atime, NFSX_V3CREATEVERF))
1074 			error = EEXIST;
1075 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred, procp);
1076 		vrele(dirp);
1077 	}
1078 	nfsm_reply(NFSX_SRVFH(info.nmi_v3) + NFSX_FATTR(info.nmi_v3)
1079 	    + NFSX_WCCDATA(info.nmi_v3));
1080 	if (info.nmi_v3) {
1081 		if (!error) {
1082 			nfsm_srvpostop_fh(fhp);
1083 			nfsm_srvpostop_attr(nfsd, 0, &va, &info);
1084 		}
1085 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1086 		    &info);
1087 	} else {
1088 		nfsm_srvfhtom(&info.nmi_mb, fhp, info.nmi_v3);
1089 		fp = nfsm_build(&info.nmi_mb, NFSX_V2FATTR);
1090 		nfsm_srvfattr(nfsd, &va, fp);
1091 	}
1092 	return (0);
1093 nfsmout:
1094 	if (dirp)
1095 		vrele(dirp);
1096 	if (nd.ni_cnd.cn_nameiop != LOOKUP) {
1097 		vrele(nd.ni_startdir);
1098 		if (nd.ni_cnd.cn_flags & HASBUF) {
1099 			pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1100 			nd.ni_cnd.cn_flags &= ~HASBUF;
1101 		}
1102 	}
1103 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1104 	if (nd.ni_dvp == nd.ni_vp)
1105 		vrele(nd.ni_dvp);
1106 	else
1107 		vput(nd.ni_dvp);
1108 	if (nd.ni_vp)
1109 		vput(nd.ni_vp);
1110 	return (error);
1111 }
1112 
1113 /*
1114  * nfs v3 mknod service
1115  */
1116 int
1117 nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1118     struct proc *procp, struct mbuf **mrq)
1119 {
1120 	struct mbuf *nam = nfsd->nd_nam;
1121 	struct ucred *cred = &nfsd->nd_cr;
1122 	struct vattr va, dirfor, diraft;
1123 	struct nfsm_info	info;
1124 	u_int32_t *tl;
1125 	struct nameidata nd;
1126 	int32_t t1;
1127 	int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
1128 	u_int32_t major, minor;
1129 	enum vtype vtyp;
1130 	char *cp2;
1131 	struct vnode *vp, *dirp = NULL;
1132 	nfsfh_t nfh;
1133 	fhandle_t *fhp;
1134 
1135 	info.nmi_mreq = NULL;
1136 	info.nmi_mrep = nfsd->nd_mrep;
1137 	info.nmi_md = nfsd->nd_md;
1138 	info.nmi_dpos = nfsd->nd_dpos;
1139 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
1140 
1141 	fhp = &nfh.fh_generic;
1142 	nfsm_srvmtofh(fhp);
1143 	nfsm_srvnamesiz(len);
1144 
1145 	NDINIT(&nd, CREATE, LOCKPARENT | LOCKLEAF | SAVESTART, UIO_SYSSPACE,
1146 	    NULL, procp);
1147 	nd.ni_cnd.cn_cred = cred;
1148 	error = nfs_namei(&nd, fhp, len, slp, nam, &info.nmi_md, &info.nmi_dpos, &dirp, procp);
1149 	if (dirp)
1150 		dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred, procp);
1151 	if (error) {
1152 		nfsm_reply(NFSX_WCCDATA(1));
1153 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1154 		    &info);
1155 		if (dirp)
1156 			vrele(dirp);
1157 		return (0);
1158 	}
1159 
1160 	nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1161 	vtyp = nfsv3tov_type(*tl);
1162 	if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1163 		vrele(nd.ni_startdir);
1164 		pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1165 		error = NFSERR_BADTYPE;
1166 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1167 		if (nd.ni_dvp == nd.ni_vp)
1168 			vrele(nd.ni_dvp);
1169 		else
1170 			vput(nd.ni_dvp);
1171 		if (nd.ni_vp)
1172 			vput(nd.ni_vp);
1173 		goto out;
1174 	}
1175 	VATTR_NULL(&va);
1176 	error = nfsm_srvsattr(&info.nmi_md, &va, info.nmi_mrep, &info.nmi_dpos);
1177 	if (error)
1178 		goto nfsmout;
1179 	if (vtyp == VCHR || vtyp == VBLK) {
1180 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1181 		major = fxdr_unsigned(u_int32_t, *tl++);
1182 		minor = fxdr_unsigned(u_int32_t, *tl);
1183 		va.va_rdev = makedev(major, minor);
1184 	}
1185 
1186 	/*
1187 	 * Iff doesn't exist, create it.
1188 	 */
1189 	if (nd.ni_vp) {
1190 		vrele(nd.ni_startdir);
1191 		pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1192 		error = EEXIST;
1193 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1194 		if (nd.ni_dvp == nd.ni_vp)
1195 			vrele(nd.ni_dvp);
1196 		else
1197 			vput(nd.ni_dvp);
1198 		vput(nd.ni_vp);
1199 		goto out;
1200 	}
1201 	va.va_type = vtyp;
1202 	if (vtyp == VSOCK) {
1203 		vrele(nd.ni_startdir);
1204 		error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1205 		if (!error)
1206 			pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1207 	} else {
1208 		if (va.va_type != VFIFO &&
1209 		    (error = suser_ucred(cred))) {
1210 			vrele(nd.ni_startdir);
1211 			pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1212 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1213 			vput(nd.ni_dvp);
1214 			goto out;
1215 		}
1216 		error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1217 		if (error) {
1218 			vrele(nd.ni_startdir);
1219 			goto out;
1220 		}
1221 		nd.ni_cnd.cn_nameiop = LOOKUP;
1222 		nd.ni_cnd.cn_flags &= ~(LOCKPARENT | SAVESTART);
1223 		nd.ni_cnd.cn_proc = procp;
1224 		nd.ni_cnd.cn_cred = procp->p_ucred;
1225 		error = vfs_lookup(&nd);
1226 		pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1227 		if (error)
1228 			goto out;
1229 		if (nd.ni_cnd.cn_flags & ISSYMLINK) {
1230 			vrele(nd.ni_dvp);
1231 			vput(nd.ni_vp);
1232 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1233 			error = EINVAL;
1234 		}
1235 	}
1236 out:
1237 	vp = nd.ni_vp;
1238 	if (!error) {
1239 		memset(fhp, 0, sizeof(nfh));
1240 		fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
1241 		error = VFS_VPTOFH(vp, &fhp->fh_fid);
1242 		if (!error)
1243 			error = VOP_GETATTR(vp, &va, cred, procp);
1244 		vput(vp);
1245 	}
1246 	diraft_ret = VOP_GETATTR(dirp, &diraft, cred, procp);
1247 	vrele(dirp);
1248 	nfsm_reply(NFSX_SRVFH(1) + NFSX_POSTOPATTR(1) + NFSX_WCCDATA(1));
1249 	if (!error) {
1250 		nfsm_srvpostop_fh(fhp);
1251 		nfsm_srvpostop_attr(nfsd, 0, &va, &info);
1252 	}
1253 	nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft, &info);
1254 	return (0);
1255 nfsmout:
1256 	if (dirp)
1257 		vrele(dirp);
1258 	if (nd.ni_cnd.cn_nameiop) {
1259 		vrele(nd.ni_startdir);
1260 		pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1261 	}
1262 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1263 	if (nd.ni_dvp == nd.ni_vp)
1264 		vrele(nd.ni_dvp);
1265 	else
1266 		vput(nd.ni_dvp);
1267 	if (nd.ni_vp)
1268 		vput(nd.ni_vp);
1269 	return (error);
1270 }
1271 
1272 /*
1273  * nfs remove service
1274  */
1275 int
1276 nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1277     struct proc *procp, struct mbuf **mrq)
1278 {
1279 	struct mbuf *nam = nfsd->nd_nam;
1280 	struct ucred *cred = &nfsd->nd_cr;
1281 	struct nameidata nd;
1282 	struct nfsm_info	info;
1283 	u_int32_t *tl;
1284 	int32_t t1;
1285 	int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
1286 	char *cp2;
1287 	struct vnode *vp, *dirp;
1288 	struct vattr dirfor, diraft;
1289 	nfsfh_t nfh;
1290 	fhandle_t *fhp;
1291 
1292 	info.nmi_mreq = NULL;
1293 	info.nmi_mrep = nfsd->nd_mrep;
1294 	info.nmi_md = nfsd->nd_md;
1295 	info.nmi_dpos = nfsd->nd_dpos;
1296 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
1297 
1298 	vp = NULL;
1299 
1300 	fhp = &nfh.fh_generic;
1301 	nfsm_srvmtofh(fhp);
1302 	nfsm_srvnamesiz(len);
1303 
1304  	NDINIT(&nd, DELETE, LOCKPARENT | LOCKLEAF, UIO_SYSSPACE, NULL, procp);
1305 	nd.ni_cnd.cn_cred = cred;
1306 	error = nfs_namei(&nd, fhp, len, slp, nam, &info.nmi_md, &info.nmi_dpos, &dirp, procp);
1307 	if (dirp) {
1308 		if (info.nmi_v3)
1309 			dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred, procp);
1310 		else {
1311 			vrele(dirp);
1312 			dirp = NULL;
1313 		}
1314 	}
1315 
1316 	if (!error) {
1317 		vp = nd.ni_vp;
1318 		if (vp->v_type == VDIR &&
1319 		    (error = suser_ucred(cred)) != 0)
1320 			goto out;
1321 		/*
1322 		 * The root of a mounted filesystem cannot be deleted.
1323 		 */
1324 		if (vp->v_flag & VROOT) {
1325 			error = EBUSY;
1326 			goto out;
1327 		}
1328 		if (vp->v_flag & VTEXT)
1329 			uvm_vnp_uncache(vp);
1330 out:
1331 		if (!error) {
1332 			error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1333 		} else {
1334 			VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1335 			if (nd.ni_dvp == vp)
1336 				vrele(nd.ni_dvp);
1337 			else
1338 				vput(nd.ni_dvp);
1339 			vput(vp);
1340 		}
1341 	}
1342 	if (dirp && info.nmi_v3) {
1343 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred, procp);
1344 		vrele(dirp);
1345 	}
1346 	nfsm_reply(NFSX_WCCDATA(info.nmi_v3));
1347 	if (info.nmi_v3) {
1348 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1349 		    &info);
1350 		return (0);
1351 	}
1352 
1353 nfsmout:
1354 	return(error);
1355 }
1356 
1357 /*
1358  * nfs rename service
1359  */
1360 int
1361 nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1362     struct proc *procp, struct mbuf **mrq)
1363 {
1364 	struct mbuf *nam = nfsd->nd_nam;
1365 	struct ucred *cred = &nfsd->nd_cr;
1366 	struct nfsm_info	info;
1367 	u_int32_t *tl;
1368 	int32_t t1;
1369 	int error = 0, len, len2, fdirfor_ret = 1, fdiraft_ret = 1;
1370 	int tdirfor_ret = 1, tdiraft_ret = 1;
1371 	char *cp2;
1372 	struct nameidata fromnd, tond;
1373 	struct vnode *fvp = NULL, *tvp, *tdvp, *fdirp = NULL;
1374 	struct vnode *tdirp = NULL;
1375 	struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
1376 	nfsfh_t fnfh, tnfh;
1377 	fhandle_t *ffhp, *tfhp;
1378 	uid_t saved_uid;
1379 
1380 	info.nmi_mreq = NULL;
1381 	info.nmi_mrep = nfsd->nd_mrep;
1382 	info.nmi_md = nfsd->nd_md;
1383 	info.nmi_dpos = nfsd->nd_dpos;
1384 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
1385 
1386 	ffhp = &fnfh.fh_generic;
1387 	tfhp = &tnfh.fh_generic;
1388 	nfsm_srvmtofh(ffhp);
1389 	nfsm_srvnamesiz(len);
1390 
1391 	/*
1392 	 * Remember our original uid so that we can reset cr_uid before
1393 	 * the second nfs_namei() call, in case it is remapped.
1394 	 */
1395 	saved_uid = cred->cr_uid;
1396 
1397 	NDINIT(&fromnd, DELETE, WANTPARENT | SAVESTART, UIO_SYSSPACE, NULL,
1398 	    procp);
1399 	fromnd.ni_cnd.cn_cred = cred;
1400 	error = nfs_namei(&fromnd, ffhp, len, slp, nam, &info.nmi_md,
1401 	    &info.nmi_dpos, &fdirp, procp);
1402 	if (fdirp) {
1403 		if (info.nmi_v3)
1404 			fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor, cred,
1405 				procp);
1406 		else {
1407 			vrele(fdirp);
1408 			fdirp = NULL;
1409 		}
1410 	}
1411 	if (error) {
1412 		nfsm_reply(2 * NFSX_WCCDATA(info.nmi_v3));
1413 		nfsm_srvwcc(nfsd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft,
1414 		    &info);
1415 		nfsm_srvwcc(nfsd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft,
1416 		    &info);
1417 		if (fdirp)
1418 			vrele(fdirp);
1419 		return (0);
1420 	}
1421 
1422 	fvp = fromnd.ni_vp;
1423 	nfsm_srvmtofh(tfhp);
1424 	nfsm_strsiz(len2, NFS_MAXNAMLEN);
1425 	cred->cr_uid = saved_uid;
1426 
1427 	NDINIT(&tond, RENAME, LOCKPARENT | LOCKLEAF| NOCACHE | SAVESTART,
1428 	    UIO_SYSSPACE, NULL, procp);
1429 	tond.ni_cnd.cn_cred = cred;
1430 	error = nfs_namei(&tond, tfhp, len2, slp, nam, &info.nmi_md,
1431 	    &info.nmi_dpos, &tdirp, procp);
1432 	if (tdirp) {
1433 		if (info.nmi_v3)
1434 			tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor, cred,
1435 				procp);
1436 		else {
1437 			vrele(tdirp);
1438 			tdirp = NULL;
1439 		}
1440 	}
1441 	if (error) {
1442 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1443 		vrele(fromnd.ni_dvp);
1444 		vrele(fvp);
1445 		goto out1;
1446 	}
1447 	tdvp = tond.ni_dvp;
1448 	tvp = tond.ni_vp;
1449 	if (tvp != NULL) {
1450 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
1451 			error = info.nmi_v3 ? EEXIST : EISDIR;
1452 			goto out;
1453 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
1454 			error = info.nmi_v3 ? EEXIST : ENOTDIR;
1455 			goto out;
1456 		}
1457 		if (tvp->v_type == VDIR && tvp->v_mountedhere) {
1458 			error = info.nmi_v3 ? EXDEV : ENOTEMPTY;
1459 			goto out;
1460 		}
1461 	}
1462 	if (fvp->v_type == VDIR && fvp->v_mountedhere) {
1463 		error = info.nmi_v3 ? EXDEV : ENOTEMPTY;
1464 		goto out;
1465 	}
1466 	if (fvp->v_mount != tdvp->v_mount) {
1467 		error = info.nmi_v3 ? EXDEV : ENOTEMPTY;
1468 		goto out;
1469 	}
1470 	if (fvp == tdvp)
1471 		error = info.nmi_v3 ? EINVAL : ENOTEMPTY;
1472 	/*
1473 	 * If source is the same as the destination (that is the
1474 	 * same vnode with the same name in the same directory),
1475 	 * then there is nothing to do.
1476 	 */
1477 	if (fvp == tvp && fromnd.ni_dvp == tdvp &&
1478 	    fromnd.ni_cnd.cn_namelen == tond.ni_cnd.cn_namelen &&
1479 	    !bcmp(fromnd.ni_cnd.cn_nameptr, tond.ni_cnd.cn_nameptr,
1480 	      fromnd.ni_cnd.cn_namelen))
1481 		error = -1;
1482 out:
1483 	if (!error) {
1484 		error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
1485 				   tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
1486 	} else {
1487 		VOP_ABORTOP(tond.ni_dvp, &tond.ni_cnd);
1488 		if (tdvp == tvp)
1489 			vrele(tdvp);
1490 		else
1491 			vput(tdvp);
1492 		if (tvp)
1493 			vput(tvp);
1494 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1495 		vrele(fromnd.ni_dvp);
1496 		vrele(fvp);
1497 		if (error == -1)
1498 			error = 0;
1499 	}
1500 	vrele(tond.ni_startdir);
1501 	pool_put(&namei_pool, tond.ni_cnd.cn_pnbuf);
1502 out1:
1503 	if (fdirp) {
1504 		fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred, procp);
1505 		vrele(fdirp);
1506 	}
1507 	if (tdirp) {
1508 		tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred, procp);
1509 		vrele(tdirp);
1510 	}
1511 	vrele(fromnd.ni_startdir);
1512 	pool_put(&namei_pool, fromnd.ni_cnd.cn_pnbuf);
1513 	nfsm_reply(2 * NFSX_WCCDATA(info.nmi_v3));
1514 	if (info.nmi_v3) {
1515 		nfsm_srvwcc(nfsd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft,
1516 		    &info);
1517 		nfsm_srvwcc(nfsd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft,
1518 		    &info);
1519 	}
1520 	return (0);
1521 
1522 nfsmout:
1523 	if (fdirp)
1524 		vrele(fdirp);
1525 	if (tdirp)
1526 		vrele(tdirp);
1527 	if (tond.ni_cnd.cn_nameiop) {
1528 		vrele(tond.ni_startdir);
1529 		pool_put(&namei_pool, tond.ni_cnd.cn_pnbuf);
1530 	}
1531 	if (fromnd.ni_cnd.cn_nameiop) {
1532 		if (fromnd.ni_startdir)
1533 			vrele(fromnd.ni_startdir);
1534 		VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1535 
1536 		/*
1537 		 * XXX: Workaround the fact that fromnd.ni_dvp can point
1538 		 * to the same vnode as fdirp.
1539 		 */
1540 		if (fromnd.ni_dvp != NULL && fromnd.ni_dvp != fdirp)
1541 			vrele(fromnd.ni_dvp);
1542 		if (fvp)
1543 			vrele(fvp);
1544 	}
1545 	return (error);
1546 }
1547 
1548 /*
1549  * nfs link service
1550  */
1551 int
1552 nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1553     struct proc *procp, struct mbuf **mrq)
1554 {
1555 	struct mbuf *nam = nfsd->nd_nam;
1556 	struct nfsm_info	info;
1557 	struct ucred *cred = &nfsd->nd_cr;
1558 	struct nameidata nd;
1559 	u_int32_t *tl;
1560 	int32_t t1;
1561 	int error = 0, rdonly, len, dirfor_ret = 1, diraft_ret = 1;
1562 	int getret = 1;
1563 	char *cp2;
1564 	struct vnode *vp, *xp, *dirp = NULL;
1565 	struct vattr dirfor, diraft, at;
1566 	nfsfh_t nfh, dnfh;
1567 	fhandle_t *fhp, *dfhp;
1568 
1569 	info.nmi_mreq = NULL;
1570 	info.nmi_mrep = nfsd->nd_mrep;
1571 	info.nmi_md = nfsd->nd_md;
1572 	info.nmi_dpos = nfsd->nd_dpos;
1573 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
1574 
1575 	fhp = &nfh.fh_generic;
1576 	dfhp = &dnfh.fh_generic;
1577 	nfsm_srvmtofh(fhp);
1578 	nfsm_srvmtofh(dfhp);
1579 	nfsm_srvnamesiz(len);
1580 
1581 	error = nfsrv_fhtovp(fhp, 0, &vp, cred, slp, nam, &rdonly);
1582 	if (error) {
1583 		nfsm_reply(NFSX_POSTOPATTR(info.nmi_v3) +
1584 		    NFSX_WCCDATA(info.nmi_v3));
1585 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
1586 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1587 		    &info);
1588 		error = 0;
1589 		goto nfsmout;
1590 	}
1591 	if (vp->v_type == VDIR && (error = suser_ucred(cred)) != 0)
1592 		goto out1;
1593 
1594 	NDINIT(&nd, CREATE, LOCKPARENT, UIO_SYSSPACE, NULL, procp);
1595 	nd.ni_cnd.cn_cred = cred;
1596 	error = nfs_namei(&nd, dfhp, len, slp, nam, &info.nmi_md,
1597 	    &info.nmi_dpos, &dirp, procp);
1598 	if (dirp) {
1599 		if (info.nmi_v3)
1600 			dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred,
1601 				procp);
1602 		else {
1603 			vrele(dirp);
1604 			dirp = NULL;
1605 		}
1606 	}
1607 	if (error)
1608 		goto out1;
1609 	xp = nd.ni_vp;
1610 	if (xp != NULL) {
1611 		error = EEXIST;
1612 		goto out;
1613 	}
1614 	xp = nd.ni_dvp;
1615 	if (vp->v_mount != xp->v_mount)
1616 		error = EXDEV;
1617 out:
1618 	if (!error) {
1619 		error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
1620 	} else {
1621 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1622 		if (nd.ni_dvp == nd.ni_vp)
1623 			vrele(nd.ni_dvp);
1624 		else
1625 			vput(nd.ni_dvp);
1626 		if (nd.ni_vp)
1627 			vrele(nd.ni_vp);
1628 	}
1629 out1:
1630 	if (info.nmi_v3)
1631 		getret = VOP_GETATTR(vp, &at, cred, procp);
1632 	if (dirp) {
1633 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred, procp);
1634 		vrele(dirp);
1635 	}
1636 	vrele(vp);
1637 	nfsm_reply(NFSX_POSTOPATTR(info.nmi_v3) + NFSX_WCCDATA(info.nmi_v3));
1638 	if (info.nmi_v3) {
1639 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
1640 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1641 		     &info);
1642 		error = 0;
1643 	}
1644 nfsmout:
1645 	return(error);
1646 }
1647 
1648 /*
1649  * nfs symbolic link service
1650  */
1651 int
1652 nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1653     struct proc *procp, struct mbuf **mrq)
1654 {
1655 	struct mbuf *nam = nfsd->nd_nam;
1656 	struct ucred *cred = &nfsd->nd_cr;
1657 	struct vattr va, dirfor, diraft;
1658 	struct nameidata nd;
1659 	struct nfsm_info	info;
1660 	u_int32_t *tl;
1661 	int32_t t1;
1662 	struct nfsv2_sattr *sp;
1663 	char *pathcp = NULL, *cp2;
1664 	struct uio io;
1665 	struct iovec iv;
1666 	int error = 0, len, pathlen, len2, dirfor_ret = 1, diraft_ret = 1;
1667 	struct vnode *dirp = NULL;
1668 	nfsfh_t nfh;
1669 	fhandle_t *fhp;
1670 
1671 	info.nmi_mreq = NULL;
1672 	info.nmi_mrep = nfsd->nd_mrep;
1673 	info.nmi_md = nfsd->nd_md;
1674 	info.nmi_dpos = nfsd->nd_dpos;
1675 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
1676 
1677 	fhp = &nfh.fh_generic;
1678 	nfsm_srvmtofh(fhp);
1679 	nfsm_srvnamesiz(len);
1680 
1681 	NDINIT(&nd, CREATE, LOCKPARENT | SAVESTART, UIO_SYSSPACE, NULL, procp);
1682 	nd.ni_cnd.cn_cred = cred;
1683 	error = nfs_namei(&nd, fhp, len, slp, nam, &info.nmi_md,
1684 	    &info.nmi_dpos, &dirp, procp);
1685 	if (dirp) {
1686 		if (info.nmi_v3)
1687 			dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred,
1688 				procp);
1689 		else {
1690 			vrele(dirp);
1691 			dirp = NULL;
1692 		}
1693 	}
1694 	if (error)
1695 		goto out;
1696 	VATTR_NULL(&va);
1697 	if (info.nmi_v3) {
1698 		error = nfsm_srvsattr(&info.nmi_md, &va, info.nmi_mrep,
1699 		    &info.nmi_dpos);
1700 		if (error)
1701 			goto nfsmout;
1702 	}
1703 	nfsm_strsiz(len2, NFS_MAXPATHLEN);
1704 	pathlen = len2 + 1;
1705 	pathcp = malloc(pathlen, M_TEMP, M_WAITOK);
1706 	iv.iov_base = pathcp;
1707 	iv.iov_len = len2;
1708 	io.uio_resid = len2;
1709 	io.uio_offset = 0;
1710 	io.uio_iov = &iv;
1711 	io.uio_iovcnt = 1;
1712 	io.uio_segflg = UIO_SYSSPACE;
1713 	io.uio_rw = UIO_READ;
1714 	io.uio_procp = NULL;
1715 	nfsm_mtouio(&io, len2);
1716 	if (!info.nmi_v3) {
1717 		nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1718 		va.va_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
1719 	}
1720 	*(pathcp + len2) = '\0';
1721 	if (nd.ni_vp) {
1722 		vrele(nd.ni_startdir);
1723 		pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1724 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1725 		if (nd.ni_dvp == nd.ni_vp)
1726 			vrele(nd.ni_dvp);
1727 		else
1728 			vput(nd.ni_dvp);
1729 		vrele(nd.ni_vp);
1730 		error = EEXIST;
1731 		goto out;
1732 	}
1733 	error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va, pathcp);
1734 	if (error)
1735 		vrele(nd.ni_startdir);
1736 	else {
1737 		if (info.nmi_v3) {
1738 			nd.ni_cnd.cn_nameiop = LOOKUP;
1739 			nd.ni_cnd.cn_flags &= ~(LOCKPARENT | SAVESTART |
1740 			    FOLLOW);
1741 			nd.ni_cnd.cn_flags |= (NOFOLLOW | LOCKLEAF);
1742 			nd.ni_cnd.cn_proc = procp;
1743 			nd.ni_cnd.cn_cred = cred;
1744 			error = vfs_lookup(&nd);
1745 			if (!error) {
1746 				memset(fhp, 0, sizeof(nfh));
1747 				fhp->fh_fsid =
1748 				    nd.ni_vp->v_mount->mnt_stat.f_fsid;
1749 				error = VFS_VPTOFH(nd.ni_vp, &fhp->fh_fid);
1750 				if (!error)
1751 					error = VOP_GETATTR(nd.ni_vp, &va, cred,
1752 					    procp);
1753 				vput(nd.ni_vp);
1754 			}
1755 		} else
1756 			vrele(nd.ni_startdir);
1757 		pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1758 	}
1759 out:
1760 	if (pathcp)
1761 		free(pathcp, M_TEMP, pathlen);
1762 	if (dirp) {
1763 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred, procp);
1764 		vrele(dirp);
1765 	}
1766 	nfsm_reply(NFSX_SRVFH(info.nmi_v3) + NFSX_POSTOPATTR(info.nmi_v3)
1767 	    + NFSX_WCCDATA(info.nmi_v3));
1768 	if (info.nmi_v3) {
1769 		if (!error) {
1770 			nfsm_srvpostop_fh(fhp);
1771 			nfsm_srvpostop_attr(nfsd, 0, &va, &info);
1772 		}
1773 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1774 		    &info);
1775 	}
1776 	return (0);
1777 nfsmout:
1778 	if (nd.ni_cnd.cn_nameiop) {
1779 		vrele(nd.ni_startdir);
1780 		pool_put(&namei_pool, nd.ni_cnd.cn_pnbuf);
1781 	}
1782 	if (dirp)
1783 		vrele(dirp);
1784 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1785 	if (nd.ni_dvp == nd.ni_vp)
1786 		vrele(nd.ni_dvp);
1787 	else
1788 		vput(nd.ni_dvp);
1789 	if (nd.ni_vp)
1790 		vrele(nd.ni_vp);
1791 	if (pathcp)
1792 		free(pathcp, M_TEMP, pathlen);
1793 	return (error);
1794 }
1795 
1796 /*
1797  * nfs mkdir service
1798  */
1799 int
1800 nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1801     struct proc *procp, struct mbuf **mrq)
1802 {
1803 	struct mbuf *nam = nfsd->nd_nam;
1804 	struct ucred *cred = &nfsd->nd_cr;
1805 	struct vattr va, dirfor, diraft;
1806 	struct nfs_fattr *fp;
1807 	struct nameidata nd;
1808 	struct nfsm_info	info;
1809 	u_int32_t *tl;
1810 	int32_t t1;
1811 	int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
1812 	char *cp2;
1813 	struct vnode *vp, *dirp = NULL;
1814 	nfsfh_t nfh;
1815 	fhandle_t *fhp;
1816 
1817 	info.nmi_mreq = NULL;
1818 	info.nmi_mrep = nfsd->nd_mrep;
1819 	info.nmi_md = nfsd->nd_md;
1820 	info.nmi_dpos = nfsd->nd_dpos;
1821 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
1822 
1823 	fhp = &nfh.fh_generic;
1824 	nfsm_srvmtofh(fhp);
1825 	nfsm_srvnamesiz(len);
1826 
1827 	NDINIT(&nd, CREATE, LOCKPARENT, UIO_SYSSPACE, NULL, procp);
1828 	nd.ni_cnd.cn_cred = cred;
1829 	error = nfs_namei(&nd, fhp, len, slp, nam, &info.nmi_md,
1830 	    &info.nmi_dpos, &dirp, procp);
1831 	if (dirp) {
1832 		if (info.nmi_v3)
1833 			dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred, procp);
1834 		else {
1835 			vrele(dirp);
1836 			dirp = NULL;
1837 		}
1838 	}
1839 	if (error) {
1840 		nfsm_reply(NFSX_WCCDATA(info.nmi_v3));
1841 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1842 		    &info);
1843 		if (dirp)
1844 			vrele(dirp);
1845 		return (0);
1846 	}
1847 
1848 	VATTR_NULL(&va);
1849 	if (info.nmi_v3) {
1850 		error = nfsm_srvsattr(&info.nmi_md, &va, info.nmi_mrep,
1851 		    &info.nmi_dpos);
1852 		if (error)
1853 			goto nfsmout;
1854 	} else {
1855 		nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1856 		va.va_mode = nfstov_mode(*tl++);
1857 	}
1858 	va.va_type = VDIR;
1859 	vp = nd.ni_vp;
1860 	if (vp != NULL) {
1861 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1862 		if (nd.ni_dvp == vp)
1863 			vrele(nd.ni_dvp);
1864 		else
1865 			vput(nd.ni_dvp);
1866 		vrele(vp);
1867 		error = EEXIST;
1868 		goto out;
1869 	}
1870 	error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1871 	if (!error) {
1872 		vp = nd.ni_vp;
1873 		memset(fhp, 0, sizeof(nfh));
1874 		fhp->fh_fsid = vp->v_mount->mnt_stat.f_fsid;
1875 		error = VFS_VPTOFH(vp, &fhp->fh_fid);
1876 		if (!error)
1877 			error = VOP_GETATTR(vp, &va, cred, procp);
1878 		vput(vp);
1879 	}
1880 out:
1881 	if (dirp) {
1882 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred, procp);
1883 		vrele(dirp);
1884 	}
1885 	nfsm_reply(NFSX_SRVFH(info.nmi_v3) + NFSX_POSTOPATTR(info.nmi_v3) +
1886 	    NFSX_WCCDATA(info.nmi_v3));
1887 	if (info.nmi_v3) {
1888 		if (!error) {
1889 			nfsm_srvpostop_fh(fhp);
1890 			nfsm_srvpostop_attr(nfsd, 0, &va, &info);
1891 		}
1892 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1893 		    &info);
1894 	} else {
1895 		nfsm_srvfhtom(&info.nmi_mb, fhp, info.nmi_v3);
1896 		fp = nfsm_build(&info.nmi_mb, NFSX_V2FATTR);
1897 		nfsm_srvfattr(nfsd, &va, fp);
1898 	}
1899 	return (0);
1900 nfsmout:
1901 	if (dirp)
1902 		vrele(dirp);
1903 	VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1904 	if (nd.ni_dvp == nd.ni_vp)
1905 		vrele(nd.ni_dvp);
1906 	else
1907 		vput(nd.ni_dvp);
1908 	if (nd.ni_vp)
1909 		vrele(nd.ni_vp);
1910 	return (error);
1911 }
1912 
1913 /*
1914  * nfs rmdir service
1915  */
1916 int
1917 nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
1918     struct proc *procp, struct mbuf **mrq)
1919 {
1920 	struct mbuf *nam = nfsd->nd_nam;
1921 	struct ucred *cred = &nfsd->nd_cr;
1922 	struct nfsm_info	info;
1923 	u_int32_t *tl;
1924 	int32_t t1;
1925 	int error = 0, len, dirfor_ret = 1, diraft_ret = 1;
1926 	char *cp2;
1927 	struct vnode *vp, *dirp = NULL;
1928 	struct vattr dirfor, diraft;
1929 	nfsfh_t nfh;
1930 	fhandle_t *fhp;
1931 	struct nameidata nd;
1932 
1933 	info.nmi_mreq = NULL;
1934 	info.nmi_mrep = nfsd->nd_mrep;
1935 	info.nmi_md = nfsd->nd_md;
1936 	info.nmi_dpos = nfsd->nd_dpos;
1937 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
1938 
1939 	fhp = &nfh.fh_generic;
1940 	nfsm_srvmtofh(fhp);
1941 	nfsm_srvnamesiz(len);
1942 
1943 	NDINIT(&nd, DELETE, LOCKPARENT | LOCKLEAF, UIO_SYSSPACE, NULL, procp);
1944 	nd.ni_cnd.cn_cred = cred;
1945 	error = nfs_namei(&nd, fhp, len, slp, nam, &info.nmi_md,
1946 	    &info.nmi_dpos, &dirp, procp);
1947 	if (dirp) {
1948 		if (info.nmi_v3)
1949 			dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred,
1950 				procp);
1951 		else {
1952 			vrele(dirp);
1953 			dirp = NULL;
1954 		}
1955 	}
1956 	if (error) {
1957 		nfsm_reply(NFSX_WCCDATA(info.nmi_v3));
1958 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1959 		    &info);
1960 		if (dirp)
1961 			vrele(dirp);
1962 		return (0);
1963 	}
1964 	vp = nd.ni_vp;
1965 	if (vp->v_type != VDIR) {
1966 		error = ENOTDIR;
1967 		goto out;
1968 	}
1969 	/*
1970 	 * No rmdir "." please.
1971 	 */
1972 	if (nd.ni_dvp == vp) {
1973 		error = EINVAL;
1974 		goto out;
1975 	}
1976 	/*
1977 	 * The root of a mounted filesystem cannot be deleted.
1978 	 */
1979 	if (vp->v_flag & VROOT)
1980 		error = EBUSY;
1981 out:
1982 	if (!error) {
1983 		error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1984 	} else {
1985 		VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1986 		if (nd.ni_dvp == nd.ni_vp)
1987 			vrele(nd.ni_dvp);
1988 		else
1989 			vput(nd.ni_dvp);
1990 		vput(vp);
1991 	}
1992 	if (dirp) {
1993 		diraft_ret = VOP_GETATTR(dirp, &diraft, cred, procp);
1994 		vrele(dirp);
1995 	}
1996 	nfsm_reply(NFSX_WCCDATA(info.nmi_v3));
1997 	if (info.nmi_v3) {
1998 		nfsm_srvwcc(nfsd, dirfor_ret, &dirfor, diraft_ret, &diraft,
1999 		    &info);
2000 		error = 0;
2001 	}
2002 nfsmout:
2003 	return(error);
2004 }
2005 
2006 /*
2007  * nfs readdir service
2008  * - mallocs what it thinks is enough to read
2009  *	count rounded up to a multiple of NFS_DIRBLKSIZ <= NFS_MAXREADDIR
2010  * - calls VOP_READDIR()
2011  * - loops around building the reply
2012  *	if the output generated exceeds count break out of loop
2013  * - it only knows that it has encountered eof when the VOP_READDIR()
2014  *	reads nothing
2015  * - as such one readdir rpc will return eof false although you are there
2016  *	and then the next will return eof
2017  * - it trims out records with d_fileno == 0
2018  *	this doesn't matter for Unix clients, but they might confuse clients
2019  *	for other os'.
2020  * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2021  *	than requested, but this may not apply to all filesystems. For
2022  *	example, client NFS does not { although it is never remote mounted
2023  *	anyhow }
2024  *     The alternate call nfsrv_readdirplus() does lookups as well.
2025  * PS: The NFS protocol spec. does not clarify what the "count" byte
2026  *	argument is a count of.. just name strings and file id's or the
2027  *	entire reply rpc or ...
2028  *	I tried just file name and id sizes and it confused the Sun client,
2029  *	so I am using the full rpc size now. The "paranoia.." comment refers
2030  *	to including the status longwords that are not a part of the dir.
2031  *	"entry" structures, but are in the rpc.
2032  */
2033 struct flrep {
2034 	nfsuint64 fl_off;
2035 	u_int32_t fl_postopok;
2036 	u_int32_t fl_fattr[NFSX_V3FATTR / sizeof (u_int32_t)];
2037 	u_int32_t fl_fhok;
2038 	u_int32_t fl_fhsize;
2039 	u_int32_t fl_nfh[NFSX_V3FH / sizeof (u_int32_t)];
2040 };
2041 
2042 int
2043 nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2044     struct proc *procp, struct mbuf **mrq)
2045 {
2046 	struct mbuf *nam = nfsd->nd_nam;
2047 	struct ucred *cred = &nfsd->nd_cr;
2048 	struct dirent *dp;
2049 	struct nfsm_info	info;
2050 	u_int32_t *tl;
2051 	int32_t t1;
2052 	char *cpos, *cend, *cp2, *rbuf;
2053 	struct vnode *vp;
2054 	struct vattr at;
2055 	nfsfh_t nfh;
2056 	fhandle_t *fhp;
2057 	struct uio io;
2058 	struct iovec iv;
2059 	int len, nlen, pad, xfer, error = 0, getret = 1;
2060 	int siz, cnt, fullsiz, eofflag, rdonly;
2061 	u_quad_t off, toff, verf;
2062 
2063 	info.nmi_mreq = NULL;
2064 	info.nmi_mrep = nfsd->nd_mrep;
2065 	info.nmi_md = nfsd->nd_md;
2066 	info.nmi_dpos = nfsd->nd_dpos;
2067 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
2068 
2069 	fhp = &nfh.fh_generic;
2070 	nfsm_srvmtofh(fhp);
2071 	if (info.nmi_v3) {
2072 		nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2073 		toff = fxdr_hyper(tl);
2074 		tl += 2;
2075 		verf = fxdr_hyper(tl);
2076 		tl += 2;
2077 	} else {
2078 		nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2079 		toff = fxdr_unsigned(u_quad_t, *tl++);
2080 	}
2081 	off = toff;
2082 	cnt = fxdr_unsigned(int, *tl);
2083 	siz = ((cnt + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
2084 	xfer = NFS_SRVMAXDATA(nfsd);
2085 	if (siz > xfer)
2086 		siz = xfer;
2087 	if (cnt > xfer)
2088 		cnt = xfer;
2089 	fullsiz = siz;
2090 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
2091 	if (error) {
2092 		nfsm_reply(NFSX_UNSIGNED);
2093 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2094 		error = 0;
2095 		goto nfsmout;
2096 	}
2097 	if (info.nmi_v3)
2098 		error = getret = VOP_GETATTR(vp, &at, cred, procp);
2099 	if (!error)
2100 		error = nfsrv_access(vp, VEXEC, cred, rdonly, procp, 0);
2101 	if (error) {
2102 		vput(vp);
2103 		nfsm_reply(NFSX_POSTOPATTR(info.nmi_v3));
2104 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2105 		error = 0;
2106 		goto nfsmout;
2107 	}
2108 	VOP_UNLOCK(vp);
2109 	rbuf = malloc(fullsiz, M_TEMP, M_WAITOK);
2110 again:
2111 	iv.iov_base = rbuf;
2112 	iv.iov_len = fullsiz;
2113 	io.uio_iov = &iv;
2114 	io.uio_iovcnt = 1;
2115 	io.uio_offset = (off_t)off;
2116 	io.uio_resid = fullsiz;
2117 	io.uio_segflg = UIO_SYSSPACE;
2118 	io.uio_rw = UIO_READ;
2119 	io.uio_procp = NULL;
2120 	eofflag = 0;
2121 
2122 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, procp);
2123 	error = VOP_READDIR(vp, &io, cred, &eofflag);
2124 
2125 	off = (off_t)io.uio_offset;
2126 	if (info.nmi_v3) {
2127 		getret = VOP_GETATTR(vp, &at, cred, procp);
2128 		if (!error)
2129 			error = getret;
2130 	}
2131 
2132 	VOP_UNLOCK(vp);
2133 	if (error) {
2134 		vrele(vp);
2135 		free(rbuf, M_TEMP, fullsiz);
2136 		nfsm_reply(NFSX_POSTOPATTR(info.nmi_v3));
2137 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2138 		error = 0;
2139 		goto nfsmout;
2140 	}
2141 	if (io.uio_resid) {
2142 		siz -= io.uio_resid;
2143 
2144 		/*
2145 		 * If nothing read, return eof
2146 		 * rpc reply
2147 		 */
2148 		if (siz == 0) {
2149 			vrele(vp);
2150 			nfsm_reply(NFSX_POSTOPATTR(info.nmi_v3) + NFSX_COOKIEVERF(info.nmi_v3) +
2151 				2 * NFSX_UNSIGNED);
2152 			if (info.nmi_v3) {
2153 				nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2154 				tl = nfsm_build(&info.nmi_mb, 4 * NFSX_UNSIGNED);
2155 				txdr_hyper(at.va_filerev, tl);
2156 				tl += 2;
2157 			} else
2158 				tl = nfsm_build(&info.nmi_mb, 2 * NFSX_UNSIGNED);
2159 			*tl++ = nfs_false;
2160 			*tl = nfs_true;
2161 			free(rbuf, M_TEMP, fullsiz);
2162 			error = 0;
2163 			goto nfsmout;
2164 		}
2165 	}
2166 
2167 	/*
2168 	 * Check for degenerate cases of nothing useful read.
2169 	 * If so go try again
2170 	 */
2171 	cpos = rbuf;
2172 	cend = rbuf + siz;
2173 	dp = (struct dirent *)cpos;
2174 
2175 	while (cpos < cend && dp->d_fileno == 0) {
2176 		cpos += dp->d_reclen;
2177 		dp = (struct dirent *)cpos;
2178 	}
2179 	if (cpos >= cend) {
2180 		toff = off;
2181 		siz = fullsiz;
2182 		goto again;
2183 	}
2184 
2185 	len = 3 * NFSX_UNSIGNED;	/* paranoia, probably can be 0 */
2186 	nfsm_reply(NFSX_POSTOPATTR(info.nmi_v3) + NFSX_COOKIEVERF(info.nmi_v3) + siz);
2187 	if (info.nmi_v3) {
2188 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2189 		tl = nfsm_build(&info.nmi_mb, 2 * NFSX_UNSIGNED);
2190 		txdr_hyper(at.va_filerev, tl);
2191 	}
2192 
2193 	/* Loop through the records and build reply */
2194 	while (cpos < cend) {
2195 		if (dp->d_fileno != 0) {
2196 			nlen = dp->d_namlen;
2197 			pad = nfsm_padlen(nlen);
2198 			len += (4 * NFSX_UNSIGNED + nlen + pad);
2199 			if (info.nmi_v3)
2200 				len += 2 * NFSX_UNSIGNED;
2201 			if (len > cnt) {
2202 				eofflag = 0;
2203 				break;
2204 			}
2205 			/*
2206 			 * Build the directory record xdr from
2207 			 * the dirent entry.
2208 			 */
2209 			tl = nfsm_build(&info.nmi_mb,
2210 			    (info.nmi_v3 ? 3 : 2) * NFSX_UNSIGNED);
2211 			*tl++ = nfs_true;
2212 			if (info.nmi_v3)
2213 				txdr_hyper(dp->d_fileno, tl);
2214 			else
2215 				*tl = txdr_unsigned((u_int32_t)dp->d_fileno);
2216 
2217 			/* And copy the name */
2218 			nfsm_strtombuf(&info.nmi_mb, dp->d_name, nlen);
2219 
2220 			/* Finish off the record */
2221 			if (info.nmi_v3) {
2222 				tl = nfsm_build(&info.nmi_mb, 2*NFSX_UNSIGNED);
2223 				txdr_hyper(dp->d_off, tl);
2224 			} else {
2225 				tl = nfsm_build(&info.nmi_mb, NFSX_UNSIGNED);
2226 				*tl = txdr_unsigned((u_int32_t)dp->d_off);
2227 			}
2228 		}
2229 		cpos += dp->d_reclen;
2230 		dp = (struct dirent *)cpos;
2231 	}
2232 	vrele(vp);
2233 	tl = nfsm_build(&info.nmi_mb, 2 * NFSX_UNSIGNED);
2234 	*tl++ = nfs_false;
2235 	if (eofflag)
2236 		*tl = nfs_true;
2237 	else
2238 		*tl = nfs_false;
2239 	free(rbuf, M_TEMP, fullsiz);
2240 nfsmout:
2241 	return(error);
2242 }
2243 
2244 int
2245 nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2246     struct proc *procp, struct mbuf **mrq)
2247 {
2248 	struct mbuf *nam = nfsd->nd_nam;
2249 	struct ucred *cred = &nfsd->nd_cr;
2250 	struct dirent *dp;
2251 	struct nfsm_info	info;
2252 	u_int32_t *tl;
2253 	int32_t t1;
2254 	char *cpos, *cend, *cp2, *rbuf;
2255 	struct vnode *vp, *nvp;
2256 	struct flrep fl;
2257 	nfsfh_t nfh;
2258 	fhandle_t *fhp, *nfhp = (fhandle_t *)fl.fl_nfh;
2259 	struct uio io;
2260 	struct iovec iv;
2261 	struct vattr va, at, *vap = &va;
2262 	struct nfs_fattr *fp;
2263 	int len, nlen, pad, xfer, error = 0, getret = 1;
2264 	int siz, cnt, fullsiz, eofflag, rdonly, dirlen;
2265 	u_quad_t off, toff, verf;
2266 
2267 	info.nmi_mreq = NULL;
2268 	info.nmi_mrep = nfsd->nd_mrep;
2269 	info.nmi_md = nfsd->nd_md;
2270 	info.nmi_dpos = nfsd->nd_dpos;
2271 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
2272 
2273 	fhp = &nfh.fh_generic;
2274 	nfsm_srvmtofh(fhp);
2275 	nfsm_dissect(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2276 	toff = fxdr_hyper(tl);
2277 	tl += 2;
2278 	verf = fxdr_hyper(tl);
2279 	tl += 2;
2280 	siz = fxdr_unsigned(int, *tl++);
2281 	cnt = fxdr_unsigned(int, *tl);
2282 	off = toff;
2283 	siz = ((siz + DIRBLKSIZ - 1) & ~(DIRBLKSIZ - 1));
2284 	xfer = NFS_SRVMAXDATA(nfsd);
2285 	if (siz > xfer)
2286 		siz = xfer;
2287 	if (cnt > xfer)
2288 		cnt = xfer;
2289 	fullsiz = siz;
2290 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
2291 	if (error) {
2292 		nfsm_reply(NFSX_UNSIGNED);
2293 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2294 		error = 0;
2295 		goto nfsmout;
2296 	}
2297 	error = getret = VOP_GETATTR(vp, &at, cred, procp);
2298 	if (!error)
2299 		error = nfsrv_access(vp, VEXEC, cred, rdonly, procp, 0);
2300 	if (error) {
2301 		vput(vp);
2302 		nfsm_reply(NFSX_V3POSTOPATTR);
2303 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2304 		error = 0;
2305 		goto nfsmout;
2306 	}
2307 	VOP_UNLOCK(vp);
2308 
2309 	rbuf = malloc(fullsiz, M_TEMP, M_WAITOK);
2310 again:
2311 	iv.iov_base = rbuf;
2312 	iv.iov_len = fullsiz;
2313 	io.uio_iov = &iv;
2314 	io.uio_iovcnt = 1;
2315 	io.uio_offset = (off_t)off;
2316 	io.uio_resid = fullsiz;
2317 	io.uio_segflg = UIO_SYSSPACE;
2318 	io.uio_rw = UIO_READ;
2319 	io.uio_procp = NULL;
2320 	eofflag = 0;
2321 
2322 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, procp);
2323 	error = VOP_READDIR(vp, &io, cred, &eofflag);
2324 
2325 	off = (u_quad_t)io.uio_offset;
2326 	getret = VOP_GETATTR(vp, &at, cred, procp);
2327 
2328 	VOP_UNLOCK(vp);
2329 
2330 	if (!error)
2331 		error = getret;
2332 	if (error) {
2333 		vrele(vp);
2334 		free(rbuf, M_TEMP, fullsiz);
2335 		nfsm_reply(NFSX_V3POSTOPATTR);
2336 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2337 		error = 0;
2338 		goto nfsmout;
2339 	}
2340 	if (io.uio_resid) {
2341 		siz -= io.uio_resid;
2342 
2343 		/*
2344 		 * If nothing read, return eof
2345 		 * rpc reply
2346 		 */
2347 		if (siz == 0) {
2348 			vrele(vp);
2349 			nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
2350 				2 * NFSX_UNSIGNED);
2351 			nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2352 			tl = nfsm_build(&info.nmi_mb, 4 * NFSX_UNSIGNED);
2353 			txdr_hyper(at.va_filerev, tl);
2354 			tl += 2;
2355 			*tl++ = nfs_false;
2356 			*tl = nfs_true;
2357 			free(rbuf, M_TEMP, fullsiz);
2358 			error = 0;
2359 			goto nfsmout;
2360 		}
2361 	}
2362 
2363 	/*
2364 	 * Check for degenerate cases of nothing useful read.
2365 	 * If so go try again
2366 	 */
2367 	cpos = rbuf;
2368 	cend = rbuf + siz;
2369 	dp = (struct dirent *)cpos;
2370 
2371 	while (cpos < cend && dp->d_fileno == 0) {
2372 		cpos += dp->d_reclen;
2373 		dp = (struct dirent *)cpos;
2374 	}
2375 	if (cpos >= cend) {
2376 		toff = off;
2377 		siz = fullsiz;
2378 		goto again;
2379 	}
2380 
2381 	/*
2382 	 * struct READDIRPLUS3resok {
2383 	 *     postop_attr dir_attributes;
2384 	 *     cookieverf3 cookieverf;
2385 	 *     dirlistplus3 reply;
2386 	 * }
2387 	 *
2388 	 * struct dirlistplus3 {
2389 	 *     entryplus3  *entries;
2390 	 *     bool eof;
2391 	 *  }
2392 	 */
2393 	dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF + 2 * NFSX_UNSIGNED;
2394 	nfsm_reply(cnt);
2395 	nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2396 	tl = nfsm_build(&info.nmi_mb, 2 * NFSX_UNSIGNED);
2397 	txdr_hyper(at.va_filerev, tl);
2398 
2399 	/* Loop through the records and build reply */
2400 	while (cpos < cend) {
2401 		if (dp->d_fileno != 0) {
2402 			nlen = dp->d_namlen;
2403 			pad = nfsm_padlen(nlen);
2404 
2405 			/*
2406 			 * For readdir_and_lookup get the vnode using
2407 			 * the file number.
2408 			 */
2409 			if (VFS_VGET(vp->v_mount, dp->d_fileno, &nvp))
2410 				goto invalid;
2411 			memset(nfhp, 0, NFSX_V3FH);
2412 			nfhp->fh_fsid =
2413 				nvp->v_mount->mnt_stat.f_fsid;
2414 			if (VFS_VPTOFH(nvp, &nfhp->fh_fid)) {
2415 				vput(nvp);
2416 				goto invalid;
2417 			}
2418 			if (VOP_GETATTR(nvp, vap, cred, procp)) {
2419 				vput(nvp);
2420 				goto invalid;
2421 			}
2422 			vput(nvp);
2423 
2424 			/*
2425 			 * If either the dircount or maxcount will be
2426 			 * exceeded, get out now. Both of these lengths
2427 			 * are calculated conservatively, including all
2428 			 * XDR overheads.
2429 			 *
2430 			 * Each entry:
2431 			 * 2 * NFSX_UNSIGNED for fileid3
2432 			 * 1 * NFSX_UNSIGNED for length of name
2433 			 * nlen + pad == space the name takes up
2434 			 * 2 * NFSX_UNSIGNED for the cookie
2435 			 * 1 * NFSX_UNSIGNED to indicate if file handle present
2436 			 * 1 * NFSX_UNSIGNED for the file handle length
2437 			 * NFSX_V3FH == space our file handle takes up
2438 			 * NFSX_V3POSTOPATTR == space the attributes take up
2439 			 * 1 * NFSX_UNSIGNED for next pointer
2440 			 */
2441 			len += (8 * NFSX_UNSIGNED + nlen + pad + NFSX_V3FH +
2442 				NFSX_V3POSTOPATTR);
2443 			dirlen += (6 * NFSX_UNSIGNED + nlen + pad);
2444 			if (len > cnt || dirlen > fullsiz) {
2445 				eofflag = 0;
2446 				break;
2447 			}
2448 
2449 			tl = nfsm_build(&info.nmi_mb, 3 * NFSX_UNSIGNED);
2450 			*tl++ = nfs_true;
2451 			txdr_hyper(dp->d_fileno, tl);
2452 
2453 			/* And copy the name */
2454 			nfsm_strtombuf(&info.nmi_mb, dp->d_name, nlen);
2455 
2456 			/*
2457 			 * Build the directory record xdr from
2458 			 * the dirent entry.
2459 			 */
2460 			fp = (struct nfs_fattr *)&fl.fl_fattr;
2461 			nfsm_srvfattr(nfsd, vap, fp);
2462 			fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
2463 			fl.fl_fhok = nfs_true;
2464 			fl.fl_postopok = nfs_true;
2465 			txdr_hyper(dp->d_off, fl.fl_off.nfsuquad);
2466 
2467 			/* Now copy the flrep structure out. */
2468 			nfsm_buftombuf(&info.nmi_mb, &fl, sizeof(struct flrep));
2469 		}
2470 invalid:
2471 		cpos += dp->d_reclen;
2472 		dp = (struct dirent *)cpos;
2473 	}
2474 	vrele(vp);
2475 	tl = nfsm_build(&info.nmi_mb, 2 * NFSX_UNSIGNED);
2476 	*tl++ = nfs_false;
2477 	if (eofflag)
2478 		*tl = nfs_true;
2479 	else
2480 		*tl = nfs_false;
2481 	free(rbuf, M_TEMP, fullsiz);
2482 nfsmout:
2483 	return(error);
2484 }
2485 
2486 /*
2487  * nfs commit service
2488  */
2489 int
2490 nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2491     struct proc *procp, struct mbuf **mrq)
2492 {
2493 	struct mbuf *nam = nfsd->nd_nam;
2494 	struct ucred *cred = &nfsd->nd_cr;
2495 	struct vattr bfor, aft;
2496 	struct vnode *vp;
2497 	struct nfsm_info	info;
2498 	nfsfh_t nfh;
2499 	fhandle_t *fhp;
2500 	u_int32_t *tl;
2501 	int32_t t1;
2502 	int error = 0, rdonly, for_ret = 1, aft_ret = 1, cnt;
2503 	char *cp2;
2504 	u_quad_t off;
2505 
2506 	info.nmi_mreq = NULL;
2507 	info.nmi_mrep = nfsd->nd_mrep;
2508 	info.nmi_md = nfsd->nd_md;
2509 	info.nmi_dpos = nfsd->nd_dpos;
2510 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
2511 
2512 	fhp = &nfh.fh_generic;
2513 	nfsm_srvmtofh(fhp);
2514 	nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
2515 
2516 	/*
2517 	 * XXX At this time VOP_FSYNC() does not accept offset and byte
2518 	 * count parameters, so these arguments are useless (someday maybe).
2519 	 */
2520 	off = fxdr_hyper(tl);
2521 	tl += 2;
2522 	cnt = fxdr_unsigned(int, *tl);
2523 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
2524 	if (error) {
2525 		nfsm_reply(2 * NFSX_UNSIGNED);
2526 		nfsm_srvwcc(nfsd, for_ret, &bfor, aft_ret, &aft, &info);
2527 		error = 0;
2528 		goto nfsmout;
2529 	}
2530 	for_ret = VOP_GETATTR(vp, &bfor, cred, procp);
2531 	error = VOP_FSYNC(vp, cred, MNT_WAIT, procp);
2532 	aft_ret = VOP_GETATTR(vp, &aft, cred, procp);
2533 	vput(vp);
2534 	nfsm_reply(NFSX_V3WCCDATA + NFSX_V3WRITEVERF);
2535 	nfsm_srvwcc(nfsd, for_ret, &bfor, aft_ret, &aft, &info);
2536 	if (!error) {
2537 		tl = nfsm_build(&info.nmi_mb, NFSX_V3WRITEVERF);
2538 		*tl++ = txdr_unsigned(boottime.tv_sec);
2539 		*tl = txdr_unsigned(boottime.tv_nsec/1000);
2540 	} else
2541 		error = 0;
2542 nfsmout:
2543 	return(error);
2544 }
2545 
2546 /*
2547  * nfs statfs service
2548  */
2549 int
2550 nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2551     struct proc *procp, struct mbuf **mrq)
2552 {
2553 	struct mbuf *nam = nfsd->nd_nam;
2554 	struct ucred *cred = &nfsd->nd_cr;
2555 	struct statfs *sf;
2556 	struct nfs_statfs *sfp;
2557 	struct nfsm_info	info;
2558 	u_int32_t *tl;
2559 	int32_t t1;
2560 	int error = 0, rdonly, getret = 1;
2561 	char *cp2;
2562 	struct vnode *vp;
2563 	struct vattr at;
2564 	nfsfh_t nfh;
2565 	fhandle_t *fhp;
2566 	struct statfs statfs;
2567 	u_quad_t tval;
2568 
2569 	info.nmi_mreq = NULL;
2570 	info.nmi_mrep = nfsd->nd_mrep;
2571 	info.nmi_md = nfsd->nd_md;
2572 	info.nmi_dpos = nfsd->nd_dpos;
2573 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
2574 
2575 	fhp = &nfh.fh_generic;
2576 	nfsm_srvmtofh(fhp);
2577 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
2578 	if (error) {
2579 		nfsm_reply(NFSX_UNSIGNED);
2580 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2581 		error = 0;
2582 		goto nfsmout;
2583 	}
2584 	sf = &statfs;
2585 	error = VFS_STATFS(vp->v_mount, sf, procp);
2586 	getret = VOP_GETATTR(vp, &at, cred, procp);
2587 	vput(vp);
2588 	nfsm_reply(NFSX_POSTOPATTR(info.nmi_v3) + NFSX_STATFS(info.nmi_v3));
2589 	if (info.nmi_v3)
2590 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2591 	if (error) {
2592 		error = 0;
2593 		goto nfsmout;
2594 	}
2595 	sfp = nfsm_build(&info.nmi_mb, NFSX_STATFS(info.nmi_v3));
2596 	if (info.nmi_v3) {
2597 		tval = (u_quad_t)sf->f_blocks;
2598 		tval *= (u_quad_t)sf->f_bsize;
2599 		txdr_hyper(tval, &sfp->sf_tbytes);
2600 		tval = (u_quad_t)sf->f_bfree;
2601 		tval *= (u_quad_t)sf->f_bsize;
2602 		txdr_hyper(tval, &sfp->sf_fbytes);
2603 		tval = (u_quad_t)sf->f_bavail;
2604 		tval *= (u_quad_t)sf->f_bsize;
2605 		txdr_hyper(tval, &sfp->sf_abytes);
2606 		tval = (u_quad_t)sf->f_files;
2607 		txdr_hyper(tval, &sfp->sf_tfiles);
2608 		tval = (u_quad_t)sf->f_ffree;
2609 		txdr_hyper(tval, &sfp->sf_ffiles);
2610 		txdr_hyper(tval, &sfp->sf_afiles);
2611 		sfp->sf_invarsec = 0;
2612 	} else {
2613 		sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
2614 		sfp->sf_bsize = txdr_unsigned(sf->f_bsize);
2615 		sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
2616 		sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
2617 		sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
2618 	}
2619 nfsmout:
2620 	return(error);
2621 }
2622 
2623 /*
2624  * nfs fsinfo service
2625  */
2626 int
2627 nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2628     struct proc *procp, struct mbuf **mrq)
2629 {
2630 	struct mbuf *nam = nfsd->nd_nam;
2631 	struct ucred *cred = &nfsd->nd_cr;
2632 	struct nfsm_info	info;
2633 	u_int32_t *tl;
2634 	struct nfsv3_fsinfo *sip;
2635 	int32_t t1;
2636 	int error = 0, rdonly, getret = 1, pref;
2637 	char *cp2;
2638 	struct vnode *vp;
2639 	struct vattr at;
2640 	nfsfh_t nfh;
2641 	fhandle_t *fhp;
2642 
2643 	info.nmi_mreq = NULL;
2644 	info.nmi_mrep = nfsd->nd_mrep;
2645 	info.nmi_md = nfsd->nd_md;
2646 	info.nmi_dpos = nfsd->nd_dpos;
2647 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
2648 
2649 	fhp = &nfh.fh_generic;
2650 	nfsm_srvmtofh(fhp);
2651 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
2652 	if (error) {
2653 		nfsm_reply(NFSX_UNSIGNED);
2654 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2655 		error = 0;
2656 		goto nfsmout;
2657 	}
2658 	getret = VOP_GETATTR(vp, &at, cred, procp);
2659 	vput(vp);
2660 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3FSINFO);
2661 	nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2662 	sip = nfsm_build(&info.nmi_mb, NFSX_V3FSINFO);
2663 
2664 	/*
2665 	 * XXX
2666 	 * There should be file system VFS OP(s) to get this information.
2667 	 * For now, assume ufs.
2668 	 */
2669 	if (slp->ns_so->so_type == SOCK_DGRAM)
2670 		pref = NFS_MAXDGRAMDATA;
2671 	else
2672 		pref = NFS_MAXDATA;
2673 	sip->fs_rtmax = txdr_unsigned(NFS_MAXDATA);
2674 	sip->fs_rtpref = txdr_unsigned(pref);
2675 	sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
2676 	sip->fs_wtmax = txdr_unsigned(NFS_MAXDATA);
2677 	sip->fs_wtpref = txdr_unsigned(pref);
2678 	sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
2679 	sip->fs_dtpref = txdr_unsigned(pref);
2680 	sip->fs_maxfilesize.nfsuquad[0] = 0xffffffff;
2681 	sip->fs_maxfilesize.nfsuquad[1] = 0xffffffff;
2682 	sip->fs_timedelta.nfsv3_sec = 0;
2683 	sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
2684 	sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
2685 		NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
2686 		NFSV3FSINFO_CANSETTIME);
2687 nfsmout:
2688 	return(error);
2689 }
2690 
2691 /*
2692  * nfs pathconf service
2693  */
2694 int
2695 nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2696     struct proc *procp, struct mbuf **mrq)
2697 {
2698 	struct mbuf *nam = nfsd->nd_nam;
2699 	struct ucred *cred = &nfsd->nd_cr;
2700 	struct nfsm_info	info;
2701 	u_int32_t *tl;
2702 	struct nfsv3_pathconf *pc;
2703 	int32_t t1;
2704 	int error = 0, rdonly, getret = 1;
2705 	register_t linkmax, namemax, chownres, notrunc;
2706 	char *cp2;
2707 	struct vnode *vp;
2708 	struct vattr at;
2709 	nfsfh_t nfh;
2710 	fhandle_t *fhp;
2711 
2712 	info.nmi_mreq = NULL;
2713 	info.nmi_mrep = nfsd->nd_mrep;
2714 	info.nmi_md = nfsd->nd_md;
2715 	info.nmi_dpos = nfsd->nd_dpos;
2716 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
2717 
2718 	fhp = &nfh.fh_generic;
2719 	nfsm_srvmtofh(fhp);
2720 	error = nfsrv_fhtovp(fhp, 1, &vp, cred, slp, nam, &rdonly);
2721 	if (error) {
2722 		nfsm_reply(NFSX_UNSIGNED);
2723 		nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2724 		error = 0;
2725 		goto nfsmout;
2726 	}
2727 	error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
2728 	if (!error)
2729 		error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
2730 	if (!error)
2731 		error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
2732 	if (!error)
2733 		error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
2734 	getret = VOP_GETATTR(vp, &at, cred, procp);
2735 	vput(vp);
2736 	nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3PATHCONF);
2737 	nfsm_srvpostop_attr(nfsd, getret, &at, &info);
2738 	if (error) {
2739 		error = 0;
2740 		goto nfsmout;
2741 	}
2742 	pc = nfsm_build(&info.nmi_mb, NFSX_V3PATHCONF);
2743 
2744 	pc->pc_linkmax = txdr_unsigned(linkmax);
2745 	pc->pc_namemax = txdr_unsigned(namemax);
2746 	pc->pc_notrunc = txdr_unsigned(notrunc);
2747 	pc->pc_chownrestricted = txdr_unsigned(chownres);
2748 
2749 	/*
2750 	 * These should probably be supported by VOP_PATHCONF(), but
2751 	 * until msdosfs is exportable (why would you want to?), the
2752 	 * Unix defaults should be ok.
2753 	 */
2754 	pc->pc_caseinsensitive = nfs_false;
2755 	pc->pc_casepreserving = nfs_true;
2756 nfsmout:
2757 	return(error);
2758 }
2759 
2760 /*
2761  * Null operation, used by clients to ping server
2762  */
2763 /* ARGSUSED */
2764 int
2765 nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2766     struct proc *procp, struct mbuf **mrq)
2767 {
2768 	struct nfsm_info	info;
2769 	int error = NFSERR_RETVOID;
2770 
2771 	info.nmi_mreq = NULL;
2772 	info.nmi_mrep = nfsd->nd_mrep;
2773 	info.nmi_md = nfsd->nd_md;
2774 	info.nmi_dpos = nfsd->nd_dpos;
2775 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
2776 
2777 	nfsm_reply(0);
2778 	return (0);
2779 }
2780 
2781 /*
2782  * No operation, used for obsolete procedures
2783  */
2784 /* ARGSUSED */
2785 int
2786 nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
2787     struct proc *procp, struct mbuf **mrq)
2788 {
2789 	struct nfsm_info	info;
2790 	int error;
2791 
2792 	info.nmi_mreq = NULL;
2793 	info.nmi_mrep = nfsd->nd_mrep;
2794 	info.nmi_md = nfsd->nd_md;
2795 	info.nmi_dpos = nfsd->nd_dpos;
2796 	info.nmi_v3 = (nfsd->nd_flag & ND_NFSV3);
2797 
2798 	if (nfsd->nd_repstat)
2799 		error = nfsd->nd_repstat;
2800 	else
2801 		error = EPROCUNAVAIL;
2802 	nfsm_reply(0);
2803 	return (0);
2804 }
2805 
2806 /*
2807  * Perform access checking for vnodes obtained from file handles that would
2808  * refer to files already opened by a Unix client.
2809  * You cannot just use vn_writechk() and VOP_ACCESS() for two reasons:
2810  * 1 - You must check for exported rdonly as well as MNT_RDONLY for the
2811  *     write case
2812  * 2 - The owner is to be given access irrespective of mode bits for some
2813  *     operations, so that processes that chmod after opening a file don't
2814  *     break. I don't like this because it opens a security hole, but since
2815  *     the nfs server opens a security hole the size of a barn door anyhow,
2816  *     what the heck. A notable exception to this rule is when VOP_ACCESS()
2817  *     returns EPERM (e.g. when a file is immutable) which is always an
2818  *     error.
2819  */
2820 int
2821 nfsrv_access(struct vnode *vp, int flags, struct ucred *cred, int rdonly,
2822     struct proc *p, int override)
2823 {
2824 	struct vattr vattr;
2825 	int error;
2826 
2827 	if (flags & VWRITE) {
2828 		/* Just vn_writechk() changed to check rdonly */
2829 		/*
2830 		 * Disallow write attempts on read-only file systems;
2831 		 * unless the file is a socket or a block or character
2832 		 * device resident on the file system.
2833 		 */
2834 		if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
2835 			switch (vp->v_type) {
2836 			case VREG:
2837 			case VDIR:
2838 			case VLNK:
2839 				return (EROFS);
2840 			default:
2841 				break;
2842 			}
2843 		}
2844 		/*
2845 		 * If there's shared text associated with
2846 		 * the inode, try to free it up once.  If
2847 		 * we fail, we can't allow writing.
2848 		 */
2849 		if ((vp->v_flag & VTEXT) && !uvm_vnp_uncache(vp))
2850 			return (ETXTBSY);
2851 	}
2852 	error = VOP_ACCESS(vp, flags, cred, p);
2853 	/*
2854 	 * Allow certain operations for the owner (reads and writes
2855 	 * on files that are already open).
2856 	 */
2857 	if (override && error == EACCES &&
2858 	    VOP_GETATTR(vp, &vattr, cred, p) == 0 &&
2859 	    cred->cr_uid == vattr.va_uid)
2860 		error = 0;
2861 	return error;
2862 }
2863