1 /*-
2  * Copyright (c) 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Rick Macklem at The University of Guelph.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 4. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)nfs_vnops.c	8.16 (Berkeley) 5/27/95
33  */
34 
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD: stable/10/sys/nfsclient/nfs_vnops.c 276500 2015-01-01 10:44:20Z kib $");
37 
38 /*
39  * vnode op calls for Sun NFS version 2 and 3
40  */
41 
42 #include "opt_inet.h"
43 #include "opt_kdtrace.h"
44 
45 #include <sys/param.h>
46 #include <sys/kernel.h>
47 #include <sys/systm.h>
48 #include <sys/resourcevar.h>
49 #include <sys/proc.h>
50 #include <sys/mount.h>
51 #include <sys/bio.h>
52 #include <sys/buf.h>
53 #include <sys/jail.h>
54 #include <sys/malloc.h>
55 #include <sys/mbuf.h>
56 #include <sys/namei.h>
57 #include <sys/socket.h>
58 #include <sys/vnode.h>
59 #include <sys/dirent.h>
60 #include <sys/fcntl.h>
61 #include <sys/lockf.h>
62 #include <sys/stat.h>
63 #include <sys/sysctl.h>
64 #include <sys/signalvar.h>
65 
66 #include <vm/vm.h>
67 #include <vm/vm_extern.h>
68 #include <vm/vm_object.h>
69 
70 #include <nfs/nfsproto.h>
71 #include <nfsclient/nfs.h>
72 #include <nfsclient/nfsnode.h>
73 #include <nfsclient/nfsmount.h>
74 #include <nfs/nfs_kdtrace.h>
75 #include <nfs/nfs_lock.h>
76 #include <nfs/xdr_subs.h>
77 #include <nfsclient/nfsm_subs.h>
78 
79 #include <net/if.h>
80 #include <netinet/in.h>
81 #include <netinet/in_var.h>
82 
83 #include <machine/stdarg.h>
84 
85 #ifdef KDTRACE_HOOKS
86 #include <sys/dtrace_bsd.h>
87 
88 dtrace_nfsclient_accesscache_flush_probe_func_t
89     dtrace_nfsclient_accesscache_flush_done_probe;
90 uint32_t nfsclient_accesscache_flush_done_id;
91 
92 dtrace_nfsclient_accesscache_get_probe_func_t
93     dtrace_nfsclient_accesscache_get_hit_probe,
94     dtrace_nfsclient_accesscache_get_miss_probe;
95 uint32_t nfsclient_accesscache_get_hit_id;
96 uint32_t nfsclient_accesscache_get_miss_id;
97 
98 dtrace_nfsclient_accesscache_load_probe_func_t
99     dtrace_nfsclient_accesscache_load_done_probe;
100 uint32_t nfsclient_accesscache_load_done_id;
101 #endif /* !KDTRACE_HOOKS */
102 
103 /* Defs */
104 #define	TRUE	1
105 #define	FALSE	0
106 
107 /*
108  * Ifdef for FreeBSD-current merged buffer cache. It is unfortunate that these
109  * calls are not in getblk() and brelse() so that they would not be necessary
110  * here.
111  */
112 #ifndef B_VMIO
113 #define vfs_busy_pages(bp, f)
114 #endif
115 
116 static vop_read_t	nfsfifo_read;
117 static vop_write_t	nfsfifo_write;
118 static vop_close_t	nfsfifo_close;
119 static int	nfs_flush(struct vnode *, int, int);
120 static int	nfs_setattrrpc(struct vnode *, struct vattr *, struct ucred *);
121 static vop_lookup_t	nfs_lookup;
122 static vop_create_t	nfs_create;
123 static vop_mknod_t	nfs_mknod;
124 static vop_open_t	nfs_open;
125 static vop_close_t	nfs_close;
126 static vop_access_t	nfs_access;
127 static vop_getattr_t	nfs_getattr;
128 static vop_setattr_t	nfs_setattr;
129 static vop_read_t	nfs_read;
130 static vop_fsync_t	nfs_fsync;
131 static vop_remove_t	nfs_remove;
132 static vop_link_t	nfs_link;
133 static vop_rename_t	nfs_rename;
134 static vop_mkdir_t	nfs_mkdir;
135 static vop_rmdir_t	nfs_rmdir;
136 static vop_symlink_t	nfs_symlink;
137 static vop_readdir_t	nfs_readdir;
138 static vop_strategy_t	nfs_strategy;
139 static	int	nfs_lookitup(struct vnode *, const char *, int,
140 		    struct ucred *, struct thread *, struct nfsnode **);
141 static	int	nfs_sillyrename(struct vnode *, struct vnode *,
142 		    struct componentname *);
143 static vop_access_t	nfsspec_access;
144 static vop_readlink_t	nfs_readlink;
145 static vop_print_t	nfs_print;
146 static vop_advlock_t	nfs_advlock;
147 static vop_advlockasync_t nfs_advlockasync;
148 
149 /*
150  * Global vfs data structures for nfs
151  */
152 struct vop_vector nfs_vnodeops = {
153 	.vop_default =		&default_vnodeops,
154 	.vop_access =		nfs_access,
155 	.vop_advlock =		nfs_advlock,
156 	.vop_advlockasync =	nfs_advlockasync,
157 	.vop_close =		nfs_close,
158 	.vop_create =		nfs_create,
159 	.vop_fsync =		nfs_fsync,
160 	.vop_getattr =		nfs_getattr,
161 	.vop_getpages =		nfs_getpages,
162 	.vop_putpages =		nfs_putpages,
163 	.vop_inactive =		nfs_inactive,
164 	.vop_link =		nfs_link,
165 	.vop_lookup =		nfs_lookup,
166 	.vop_mkdir =		nfs_mkdir,
167 	.vop_mknod =		nfs_mknod,
168 	.vop_open =		nfs_open,
169 	.vop_print =		nfs_print,
170 	.vop_read =		nfs_read,
171 	.vop_readdir =		nfs_readdir,
172 	.vop_readlink =		nfs_readlink,
173 	.vop_reclaim =		nfs_reclaim,
174 	.vop_remove =		nfs_remove,
175 	.vop_rename =		nfs_rename,
176 	.vop_rmdir =		nfs_rmdir,
177 	.vop_setattr =		nfs_setattr,
178 	.vop_strategy =		nfs_strategy,
179 	.vop_symlink =		nfs_symlink,
180 	.vop_write =		nfs_write,
181 };
182 
183 struct vop_vector nfs_fifoops = {
184 	.vop_default =		&fifo_specops,
185 	.vop_access =		nfsspec_access,
186 	.vop_close =		nfsfifo_close,
187 	.vop_fsync =		nfs_fsync,
188 	.vop_getattr =		nfs_getattr,
189 	.vop_inactive =		nfs_inactive,
190 	.vop_print =		nfs_print,
191 	.vop_read =		nfsfifo_read,
192 	.vop_reclaim =		nfs_reclaim,
193 	.vop_setattr =		nfs_setattr,
194 	.vop_write =		nfsfifo_write,
195 };
196 
197 static int	nfs_mknodrpc(struct vnode *dvp, struct vnode **vpp,
198 			     struct componentname *cnp, struct vattr *vap);
199 static int	nfs_removerpc(struct vnode *dvp, const char *name, int namelen,
200 			      struct ucred *cred, struct thread *td);
201 static int	nfs_renamerpc(struct vnode *fdvp, const char *fnameptr,
202 			      int fnamelen, struct vnode *tdvp,
203 			      const char *tnameptr, int tnamelen,
204 			      struct ucred *cred, struct thread *td);
205 static int	nfs_renameit(struct vnode *sdvp, struct componentname *scnp,
206 			     struct sillyrename *sp);
207 
208 /*
209  * Global variables
210  */
211 struct mtx 	nfs_iod_mtx;
212 enum nfsiod_state nfs_iodwant[NFS_MAXASYNCDAEMON];
213 struct nfsmount *nfs_iodmount[NFS_MAXASYNCDAEMON];
214 int		 nfs_numasync = 0;
215 #define	DIRHDSIZ	(sizeof (struct dirent) - (MAXNAMLEN + 1))
216 
217 SYSCTL_DECL(_vfs_oldnfs);
218 
219 static int	nfsaccess_cache_timeout = NFS_MAXATTRTIMO;
220 SYSCTL_INT(_vfs_oldnfs, OID_AUTO, access_cache_timeout, CTLFLAG_RW,
221 	   &nfsaccess_cache_timeout, 0, "NFS ACCESS cache timeout");
222 
223 static int	nfs_prime_access_cache = 0;
224 SYSCTL_INT(_vfs_oldnfs, OID_AUTO, prime_access_cache, CTLFLAG_RW,
225 	   &nfs_prime_access_cache, 0,
226 	   "Prime NFS ACCESS cache when fetching attributes");
227 
228 static int	nfsv3_commit_on_close = 0;
229 SYSCTL_INT(_vfs_oldnfs, OID_AUTO, nfsv3_commit_on_close, CTLFLAG_RW,
230 	   &nfsv3_commit_on_close, 0, "write+commit on close, else only write");
231 
232 static int	nfs_clean_pages_on_close = 1;
233 SYSCTL_INT(_vfs_oldnfs, OID_AUTO, clean_pages_on_close, CTLFLAG_RW,
234 	   &nfs_clean_pages_on_close, 0, "NFS clean dirty pages on close");
235 
236 int nfs_directio_enable = 0;
237 SYSCTL_INT(_vfs_oldnfs, OID_AUTO, nfs_directio_enable, CTLFLAG_RW,
238 	   &nfs_directio_enable, 0, "Enable NFS directio");
239 
240 /*
241  * This sysctl allows other processes to mmap a file that has been opened
242  * O_DIRECT by a process.  In general, having processes mmap the file while
243  * Direct IO is in progress can lead to Data Inconsistencies.  But, we allow
244  * this by default to prevent DoS attacks - to prevent a malicious user from
245  * opening up files O_DIRECT preventing other users from mmap'ing these
246  * files.  "Protected" environments where stricter consistency guarantees are
247  * required can disable this knob.  The process that opened the file O_DIRECT
248  * cannot mmap() the file, because mmap'ed IO on an O_DIRECT open() is not
249  * meaningful.
250  */
251 int nfs_directio_allow_mmap = 1;
252 SYSCTL_INT(_vfs_oldnfs, OID_AUTO, nfs_directio_allow_mmap, CTLFLAG_RW,
253 	   &nfs_directio_allow_mmap, 0, "Enable mmaped IO on file with O_DIRECT opens");
254 
255 #if 0
256 SYSCTL_INT(_vfs_oldnfs, OID_AUTO, access_cache_hits, CTLFLAG_RD,
257 	   &nfsstats.accesscache_hits, 0, "NFS ACCESS cache hit count");
258 
259 SYSCTL_INT(_vfs_oldnfs, OID_AUTO, access_cache_misses, CTLFLAG_RD,
260 	   &nfsstats.accesscache_misses, 0, "NFS ACCESS cache miss count");
261 #endif
262 
263 #define	NFSV3ACCESS_ALL (NFSV3ACCESS_READ | NFSV3ACCESS_MODIFY		\
264 			 | NFSV3ACCESS_EXTEND | NFSV3ACCESS_EXECUTE	\
265 			 | NFSV3ACCESS_DELETE | NFSV3ACCESS_LOOKUP)
266 
267 /*
268  * SMP Locking Note :
269  * The list of locks after the description of the lock is the ordering
270  * of other locks acquired with the lock held.
271  * np->n_mtx : Protects the fields in the nfsnode.
272        VM Object Lock
273        VI_MTX (acquired indirectly)
274  * nmp->nm_mtx : Protects the fields in the nfsmount.
275        rep->r_mtx
276  * nfs_iod_mtx : Global lock, protects shared nfsiod state.
277  * nfs_reqq_mtx : Global lock, protects the nfs_reqq list.
278        nmp->nm_mtx
279        rep->r_mtx
280  * rep->r_mtx : Protects the fields in an nfsreq.
281  */
282 
283 static int
nfs3_access_otw(struct vnode * vp,int wmode,struct thread * td,struct ucred * cred,uint32_t * retmode)284 nfs3_access_otw(struct vnode *vp, int wmode, struct thread *td,
285     struct ucred *cred, uint32_t *retmode)
286 {
287 	const int v3 = 1;
288 	u_int32_t *tl;
289 	int error = 0, attrflag, i, lrupos;
290 
291 	struct mbuf *mreq, *mrep, *md, *mb;
292 	caddr_t bpos, dpos;
293 	u_int32_t rmode;
294 	struct nfsnode *np = VTONFS(vp);
295 
296 	nfsstats.rpccnt[NFSPROC_ACCESS]++;
297 	mreq = m_get2(NFSX_FH(v3) + NFSX_UNSIGNED, M_WAITOK, MT_DATA, 0);
298 	mb = mreq;
299 	bpos = mtod(mb, caddr_t);
300 	nfsm_fhtom(vp, v3);
301 	tl = nfsm_build(u_int32_t *, NFSX_UNSIGNED);
302 	*tl = txdr_unsigned(wmode);
303 	nfsm_request(vp, NFSPROC_ACCESS, td, cred);
304 	nfsm_postop_attr(vp, attrflag);
305 	if (!error) {
306 		lrupos = 0;
307 		tl = nfsm_dissect(u_int32_t *, NFSX_UNSIGNED);
308 		rmode = fxdr_unsigned(u_int32_t, *tl);
309 		mtx_lock(&np->n_mtx);
310 		for (i = 0; i < NFS_ACCESSCACHESIZE; i++) {
311 			if (np->n_accesscache[i].uid == cred->cr_uid) {
312 				np->n_accesscache[i].mode = rmode;
313 				np->n_accesscache[i].stamp = time_second;
314 				break;
315 			}
316 			if (i > 0 && np->n_accesscache[i].stamp <
317 			    np->n_accesscache[lrupos].stamp)
318 				lrupos = i;
319 		}
320 		if (i == NFS_ACCESSCACHESIZE) {
321 			np->n_accesscache[lrupos].uid = cred->cr_uid;
322 			np->n_accesscache[lrupos].mode = rmode;
323 			np->n_accesscache[lrupos].stamp = time_second;
324 		}
325 		mtx_unlock(&np->n_mtx);
326 		if (retmode != NULL)
327 			*retmode = rmode;
328 		KDTRACE_NFS_ACCESSCACHE_LOAD_DONE(vp, cred->cr_uid, rmode, 0);
329 	}
330 	m_freem(mrep);
331 nfsmout:
332 #ifdef KDTRACE_HOOKS
333 	if (error) {
334 		KDTRACE_NFS_ACCESSCACHE_LOAD_DONE(vp, cred->cr_uid, 0,
335 		    error);
336 	}
337 #endif
338 	return (error);
339 }
340 
341 /*
342  * nfs access vnode op.
343  * For nfs version 2, just return ok. File accesses may fail later.
344  * For nfs version 3, use the access rpc to check accessibility. If file modes
345  * are changed on the server, accesses might still fail later.
346  */
347 static int
nfs_access(struct vop_access_args * ap)348 nfs_access(struct vop_access_args *ap)
349 {
350 	struct vnode *vp = ap->a_vp;
351 	int error = 0, i, gotahit;
352 	u_int32_t mode, rmode, wmode;
353 	int v3 = NFS_ISV3(vp);
354 	struct nfsnode *np = VTONFS(vp);
355 
356 	/*
357 	 * Disallow write attempts on filesystems mounted read-only;
358 	 * unless the file is a socket, fifo, or a block or character
359 	 * device resident on the filesystem.
360 	 */
361 	if ((ap->a_accmode & VWRITE) && (vp->v_mount->mnt_flag & MNT_RDONLY)) {
362 		switch (vp->v_type) {
363 		case VREG:
364 		case VDIR:
365 		case VLNK:
366 			return (EROFS);
367 		default:
368 			break;
369 		}
370 	}
371 	/*
372 	 * For nfs v3, check to see if we have done this recently, and if
373 	 * so return our cached result instead of making an ACCESS call.
374 	 * If not, do an access rpc, otherwise you are stuck emulating
375 	 * ufs_access() locally using the vattr. This may not be correct,
376 	 * since the server may apply other access criteria such as
377 	 * client uid-->server uid mapping that we do not know about.
378 	 */
379 	if (v3) {
380 		if (ap->a_accmode & VREAD)
381 			mode = NFSV3ACCESS_READ;
382 		else
383 			mode = 0;
384 		if (vp->v_type != VDIR) {
385 			if (ap->a_accmode & VWRITE)
386 				mode |= (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
387 			if (ap->a_accmode & VEXEC)
388 				mode |= NFSV3ACCESS_EXECUTE;
389 		} else {
390 			if (ap->a_accmode & VWRITE)
391 				mode |= (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
392 					 NFSV3ACCESS_DELETE);
393 			if (ap->a_accmode & VEXEC)
394 				mode |= NFSV3ACCESS_LOOKUP;
395 		}
396 		/* XXX safety belt, only make blanket request if caching */
397 		if (nfsaccess_cache_timeout > 0) {
398 			wmode = NFSV3ACCESS_READ | NFSV3ACCESS_MODIFY |
399 				NFSV3ACCESS_EXTEND | NFSV3ACCESS_EXECUTE |
400 				NFSV3ACCESS_DELETE | NFSV3ACCESS_LOOKUP;
401 		} else {
402 			wmode = mode;
403 		}
404 
405 		/*
406 		 * Does our cached result allow us to give a definite yes to
407 		 * this request?
408 		 */
409 		gotahit = 0;
410 		mtx_lock(&np->n_mtx);
411 		for (i = 0; i < NFS_ACCESSCACHESIZE; i++) {
412 			if (ap->a_cred->cr_uid == np->n_accesscache[i].uid) {
413 				if (time_second < (np->n_accesscache[i].stamp +
414 				    nfsaccess_cache_timeout) &&
415 				    (np->n_accesscache[i].mode & mode) == mode) {
416 					nfsstats.accesscache_hits++;
417 					gotahit = 1;
418 				}
419 				break;
420 			}
421 		}
422 		mtx_unlock(&np->n_mtx);
423 #ifdef KDTRACE_HOOKS
424 		if (gotahit)
425 			KDTRACE_NFS_ACCESSCACHE_GET_HIT(vp,
426 			    ap->a_cred->cr_uid, mode);
427 		else
428 			KDTRACE_NFS_ACCESSCACHE_GET_MISS(vp,
429 			    ap->a_cred->cr_uid, mode);
430 #endif
431 		if (gotahit == 0) {
432 			/*
433 			 * Either a no, or a don't know.  Go to the wire.
434 			 */
435 			nfsstats.accesscache_misses++;
436 		        error = nfs3_access_otw(vp, wmode, ap->a_td, ap->a_cred,
437 			    &rmode);
438 			if (!error) {
439 				if ((rmode & mode) != mode)
440 					error = EACCES;
441 			}
442 		}
443 		return (error);
444 	} else {
445 		if ((error = nfsspec_access(ap)) != 0) {
446 			return (error);
447 		}
448 		/*
449 		 * Attempt to prevent a mapped root from accessing a file
450 		 * which it shouldn't.  We try to read a byte from the file
451 		 * if the user is root and the file is not zero length.
452 		 * After calling nfsspec_access, we should have the correct
453 		 * file size cached.
454 		 */
455 		mtx_lock(&np->n_mtx);
456 		if (ap->a_cred->cr_uid == 0 && (ap->a_accmode & VREAD)
457 		    && VTONFS(vp)->n_size > 0) {
458 			struct iovec aiov;
459 			struct uio auio;
460 			char buf[1];
461 
462 			mtx_unlock(&np->n_mtx);
463 			aiov.iov_base = buf;
464 			aiov.iov_len = 1;
465 			auio.uio_iov = &aiov;
466 			auio.uio_iovcnt = 1;
467 			auio.uio_offset = 0;
468 			auio.uio_resid = 1;
469 			auio.uio_segflg = UIO_SYSSPACE;
470 			auio.uio_rw = UIO_READ;
471 			auio.uio_td = ap->a_td;
472 
473 			if (vp->v_type == VREG)
474 				error = nfs_readrpc(vp, &auio, ap->a_cred);
475 			else if (vp->v_type == VDIR) {
476 				char* bp;
477 				bp = malloc(NFS_DIRBLKSIZ, M_TEMP, M_WAITOK);
478 				aiov.iov_base = bp;
479 				aiov.iov_len = auio.uio_resid = NFS_DIRBLKSIZ;
480 				error = nfs_readdirrpc(vp, &auio, ap->a_cred);
481 				free(bp, M_TEMP);
482 			} else if (vp->v_type == VLNK)
483 				error = nfs_readlinkrpc(vp, &auio, ap->a_cred);
484 			else
485 				error = EACCES;
486 		} else
487 			mtx_unlock(&np->n_mtx);
488 		return (error);
489 	}
490 }
491 
492 int nfs_otw_getattr_avoid = 0;
493 
494 /*
495  * nfs open vnode op
496  * Check to see if the type is ok
497  * and that deletion is not in progress.
498  * For paged in text files, you will need to flush the page cache
499  * if consistency is lost.
500  */
501 /* ARGSUSED */
502 static int
nfs_open(struct vop_open_args * ap)503 nfs_open(struct vop_open_args *ap)
504 {
505 	struct vnode *vp = ap->a_vp;
506 	struct nfsnode *np = VTONFS(vp);
507 	struct vattr vattr;
508 	int error;
509 	int fmode = ap->a_mode;
510 	struct ucred *cred;
511 
512 	if (vp->v_type != VREG && vp->v_type != VDIR && vp->v_type != VLNK)
513 		return (EOPNOTSUPP);
514 
515 	/*
516 	 * Get a valid lease. If cached data is stale, flush it.
517 	 */
518 	mtx_lock(&np->n_mtx);
519 	if (np->n_flag & NMODIFIED) {
520 		mtx_unlock(&np->n_mtx);
521 		error = nfs_vinvalbuf(vp, V_SAVE, ap->a_td, 1);
522 		if (error == EINTR || error == EIO)
523 			return (error);
524 		mtx_lock(&np->n_mtx);
525 		np->n_attrstamp = 0;
526 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(vp);
527 		if (vp->v_type == VDIR)
528 			np->n_direofoffset = 0;
529 		mtx_unlock(&np->n_mtx);
530 		error = VOP_GETATTR(vp, &vattr, ap->a_cred);
531 		if (error)
532 			return (error);
533 		mtx_lock(&np->n_mtx);
534 		np->n_mtime = vattr.va_mtime;
535 	} else {
536 		mtx_unlock(&np->n_mtx);
537 		error = VOP_GETATTR(vp, &vattr, ap->a_cred);
538 		if (error)
539 			return (error);
540 		mtx_lock(&np->n_mtx);
541 		if (NFS_TIMESPEC_COMPARE(&np->n_mtime, &vattr.va_mtime)) {
542 			if (vp->v_type == VDIR)
543 				np->n_direofoffset = 0;
544 			mtx_unlock(&np->n_mtx);
545 			error = nfs_vinvalbuf(vp, V_SAVE, ap->a_td, 1);
546 			if (error == EINTR || error == EIO) {
547 				return (error);
548 			}
549 			mtx_lock(&np->n_mtx);
550 			np->n_mtime = vattr.va_mtime;
551 		}
552 	}
553 	/*
554 	 * If the object has >= 1 O_DIRECT active opens, we disable caching.
555 	 */
556 	if (nfs_directio_enable && (fmode & O_DIRECT) && (vp->v_type == VREG)) {
557 		if (np->n_directio_opens == 0) {
558 			mtx_unlock(&np->n_mtx);
559 			error = nfs_vinvalbuf(vp, V_SAVE, ap->a_td, 1);
560 			if (error)
561 				return (error);
562 			mtx_lock(&np->n_mtx);
563 			np->n_flag |= NNONCACHE;
564 		}
565 		np->n_directio_opens++;
566 	}
567 
568 	/*
569 	 * If this is an open for writing, capture a reference to the
570 	 * credentials, so they can be used by nfs_putpages(). Using
571 	 * these write credentials is preferable to the credentials of
572 	 * whatever thread happens to be doing the VOP_PUTPAGES() since
573 	 * the write RPCs are less likely to fail with EACCES.
574 	 */
575 	if ((fmode & FWRITE) != 0) {
576 		cred = np->n_writecred;
577 		np->n_writecred = crhold(ap->a_cred);
578 	} else
579 		cred = NULL;
580 	mtx_unlock(&np->n_mtx);
581 	if (cred != NULL)
582 		crfree(cred);
583 	vnode_create_vobject(vp, vattr.va_size, ap->a_td);
584 	return (0);
585 }
586 
587 /*
588  * nfs close vnode op
589  * What an NFS client should do upon close after writing is a debatable issue.
590  * Most NFS clients push delayed writes to the server upon close, basically for
591  * two reasons:
592  * 1 - So that any write errors may be reported back to the client process
593  *     doing the close system call. By far the two most likely errors are
594  *     NFSERR_NOSPC and NFSERR_DQUOT to indicate space allocation failure.
595  * 2 - To put a worst case upper bound on cache inconsistency between
596  *     multiple clients for the file.
597  * There is also a consistency problem for Version 2 of the protocol w.r.t.
598  * not being able to tell if other clients are writing a file concurrently,
599  * since there is no way of knowing if the changed modify time in the reply
600  * is only due to the write for this client.
601  * (NFS Version 3 provides weak cache consistency data in the reply that
602  *  should be sufficient to detect and handle this case.)
603  *
604  * The current code does the following:
605  * for NFS Version 2 - play it safe and flush/invalidate all dirty buffers
606  * for NFS Version 3 - flush dirty buffers to the server but don't invalidate
607  *                     or commit them (this satisfies 1 and 2 except for the
608  *                     case where the server crashes after this close but
609  *                     before the commit RPC, which is felt to be "good
610  *                     enough". Changing the last argument to nfs_flush() to
611  *                     a 1 would force a commit operation, if it is felt a
612  *                     commit is necessary now.
613  */
614 /* ARGSUSED */
615 static int
nfs_close(struct vop_close_args * ap)616 nfs_close(struct vop_close_args *ap)
617 {
618 	struct vnode *vp = ap->a_vp;
619 	struct nfsnode *np = VTONFS(vp);
620 	int error = 0;
621 	int fmode = ap->a_fflag;
622 
623 	if (vp->v_type == VREG) {
624 	    /*
625 	     * Examine and clean dirty pages, regardless of NMODIFIED.
626 	     * This closes a major hole in close-to-open consistency.
627 	     * We want to push out all dirty pages (and buffers) on
628 	     * close, regardless of whether they were dirtied by
629 	     * mmap'ed writes or via write().
630 	     */
631 	    if (nfs_clean_pages_on_close && vp->v_object) {
632 		VM_OBJECT_WLOCK(vp->v_object);
633 		vm_object_page_clean(vp->v_object, 0, 0, 0);
634 		VM_OBJECT_WUNLOCK(vp->v_object);
635 	    }
636 	    mtx_lock(&np->n_mtx);
637 	    if (np->n_flag & NMODIFIED) {
638 		mtx_unlock(&np->n_mtx);
639 		if (NFS_ISV3(vp)) {
640 		    /*
641 		     * Under NFSv3 we have dirty buffers to dispose of.  We
642 		     * must flush them to the NFS server.  We have the option
643 		     * of waiting all the way through the commit rpc or just
644 		     * waiting for the initial write.  The default is to only
645 		     * wait through the initial write so the data is in the
646 		     * server's cache, which is roughly similar to the state
647 		     * a standard disk subsystem leaves the file in on close().
648 		     *
649 		     * We cannot clear the NMODIFIED bit in np->n_flag due to
650 		     * potential races with other processes, and certainly
651 		     * cannot clear it if we don't commit.
652 		     */
653 		    int cm = nfsv3_commit_on_close ? 1 : 0;
654 		    error = nfs_flush(vp, MNT_WAIT, cm);
655 		    /* np->n_flag &= ~NMODIFIED; */
656 		} else
657 		    error = nfs_vinvalbuf(vp, V_SAVE, ap->a_td, 1);
658 		mtx_lock(&np->n_mtx);
659 	    }
660 	    if (np->n_flag & NWRITEERR) {
661 		np->n_flag &= ~NWRITEERR;
662 		error = np->n_error;
663 	    }
664 	    mtx_unlock(&np->n_mtx);
665 	}
666 	if (nfs_directio_enable)
667 		KASSERT((np->n_directio_asyncwr == 0),
668 			("nfs_close: dirty unflushed (%d) directio buffers\n",
669 			 np->n_directio_asyncwr));
670 	if (nfs_directio_enable && (fmode & O_DIRECT) && (vp->v_type == VREG)) {
671 		mtx_lock(&np->n_mtx);
672 		KASSERT((np->n_directio_opens > 0),
673 			("nfs_close: unexpectedly value (0) of n_directio_opens\n"));
674 		np->n_directio_opens--;
675 		if (np->n_directio_opens == 0)
676 			np->n_flag &= ~NNONCACHE;
677 		mtx_unlock(&np->n_mtx);
678 	}
679 	return (error);
680 }
681 
682 /*
683  * nfs getattr call from vfs.
684  */
685 static int
nfs_getattr(struct vop_getattr_args * ap)686 nfs_getattr(struct vop_getattr_args *ap)
687 {
688 	struct vnode *vp = ap->a_vp;
689 	struct nfsnode *np = VTONFS(vp);
690 	struct thread *td = curthread;
691 	struct vattr *vap = ap->a_vap;
692 	struct vattr vattr;
693 	caddr_t bpos, dpos;
694 	int error = 0;
695 	struct mbuf *mreq, *mrep, *md, *mb;
696 	int v3 = NFS_ISV3(vp);
697 
698 	/*
699 	 * Update local times for special files.
700 	 */
701 	mtx_lock(&np->n_mtx);
702 	if (np->n_flag & (NACC | NUPD))
703 		np->n_flag |= NCHG;
704 	mtx_unlock(&np->n_mtx);
705 	/*
706 	 * First look in the cache.
707 	 */
708 	if (nfs_getattrcache(vp, &vattr) == 0)
709 		goto nfsmout;
710 	if (v3 && nfs_prime_access_cache && nfsaccess_cache_timeout > 0) {
711 		nfsstats.accesscache_misses++;
712 		nfs3_access_otw(vp, NFSV3ACCESS_ALL, td, ap->a_cred, NULL);
713 		if (nfs_getattrcache(vp, &vattr) == 0)
714 			goto nfsmout;
715 	}
716 	nfsstats.rpccnt[NFSPROC_GETATTR]++;
717 	mreq = m_get2(NFSX_FH(v3), M_WAITOK, MT_DATA, 0);
718 	mb = mreq;
719 	bpos = mtod(mb, caddr_t);
720 	nfsm_fhtom(vp, v3);
721 	nfsm_request(vp, NFSPROC_GETATTR, td, ap->a_cred);
722 	if (!error) {
723 		nfsm_loadattr(vp, &vattr);
724 	}
725 	m_freem(mrep);
726 nfsmout:
727 	vap->va_type = vattr.va_type;
728 	vap->va_mode = vattr.va_mode;
729 	vap->va_nlink = vattr.va_nlink;
730 	vap->va_uid = vattr.va_uid;
731 	vap->va_gid = vattr.va_gid;
732 	vap->va_fsid = vattr.va_fsid;
733 	vap->va_fileid = vattr.va_fileid;
734 	vap->va_size = vattr.va_size;
735 	vap->va_blocksize = vattr.va_blocksize;
736 	vap->va_atime = vattr.va_atime;
737 	vap->va_mtime = vattr.va_mtime;
738 	vap->va_ctime = vattr.va_ctime;
739 	vap->va_gen = vattr.va_gen;
740 	vap->va_flags = vattr.va_flags;
741 	vap->va_rdev = vattr.va_rdev;
742 	vap->va_bytes = vattr.va_bytes;
743 	vap->va_filerev = vattr.va_filerev;
744 
745 	return (error);
746 }
747 
748 /*
749  * nfs setattr call.
750  */
751 static int
nfs_setattr(struct vop_setattr_args * ap)752 nfs_setattr(struct vop_setattr_args *ap)
753 {
754 	struct vnode *vp = ap->a_vp;
755 	struct nfsnode *np = VTONFS(vp);
756 	struct vattr *vap = ap->a_vap;
757 	struct thread *td = curthread;
758 	int error = 0;
759 	u_quad_t tsize;
760 
761 #ifndef nolint
762 	tsize = (u_quad_t)0;
763 #endif
764 
765 	/*
766 	 * Setting of flags is not supported.
767 	 */
768 	if (vap->va_flags != VNOVAL)
769 		return (EOPNOTSUPP);
770 
771 	/*
772 	 * Disallow write attempts if the filesystem is mounted read-only.
773 	 */
774   	if ((vap->va_flags != VNOVAL || vap->va_uid != (uid_t)VNOVAL ||
775 	    vap->va_gid != (gid_t)VNOVAL || vap->va_atime.tv_sec != VNOVAL ||
776 	    vap->va_mtime.tv_sec != VNOVAL || vap->va_mode != (mode_t)VNOVAL) &&
777 	    (vp->v_mount->mnt_flag & MNT_RDONLY)) {
778 		error = EROFS;
779 		goto out;
780 	}
781 	if (vap->va_size != VNOVAL) {
782  		switch (vp->v_type) {
783  		case VDIR:
784  			return (EISDIR);
785  		case VCHR:
786  		case VBLK:
787  		case VSOCK:
788  		case VFIFO:
789 			if (vap->va_mtime.tv_sec == VNOVAL &&
790 			    vap->va_atime.tv_sec == VNOVAL &&
791 			    vap->va_mode == (mode_t)VNOVAL &&
792 			    vap->va_uid == (uid_t)VNOVAL &&
793 			    vap->va_gid == (gid_t)VNOVAL)
794 				return (0);
795  			vap->va_size = VNOVAL;
796  			break;
797  		default:
798 			/*
799 			 * Disallow write attempts if the filesystem is
800 			 * mounted read-only.
801 			 */
802 			if (vp->v_mount->mnt_flag & MNT_RDONLY)
803 				return (EROFS);
804 			/*
805 			 *  We run vnode_pager_setsize() early (why?),
806 			 * we must set np->n_size now to avoid vinvalbuf
807 			 * V_SAVE races that might setsize a lower
808 			 * value.
809 			 */
810 			mtx_lock(&np->n_mtx);
811 			tsize = np->n_size;
812 			mtx_unlock(&np->n_mtx);
813 			error = nfs_meta_setsize(vp, ap->a_cred, td,
814 			    vap->va_size);
815 			mtx_lock(&np->n_mtx);
816  			if (np->n_flag & NMODIFIED) {
817 			    tsize = np->n_size;
818 			    mtx_unlock(&np->n_mtx);
819  			    if (vap->va_size == 0)
820  				error = nfs_vinvalbuf(vp, 0, td, 1);
821  			    else
822  				error = nfs_vinvalbuf(vp, V_SAVE, td, 1);
823  			    if (error) {
824 				vnode_pager_setsize(vp, tsize);
825 				goto out;
826 			    }
827  			} else
828 			    mtx_unlock(&np->n_mtx);
829 			/*
830 			 * np->n_size has already been set to vap->va_size
831 			 * in nfs_meta_setsize(). We must set it again since
832 			 * nfs_loadattrcache() could be called through
833 			 * nfs_meta_setsize() and could modify np->n_size.
834 			 */
835 			mtx_lock(&np->n_mtx);
836  			np->n_vattr.va_size = np->n_size = vap->va_size;
837 			mtx_unlock(&np->n_mtx);
838   		};
839   	} else {
840 		mtx_lock(&np->n_mtx);
841 		if ((vap->va_mtime.tv_sec != VNOVAL || vap->va_atime.tv_sec != VNOVAL) &&
842 		    (np->n_flag & NMODIFIED) && vp->v_type == VREG) {
843 			mtx_unlock(&np->n_mtx);
844 			if ((error = nfs_vinvalbuf(vp, V_SAVE, td, 1)) != 0 &&
845 			    (error == EINTR || error == EIO))
846 				return error;
847 		} else
848 			mtx_unlock(&np->n_mtx);
849 	}
850 	error = nfs_setattrrpc(vp, vap, ap->a_cred);
851 	if (error && vap->va_size != VNOVAL) {
852 		mtx_lock(&np->n_mtx);
853 		np->n_size = np->n_vattr.va_size = tsize;
854 		vnode_pager_setsize(vp, tsize);
855 		mtx_unlock(&np->n_mtx);
856 	}
857 out:
858 	return (error);
859 }
860 
861 /*
862  * Do an nfs setattr rpc.
863  */
864 static int
nfs_setattrrpc(struct vnode * vp,struct vattr * vap,struct ucred * cred)865 nfs_setattrrpc(struct vnode *vp, struct vattr *vap, struct ucred *cred)
866 {
867 	struct nfsv2_sattr *sp;
868 	struct nfsnode *np = VTONFS(vp);
869 	caddr_t bpos, dpos;
870 	u_int32_t *tl;
871 	int error = 0, i, wccflag = NFSV3_WCCRATTR;
872 	struct mbuf *mreq, *mrep, *md, *mb;
873 	int v3 = NFS_ISV3(vp);
874 
875 	nfsstats.rpccnt[NFSPROC_SETATTR]++;
876 	mreq = m_get2(NFSX_FH(v3) + NFSX_SATTR(v3), M_WAITOK, MT_DATA, 0);
877 	mb = mreq;
878 	bpos = mtod(mb, caddr_t);
879 	nfsm_fhtom(vp, v3);
880 	if (v3) {
881 		nfsm_v3attrbuild(vap, TRUE);
882 		tl = nfsm_build(u_int32_t *, NFSX_UNSIGNED);
883 		*tl = nfs_false;
884 	} else {
885 		sp = nfsm_build(struct nfsv2_sattr *, NFSX_V2SATTR);
886 		if (vap->va_mode == (mode_t)VNOVAL)
887 			sp->sa_mode = nfs_xdrneg1;
888 		else
889 			sp->sa_mode = vtonfsv2_mode(vp->v_type, vap->va_mode);
890 		if (vap->va_uid == (uid_t)VNOVAL)
891 			sp->sa_uid = nfs_xdrneg1;
892 		else
893 			sp->sa_uid = txdr_unsigned(vap->va_uid);
894 		if (vap->va_gid == (gid_t)VNOVAL)
895 			sp->sa_gid = nfs_xdrneg1;
896 		else
897 			sp->sa_gid = txdr_unsigned(vap->va_gid);
898 		sp->sa_size = txdr_unsigned(vap->va_size);
899 		txdr_nfsv2time(&vap->va_atime, &sp->sa_atime);
900 		txdr_nfsv2time(&vap->va_mtime, &sp->sa_mtime);
901 	}
902 	nfsm_request(vp, NFSPROC_SETATTR, curthread, cred);
903 	if (v3) {
904 		mtx_lock(&np->n_mtx);
905 		for (i = 0; i < NFS_ACCESSCACHESIZE; i++)
906 			np->n_accesscache[i].stamp = 0;
907 		mtx_unlock(&np->n_mtx);
908 		KDTRACE_NFS_ACCESSCACHE_FLUSH_DONE(vp);
909 		nfsm_wcc_data(vp, wccflag);
910 	} else
911 		nfsm_loadattr(vp, NULL);
912 	m_freem(mrep);
913 nfsmout:
914 	return (error);
915 }
916 
917 /*
918  * nfs lookup call, one step at a time...
919  * First look in cache
920  * If not found, unlock the directory nfsnode and do the rpc
921  */
922 static int
nfs_lookup(struct vop_lookup_args * ap)923 nfs_lookup(struct vop_lookup_args *ap)
924 {
925 	struct componentname *cnp = ap->a_cnp;
926 	struct vnode *dvp = ap->a_dvp;
927 	struct vnode **vpp = ap->a_vpp;
928 	struct mount *mp = dvp->v_mount;
929 	struct vattr dvattr, vattr;
930 	struct timespec nctime;
931 	int flags = cnp->cn_flags;
932 	struct vnode *newvp;
933 	struct nfsmount *nmp;
934 	caddr_t bpos, dpos;
935 	struct mbuf *mreq, *mrep, *md, *mb;
936 	long len;
937 	nfsfh_t *fhp;
938 	struct nfsnode *np, *newnp;
939 	int error = 0, attrflag, dattrflag, fhsize, ltype, ncticks;
940 	int v3 = NFS_ISV3(dvp);
941 	struct thread *td = cnp->cn_thread;
942 
943 	*vpp = NULLVP;
944 	if ((flags & ISLASTCN) && (mp->mnt_flag & MNT_RDONLY) &&
945 	    (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME))
946 		return (EROFS);
947 	if (dvp->v_type != VDIR)
948 		return (ENOTDIR);
949 	nmp = VFSTONFS(mp);
950 	np = VTONFS(dvp);
951 	if ((error = VOP_ACCESS(dvp, VEXEC, cnp->cn_cred, td)) != 0) {
952 		*vpp = NULLVP;
953 		return (error);
954 	}
955 	error = cache_lookup(dvp, vpp, cnp, &nctime, &ncticks);
956 	if (error > 0 && error != ENOENT)
957 		return (error);
958 	if (error == -1) {
959 		/*
960 		 * Lookups of "." are special and always return the
961 		 * current directory.  cache_lookup() already handles
962 		 * associated locking bookkeeping, etc.
963 		 */
964 		if (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') {
965 			/* XXX: Is this really correct? */
966 			if (cnp->cn_nameiop != LOOKUP &&
967 			    (flags & ISLASTCN))
968 				cnp->cn_flags |= SAVENAME;
969 			return (0);
970 		}
971 
972 		/*
973 		 * We only accept a positive hit in the cache if the
974 		 * change time of the file matches our cached copy.
975 		 * Otherwise, we discard the cache entry and fallback
976 		 * to doing a lookup RPC.  We also only trust cache
977 		 * entries for less than nm_nametimeo seconds.
978 		 *
979 		 * To better handle stale file handles and attributes,
980 		 * clear the attribute cache of this node if it is a
981 		 * leaf component, part of an open() call, and not
982 		 * locally modified before fetching the attributes.
983 		 * This should allow stale file handles to be detected
984 		 * here where we can fall back to a LOOKUP RPC to
985 		 * recover rather than having nfs_open() detect the
986 		 * stale file handle and failing open(2) with ESTALE.
987 		 */
988 		newvp = *vpp;
989 		newnp = VTONFS(newvp);
990 		if (!(nmp->nm_flag & NFSMNT_NOCTO) &&
991 		    (flags & (ISLASTCN | ISOPEN)) == (ISLASTCN | ISOPEN) &&
992 		    !(newnp->n_flag & NMODIFIED)) {
993 			mtx_lock(&newnp->n_mtx);
994 			newnp->n_attrstamp = 0;
995 			KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(newvp);
996 			mtx_unlock(&newnp->n_mtx);
997 		}
998 		if ((u_int)(ticks - ncticks) < (nmp->nm_nametimeo * hz) &&
999 		    VOP_GETATTR(newvp, &vattr, cnp->cn_cred) == 0 &&
1000 		    timespeccmp(&vattr.va_ctime, &nctime, ==)) {
1001 			nfsstats.lookupcache_hits++;
1002 			if (cnp->cn_nameiop != LOOKUP &&
1003 			    (flags & ISLASTCN))
1004 				cnp->cn_flags |= SAVENAME;
1005 			return (0);
1006 		}
1007 		cache_purge(newvp);
1008 		if (dvp != newvp)
1009 			vput(newvp);
1010 		else
1011 			vrele(newvp);
1012 		*vpp = NULLVP;
1013 	} else if (error == ENOENT) {
1014 		if (dvp->v_iflag & VI_DOOMED)
1015 			return (ENOENT);
1016 		/*
1017 		 * We only accept a negative hit in the cache if the
1018 		 * modification time of the parent directory matches
1019 		 * the cached copy in the name cache entry.
1020 		 * Otherwise, we discard all of the negative cache
1021 		 * entries for this directory.  We also only trust
1022 		 * negative cache entries for up to nm_negnametimeo
1023 		 * seconds.
1024 		 */
1025 		if ((u_int)(ticks - ncticks) < (nmp->nm_negnametimeo * hz) &&
1026 		    VOP_GETATTR(dvp, &vattr, cnp->cn_cred) == 0 &&
1027 		    timespeccmp(&vattr.va_mtime, &nctime, ==)) {
1028 			nfsstats.lookupcache_hits++;
1029 			return (ENOENT);
1030 		}
1031 		cache_purge_negative(dvp);
1032 	}
1033 
1034 	attrflag = dattrflag = 0;
1035 	error = 0;
1036 	newvp = NULLVP;
1037 	nfsstats.lookupcache_misses++;
1038 	nfsstats.rpccnt[NFSPROC_LOOKUP]++;
1039 	len = cnp->cn_namelen;
1040 	mreq = m_get2(NFSX_FH(v3) + NFSX_UNSIGNED + nfsm_rndup(len), M_WAITOK,
1041 	    MT_DATA, 0);
1042 	mb = mreq;
1043 	bpos = mtod(mb, caddr_t);
1044 	nfsm_fhtom(dvp, v3);
1045 	nfsm_strtom(cnp->cn_nameptr, len, NFS_MAXNAMLEN);
1046 	nfsm_request(dvp, NFSPROC_LOOKUP, cnp->cn_thread, cnp->cn_cred);
1047 	if (error) {
1048 		if (v3) {
1049 			nfsm_postop_attr_va(dvp, dattrflag, &vattr);
1050 			m_freem(mrep);
1051 		}
1052 		goto nfsmout;
1053 	}
1054 	nfsm_getfh(fhp, fhsize, v3);
1055 
1056 	/*
1057 	 * Handle RENAME case...
1058 	 */
1059 	if (cnp->cn_nameiop == RENAME && (flags & ISLASTCN)) {
1060 		if (NFS_CMPFH(np, fhp, fhsize)) {
1061 			m_freem(mrep);
1062 			return (EISDIR);
1063 		}
1064 		error = nfs_nget(mp, fhp, fhsize, &np, LK_EXCLUSIVE);
1065 		if (error) {
1066 			m_freem(mrep);
1067 			return (error);
1068 		}
1069 		newvp = NFSTOV(np);
1070 		if (v3) {
1071 			nfsm_postop_attr(newvp, attrflag);
1072 			nfsm_postop_attr(dvp, attrflag);
1073 		} else
1074 			nfsm_loadattr(newvp, NULL);
1075 		*vpp = newvp;
1076 		m_freem(mrep);
1077 		cnp->cn_flags |= SAVENAME;
1078 		return (0);
1079 	}
1080 
1081 	if (flags & ISDOTDOT) {
1082 		ltype = VOP_ISLOCKED(dvp);
1083 		error = vfs_busy(mp, MBF_NOWAIT);
1084 		if (error != 0) {
1085 			vfs_ref(mp);
1086 			VOP_UNLOCK(dvp, 0);
1087 			error = vfs_busy(mp, 0);
1088 			vn_lock(dvp, ltype | LK_RETRY);
1089 			vfs_rel(mp);
1090 			if (error == 0 && (dvp->v_iflag & VI_DOOMED)) {
1091 				vfs_unbusy(mp);
1092 				error = ENOENT;
1093 			}
1094 			if (error != 0) {
1095 				m_freem(mrep);
1096 				return (error);
1097 			}
1098 		}
1099 		VOP_UNLOCK(dvp, 0);
1100 		error = nfs_nget(mp, fhp, fhsize, &np, cnp->cn_lkflags);
1101 		if (error == 0)
1102 			newvp = NFSTOV(np);
1103 		vfs_unbusy(mp);
1104 		if (newvp != dvp)
1105 			vn_lock(dvp, ltype | LK_RETRY);
1106 		if (dvp->v_iflag & VI_DOOMED) {
1107 			if (error == 0) {
1108 				if (newvp == dvp)
1109 					vrele(newvp);
1110 				else
1111 					vput(newvp);
1112 			}
1113 			error = ENOENT;
1114 		}
1115 		if (error) {
1116 			m_freem(mrep);
1117 			return (error);
1118 		}
1119 	} else if (NFS_CMPFH(np, fhp, fhsize)) {
1120 		VREF(dvp);
1121 		newvp = dvp;
1122 	} else {
1123 		error = nfs_nget(mp, fhp, fhsize, &np, cnp->cn_lkflags);
1124 		if (error) {
1125 			m_freem(mrep);
1126 			return (error);
1127 		}
1128 		newvp = NFSTOV(np);
1129 
1130 		/*
1131 		 * Flush the attribute cache when opening a leaf node
1132 		 * to ensure that fresh attributes are fetched in
1133 		 * nfs_open() if we are unable to fetch attributes
1134 		 * from the LOOKUP reply.
1135 		 */
1136 		if ((flags & (ISLASTCN | ISOPEN)) == (ISLASTCN | ISOPEN) &&
1137 		    !(np->n_flag & NMODIFIED)) {
1138 			mtx_lock(&np->n_mtx);
1139 			np->n_attrstamp = 0;
1140 			KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(newvp);
1141 			mtx_unlock(&np->n_mtx);
1142 		}
1143 	}
1144 	if (v3) {
1145 		nfsm_postop_attr_va(newvp, attrflag, &vattr);
1146 		nfsm_postop_attr_va(dvp, dattrflag, &dvattr);
1147 	} else {
1148 		nfsm_loadattr(newvp, &vattr);
1149 		attrflag = 1;
1150 	}
1151 	if (cnp->cn_nameiop != LOOKUP && (flags & ISLASTCN))
1152 		cnp->cn_flags |= SAVENAME;
1153 	if ((cnp->cn_flags & MAKEENTRY) &&
1154 	    (cnp->cn_nameiop != DELETE || !(flags & ISLASTCN)) &&
1155 	    attrflag != 0 && (newvp->v_type != VDIR || dattrflag != 0))
1156 		cache_enter_time(dvp, newvp, cnp, &vattr.va_ctime,
1157 		    newvp->v_type != VDIR ? NULL : &dvattr.va_ctime);
1158 	*vpp = newvp;
1159 	m_freem(mrep);
1160 nfsmout:
1161 	if (error) {
1162 		if (newvp != NULLVP) {
1163 			vput(newvp);
1164 			*vpp = NULLVP;
1165 		}
1166 
1167 		if (error != ENOENT)
1168 			goto done;
1169 
1170 		/* The requested file was not found. */
1171 		if ((cnp->cn_nameiop == CREATE || cnp->cn_nameiop == RENAME) &&
1172 		    (flags & ISLASTCN)) {
1173 			/*
1174 			 * XXX: UFS does a full VOP_ACCESS(dvp,
1175 			 * VWRITE) here instead of just checking
1176 			 * MNT_RDONLY.
1177 			 */
1178 			if (mp->mnt_flag & MNT_RDONLY)
1179 				return (EROFS);
1180 			cnp->cn_flags |= SAVENAME;
1181 			return (EJUSTRETURN);
1182 		}
1183 
1184 		if ((cnp->cn_flags & MAKEENTRY) != 0 && dattrflag) {
1185 			/*
1186 			 * Cache the modification time of the parent
1187 			 * directory from the post-op attributes in
1188 			 * the name cache entry.  The negative cache
1189 			 * entry will be ignored once the directory
1190 			 * has changed.  Don't bother adding the entry
1191 			 * if the directory has already changed.
1192 			 */
1193 			mtx_lock(&np->n_mtx);
1194 			if (timespeccmp(&np->n_vattr.va_mtime,
1195 			    &vattr.va_mtime, ==)) {
1196 				mtx_unlock(&np->n_mtx);
1197 				cache_enter_time(dvp, NULL, cnp,
1198 				    &vattr.va_mtime, NULL);
1199 			} else
1200 				mtx_unlock(&np->n_mtx);
1201 		}
1202 		return (ENOENT);
1203 	}
1204 done:
1205 	return (error);
1206 }
1207 
1208 /*
1209  * nfs read call.
1210  * Just call nfs_bioread() to do the work.
1211  */
1212 static int
nfs_read(struct vop_read_args * ap)1213 nfs_read(struct vop_read_args *ap)
1214 {
1215 	struct vnode *vp = ap->a_vp;
1216 
1217 	switch (vp->v_type) {
1218 	case VREG:
1219 		return (nfs_bioread(vp, ap->a_uio, ap->a_ioflag, ap->a_cred));
1220 	case VDIR:
1221 		return (EISDIR);
1222 	default:
1223 		return (EOPNOTSUPP);
1224 	}
1225 }
1226 
1227 /*
1228  * nfs readlink call
1229  */
1230 static int
nfs_readlink(struct vop_readlink_args * ap)1231 nfs_readlink(struct vop_readlink_args *ap)
1232 {
1233 	struct vnode *vp = ap->a_vp;
1234 
1235 	if (vp->v_type != VLNK)
1236 		return (EINVAL);
1237 	return (nfs_bioread(vp, ap->a_uio, 0, ap->a_cred));
1238 }
1239 
1240 /*
1241  * Do a readlink rpc.
1242  * Called by nfs_doio() from below the buffer cache.
1243  */
1244 int
nfs_readlinkrpc(struct vnode * vp,struct uio * uiop,struct ucred * cred)1245 nfs_readlinkrpc(struct vnode *vp, struct uio *uiop, struct ucred *cred)
1246 {
1247 	caddr_t bpos, dpos;
1248 	int error = 0, len, attrflag;
1249 	struct mbuf *mreq, *mrep, *md, *mb;
1250 	int v3 = NFS_ISV3(vp);
1251 
1252 	nfsstats.rpccnt[NFSPROC_READLINK]++;
1253 	mreq = m_get2(NFSX_FH(v3), M_WAITOK, MT_DATA, 0);
1254 	mb = mreq;
1255 	bpos = mtod(mb, caddr_t);
1256 	nfsm_fhtom(vp, v3);
1257 	nfsm_request(vp, NFSPROC_READLINK, uiop->uio_td, cred);
1258 	if (v3)
1259 		nfsm_postop_attr(vp, attrflag);
1260 	if (!error) {
1261 		nfsm_strsiz(len, NFS_MAXPATHLEN);
1262 		if (len == NFS_MAXPATHLEN) {
1263 			struct nfsnode *np = VTONFS(vp);
1264 			mtx_lock(&np->n_mtx);
1265 			if (np->n_size && np->n_size < NFS_MAXPATHLEN)
1266 				len = np->n_size;
1267 			mtx_unlock(&np->n_mtx);
1268 		}
1269 		nfsm_mtouio(uiop, len);
1270 	}
1271 	m_freem(mrep);
1272 nfsmout:
1273 	return (error);
1274 }
1275 
1276 /*
1277  * nfs read rpc call
1278  * Ditto above
1279  */
1280 int
nfs_readrpc(struct vnode * vp,struct uio * uiop,struct ucred * cred)1281 nfs_readrpc(struct vnode *vp, struct uio *uiop, struct ucred *cred)
1282 {
1283 	u_int32_t *tl;
1284 	caddr_t bpos, dpos;
1285 	struct mbuf *mreq, *mrep, *md, *mb;
1286 	struct nfsmount *nmp;
1287 	off_t end;
1288 	int error = 0, len, retlen, tsiz, eof, attrflag;
1289 	int v3 = NFS_ISV3(vp);
1290 	int rsize;
1291 
1292 #ifndef nolint
1293 	eof = 0;
1294 #endif
1295 	nmp = VFSTONFS(vp->v_mount);
1296 	tsiz = uiop->uio_resid;
1297 	mtx_lock(&nmp->nm_mtx);
1298 	end = uiop->uio_offset + tsiz;
1299 	if (end > nmp->nm_maxfilesize || end < uiop->uio_offset) {
1300 		mtx_unlock(&nmp->nm_mtx);
1301 		return (EFBIG);
1302 	}
1303 	rsize = nmp->nm_rsize;
1304 	mtx_unlock(&nmp->nm_mtx);
1305 	while (tsiz > 0) {
1306 		nfsstats.rpccnt[NFSPROC_READ]++;
1307 		len = (tsiz > rsize) ? rsize : tsiz;
1308 		mreq = m_get2(NFSX_FH(v3) + NFSX_UNSIGNED * 3, M_WAITOK,
1309 		    MT_DATA, 0);
1310 		mb = mreq;
1311 		bpos = mtod(mb, caddr_t);
1312 		nfsm_fhtom(vp, v3);
1313 		tl = nfsm_build(u_int32_t *, NFSX_UNSIGNED * 3);
1314 		if (v3) {
1315 			txdr_hyper(uiop->uio_offset, tl);
1316 			*(tl + 2) = txdr_unsigned(len);
1317 		} else {
1318 			*tl++ = txdr_unsigned(uiop->uio_offset);
1319 			*tl++ = txdr_unsigned(len);
1320 			*tl = 0;
1321 		}
1322 		nfsm_request(vp, NFSPROC_READ, uiop->uio_td, cred);
1323 		if (v3) {
1324 			nfsm_postop_attr(vp, attrflag);
1325 			if (error) {
1326 				m_freem(mrep);
1327 				goto nfsmout;
1328 			}
1329 			tl = nfsm_dissect(u_int32_t *, 2 * NFSX_UNSIGNED);
1330 			eof = fxdr_unsigned(int, *(tl + 1));
1331 		} else {
1332 			nfsm_loadattr(vp, NULL);
1333 		}
1334 		nfsm_strsiz(retlen, rsize);
1335 		nfsm_mtouio(uiop, retlen);
1336 		m_freem(mrep);
1337 		tsiz -= retlen;
1338 		if (v3) {
1339 			if (eof || retlen == 0) {
1340 				tsiz = 0;
1341 			}
1342 		} else if (retlen < len) {
1343 			tsiz = 0;
1344 		}
1345 	}
1346 nfsmout:
1347 	return (error);
1348 }
1349 
1350 /*
1351  * nfs write call
1352  */
1353 int
nfs_writerpc(struct vnode * vp,struct uio * uiop,struct ucred * cred,int * iomode,int * must_commit)1354 nfs_writerpc(struct vnode *vp, struct uio *uiop, struct ucred *cred,
1355 	     int *iomode, int *must_commit)
1356 {
1357 	u_int32_t *tl;
1358 	int32_t backup;
1359 	caddr_t bpos, dpos;
1360 	struct mbuf *mreq, *mrep, *md, *mb;
1361 	struct nfsmount *nmp = VFSTONFS(vp->v_mount);
1362 	off_t end;
1363 	int error = 0, len, tsiz, wccflag = NFSV3_WCCRATTR, rlen, commit;
1364 	int v3 = NFS_ISV3(vp), committed = NFSV3WRITE_FILESYNC;
1365 	int wsize;
1366 
1367 	KASSERT(uiop->uio_iovcnt == 1, ("nfs: writerpc iovcnt > 1"));
1368 	*must_commit = 0;
1369 	tsiz = uiop->uio_resid;
1370 	mtx_lock(&nmp->nm_mtx);
1371 	end = uiop->uio_offset + tsiz;
1372 	if (end > nmp->nm_maxfilesize || end < uiop->uio_offset) {
1373 		mtx_unlock(&nmp->nm_mtx);
1374 		return (EFBIG);
1375 	}
1376 	wsize = nmp->nm_wsize;
1377 	mtx_unlock(&nmp->nm_mtx);
1378 	while (tsiz > 0) {
1379 		nfsstats.rpccnt[NFSPROC_WRITE]++;
1380 		len = (tsiz > wsize) ? wsize : tsiz;
1381 		mreq = m_get2(NFSX_FH(v3) + 5 * NFSX_UNSIGNED, M_WAITOK,
1382 		    MT_DATA, 0);
1383 		mb = mreq;
1384 		bpos = mtod(mb, caddr_t);
1385 		nfsm_fhtom(vp, v3);
1386 		if (v3) {
1387 			tl = nfsm_build(u_int32_t *, 5 * NFSX_UNSIGNED);
1388 			txdr_hyper(uiop->uio_offset, tl);
1389 			tl += 2;
1390 			*tl++ = txdr_unsigned(len);
1391 			*tl++ = txdr_unsigned(*iomode);
1392 			*tl = txdr_unsigned(len);
1393 		} else {
1394 			u_int32_t x;
1395 
1396 			tl = nfsm_build(u_int32_t *, 4 * NFSX_UNSIGNED);
1397 			/* Set both "begin" and "current" to non-garbage. */
1398 			x = txdr_unsigned((u_int32_t)uiop->uio_offset);
1399 			*tl++ = x;	/* "begin offset" */
1400 			*tl++ = x;	/* "current offset" */
1401 			x = txdr_unsigned(len);
1402 			*tl++ = x;	/* total to this offset */
1403 			*tl = x;	/* size of this write */
1404 		}
1405 		nfsm_uiotom(uiop, len);
1406 		nfsm_request(vp, NFSPROC_WRITE, uiop->uio_td, cred);
1407 		if (v3) {
1408 			wccflag = NFSV3_WCCCHK;
1409 			nfsm_wcc_data(vp, wccflag);
1410 			if (!error) {
1411 				tl = nfsm_dissect(u_int32_t *, 2 * NFSX_UNSIGNED
1412 					+ NFSX_V3WRITEVERF);
1413 				rlen = fxdr_unsigned(int, *tl++);
1414 				if (rlen == 0) {
1415 					error = NFSERR_IO;
1416 					m_freem(mrep);
1417 					break;
1418 				} else if (rlen < len) {
1419 					backup = len - rlen;
1420 					uiop->uio_iov->iov_base =
1421 					    (char *)uiop->uio_iov->iov_base -
1422 					    backup;
1423 					uiop->uio_iov->iov_len += backup;
1424 					uiop->uio_offset -= backup;
1425 					uiop->uio_resid += backup;
1426 					len = rlen;
1427 				}
1428 				commit = fxdr_unsigned(int, *tl++);
1429 
1430 				/*
1431 				 * Return the lowest committment level
1432 				 * obtained by any of the RPCs.
1433 				 */
1434 				if (committed == NFSV3WRITE_FILESYNC)
1435 					committed = commit;
1436 				else if (committed == NFSV3WRITE_DATASYNC &&
1437 					commit == NFSV3WRITE_UNSTABLE)
1438 					committed = commit;
1439 				mtx_lock(&nmp->nm_mtx);
1440 				if ((nmp->nm_state & NFSSTA_HASWRITEVERF) == 0){
1441 				    bcopy((caddr_t)tl, (caddr_t)nmp->nm_verf,
1442 					NFSX_V3WRITEVERF);
1443 				    nmp->nm_state |= NFSSTA_HASWRITEVERF;
1444 				} else if (bcmp((caddr_t)tl,
1445 				    (caddr_t)nmp->nm_verf, NFSX_V3WRITEVERF)) {
1446 				    *must_commit = 1;
1447 				    bcopy((caddr_t)tl, (caddr_t)nmp->nm_verf,
1448 					NFSX_V3WRITEVERF);
1449 				}
1450 				mtx_unlock(&nmp->nm_mtx);
1451 			}
1452 		} else {
1453 			nfsm_loadattr(vp, NULL);
1454 		}
1455 		if (wccflag) {
1456 			mtx_lock(&(VTONFS(vp))->n_mtx);
1457 			VTONFS(vp)->n_mtime = VTONFS(vp)->n_vattr.va_mtime;
1458 			mtx_unlock(&(VTONFS(vp))->n_mtx);
1459 		}
1460 		m_freem(mrep);
1461 		if (error)
1462 			break;
1463 		tsiz -= len;
1464 	}
1465 nfsmout:
1466 	if (DOINGASYNC(vp))
1467 		committed = NFSV3WRITE_FILESYNC;
1468 	*iomode = committed;
1469 	if (error)
1470 		uiop->uio_resid = tsiz;
1471 	return (error);
1472 }
1473 
1474 /*
1475  * nfs mknod rpc
1476  * For NFS v2 this is a kludge. Use a create rpc but with the IFMT bits of the
1477  * mode set to specify the file type and the size field for rdev.
1478  */
1479 static int
nfs_mknodrpc(struct vnode * dvp,struct vnode ** vpp,struct componentname * cnp,struct vattr * vap)1480 nfs_mknodrpc(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp,
1481     struct vattr *vap)
1482 {
1483 	struct nfsv2_sattr *sp;
1484 	u_int32_t *tl;
1485 	struct vnode *newvp = NULL;
1486 	struct nfsnode *np = NULL;
1487 	struct vattr vattr;
1488 	caddr_t bpos, dpos;
1489 	int error = 0, wccflag = NFSV3_WCCRATTR, gotvp = 0;
1490 	struct mbuf *mreq, *mrep, *md, *mb;
1491 	u_int32_t rdev;
1492 	int v3 = NFS_ISV3(dvp);
1493 
1494 	if (vap->va_type == VCHR || vap->va_type == VBLK)
1495 		rdev = txdr_unsigned(vap->va_rdev);
1496 	else if (vap->va_type == VFIFO || vap->va_type == VSOCK)
1497 		rdev = nfs_xdrneg1;
1498 	else {
1499 		return (EOPNOTSUPP);
1500 	}
1501 	if ((error = VOP_GETATTR(dvp, &vattr, cnp->cn_cred)) != 0)
1502 		return (error);
1503 	nfsstats.rpccnt[NFSPROC_MKNOD]++;
1504 	mreq = m_get2(NFSX_FH(v3) + 4 * NFSX_UNSIGNED +
1505 	    nfsm_rndup(cnp->cn_namelen) + NFSX_SATTR(v3), M_WAITOK, MT_DATA, 0);
1506 	mb = mreq;
1507 	bpos = mtod(mb, caddr_t);
1508 	nfsm_fhtom(dvp, v3);
1509 	nfsm_strtom(cnp->cn_nameptr, cnp->cn_namelen, NFS_MAXNAMLEN);
1510 	if (v3) {
1511 		tl = nfsm_build(u_int32_t *, NFSX_UNSIGNED);
1512 		*tl++ = vtonfsv3_type(vap->va_type);
1513 		nfsm_v3attrbuild(vap, FALSE);
1514 		if (vap->va_type == VCHR || vap->va_type == VBLK) {
1515 			tl = nfsm_build(u_int32_t *, 2 * NFSX_UNSIGNED);
1516 			*tl++ = txdr_unsigned(major(vap->va_rdev));
1517 			*tl = txdr_unsigned(minor(vap->va_rdev));
1518 		}
1519 	} else {
1520 		sp = nfsm_build(struct nfsv2_sattr *, NFSX_V2SATTR);
1521 		sp->sa_mode = vtonfsv2_mode(vap->va_type, vap->va_mode);
1522 		sp->sa_uid = nfs_xdrneg1;
1523 		sp->sa_gid = nfs_xdrneg1;
1524 		sp->sa_size = rdev;
1525 		txdr_nfsv2time(&vap->va_atime, &sp->sa_atime);
1526 		txdr_nfsv2time(&vap->va_mtime, &sp->sa_mtime);
1527 	}
1528 	nfsm_request(dvp, NFSPROC_MKNOD, cnp->cn_thread, cnp->cn_cred);
1529 	if (!error) {
1530 		nfsm_mtofh(dvp, newvp, v3, gotvp);
1531 		if (!gotvp) {
1532 			if (newvp) {
1533 				vput(newvp);
1534 				newvp = NULL;
1535 			}
1536 			error = nfs_lookitup(dvp, cnp->cn_nameptr,
1537 			    cnp->cn_namelen, cnp->cn_cred, cnp->cn_thread, &np);
1538 			if (!error)
1539 				newvp = NFSTOV(np);
1540 		}
1541 	}
1542 	if (v3)
1543 		nfsm_wcc_data(dvp, wccflag);
1544 	m_freem(mrep);
1545 nfsmout:
1546 	if (error) {
1547 		if (newvp)
1548 			vput(newvp);
1549 	} else {
1550 		*vpp = newvp;
1551 	}
1552 	mtx_lock(&(VTONFS(dvp))->n_mtx);
1553 	VTONFS(dvp)->n_flag |= NMODIFIED;
1554 	if (!wccflag) {
1555 		VTONFS(dvp)->n_attrstamp = 0;
1556 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(dvp);
1557 	}
1558 	mtx_unlock(&(VTONFS(dvp))->n_mtx);
1559 	return (error);
1560 }
1561 
1562 /*
1563  * nfs mknod vop
1564  * just call nfs_mknodrpc() to do the work.
1565  */
1566 /* ARGSUSED */
1567 static int
nfs_mknod(struct vop_mknod_args * ap)1568 nfs_mknod(struct vop_mknod_args *ap)
1569 {
1570 	return (nfs_mknodrpc(ap->a_dvp, ap->a_vpp, ap->a_cnp, ap->a_vap));
1571 }
1572 
1573 static u_long create_verf;
1574 /*
1575  * nfs file create call
1576  */
1577 static int
nfs_create(struct vop_create_args * ap)1578 nfs_create(struct vop_create_args *ap)
1579 {
1580 	struct vnode *dvp = ap->a_dvp;
1581 	struct vattr *vap = ap->a_vap;
1582 	struct componentname *cnp = ap->a_cnp;
1583 	struct nfsv2_sattr *sp;
1584 	u_int32_t *tl;
1585 	struct nfsnode *np = NULL;
1586 	struct vnode *newvp = NULL;
1587 	caddr_t bpos, dpos;
1588 	int error = 0, wccflag = NFSV3_WCCRATTR, gotvp = 0, fmode = 0;
1589 	struct mbuf *mreq, *mrep, *md, *mb;
1590 	struct vattr vattr;
1591 	int v3 = NFS_ISV3(dvp);
1592 
1593 	/*
1594 	 * Oops, not for me..
1595 	 */
1596 	if (vap->va_type == VSOCK) {
1597 		error = nfs_mknodrpc(dvp, ap->a_vpp, cnp, vap);
1598 		return (error);
1599 	}
1600 
1601 	if ((error = VOP_GETATTR(dvp, &vattr, cnp->cn_cred)) != 0) {
1602 		return (error);
1603 	}
1604 	if (vap->va_vaflags & VA_EXCLUSIVE)
1605 		fmode |= O_EXCL;
1606 again:
1607 	nfsstats.rpccnt[NFSPROC_CREATE]++;
1608 	mreq = m_get2(NFSX_FH(v3) + 2 * NFSX_UNSIGNED +
1609 	    nfsm_rndup(cnp->cn_namelen) + NFSX_SATTR(v3), M_WAITOK, MT_DATA, 0);
1610 	mb = mreq;
1611 	bpos = mtod(mb, caddr_t);
1612 	nfsm_fhtom(dvp, v3);
1613 	nfsm_strtom(cnp->cn_nameptr, cnp->cn_namelen, NFS_MAXNAMLEN);
1614 	if (v3) {
1615 		tl = nfsm_build(u_int32_t *, NFSX_UNSIGNED);
1616 		if (fmode & O_EXCL) {
1617 			*tl = txdr_unsigned(NFSV3CREATE_EXCLUSIVE);
1618 			tl = nfsm_build(u_int32_t *, NFSX_V3CREATEVERF);
1619 #ifdef INET
1620 			CURVNET_SET(CRED_TO_VNET(cnp->cn_cred));
1621 			IN_IFADDR_RLOCK();
1622 			if (!TAILQ_EMPTY(&V_in_ifaddrhead))
1623 				*tl++ = IA_SIN(TAILQ_FIRST(&V_in_ifaddrhead))->sin_addr.s_addr;
1624 			else
1625 #endif
1626 				*tl++ = create_verf;
1627 #ifdef INET
1628 			IN_IFADDR_RUNLOCK();
1629 			CURVNET_RESTORE();
1630 #endif
1631 			*tl = ++create_verf;
1632 		} else {
1633 			*tl = txdr_unsigned(NFSV3CREATE_UNCHECKED);
1634 			nfsm_v3attrbuild(vap, FALSE);
1635 		}
1636 	} else {
1637 		sp = nfsm_build(struct nfsv2_sattr *, NFSX_V2SATTR);
1638 		sp->sa_mode = vtonfsv2_mode(vap->va_type, vap->va_mode);
1639 		sp->sa_uid = nfs_xdrneg1;
1640 		sp->sa_gid = nfs_xdrneg1;
1641 		sp->sa_size = 0;
1642 		txdr_nfsv2time(&vap->va_atime, &sp->sa_atime);
1643 		txdr_nfsv2time(&vap->va_mtime, &sp->sa_mtime);
1644 	}
1645 	nfsm_request(dvp, NFSPROC_CREATE, cnp->cn_thread, cnp->cn_cred);
1646 	if (!error) {
1647 		nfsm_mtofh(dvp, newvp, v3, gotvp);
1648 		if (!gotvp) {
1649 			if (newvp) {
1650 				vput(newvp);
1651 				newvp = NULL;
1652 			}
1653 			error = nfs_lookitup(dvp, cnp->cn_nameptr,
1654 			    cnp->cn_namelen, cnp->cn_cred, cnp->cn_thread, &np);
1655 			if (!error)
1656 				newvp = NFSTOV(np);
1657 		}
1658 	}
1659 	if (v3)
1660 		nfsm_wcc_data(dvp, wccflag);
1661 	m_freem(mrep);
1662 nfsmout:
1663 	if (error) {
1664 		if (v3 && (fmode & O_EXCL) && error == NFSERR_NOTSUPP) {
1665 			fmode &= ~O_EXCL;
1666 			goto again;
1667 		}
1668 		if (newvp)
1669 			vput(newvp);
1670 	} else if (v3 && (fmode & O_EXCL)) {
1671 		/*
1672 		 * We are normally called with only a partially initialized
1673 		 * VAP.  Since the NFSv3 spec says that server may use the
1674 		 * file attributes to store the verifier, the spec requires
1675 		 * us to do a SETATTR RPC. FreeBSD servers store the verifier
1676 		 * in atime, but we can't really assume that all servers will
1677 		 * so we ensure that our SETATTR sets both atime and mtime.
1678 		 */
1679 		if (vap->va_mtime.tv_sec == VNOVAL)
1680 			vfs_timestamp(&vap->va_mtime);
1681 		if (vap->va_atime.tv_sec == VNOVAL)
1682 			vap->va_atime = vap->va_mtime;
1683 		error = nfs_setattrrpc(newvp, vap, cnp->cn_cred);
1684 		if (error)
1685 			vput(newvp);
1686 	}
1687 	if (!error) {
1688 		*ap->a_vpp = newvp;
1689 	}
1690 	mtx_lock(&(VTONFS(dvp))->n_mtx);
1691 	VTONFS(dvp)->n_flag |= NMODIFIED;
1692 	if (!wccflag) {
1693 		VTONFS(dvp)->n_attrstamp = 0;
1694 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(dvp);
1695 	}
1696 	mtx_unlock(&(VTONFS(dvp))->n_mtx);
1697 	return (error);
1698 }
1699 
1700 /*
1701  * nfs file remove call
1702  * To try and make nfs semantics closer to ufs semantics, a file that has
1703  * other processes using the vnode is renamed instead of removed and then
1704  * removed later on the last close.
1705  * - If v_usecount > 1
1706  *	  If a rename is not already in the works
1707  *	     call nfs_sillyrename() to set it up
1708  *     else
1709  *	  do the remove rpc
1710  */
1711 static int
nfs_remove(struct vop_remove_args * ap)1712 nfs_remove(struct vop_remove_args *ap)
1713 {
1714 	struct vnode *vp = ap->a_vp;
1715 	struct vnode *dvp = ap->a_dvp;
1716 	struct componentname *cnp = ap->a_cnp;
1717 	struct nfsnode *np = VTONFS(vp);
1718 	int error = 0;
1719 	struct vattr vattr;
1720 
1721 	KASSERT((cnp->cn_flags & HASBUF) != 0, ("nfs_remove: no name"));
1722 	KASSERT(vrefcnt(vp) > 0, ("nfs_remove: bad v_usecount"));
1723 	if (vp->v_type == VDIR)
1724 		error = EPERM;
1725 	else if (vrefcnt(vp) == 1 || (np->n_sillyrename &&
1726 	    !VOP_GETATTR(vp, &vattr, cnp->cn_cred) && vattr.va_nlink > 1)) {
1727 		/*
1728 		 * Purge the name cache so that the chance of a lookup for
1729 		 * the name succeeding while the remove is in progress is
1730 		 * minimized. Without node locking it can still happen, such
1731 		 * that an I/O op returns ESTALE, but since you get this if
1732 		 * another host removes the file..
1733 		 */
1734 		cache_purge(vp);
1735 		/*
1736 		 * throw away biocache buffers, mainly to avoid
1737 		 * unnecessary delayed writes later.
1738 		 */
1739 		error = nfs_vinvalbuf(vp, 0, cnp->cn_thread, 1);
1740 		/* Do the rpc */
1741 		if (error != EINTR && error != EIO)
1742 			error = nfs_removerpc(dvp, cnp->cn_nameptr,
1743 				cnp->cn_namelen, cnp->cn_cred, cnp->cn_thread);
1744 		/*
1745 		 * Kludge City: If the first reply to the remove rpc is lost..
1746 		 *   the reply to the retransmitted request will be ENOENT
1747 		 *   since the file was in fact removed
1748 		 *   Therefore, we cheat and return success.
1749 		 */
1750 		if (error == ENOENT)
1751 			error = 0;
1752 	} else if (!np->n_sillyrename)
1753 		error = nfs_sillyrename(dvp, vp, cnp);
1754 	mtx_lock(&np->n_mtx);
1755 	np->n_attrstamp = 0;
1756 	mtx_unlock(&np->n_mtx);
1757 	KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(vp);
1758 	return (error);
1759 }
1760 
1761 /*
1762  * nfs file remove rpc called from nfs_inactive
1763  */
1764 int
nfs_removeit(struct sillyrename * sp)1765 nfs_removeit(struct sillyrename *sp)
1766 {
1767 	/*
1768 	 * Make sure that the directory vnode is still valid.
1769 	 * XXX we should lock sp->s_dvp here.
1770 	 */
1771 	if (sp->s_dvp->v_type == VBAD)
1772 		return (0);
1773 	return (nfs_removerpc(sp->s_dvp, sp->s_name, sp->s_namlen, sp->s_cred,
1774 		NULL));
1775 }
1776 
1777 /*
1778  * Nfs remove rpc, called from nfs_remove() and nfs_removeit().
1779  */
1780 static int
nfs_removerpc(struct vnode * dvp,const char * name,int namelen,struct ucred * cred,struct thread * td)1781 nfs_removerpc(struct vnode *dvp, const char *name, int namelen,
1782     struct ucred *cred, struct thread *td)
1783 {
1784 	caddr_t bpos, dpos;
1785 	int error = 0, wccflag = NFSV3_WCCRATTR;
1786 	struct mbuf *mreq, *mrep, *md, *mb;
1787 	int v3 = NFS_ISV3(dvp);
1788 
1789 	nfsstats.rpccnt[NFSPROC_REMOVE]++;
1790 	mreq = m_get2(NFSX_FH(v3) + NFSX_UNSIGNED + nfsm_rndup(namelen),
1791 	    M_WAITOK, MT_DATA, 0);
1792 	mb = mreq;
1793 	bpos = mtod(mb, caddr_t);
1794 	nfsm_fhtom(dvp, v3);
1795 	nfsm_strtom(name, namelen, NFS_MAXNAMLEN);
1796 	nfsm_request(dvp, NFSPROC_REMOVE, td, cred);
1797 	if (v3)
1798 		nfsm_wcc_data(dvp, wccflag);
1799 	m_freem(mrep);
1800 nfsmout:
1801 	mtx_lock(&(VTONFS(dvp))->n_mtx);
1802 	VTONFS(dvp)->n_flag |= NMODIFIED;
1803 	if (!wccflag) {
1804 		VTONFS(dvp)->n_attrstamp = 0;
1805 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(dvp);
1806 	}
1807 	mtx_unlock(&(VTONFS(dvp))->n_mtx);
1808 	return (error);
1809 }
1810 
1811 /*
1812  * nfs file rename call
1813  */
1814 static int
nfs_rename(struct vop_rename_args * ap)1815 nfs_rename(struct vop_rename_args *ap)
1816 {
1817 	struct vnode *fvp = ap->a_fvp;
1818 	struct vnode *tvp = ap->a_tvp;
1819 	struct vnode *fdvp = ap->a_fdvp;
1820 	struct vnode *tdvp = ap->a_tdvp;
1821 	struct componentname *tcnp = ap->a_tcnp;
1822 	struct componentname *fcnp = ap->a_fcnp;
1823 	int error;
1824 
1825 	KASSERT((tcnp->cn_flags & HASBUF) != 0 &&
1826 	    (fcnp->cn_flags & HASBUF) != 0, ("nfs_rename: no name"));
1827 	/* Check for cross-device rename */
1828 	if ((fvp->v_mount != tdvp->v_mount) ||
1829 	    (tvp && (fvp->v_mount != tvp->v_mount))) {
1830 		error = EXDEV;
1831 		goto out;
1832 	}
1833 
1834 	if (fvp == tvp) {
1835 		nfs_printf("nfs_rename: fvp == tvp (can't happen)\n");
1836 		error = 0;
1837 		goto out;
1838 	}
1839 	if ((error = vn_lock(fvp, LK_EXCLUSIVE)) != 0)
1840 		goto out;
1841 
1842 	/*
1843 	 * We have to flush B_DELWRI data prior to renaming
1844 	 * the file.  If we don't, the delayed-write buffers
1845 	 * can be flushed out later after the file has gone stale
1846 	 * under NFSV3.  NFSV2 does not have this problem because
1847 	 * ( as far as I can tell ) it flushes dirty buffers more
1848 	 * often.
1849 	 *
1850 	 * Skip the rename operation if the fsync fails, this can happen
1851 	 * due to the server's volume being full, when we pushed out data
1852 	 * that was written back to our cache earlier. Not checking for
1853 	 * this condition can result in potential (silent) data loss.
1854 	 */
1855 	error = VOP_FSYNC(fvp, MNT_WAIT, fcnp->cn_thread);
1856 	VOP_UNLOCK(fvp, 0);
1857 	if (!error && tvp)
1858 		error = VOP_FSYNC(tvp, MNT_WAIT, tcnp->cn_thread);
1859 	if (error)
1860 		goto out;
1861 
1862 	/*
1863 	 * If the tvp exists and is in use, sillyrename it before doing the
1864 	 * rename of the new file over it.
1865 	 * XXX Can't sillyrename a directory.
1866 	 */
1867 	if (tvp && vrefcnt(tvp) > 1 && !VTONFS(tvp)->n_sillyrename &&
1868 		tvp->v_type != VDIR && !nfs_sillyrename(tdvp, tvp, tcnp)) {
1869 		vput(tvp);
1870 		tvp = NULL;
1871 	}
1872 
1873 	error = nfs_renamerpc(fdvp, fcnp->cn_nameptr, fcnp->cn_namelen,
1874 		tdvp, tcnp->cn_nameptr, tcnp->cn_namelen, tcnp->cn_cred,
1875 		tcnp->cn_thread);
1876 
1877 	if (fvp->v_type == VDIR) {
1878 		if (tvp != NULL && tvp->v_type == VDIR)
1879 			cache_purge(tdvp);
1880 		cache_purge(fdvp);
1881 	}
1882 
1883 out:
1884 	if (tdvp == tvp)
1885 		vrele(tdvp);
1886 	else
1887 		vput(tdvp);
1888 	if (tvp)
1889 		vput(tvp);
1890 	vrele(fdvp);
1891 	vrele(fvp);
1892 	/*
1893 	 * Kludge: Map ENOENT => 0 assuming that it is a reply to a retry.
1894 	 */
1895 	if (error == ENOENT)
1896 		error = 0;
1897 	return (error);
1898 }
1899 
1900 /*
1901  * nfs file rename rpc called from nfs_remove() above
1902  */
1903 static int
nfs_renameit(struct vnode * sdvp,struct componentname * scnp,struct sillyrename * sp)1904 nfs_renameit(struct vnode *sdvp, struct componentname *scnp,
1905     struct sillyrename *sp)
1906 {
1907 
1908 	return (nfs_renamerpc(sdvp, scnp->cn_nameptr, scnp->cn_namelen, sdvp,
1909 	    sp->s_name, sp->s_namlen, scnp->cn_cred, scnp->cn_thread));
1910 }
1911 
1912 /*
1913  * Do an nfs rename rpc. Called from nfs_rename() and nfs_renameit().
1914  */
1915 static int
nfs_renamerpc(struct vnode * fdvp,const char * fnameptr,int fnamelen,struct vnode * tdvp,const char * tnameptr,int tnamelen,struct ucred * cred,struct thread * td)1916 nfs_renamerpc(struct vnode *fdvp, const char *fnameptr, int fnamelen,
1917     struct vnode *tdvp, const char *tnameptr, int tnamelen, struct ucred *cred,
1918     struct thread *td)
1919 {
1920 	caddr_t bpos, dpos;
1921 	int error = 0, fwccflag = NFSV3_WCCRATTR, twccflag = NFSV3_WCCRATTR;
1922 	struct mbuf *mreq, *mrep, *md, *mb;
1923 	int v3 = NFS_ISV3(fdvp);
1924 
1925 	nfsstats.rpccnt[NFSPROC_RENAME]++;
1926 	mreq = m_get2((NFSX_FH(v3) + NFSX_UNSIGNED)*2 + nfsm_rndup(fnamelen) +
1927 	    nfsm_rndup(tnamelen), M_WAITOK, MT_DATA, 0);
1928 	mb = mreq;
1929 	bpos = mtod(mb, caddr_t);
1930 	nfsm_fhtom(fdvp, v3);
1931 	nfsm_strtom(fnameptr, fnamelen, NFS_MAXNAMLEN);
1932 	nfsm_fhtom(tdvp, v3);
1933 	nfsm_strtom(tnameptr, tnamelen, NFS_MAXNAMLEN);
1934 	nfsm_request(fdvp, NFSPROC_RENAME, td, cred);
1935 	if (v3) {
1936 		nfsm_wcc_data(fdvp, fwccflag);
1937 		nfsm_wcc_data(tdvp, twccflag);
1938 	}
1939 	m_freem(mrep);
1940 nfsmout:
1941 	mtx_lock(&(VTONFS(fdvp))->n_mtx);
1942 	VTONFS(fdvp)->n_flag |= NMODIFIED;
1943 	mtx_unlock(&(VTONFS(fdvp))->n_mtx);
1944 	mtx_lock(&(VTONFS(tdvp))->n_mtx);
1945 	VTONFS(tdvp)->n_flag |= NMODIFIED;
1946 	mtx_unlock(&(VTONFS(tdvp))->n_mtx);
1947 	if (!fwccflag) {
1948 		VTONFS(fdvp)->n_attrstamp = 0;
1949 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(fdvp);
1950 	}
1951 	if (!twccflag) {
1952 		VTONFS(tdvp)->n_attrstamp = 0;
1953 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(tdvp);
1954 	}
1955 	return (error);
1956 }
1957 
1958 /*
1959  * nfs hard link create call
1960  */
1961 static int
nfs_link(struct vop_link_args * ap)1962 nfs_link(struct vop_link_args *ap)
1963 {
1964 	struct vnode *vp = ap->a_vp;
1965 	struct vnode *tdvp = ap->a_tdvp;
1966 	struct componentname *cnp = ap->a_cnp;
1967 	caddr_t bpos, dpos;
1968 	int error = 0, wccflag = NFSV3_WCCRATTR, attrflag = 0;
1969 	struct mbuf *mreq, *mrep, *md, *mb;
1970 	int v3;
1971 
1972 	if (vp->v_mount != tdvp->v_mount) {
1973 		return (EXDEV);
1974 	}
1975 
1976 	/*
1977 	 * Push all writes to the server, so that the attribute cache
1978 	 * doesn't get "out of sync" with the server.
1979 	 * XXX There should be a better way!
1980 	 */
1981 	VOP_FSYNC(vp, MNT_WAIT, cnp->cn_thread);
1982 
1983 	v3 = NFS_ISV3(vp);
1984 	nfsstats.rpccnt[NFSPROC_LINK]++;
1985 	mreq = m_get2(NFSX_FH(v3)*2 + NFSX_UNSIGNED +
1986 	    nfsm_rndup(cnp->cn_namelen), M_WAITOK, MT_DATA, 0);
1987 	mb = mreq;
1988 	bpos = mtod(mb, caddr_t);
1989 	nfsm_fhtom(vp, v3);
1990 	nfsm_fhtom(tdvp, v3);
1991 	nfsm_strtom(cnp->cn_nameptr, cnp->cn_namelen, NFS_MAXNAMLEN);
1992 	nfsm_request(vp, NFSPROC_LINK, cnp->cn_thread, cnp->cn_cred);
1993 	if (v3) {
1994 		nfsm_postop_attr(vp, attrflag);
1995 		nfsm_wcc_data(tdvp, wccflag);
1996 	}
1997 	m_freem(mrep);
1998 nfsmout:
1999 	mtx_lock(&(VTONFS(tdvp))->n_mtx);
2000 	VTONFS(tdvp)->n_flag |= NMODIFIED;
2001 	mtx_unlock(&(VTONFS(tdvp))->n_mtx);
2002 	if (!attrflag) {
2003 		VTONFS(vp)->n_attrstamp = 0;
2004 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(vp);
2005 	}
2006 	if (!wccflag) {
2007 		VTONFS(tdvp)->n_attrstamp = 0;
2008 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(tdvp);
2009 	}
2010 	return (error);
2011 }
2012 
2013 /*
2014  * nfs symbolic link create call
2015  */
2016 static int
nfs_symlink(struct vop_symlink_args * ap)2017 nfs_symlink(struct vop_symlink_args *ap)
2018 {
2019 	struct vnode *dvp = ap->a_dvp;
2020 	struct vattr *vap = ap->a_vap;
2021 	struct componentname *cnp = ap->a_cnp;
2022 	struct nfsv2_sattr *sp;
2023 	caddr_t bpos, dpos;
2024 	int slen, error = 0, wccflag = NFSV3_WCCRATTR, gotvp;
2025 	struct mbuf *mreq, *mrep, *md, *mb;
2026 	struct vnode *newvp = NULL;
2027 	int v3 = NFS_ISV3(dvp);
2028 
2029 	nfsstats.rpccnt[NFSPROC_SYMLINK]++;
2030 	slen = strlen(ap->a_target);
2031 	mreq = m_get2(NFSX_FH(v3) + 2*NFSX_UNSIGNED +
2032 	    nfsm_rndup(cnp->cn_namelen) + nfsm_rndup(slen) + NFSX_SATTR(v3),
2033 	    M_WAITOK, MT_DATA, 0);
2034 	mb = mreq;
2035 	bpos = mtod(mb, caddr_t);
2036 	nfsm_fhtom(dvp, v3);
2037 	nfsm_strtom(cnp->cn_nameptr, cnp->cn_namelen, NFS_MAXNAMLEN);
2038 	if (v3) {
2039 		nfsm_v3attrbuild(vap, FALSE);
2040 	}
2041 	nfsm_strtom(ap->a_target, slen, NFS_MAXPATHLEN);
2042 	if (!v3) {
2043 		sp = nfsm_build(struct nfsv2_sattr *, NFSX_V2SATTR);
2044 		sp->sa_mode = vtonfsv2_mode(VLNK, vap->va_mode);
2045 		sp->sa_uid = nfs_xdrneg1;
2046 		sp->sa_gid = nfs_xdrneg1;
2047 		sp->sa_size = nfs_xdrneg1;
2048 		txdr_nfsv2time(&vap->va_atime, &sp->sa_atime);
2049 		txdr_nfsv2time(&vap->va_mtime, &sp->sa_mtime);
2050 	}
2051 
2052 	/*
2053 	 * Issue the NFS request and get the rpc response.
2054 	 *
2055 	 * Only NFSv3 responses returning an error of 0 actually return
2056 	 * a file handle that can be converted into newvp without having
2057 	 * to do an extra lookup rpc.
2058 	 */
2059 	nfsm_request(dvp, NFSPROC_SYMLINK, cnp->cn_thread, cnp->cn_cred);
2060 	if (v3) {
2061 		if (error == 0)
2062 			nfsm_mtofh(dvp, newvp, v3, gotvp);
2063 		nfsm_wcc_data(dvp, wccflag);
2064 	}
2065 
2066 	/*
2067 	 * out code jumps -> here, mrep is also freed.
2068 	 */
2069 
2070 	m_freem(mrep);
2071 nfsmout:
2072 
2073 	/*
2074 	 * If we do not have an error and we could not extract the newvp from
2075 	 * the response due to the request being NFSv2, we have to do a
2076 	 * lookup in order to obtain a newvp to return.
2077 	 */
2078 	if (error == 0 && newvp == NULL) {
2079 		struct nfsnode *np = NULL;
2080 
2081 		error = nfs_lookitup(dvp, cnp->cn_nameptr, cnp->cn_namelen,
2082 		    cnp->cn_cred, cnp->cn_thread, &np);
2083 		if (!error)
2084 			newvp = NFSTOV(np);
2085 	}
2086 	if (error) {
2087 		if (newvp)
2088 			vput(newvp);
2089 	} else {
2090 		*ap->a_vpp = newvp;
2091 	}
2092 	mtx_lock(&(VTONFS(dvp))->n_mtx);
2093 	VTONFS(dvp)->n_flag |= NMODIFIED;
2094 	mtx_unlock(&(VTONFS(dvp))->n_mtx);
2095 	if (!wccflag) {
2096 		VTONFS(dvp)->n_attrstamp = 0;
2097 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(dvp);
2098 	}
2099 	return (error);
2100 }
2101 
2102 /*
2103  * nfs make dir call
2104  */
2105 static int
nfs_mkdir(struct vop_mkdir_args * ap)2106 nfs_mkdir(struct vop_mkdir_args *ap)
2107 {
2108 	struct vnode *dvp = ap->a_dvp;
2109 	struct vattr *vap = ap->a_vap;
2110 	struct componentname *cnp = ap->a_cnp;
2111 	struct nfsv2_sattr *sp;
2112 	int len;
2113 	struct nfsnode *np = NULL;
2114 	struct vnode *newvp = NULL;
2115 	caddr_t bpos, dpos;
2116 	int error = 0, wccflag = NFSV3_WCCRATTR;
2117 	int gotvp = 0;
2118 	struct mbuf *mreq, *mrep, *md, *mb;
2119 	struct vattr vattr;
2120 	int v3 = NFS_ISV3(dvp);
2121 
2122 	if ((error = VOP_GETATTR(dvp, &vattr, cnp->cn_cred)) != 0)
2123 		return (error);
2124 	len = cnp->cn_namelen;
2125 	nfsstats.rpccnt[NFSPROC_MKDIR]++;
2126 	mreq = m_get2(NFSX_FH(v3) + NFSX_UNSIGNED + nfsm_rndup(len) +
2127 	    NFSX_SATTR(v3), M_WAITOK, MT_DATA, 0);
2128 	mb = mreq;
2129 	bpos = mtod(mb, caddr_t);
2130 	nfsm_fhtom(dvp, v3);
2131 	nfsm_strtom(cnp->cn_nameptr, len, NFS_MAXNAMLEN);
2132 	if (v3) {
2133 		nfsm_v3attrbuild(vap, FALSE);
2134 	} else {
2135 		sp = nfsm_build(struct nfsv2_sattr *, NFSX_V2SATTR);
2136 		sp->sa_mode = vtonfsv2_mode(VDIR, vap->va_mode);
2137 		sp->sa_uid = nfs_xdrneg1;
2138 		sp->sa_gid = nfs_xdrneg1;
2139 		sp->sa_size = nfs_xdrneg1;
2140 		txdr_nfsv2time(&vap->va_atime, &sp->sa_atime);
2141 		txdr_nfsv2time(&vap->va_mtime, &sp->sa_mtime);
2142 	}
2143 	nfsm_request(dvp, NFSPROC_MKDIR, cnp->cn_thread, cnp->cn_cred);
2144 	if (!error)
2145 		nfsm_mtofh(dvp, newvp, v3, gotvp);
2146 	if (v3)
2147 		nfsm_wcc_data(dvp, wccflag);
2148 	m_freem(mrep);
2149 nfsmout:
2150 	mtx_lock(&(VTONFS(dvp))->n_mtx);
2151 	VTONFS(dvp)->n_flag |= NMODIFIED;
2152 	mtx_unlock(&(VTONFS(dvp))->n_mtx);
2153 	if (!wccflag) {
2154 		VTONFS(dvp)->n_attrstamp = 0;
2155 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(dvp);
2156 	}
2157 	if (error == 0 && newvp == NULL) {
2158 		error = nfs_lookitup(dvp, cnp->cn_nameptr, len, cnp->cn_cred,
2159 			cnp->cn_thread, &np);
2160 		if (!error) {
2161 			newvp = NFSTOV(np);
2162 			if (newvp->v_type != VDIR)
2163 				error = EEXIST;
2164 		}
2165 	}
2166 	if (error) {
2167 		if (newvp)
2168 			vput(newvp);
2169 	} else
2170 		*ap->a_vpp = newvp;
2171 	return (error);
2172 }
2173 
2174 /*
2175  * nfs remove directory call
2176  */
2177 static int
nfs_rmdir(struct vop_rmdir_args * ap)2178 nfs_rmdir(struct vop_rmdir_args *ap)
2179 {
2180 	struct vnode *vp = ap->a_vp;
2181 	struct vnode *dvp = ap->a_dvp;
2182 	struct componentname *cnp = ap->a_cnp;
2183 	caddr_t bpos, dpos;
2184 	int error = 0, wccflag = NFSV3_WCCRATTR;
2185 	struct mbuf *mreq, *mrep, *md, *mb;
2186 	int v3 = NFS_ISV3(dvp);
2187 
2188 	if (dvp == vp)
2189 		return (EINVAL);
2190 	nfsstats.rpccnt[NFSPROC_RMDIR]++;
2191 	mreq = m_get2(NFSX_FH(v3) + NFSX_UNSIGNED +
2192 	    nfsm_rndup(cnp->cn_namelen), M_WAITOK, MT_DATA, 0);
2193 	mb = mreq;
2194 	bpos = mtod(mb, caddr_t);
2195 	nfsm_fhtom(dvp, v3);
2196 	nfsm_strtom(cnp->cn_nameptr, cnp->cn_namelen, NFS_MAXNAMLEN);
2197 	nfsm_request(dvp, NFSPROC_RMDIR, cnp->cn_thread, cnp->cn_cred);
2198 	if (v3)
2199 		nfsm_wcc_data(dvp, wccflag);
2200 	m_freem(mrep);
2201 nfsmout:
2202 	mtx_lock(&(VTONFS(dvp))->n_mtx);
2203 	VTONFS(dvp)->n_flag |= NMODIFIED;
2204 	mtx_unlock(&(VTONFS(dvp))->n_mtx);
2205 	if (!wccflag) {
2206 		VTONFS(dvp)->n_attrstamp = 0;
2207 		KDTRACE_NFS_ATTRCACHE_FLUSH_DONE(dvp);
2208 	}
2209 	cache_purge(dvp);
2210 	cache_purge(vp);
2211 	/*
2212 	 * Kludge: Map ENOENT => 0 assuming that you have a reply to a retry.
2213 	 */
2214 	if (error == ENOENT)
2215 		error = 0;
2216 	return (error);
2217 }
2218 
2219 /*
2220  * nfs readdir call
2221  */
2222 static int
nfs_readdir(struct vop_readdir_args * ap)2223 nfs_readdir(struct vop_readdir_args *ap)
2224 {
2225 	struct vnode *vp = ap->a_vp;
2226 	struct nfsnode *np = VTONFS(vp);
2227 	struct uio *uio = ap->a_uio;
2228 	int tresid, error = 0;
2229 	struct vattr vattr;
2230 
2231 	if (vp->v_type != VDIR)
2232 		return(EPERM);
2233 
2234 	/*
2235 	 * First, check for hit on the EOF offset cache
2236 	 */
2237 	if (np->n_direofoffset > 0 && uio->uio_offset >= np->n_direofoffset &&
2238 	    (np->n_flag & NMODIFIED) == 0) {
2239 		if (VOP_GETATTR(vp, &vattr, ap->a_cred) == 0) {
2240 			mtx_lock(&np->n_mtx);
2241 			if (!NFS_TIMESPEC_COMPARE(&np->n_mtime, &vattr.va_mtime)) {
2242 				mtx_unlock(&np->n_mtx);
2243 				nfsstats.direofcache_hits++;
2244 				goto out;
2245 			} else
2246 				mtx_unlock(&np->n_mtx);
2247 		}
2248 	}
2249 
2250 	/*
2251 	 * Call nfs_bioread() to do the real work.
2252 	 */
2253 	tresid = uio->uio_resid;
2254 	error = nfs_bioread(vp, uio, 0, ap->a_cred);
2255 
2256 	if (!error && uio->uio_resid == tresid) {
2257 		nfsstats.direofcache_misses++;
2258 	}
2259 out:
2260 	return (error);
2261 }
2262 
2263 /*
2264  * Readdir rpc call.
2265  * Called from below the buffer cache by nfs_doio().
2266  */
2267 int
nfs_readdirrpc(struct vnode * vp,struct uio * uiop,struct ucred * cred)2268 nfs_readdirrpc(struct vnode *vp, struct uio *uiop, struct ucred *cred)
2269 {
2270 	int len, left;
2271 	struct dirent *dp = NULL;
2272 	u_int32_t *tl;
2273 	caddr_t cp;
2274 	nfsuint64 *cookiep;
2275 	caddr_t bpos, dpos;
2276 	struct mbuf *mreq, *mrep, *md, *mb;
2277 	nfsuint64 cookie;
2278 	struct nfsmount *nmp = VFSTONFS(vp->v_mount);
2279 	struct nfsnode *dnp = VTONFS(vp);
2280 	u_quad_t fileno;
2281 	int error = 0, tlen, more_dirs = 1, blksiz = 0, bigenough = 1;
2282 	int attrflag;
2283 	int v3 = NFS_ISV3(vp);
2284 
2285 	KASSERT(uiop->uio_iovcnt == 1 &&
2286 	    (uiop->uio_offset & (DIRBLKSIZ - 1)) == 0 &&
2287 	    (uiop->uio_resid & (DIRBLKSIZ - 1)) == 0,
2288 	    ("nfs readdirrpc bad uio"));
2289 
2290 	/*
2291 	 * If there is no cookie, assume directory was stale.
2292 	 */
2293 	nfs_dircookie_lock(dnp);
2294 	cookiep = nfs_getcookie(dnp, uiop->uio_offset, 0);
2295 	if (cookiep) {
2296 		cookie = *cookiep;
2297 		nfs_dircookie_unlock(dnp);
2298 	} else {
2299 		nfs_dircookie_unlock(dnp);
2300 		return (NFSERR_BAD_COOKIE);
2301 	}
2302 
2303 	/*
2304 	 * Loop around doing readdir rpc's of size nm_readdirsize
2305 	 * truncated to a multiple of DIRBLKSIZ.
2306 	 * The stopping criteria is EOF or buffer full.
2307 	 */
2308 	while (more_dirs && bigenough) {
2309 		nfsstats.rpccnt[NFSPROC_READDIR]++;
2310 		mreq = m_get2(NFSX_FH(v3) + NFSX_READDIR(v3), M_WAITOK,
2311 		    MT_DATA, 0);
2312 		mb = mreq;
2313 		bpos = mtod(mb, caddr_t);
2314 		nfsm_fhtom(vp, v3);
2315 		if (v3) {
2316 			tl = nfsm_build(u_int32_t *, 5 * NFSX_UNSIGNED);
2317 			*tl++ = cookie.nfsuquad[0];
2318 			*tl++ = cookie.nfsuquad[1];
2319 			mtx_lock(&dnp->n_mtx);
2320 			*tl++ = dnp->n_cookieverf.nfsuquad[0];
2321 			*tl++ = dnp->n_cookieverf.nfsuquad[1];
2322 			mtx_unlock(&dnp->n_mtx);
2323 		} else {
2324 			tl = nfsm_build(u_int32_t *, 2 * NFSX_UNSIGNED);
2325 			*tl++ = cookie.nfsuquad[0];
2326 		}
2327 		*tl = txdr_unsigned(nmp->nm_readdirsize);
2328 		nfsm_request(vp, NFSPROC_READDIR, uiop->uio_td, cred);
2329 		if (v3) {
2330 			nfsm_postop_attr(vp, attrflag);
2331 			if (!error) {
2332 				tl = nfsm_dissect(u_int32_t *,
2333 				    2 * NFSX_UNSIGNED);
2334 				mtx_lock(&dnp->n_mtx);
2335 				dnp->n_cookieverf.nfsuquad[0] = *tl++;
2336 				dnp->n_cookieverf.nfsuquad[1] = *tl;
2337 				mtx_unlock(&dnp->n_mtx);
2338 			} else {
2339 				m_freem(mrep);
2340 				goto nfsmout;
2341 			}
2342 		}
2343 		tl = nfsm_dissect(u_int32_t *, NFSX_UNSIGNED);
2344 		more_dirs = fxdr_unsigned(int, *tl);
2345 
2346 		/* loop thru the dir entries, doctoring them to 4bsd form */
2347 		while (more_dirs && bigenough) {
2348 			if (v3) {
2349 				tl = nfsm_dissect(u_int32_t *,
2350 				    3 * NFSX_UNSIGNED);
2351 				fileno = fxdr_hyper(tl);
2352 				len = fxdr_unsigned(int, *(tl + 2));
2353 			} else {
2354 				tl = nfsm_dissect(u_int32_t *,
2355 				    2 * NFSX_UNSIGNED);
2356 				fileno = fxdr_unsigned(u_quad_t, *tl++);
2357 				len = fxdr_unsigned(int, *tl);
2358 			}
2359 			if (len <= 0 || len > NFS_MAXNAMLEN) {
2360 				error = EBADRPC;
2361 				m_freem(mrep);
2362 				goto nfsmout;
2363 			}
2364 			tlen = nfsm_rndup(len);
2365 			if (tlen == len)
2366 				tlen += 4;	/* To ensure null termination */
2367 			left = DIRBLKSIZ - blksiz;
2368 			if ((tlen + DIRHDSIZ) > left) {
2369 				dp->d_reclen += left;
2370 				uiop->uio_iov->iov_base =
2371 				    (char *)uiop->uio_iov->iov_base + left;
2372 				uiop->uio_iov->iov_len -= left;
2373 				uiop->uio_offset += left;
2374 				uiop->uio_resid -= left;
2375 				blksiz = 0;
2376 			}
2377 			if ((tlen + DIRHDSIZ) > uiop->uio_resid)
2378 				bigenough = 0;
2379 			if (bigenough) {
2380 				dp = (struct dirent *)uiop->uio_iov->iov_base;
2381 				dp->d_fileno = (int)fileno;
2382 				dp->d_namlen = len;
2383 				dp->d_reclen = tlen + DIRHDSIZ;
2384 				dp->d_type = DT_UNKNOWN;
2385 				blksiz += dp->d_reclen;
2386 				if (blksiz == DIRBLKSIZ)
2387 					blksiz = 0;
2388 				uiop->uio_offset += DIRHDSIZ;
2389 				uiop->uio_resid -= DIRHDSIZ;
2390 				uiop->uio_iov->iov_base =
2391 				    (char *)uiop->uio_iov->iov_base + DIRHDSIZ;
2392 				uiop->uio_iov->iov_len -= DIRHDSIZ;
2393 				nfsm_mtouio(uiop, len);
2394 				cp = uiop->uio_iov->iov_base;
2395 				tlen -= len;
2396 				*cp = '\0';	/* null terminate */
2397 				uiop->uio_iov->iov_base =
2398 				    (char *)uiop->uio_iov->iov_base + tlen;
2399 				uiop->uio_iov->iov_len -= tlen;
2400 				uiop->uio_offset += tlen;
2401 				uiop->uio_resid -= tlen;
2402 			} else
2403 				nfsm_adv(nfsm_rndup(len));
2404 			if (v3) {
2405 				tl = nfsm_dissect(u_int32_t *,
2406 				    3 * NFSX_UNSIGNED);
2407 			} else {
2408 				tl = nfsm_dissect(u_int32_t *,
2409 				    2 * NFSX_UNSIGNED);
2410 			}
2411 			if (bigenough) {
2412 				cookie.nfsuquad[0] = *tl++;
2413 				if (v3)
2414 					cookie.nfsuquad[1] = *tl++;
2415 			} else if (v3)
2416 				tl += 2;
2417 			else
2418 				tl++;
2419 			more_dirs = fxdr_unsigned(int, *tl);
2420 		}
2421 		/*
2422 		 * If at end of rpc data, get the eof boolean
2423 		 */
2424 		if (!more_dirs) {
2425 			tl = nfsm_dissect(u_int32_t *, NFSX_UNSIGNED);
2426 			more_dirs = (fxdr_unsigned(int, *tl) == 0);
2427 		}
2428 		m_freem(mrep);
2429 	}
2430 	/*
2431 	 * Fill last record, iff any, out to a multiple of DIRBLKSIZ
2432 	 * by increasing d_reclen for the last record.
2433 	 */
2434 	if (blksiz > 0) {
2435 		left = DIRBLKSIZ - blksiz;
2436 		dp->d_reclen += left;
2437 		uiop->uio_iov->iov_base =
2438 		    (char *)uiop->uio_iov->iov_base + left;
2439 		uiop->uio_iov->iov_len -= left;
2440 		uiop->uio_offset += left;
2441 		uiop->uio_resid -= left;
2442 	}
2443 
2444 	/*
2445 	 * We are now either at the end of the directory or have filled the
2446 	 * block.
2447 	 */
2448 	if (bigenough)
2449 		dnp->n_direofoffset = uiop->uio_offset;
2450 	else {
2451 		if (uiop->uio_resid > 0)
2452 			nfs_printf("EEK! readdirrpc resid > 0\n");
2453 		nfs_dircookie_lock(dnp);
2454 		cookiep = nfs_getcookie(dnp, uiop->uio_offset, 1);
2455 		*cookiep = cookie;
2456 		nfs_dircookie_unlock(dnp);
2457 	}
2458 nfsmout:
2459 	return (error);
2460 }
2461 
2462 /*
2463  * NFS V3 readdir plus RPC. Used in place of nfs_readdirrpc().
2464  */
2465 int
nfs_readdirplusrpc(struct vnode * vp,struct uio * uiop,struct ucred * cred)2466 nfs_readdirplusrpc(struct vnode *vp, struct uio *uiop, struct ucred *cred)
2467 {
2468 	int len, left;
2469 	struct dirent *dp;
2470 	u_int32_t *tl;
2471 	caddr_t cp;
2472 	struct vnode *newvp;
2473 	nfsuint64 *cookiep;
2474 	caddr_t bpos, dpos, dpossav1, dpossav2;
2475 	struct mbuf *mreq, *mrep, *md, *mb, *mdsav1, *mdsav2;
2476 	struct nameidata nami, *ndp = &nami;
2477 	struct componentname *cnp = &ndp->ni_cnd;
2478 	nfsuint64 cookie;
2479 	struct nfsmount *nmp = VFSTONFS(vp->v_mount);
2480 	struct nfsnode *dnp = VTONFS(vp), *np;
2481 	struct vattr vattr, dvattr;
2482 	nfsfh_t *fhp;
2483 	u_quad_t fileno;
2484 	int error = 0, tlen, more_dirs = 1, blksiz = 0, doit, bigenough = 1, i;
2485 	int attrflag, dattrflag, fhsize;
2486 
2487 #ifndef nolint
2488 	dp = NULL;
2489 #endif
2490 	KASSERT(uiop->uio_iovcnt == 1 &&
2491 	    (uiop->uio_offset & (DIRBLKSIZ - 1)) == 0 &&
2492 	    (uiop->uio_resid & (DIRBLKSIZ - 1)) == 0,
2493 	    ("nfs readdirplusrpc bad uio"));
2494 	ndp->ni_dvp = vp;
2495 	newvp = NULLVP;
2496 
2497 	/*
2498 	 * If there is no cookie, assume directory was stale.
2499 	 */
2500 	nfs_dircookie_lock(dnp);
2501 	cookiep = nfs_getcookie(dnp, uiop->uio_offset, 0);
2502 	if (cookiep) {
2503 		cookie = *cookiep;
2504 		nfs_dircookie_unlock(dnp);
2505 	} else {
2506 		nfs_dircookie_unlock(dnp);
2507 		return (NFSERR_BAD_COOKIE);
2508 	}
2509 	/*
2510 	 * Loop around doing readdir rpc's of size nm_readdirsize
2511 	 * truncated to a multiple of DIRBLKSIZ.
2512 	 * The stopping criteria is EOF or buffer full.
2513 	 */
2514 	while (more_dirs && bigenough) {
2515 		nfsstats.rpccnt[NFSPROC_READDIRPLUS]++;
2516 		mreq = m_get2(NFSX_FH(1) + 6 * NFSX_UNSIGNED, M_WAITOK,
2517 		    MT_DATA, 0);
2518 		mb = mreq;
2519 		bpos = mtod(mb, caddr_t);
2520 		nfsm_fhtom(vp, 1);
2521  		tl = nfsm_build(u_int32_t *, 6 * NFSX_UNSIGNED);
2522 		*tl++ = cookie.nfsuquad[0];
2523 		*tl++ = cookie.nfsuquad[1];
2524 		mtx_lock(&dnp->n_mtx);
2525 		*tl++ = dnp->n_cookieverf.nfsuquad[0];
2526 		*tl++ = dnp->n_cookieverf.nfsuquad[1];
2527 		mtx_unlock(&dnp->n_mtx);
2528 		*tl++ = txdr_unsigned(nmp->nm_readdirsize);
2529 		*tl = txdr_unsigned(nmp->nm_rsize);
2530 		nfsm_request(vp, NFSPROC_READDIRPLUS, uiop->uio_td, cred);
2531 		nfsm_postop_attr_va(vp, dattrflag, &dvattr);
2532 		if (error) {
2533 			m_freem(mrep);
2534 			goto nfsmout;
2535 		}
2536 		tl = nfsm_dissect(u_int32_t *, 3 * NFSX_UNSIGNED);
2537 		mtx_lock(&dnp->n_mtx);
2538 		dnp->n_cookieverf.nfsuquad[0] = *tl++;
2539 		dnp->n_cookieverf.nfsuquad[1] = *tl++;
2540 		mtx_unlock(&dnp->n_mtx);
2541 		more_dirs = fxdr_unsigned(int, *tl);
2542 
2543 		/* loop thru the dir entries, doctoring them to 4bsd form */
2544 		while (more_dirs && bigenough) {
2545 			tl = nfsm_dissect(u_int32_t *, 3 * NFSX_UNSIGNED);
2546 			fileno = fxdr_hyper(tl);
2547 			len = fxdr_unsigned(int, *(tl + 2));
2548 			if (len <= 0 || len > NFS_MAXNAMLEN) {
2549 				error = EBADRPC;
2550 				m_freem(mrep);
2551 				goto nfsmout;
2552 			}
2553 			tlen = nfsm_rndup(len);
2554 			if (tlen == len)
2555 				tlen += 4;	/* To ensure null termination*/
2556 			left = DIRBLKSIZ - blksiz;
2557 			if ((tlen + DIRHDSIZ) > left) {
2558 				dp->d_reclen += left;
2559 				uiop->uio_iov->iov_base =
2560 				    (char *)uiop->uio_iov->iov_base + left;
2561 				uiop->uio_iov->iov_len -= left;
2562 				uiop->uio_offset += left;
2563 				uiop->uio_resid -= left;
2564 				blksiz = 0;
2565 			}
2566 			if ((tlen + DIRHDSIZ) > uiop->uio_resid)
2567 				bigenough = 0;
2568 			if (bigenough) {
2569 				dp = (struct dirent *)uiop->uio_iov->iov_base;
2570 				dp->d_fileno = (int)fileno;
2571 				dp->d_namlen = len;
2572 				dp->d_reclen = tlen + DIRHDSIZ;
2573 				dp->d_type = DT_UNKNOWN;
2574 				blksiz += dp->d_reclen;
2575 				if (blksiz == DIRBLKSIZ)
2576 					blksiz = 0;
2577 				uiop->uio_offset += DIRHDSIZ;
2578 				uiop->uio_resid -= DIRHDSIZ;
2579 				uiop->uio_iov->iov_base =
2580 				    (char *)uiop->uio_iov->iov_base + DIRHDSIZ;
2581 				uiop->uio_iov->iov_len -= DIRHDSIZ;
2582 				cnp->cn_nameptr = uiop->uio_iov->iov_base;
2583 				cnp->cn_namelen = len;
2584 				nfsm_mtouio(uiop, len);
2585 				cp = uiop->uio_iov->iov_base;
2586 				tlen -= len;
2587 				*cp = '\0';
2588 				uiop->uio_iov->iov_base =
2589 				    (char *)uiop->uio_iov->iov_base + tlen;
2590 				uiop->uio_iov->iov_len -= tlen;
2591 				uiop->uio_offset += tlen;
2592 				uiop->uio_resid -= tlen;
2593 			} else
2594 				nfsm_adv(nfsm_rndup(len));
2595 			tl = nfsm_dissect(u_int32_t *, 3 * NFSX_UNSIGNED);
2596 			if (bigenough) {
2597 				cookie.nfsuquad[0] = *tl++;
2598 				cookie.nfsuquad[1] = *tl++;
2599 			} else
2600 				tl += 2;
2601 
2602 			/*
2603 			 * Since the attributes are before the file handle
2604 			 * (sigh), we must skip over the attributes and then
2605 			 * come back and get them.
2606 			 */
2607 			attrflag = fxdr_unsigned(int, *tl);
2608 			if (attrflag) {
2609 			    dpossav1 = dpos;
2610 			    mdsav1 = md;
2611 			    nfsm_adv(NFSX_V3FATTR);
2612 			    tl = nfsm_dissect(u_int32_t *, NFSX_UNSIGNED);
2613 			    doit = fxdr_unsigned(int, *tl);
2614 			    /*
2615  			     * Skip loading the attrs for "..". There's a
2616  			     * race between loading the attrs here and
2617  			     * lookups that look for the directory currently
2618  			     * being read (in the parent). We try to acquire
2619  			     * the exclusive lock on ".." here, owning the
2620  			     * lock on the directory being read. Lookup will
2621  			     * hold the lock on ".." and try to acquire the
2622  			     * lock on the directory being read.
2623  			     *
2624  			     * There are other ways of fixing this, one would
2625  			     * be to do a trylock on the ".." vnode and skip
2626  			     * loading the attrs on ".." if it happens to be
2627  			     * locked by another process. But skipping the
2628  			     * attrload on ".." seems the easiest option.
2629  			     */
2630  			    if (strcmp(dp->d_name, "..") == 0) {
2631  				    doit = 0;
2632  				    /*
2633  				     * We've already skipped over the attrs,
2634  				     * skip over the filehandle. And store d_type
2635  				     * as VDIR.
2636  				     */
2637  				    tl = nfsm_dissect(u_int32_t *, NFSX_UNSIGNED);
2638  				    i = fxdr_unsigned(int, *tl);
2639  				    nfsm_adv(nfsm_rndup(i));
2640  				    dp->d_type = IFTODT(VTTOIF(VDIR));
2641  			    }
2642 			    if (doit) {
2643 				nfsm_getfh(fhp, fhsize, 1);
2644 				if (NFS_CMPFH(dnp, fhp, fhsize)) {
2645 				    VREF(vp);
2646 				    newvp = vp;
2647 				    np = dnp;
2648 				} else {
2649 				    error = nfs_nget(vp->v_mount, fhp,
2650 					fhsize, &np, LK_EXCLUSIVE);
2651 				    if (error)
2652 					doit = 0;
2653 				    else
2654 					newvp = NFSTOV(np);
2655 				}
2656 			    }
2657 			    if (doit && bigenough) {
2658 				dpossav2 = dpos;
2659 				dpos = dpossav1;
2660 				mdsav2 = md;
2661 				md = mdsav1;
2662 				nfsm_loadattr(newvp, &vattr);
2663 				dpos = dpossav2;
2664 				md = mdsav2;
2665 				dp->d_type = IFTODT(VTTOIF(vattr.va_type));
2666 				ndp->ni_vp = newvp;
2667 				if (newvp->v_type != VDIR || dattrflag != 0)
2668 				    cache_enter_time(ndp->ni_dvp, ndp->ni_vp,
2669 					cnp, &vattr.va_ctime,
2670 					newvp->v_type != VDIR ? NULL :
2671 					&dvattr.va_ctime);
2672 			    }
2673 			} else {
2674 			    /* Just skip over the file handle */
2675 			    tl = nfsm_dissect(u_int32_t *, NFSX_UNSIGNED);
2676 			    i = fxdr_unsigned(int, *tl);
2677 			    if (i) {
2678 				    tl = nfsm_dissect(u_int32_t *, NFSX_UNSIGNED);
2679 				    fhsize = fxdr_unsigned(int, *tl);
2680 				    nfsm_adv(nfsm_rndup(fhsize));
2681 			    }
2682 			}
2683 			if (newvp != NULLVP) {
2684 			    if (newvp == vp)
2685 				vrele(newvp);
2686 			    else
2687 				vput(newvp);
2688 			    newvp = NULLVP;
2689 			}
2690 			tl = nfsm_dissect(u_int32_t *, NFSX_UNSIGNED);
2691 			more_dirs = fxdr_unsigned(int, *tl);
2692 		}
2693 		/*
2694 		 * If at end of rpc data, get the eof boolean
2695 		 */
2696 		if (!more_dirs) {
2697 			tl = nfsm_dissect(u_int32_t *, NFSX_UNSIGNED);
2698 			more_dirs = (fxdr_unsigned(int, *tl) == 0);
2699 		}
2700 		m_freem(mrep);
2701 	}
2702 	/*
2703 	 * Fill last record, iff any, out to a multiple of DIRBLKSIZ
2704 	 * by increasing d_reclen for the last record.
2705 	 */
2706 	if (blksiz > 0) {
2707 		left = DIRBLKSIZ - blksiz;
2708 		dp->d_reclen += left;
2709 		uiop->uio_iov->iov_base =
2710 		    (char *)uiop->uio_iov->iov_base + left;
2711 		uiop->uio_iov->iov_len -= left;
2712 		uiop->uio_offset += left;
2713 		uiop->uio_resid -= left;
2714 	}
2715 
2716 	/*
2717 	 * We are now either at the end of the directory or have filled the
2718 	 * block.
2719 	 */
2720 	if (bigenough)
2721 		dnp->n_direofoffset = uiop->uio_offset;
2722 	else {
2723 		if (uiop->uio_resid > 0)
2724 			nfs_printf("EEK! readdirplusrpc resid > 0\n");
2725 		nfs_dircookie_lock(dnp);
2726 		cookiep = nfs_getcookie(dnp, uiop->uio_offset, 1);
2727 		*cookiep = cookie;
2728 		nfs_dircookie_unlock(dnp);
2729 	}
2730 nfsmout:
2731 	if (newvp != NULLVP) {
2732 	        if (newvp == vp)
2733 			vrele(newvp);
2734 		else
2735 			vput(newvp);
2736 		newvp = NULLVP;
2737 	}
2738 	return (error);
2739 }
2740 
2741 /*
2742  * Silly rename. To make the NFS filesystem that is stateless look a little
2743  * more like the "ufs" a remove of an active vnode is translated to a rename
2744  * to a funny looking filename that is removed by nfs_inactive on the
2745  * nfsnode. There is the potential for another process on a different client
2746  * to create the same funny name between the nfs_lookitup() fails and the
2747  * nfs_rename() completes, but...
2748  */
2749 static int
nfs_sillyrename(struct vnode * dvp,struct vnode * vp,struct componentname * cnp)2750 nfs_sillyrename(struct vnode *dvp, struct vnode *vp, struct componentname *cnp)
2751 {
2752 	struct sillyrename *sp;
2753 	struct nfsnode *np;
2754 	int error;
2755 	short pid;
2756 	unsigned int lticks;
2757 
2758 	cache_purge(dvp);
2759 	np = VTONFS(vp);
2760 	KASSERT(vp->v_type != VDIR, ("nfs: sillyrename dir"));
2761 	sp = malloc(sizeof (struct sillyrename),
2762 		M_NFSREQ, M_WAITOK);
2763 	sp->s_cred = crhold(cnp->cn_cred);
2764 	sp->s_dvp = dvp;
2765 	sp->s_removeit = nfs_removeit;
2766 	VREF(dvp);
2767 
2768 	/*
2769 	 * Fudge together a funny name.
2770 	 * Changing the format of the funny name to accomodate more
2771 	 * sillynames per directory.
2772 	 * The name is now changed to .nfs.<ticks>.<pid>.4, where ticks is
2773 	 * CPU ticks since boot.
2774 	 */
2775 	pid = cnp->cn_thread->td_proc->p_pid;
2776 	lticks = (unsigned int)ticks;
2777 	for ( ; ; ) {
2778 		sp->s_namlen = sprintf(sp->s_name,
2779 				       ".nfs.%08x.%04x4.4", lticks,
2780 				       pid);
2781 		if (nfs_lookitup(dvp, sp->s_name, sp->s_namlen, sp->s_cred,
2782 				 cnp->cn_thread, NULL))
2783 			break;
2784 		lticks++;
2785 	}
2786 	error = nfs_renameit(dvp, cnp, sp);
2787 	if (error)
2788 		goto bad;
2789 	error = nfs_lookitup(dvp, sp->s_name, sp->s_namlen, sp->s_cred,
2790 		cnp->cn_thread, &np);
2791 	np->n_sillyrename = sp;
2792 	return (0);
2793 bad:
2794 	vrele(sp->s_dvp);
2795 	crfree(sp->s_cred);
2796 	free((caddr_t)sp, M_NFSREQ);
2797 	return (error);
2798 }
2799 
2800 /*
2801  * Look up a file name and optionally either update the file handle or
2802  * allocate an nfsnode, depending on the value of npp.
2803  * npp == NULL	--> just do the lookup
2804  * *npp == NULL --> allocate a new nfsnode and make sure attributes are
2805  *			handled too
2806  * *npp != NULL --> update the file handle in the vnode
2807  */
2808 static int
nfs_lookitup(struct vnode * dvp,const char * name,int len,struct ucred * cred,struct thread * td,struct nfsnode ** npp)2809 nfs_lookitup(struct vnode *dvp, const char *name, int len, struct ucred *cred,
2810     struct thread *td, struct nfsnode **npp)
2811 {
2812 	struct vnode *newvp = NULL;
2813 	struct nfsnode *np, *dnp = VTONFS(dvp);
2814 	caddr_t bpos, dpos;
2815 	int error = 0, fhlen, attrflag;
2816 	struct mbuf *mreq, *mrep, *md, *mb;
2817 	nfsfh_t *nfhp;
2818 	int v3 = NFS_ISV3(dvp);
2819 
2820 	nfsstats.rpccnt[NFSPROC_LOOKUP]++;
2821 	mreq = m_get2(NFSX_FH(v3) + NFSX_UNSIGNED + nfsm_rndup(len),
2822 	    M_WAITOK, MT_DATA, 0);
2823 	mb = mreq;
2824 	bpos = mtod(mb, caddr_t);
2825 	nfsm_fhtom(dvp, v3);
2826 	nfsm_strtom(name, len, NFS_MAXNAMLEN);
2827 	nfsm_request(dvp, NFSPROC_LOOKUP, td, cred);
2828 	if (npp && !error) {
2829 		nfsm_getfh(nfhp, fhlen, v3);
2830 		if (*npp) {
2831 		    np = *npp;
2832 		    if (np->n_fhsize > NFS_SMALLFH && fhlen <= NFS_SMALLFH) {
2833 			free((caddr_t)np->n_fhp, M_NFSBIGFH);
2834 			np->n_fhp = &np->n_fh;
2835 		    } else if (np->n_fhsize <= NFS_SMALLFH && fhlen>NFS_SMALLFH)
2836 			np->n_fhp =(nfsfh_t *)malloc(fhlen, M_NFSBIGFH, M_WAITOK);
2837 		    bcopy((caddr_t)nfhp, (caddr_t)np->n_fhp, fhlen);
2838 		    np->n_fhsize = fhlen;
2839 		    newvp = NFSTOV(np);
2840 		} else if (NFS_CMPFH(dnp, nfhp, fhlen)) {
2841 		    VREF(dvp);
2842 		    newvp = dvp;
2843 		} else {
2844 		    error = nfs_nget(dvp->v_mount, nfhp, fhlen, &np, LK_EXCLUSIVE);
2845 		    if (error) {
2846 			m_freem(mrep);
2847 			return (error);
2848 		    }
2849 		    newvp = NFSTOV(np);
2850 		}
2851 		if (v3) {
2852 			nfsm_postop_attr(newvp, attrflag);
2853 			if (!attrflag && *npp == NULL) {
2854 				m_freem(mrep);
2855 				if (newvp == dvp)
2856 					vrele(newvp);
2857 				else
2858 					vput(newvp);
2859 				return (ENOENT);
2860 			}
2861 		} else
2862 			nfsm_loadattr(newvp, NULL);
2863 	}
2864 	m_freem(mrep);
2865 nfsmout:
2866 	if (npp && *npp == NULL) {
2867 		if (error) {
2868 			if (newvp) {
2869 				if (newvp == dvp)
2870 					vrele(newvp);
2871 				else
2872 					vput(newvp);
2873 			}
2874 		} else
2875 			*npp = np;
2876 	}
2877 	return (error);
2878 }
2879 
2880 /*
2881  * Nfs Version 3 commit rpc
2882  */
2883 int
nfs_commit(struct vnode * vp,u_quad_t offset,int cnt,struct ucred * cred,struct thread * td)2884 nfs_commit(struct vnode *vp, u_quad_t offset, int cnt, struct ucred *cred,
2885 	   struct thread *td)
2886 {
2887 	u_int32_t *tl;
2888 	struct nfsmount *nmp = VFSTONFS(vp->v_mount);
2889 	caddr_t bpos, dpos;
2890 	int error = 0, wccflag = NFSV3_WCCRATTR;
2891 	struct mbuf *mreq, *mrep, *md, *mb;
2892 
2893 	mtx_lock(&nmp->nm_mtx);
2894 	if ((nmp->nm_state & NFSSTA_HASWRITEVERF) == 0) {
2895 		mtx_unlock(&nmp->nm_mtx);
2896 		return (0);
2897 	}
2898 	mtx_unlock(&nmp->nm_mtx);
2899 	nfsstats.rpccnt[NFSPROC_COMMIT]++;
2900 	mreq = m_get2(NFSX_FH(1), M_WAITOK, MT_DATA, 0);
2901 	mb = mreq;
2902 	bpos = mtod(mb, caddr_t);
2903 	nfsm_fhtom(vp, 1);
2904 	tl = nfsm_build(u_int32_t *, 3 * NFSX_UNSIGNED);
2905 	txdr_hyper(offset, tl);
2906 	tl += 2;
2907 	*tl = txdr_unsigned(cnt);
2908 	nfsm_request(vp, NFSPROC_COMMIT, td, cred);
2909 	nfsm_wcc_data(vp, wccflag);
2910 	if (!error) {
2911 		tl = nfsm_dissect(u_int32_t *, NFSX_V3WRITEVERF);
2912 		if (bcmp((caddr_t)nmp->nm_verf, (caddr_t)tl,
2913 			NFSX_V3WRITEVERF)) {
2914 			bcopy((caddr_t)tl, (caddr_t)nmp->nm_verf,
2915 				NFSX_V3WRITEVERF);
2916 			error = NFSERR_STALEWRITEVERF;
2917 		}
2918 	}
2919 	m_freem(mrep);
2920 nfsmout:
2921 	return (error);
2922 }
2923 
2924 /*
2925  * Strategy routine.
2926  * For async requests when nfsiod(s) are running, queue the request by
2927  * calling nfs_asyncio(), otherwise just all nfs_doio() to do the
2928  * request.
2929  */
2930 static int
nfs_strategy(struct vop_strategy_args * ap)2931 nfs_strategy(struct vop_strategy_args *ap)
2932 {
2933 	struct buf *bp = ap->a_bp;
2934 	struct ucred *cr;
2935 
2936 	KASSERT(!(bp->b_flags & B_DONE),
2937 	    ("nfs_strategy: buffer %p unexpectedly marked B_DONE", bp));
2938 	BUF_ASSERT_HELD(bp);
2939 
2940 	if (bp->b_iocmd == BIO_READ)
2941 		cr = bp->b_rcred;
2942 	else
2943 		cr = bp->b_wcred;
2944 
2945 	/*
2946 	 * If the op is asynchronous and an i/o daemon is waiting
2947 	 * queue the request, wake it up and wait for completion
2948 	 * otherwise just do it ourselves.
2949 	 */
2950 	if ((bp->b_flags & B_ASYNC) == 0 ||
2951 	    nfs_asyncio(VFSTONFS(ap->a_vp->v_mount), bp, NOCRED, curthread))
2952 		(void)nfs_doio(ap->a_vp, bp, cr, curthread);
2953 	return (0);
2954 }
2955 
2956 /*
2957  * fsync vnode op. Just call nfs_flush() with commit == 1.
2958  */
2959 /* ARGSUSED */
2960 static int
nfs_fsync(struct vop_fsync_args * ap)2961 nfs_fsync(struct vop_fsync_args *ap)
2962 {
2963 
2964 	return (nfs_flush(ap->a_vp, ap->a_waitfor, 1));
2965 }
2966 
2967 /*
2968  * Flush all the blocks associated with a vnode.
2969  * 	Walk through the buffer pool and push any dirty pages
2970  *	associated with the vnode.
2971  */
2972 static int
nfs_flush(struct vnode * vp,int waitfor,int commit)2973 nfs_flush(struct vnode *vp, int waitfor, int commit)
2974 {
2975 	struct nfsnode *np = VTONFS(vp);
2976 	struct buf *bp;
2977 	int i;
2978 	struct buf *nbp;
2979 	struct nfsmount *nmp = VFSTONFS(vp->v_mount);
2980 	int error = 0, slptimeo = 0, slpflag = 0, retv, bvecpos;
2981 	int passone = 1;
2982 	u_quad_t off, endoff, toff;
2983 	struct ucred* wcred = NULL;
2984 	struct buf **bvec = NULL;
2985 	struct bufobj *bo;
2986 	struct thread *td = curthread;
2987 #ifndef NFS_COMMITBVECSIZ
2988 #define NFS_COMMITBVECSIZ	20
2989 #endif
2990 	struct buf *bvec_on_stack[NFS_COMMITBVECSIZ];
2991 	int bvecsize = 0, bveccount;
2992 
2993 	if (nmp->nm_flag & NFSMNT_INT)
2994 		slpflag = PCATCH;
2995 	if (!commit)
2996 		passone = 0;
2997 	bo = &vp->v_bufobj;
2998 	/*
2999 	 * A b_flags == (B_DELWRI | B_NEEDCOMMIT) block has been written to the
3000 	 * server, but has not been committed to stable storage on the server
3001 	 * yet. On the first pass, the byte range is worked out and the commit
3002 	 * rpc is done. On the second pass, nfs_writebp() is called to do the
3003 	 * job.
3004 	 */
3005 again:
3006 	off = (u_quad_t)-1;
3007 	endoff = 0;
3008 	bvecpos = 0;
3009 	if (NFS_ISV3(vp) && commit) {
3010 		if (bvec != NULL && bvec != bvec_on_stack)
3011 			free(bvec, M_TEMP);
3012 		/*
3013 		 * Count up how many buffers waiting for a commit.
3014 		 */
3015 		bveccount = 0;
3016 		BO_LOCK(bo);
3017 		TAILQ_FOREACH_SAFE(bp, &bo->bo_dirty.bv_hd, b_bobufs, nbp) {
3018 			if (!BUF_ISLOCKED(bp) &&
3019 			    (bp->b_flags & (B_DELWRI | B_NEEDCOMMIT))
3020 				== (B_DELWRI | B_NEEDCOMMIT))
3021 				bveccount++;
3022 		}
3023 		/*
3024 		 * Allocate space to remember the list of bufs to commit.  It is
3025 		 * important to use M_NOWAIT here to avoid a race with nfs_write.
3026 		 * If we can't get memory (for whatever reason), we will end up
3027 		 * committing the buffers one-by-one in the loop below.
3028 		 */
3029 		if (bveccount > NFS_COMMITBVECSIZ) {
3030 			/*
3031 			 * Release the vnode interlock to avoid a lock
3032 			 * order reversal.
3033 			 */
3034 			BO_UNLOCK(bo);
3035 			bvec = (struct buf **)
3036 				malloc(bveccount * sizeof(struct buf *),
3037 				       M_TEMP, M_NOWAIT);
3038 			BO_LOCK(bo);
3039 			if (bvec == NULL) {
3040 				bvec = bvec_on_stack;
3041 				bvecsize = NFS_COMMITBVECSIZ;
3042 			} else
3043 				bvecsize = bveccount;
3044 		} else {
3045 			bvec = bvec_on_stack;
3046 			bvecsize = NFS_COMMITBVECSIZ;
3047 		}
3048 		TAILQ_FOREACH_SAFE(bp, &bo->bo_dirty.bv_hd, b_bobufs, nbp) {
3049 			if (bvecpos >= bvecsize)
3050 				break;
3051 			if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_NOWAIT, NULL)) {
3052 				nbp = TAILQ_NEXT(bp, b_bobufs);
3053 				continue;
3054 			}
3055 			if ((bp->b_flags & (B_DELWRI | B_NEEDCOMMIT)) !=
3056 			    (B_DELWRI | B_NEEDCOMMIT)) {
3057 				BUF_UNLOCK(bp);
3058 				nbp = TAILQ_NEXT(bp, b_bobufs);
3059 				continue;
3060 			}
3061 			BO_UNLOCK(bo);
3062 			bremfree(bp);
3063 			/*
3064 			 * Work out if all buffers are using the same cred
3065 			 * so we can deal with them all with one commit.
3066 			 *
3067 			 * NOTE: we are not clearing B_DONE here, so we have
3068 			 * to do it later on in this routine if we intend to
3069 			 * initiate I/O on the bp.
3070 			 *
3071 			 * Note: to avoid loopback deadlocks, we do not
3072 			 * assign b_runningbufspace.
3073 			 */
3074 			if (wcred == NULL)
3075 				wcred = bp->b_wcred;
3076 			else if (wcred != bp->b_wcred)
3077 				wcred = NOCRED;
3078 			vfs_busy_pages(bp, 1);
3079 
3080 			BO_LOCK(bo);
3081 			/*
3082 			 * bp is protected by being locked, but nbp is not
3083 			 * and vfs_busy_pages() may sleep.  We have to
3084 			 * recalculate nbp.
3085 			 */
3086 			nbp = TAILQ_NEXT(bp, b_bobufs);
3087 
3088 			/*
3089 			 * A list of these buffers is kept so that the
3090 			 * second loop knows which buffers have actually
3091 			 * been committed. This is necessary, since there
3092 			 * may be a race between the commit rpc and new
3093 			 * uncommitted writes on the file.
3094 			 */
3095 			bvec[bvecpos++] = bp;
3096 			toff = ((u_quad_t)bp->b_blkno) * DEV_BSIZE +
3097 				bp->b_dirtyoff;
3098 			if (toff < off)
3099 				off = toff;
3100 			toff += (u_quad_t)(bp->b_dirtyend - bp->b_dirtyoff);
3101 			if (toff > endoff)
3102 				endoff = toff;
3103 		}
3104 		BO_UNLOCK(bo);
3105 	}
3106 	if (bvecpos > 0) {
3107 		/*
3108 		 * Commit data on the server, as required.
3109 		 * If all bufs are using the same wcred, then use that with
3110 		 * one call for all of them, otherwise commit each one
3111 		 * separately.
3112 		 */
3113 		if (wcred != NOCRED)
3114 			retv = nfs_commit(vp, off, (int)(endoff - off),
3115 					  wcred, td);
3116 		else {
3117 			retv = 0;
3118 			for (i = 0; i < bvecpos; i++) {
3119 				off_t off, size;
3120 				bp = bvec[i];
3121 				off = ((u_quad_t)bp->b_blkno) * DEV_BSIZE +
3122 					bp->b_dirtyoff;
3123 				size = (u_quad_t)(bp->b_dirtyend
3124 						  - bp->b_dirtyoff);
3125 				retv = nfs_commit(vp, off, (int)size,
3126 						  bp->b_wcred, td);
3127 				if (retv) break;
3128 			}
3129 		}
3130 
3131 		if (retv == NFSERR_STALEWRITEVERF)
3132 			nfs_clearcommit(vp->v_mount);
3133 
3134 		/*
3135 		 * Now, either mark the blocks I/O done or mark the
3136 		 * blocks dirty, depending on whether the commit
3137 		 * succeeded.
3138 		 */
3139 		for (i = 0; i < bvecpos; i++) {
3140 			bp = bvec[i];
3141 			bp->b_flags &= ~(B_NEEDCOMMIT | B_CLUSTEROK);
3142 			if (retv) {
3143 				/*
3144 				 * Error, leave B_DELWRI intact
3145 				 */
3146 				vfs_unbusy_pages(bp);
3147 				brelse(bp);
3148 			} else {
3149 				/*
3150 				 * Success, remove B_DELWRI ( bundirty() ).
3151 				 *
3152 				 * b_dirtyoff/b_dirtyend seem to be NFS
3153 				 * specific.  We should probably move that
3154 				 * into bundirty(). XXX
3155 				 */
3156 				bufobj_wref(bo);
3157 				bp->b_flags |= B_ASYNC;
3158 				bundirty(bp);
3159 				bp->b_flags &= ~B_DONE;
3160 				bp->b_ioflags &= ~BIO_ERROR;
3161 				bp->b_dirtyoff = bp->b_dirtyend = 0;
3162 				bufdone(bp);
3163 			}
3164 		}
3165 	}
3166 
3167 	/*
3168 	 * Start/do any write(s) that are required.
3169 	 */
3170 loop:
3171 	BO_LOCK(bo);
3172 	TAILQ_FOREACH_SAFE(bp, &bo->bo_dirty.bv_hd, b_bobufs, nbp) {
3173 		if (BUF_LOCK(bp, LK_EXCLUSIVE | LK_NOWAIT, NULL)) {
3174 			if (waitfor != MNT_WAIT || passone)
3175 				continue;
3176 
3177 			error = BUF_TIMELOCK(bp,
3178 			    LK_EXCLUSIVE | LK_SLEEPFAIL | LK_INTERLOCK,
3179 			    BO_LOCKPTR(bo), "nfsfsync", slpflag, slptimeo);
3180 			if (error == 0) {
3181 				BUF_UNLOCK(bp);
3182 				goto loop;
3183 			}
3184 			if (error == ENOLCK) {
3185 				error = 0;
3186 				goto loop;
3187 			}
3188 			if (nfs_sigintr(nmp, td)) {
3189 				error = EINTR;
3190 				goto done;
3191 			}
3192 			if (slpflag == PCATCH) {
3193 				slpflag = 0;
3194 				slptimeo = 2 * hz;
3195 			}
3196 			goto loop;
3197 		}
3198 		if ((bp->b_flags & B_DELWRI) == 0)
3199 			panic("nfs_fsync: not dirty");
3200 		if ((passone || !commit) && (bp->b_flags & B_NEEDCOMMIT)) {
3201 			BUF_UNLOCK(bp);
3202 			continue;
3203 		}
3204 		BO_UNLOCK(bo);
3205 		bremfree(bp);
3206 		if (passone || !commit)
3207 		    bp->b_flags |= B_ASYNC;
3208 		else
3209 		    bp->b_flags |= B_ASYNC;
3210 		bwrite(bp);
3211 		if (nfs_sigintr(nmp, td)) {
3212 			error = EINTR;
3213 			goto done;
3214 		}
3215 		goto loop;
3216 	}
3217 	if (passone) {
3218 		passone = 0;
3219 		BO_UNLOCK(bo);
3220 		goto again;
3221 	}
3222 	if (waitfor == MNT_WAIT) {
3223 		while (bo->bo_numoutput) {
3224 			error = bufobj_wwait(bo, slpflag, slptimeo);
3225 			if (error) {
3226 			    BO_UNLOCK(bo);
3227 			    error = nfs_sigintr(nmp, td);
3228 			    if (error)
3229 				goto done;
3230 			    if (slpflag == PCATCH) {
3231 				slpflag = 0;
3232 				slptimeo = 2 * hz;
3233 			    }
3234 			    BO_LOCK(bo);
3235 			}
3236 		}
3237 		if (bo->bo_dirty.bv_cnt != 0 && commit) {
3238 			BO_UNLOCK(bo);
3239 			goto loop;
3240 		}
3241 		/*
3242 		 * Wait for all the async IO requests to drain
3243 		 */
3244 		BO_UNLOCK(bo);
3245 		mtx_lock(&np->n_mtx);
3246 		while (np->n_directio_asyncwr > 0) {
3247 			np->n_flag |= NFSYNCWAIT;
3248 			error = nfs_msleep(td, (caddr_t)&np->n_directio_asyncwr,
3249 					   &np->n_mtx, slpflag | (PRIBIO + 1),
3250 					   "nfsfsync", 0);
3251 			if (error) {
3252 				if (nfs_sigintr(nmp, td)) {
3253 					mtx_unlock(&np->n_mtx);
3254 					error = EINTR;
3255 					goto done;
3256 				}
3257 			}
3258 		}
3259 		mtx_unlock(&np->n_mtx);
3260 	} else
3261 		BO_UNLOCK(bo);
3262 	mtx_lock(&np->n_mtx);
3263 	if (np->n_flag & NWRITEERR) {
3264 		error = np->n_error;
3265 		np->n_flag &= ~NWRITEERR;
3266 	}
3267   	if (commit && bo->bo_dirty.bv_cnt == 0 &&
3268 	    bo->bo_numoutput == 0 && np->n_directio_asyncwr == 0)
3269   		np->n_flag &= ~NMODIFIED;
3270 	mtx_unlock(&np->n_mtx);
3271 done:
3272 	if (bvec != NULL && bvec != bvec_on_stack)
3273 		free(bvec, M_TEMP);
3274 	return (error);
3275 }
3276 
3277 /*
3278  * NFS advisory byte-level locks.
3279  */
3280 static int
nfs_advlock(struct vop_advlock_args * ap)3281 nfs_advlock(struct vop_advlock_args *ap)
3282 {
3283 	struct vnode *vp = ap->a_vp;
3284 	u_quad_t size;
3285 	int error;
3286 
3287 	error = vn_lock(vp, LK_SHARED);
3288 	if (error)
3289 		return (error);
3290 	if ((VFSTONFS(vp->v_mount)->nm_flag & NFSMNT_NOLOCKD) != 0) {
3291 		size = VTONFS(vp)->n_size;
3292 		VOP_UNLOCK(vp, 0);
3293 		error = lf_advlock(ap, &(vp->v_lockf), size);
3294 	} else {
3295 		if (nfs_advlock_p)
3296 			error = nfs_advlock_p(ap);
3297 		else
3298 			error = ENOLCK;
3299 	}
3300 
3301 	return (error);
3302 }
3303 
3304 /*
3305  * NFS advisory byte-level locks.
3306  */
3307 static int
nfs_advlockasync(struct vop_advlockasync_args * ap)3308 nfs_advlockasync(struct vop_advlockasync_args *ap)
3309 {
3310 	struct vnode *vp = ap->a_vp;
3311 	u_quad_t size;
3312 	int error;
3313 
3314 	error = vn_lock(vp, LK_SHARED);
3315 	if (error)
3316 		return (error);
3317 	if ((VFSTONFS(vp->v_mount)->nm_flag & NFSMNT_NOLOCKD) != 0) {
3318 		size = VTONFS(vp)->n_size;
3319 		VOP_UNLOCK(vp, 0);
3320 		error = lf_advlockasync(ap, &(vp->v_lockf), size);
3321 	} else {
3322 		VOP_UNLOCK(vp, 0);
3323 		error = EOPNOTSUPP;
3324 	}
3325 	return (error);
3326 }
3327 
3328 /*
3329  * Print out the contents of an nfsnode.
3330  */
3331 static int
nfs_print(struct vop_print_args * ap)3332 nfs_print(struct vop_print_args *ap)
3333 {
3334 	struct vnode *vp = ap->a_vp;
3335 	struct nfsnode *np = VTONFS(vp);
3336 
3337 	nfs_printf("\tfileid %ld fsid 0x%x",
3338 	   np->n_vattr.va_fileid, np->n_vattr.va_fsid);
3339 	if (vp->v_type == VFIFO)
3340 		fifo_printinfo(vp);
3341 	printf("\n");
3342 	return (0);
3343 }
3344 
3345 /*
3346  * This is the "real" nfs::bwrite(struct buf*).
3347  * We set B_CACHE if this is a VMIO buffer.
3348  */
3349 int
nfs_writebp(struct buf * bp,int force __unused,struct thread * td)3350 nfs_writebp(struct buf *bp, int force __unused, struct thread *td)
3351 {
3352 	int s;
3353 	int oldflags = bp->b_flags;
3354 #if 0
3355 	int retv = 1;
3356 	off_t off;
3357 #endif
3358 
3359 	BUF_ASSERT_HELD(bp);
3360 
3361 	if (bp->b_flags & B_INVAL) {
3362 		brelse(bp);
3363 		return(0);
3364 	}
3365 
3366 	bp->b_flags |= B_CACHE;
3367 
3368 	/*
3369 	 * Undirty the bp.  We will redirty it later if the I/O fails.
3370 	 */
3371 
3372 	s = splbio();
3373 	bundirty(bp);
3374 	bp->b_flags &= ~B_DONE;
3375 	bp->b_ioflags &= ~BIO_ERROR;
3376 	bp->b_iocmd = BIO_WRITE;
3377 
3378 	bufobj_wref(bp->b_bufobj);
3379 	curthread->td_ru.ru_oublock++;
3380 	splx(s);
3381 
3382 	/*
3383 	 * Note: to avoid loopback deadlocks, we do not
3384 	 * assign b_runningbufspace.
3385 	 */
3386 	vfs_busy_pages(bp, 1);
3387 
3388 	BUF_KERNPROC(bp);
3389 	bp->b_iooffset = dbtob(bp->b_blkno);
3390 	bstrategy(bp);
3391 
3392 	if( (oldflags & B_ASYNC) == 0) {
3393 		int rtval = bufwait(bp);
3394 
3395 		if (oldflags & B_DELWRI) {
3396 			s = splbio();
3397 			reassignbuf(bp);
3398 			splx(s);
3399 		}
3400 		brelse(bp);
3401 		return (rtval);
3402 	}
3403 
3404 	return (0);
3405 }
3406 
3407 /*
3408  * nfs special file access vnode op.
3409  * Essentially just get vattr and then imitate iaccess() since the device is
3410  * local to the client.
3411  */
3412 static int
nfsspec_access(struct vop_access_args * ap)3413 nfsspec_access(struct vop_access_args *ap)
3414 {
3415 	struct vattr *vap;
3416 	struct ucred *cred = ap->a_cred;
3417 	struct vnode *vp = ap->a_vp;
3418 	accmode_t accmode = ap->a_accmode;
3419 	struct vattr vattr;
3420 	int error;
3421 
3422 	/*
3423 	 * Disallow write attempts on filesystems mounted read-only;
3424 	 * unless the file is a socket, fifo, or a block or character
3425 	 * device resident on the filesystem.
3426 	 */
3427 	if ((accmode & VWRITE) && (vp->v_mount->mnt_flag & MNT_RDONLY)) {
3428 		switch (vp->v_type) {
3429 		case VREG:
3430 		case VDIR:
3431 		case VLNK:
3432 			return (EROFS);
3433 		default:
3434 			break;
3435 		}
3436 	}
3437 	vap = &vattr;
3438 	error = VOP_GETATTR(vp, vap, cred);
3439 	if (error)
3440 		goto out;
3441 	error  = vaccess(vp->v_type, vap->va_mode, vap->va_uid, vap->va_gid,
3442 			 accmode, cred, NULL);
3443 out:
3444 	return error;
3445 }
3446 
3447 /*
3448  * Read wrapper for fifos.
3449  */
3450 static int
nfsfifo_read(struct vop_read_args * ap)3451 nfsfifo_read(struct vop_read_args *ap)
3452 {
3453 	struct nfsnode *np = VTONFS(ap->a_vp);
3454 	int error;
3455 
3456 	/*
3457 	 * Set access flag.
3458 	 */
3459 	mtx_lock(&np->n_mtx);
3460 	np->n_flag |= NACC;
3461 	vfs_timestamp(&np->n_atim);
3462 	mtx_unlock(&np->n_mtx);
3463 	error = fifo_specops.vop_read(ap);
3464 	return error;
3465 }
3466 
3467 /*
3468  * Write wrapper for fifos.
3469  */
3470 static int
nfsfifo_write(struct vop_write_args * ap)3471 nfsfifo_write(struct vop_write_args *ap)
3472 {
3473 	struct nfsnode *np = VTONFS(ap->a_vp);
3474 
3475 	/*
3476 	 * Set update flag.
3477 	 */
3478 	mtx_lock(&np->n_mtx);
3479 	np->n_flag |= NUPD;
3480 	vfs_timestamp(&np->n_mtim);
3481 	mtx_unlock(&np->n_mtx);
3482 	return(fifo_specops.vop_write(ap));
3483 }
3484 
3485 /*
3486  * Close wrapper for fifos.
3487  *
3488  * Update the times on the nfsnode then do fifo close.
3489  */
3490 static int
nfsfifo_close(struct vop_close_args * ap)3491 nfsfifo_close(struct vop_close_args *ap)
3492 {
3493 	struct vnode *vp = ap->a_vp;
3494 	struct nfsnode *np = VTONFS(vp);
3495 	struct vattr vattr;
3496 	struct timespec ts;
3497 
3498 	mtx_lock(&np->n_mtx);
3499 	if (np->n_flag & (NACC | NUPD)) {
3500 		vfs_timestamp(&ts);
3501 		if (np->n_flag & NACC)
3502 			np->n_atim = ts;
3503 		if (np->n_flag & NUPD)
3504 			np->n_mtim = ts;
3505 		np->n_flag |= NCHG;
3506 		if (vrefcnt(vp) == 1 &&
3507 		    (vp->v_mount->mnt_flag & MNT_RDONLY) == 0) {
3508 			VATTR_NULL(&vattr);
3509 			if (np->n_flag & NACC)
3510 				vattr.va_atime = np->n_atim;
3511 			if (np->n_flag & NUPD)
3512 				vattr.va_mtime = np->n_mtim;
3513 			mtx_unlock(&np->n_mtx);
3514 			(void)VOP_SETATTR(vp, &vattr, ap->a_cred);
3515 			goto out;
3516 		}
3517 	}
3518 	mtx_unlock(&np->n_mtx);
3519 out:
3520 	return (fifo_specops.vop_close(ap));
3521 }
3522 
3523 /*
3524  * Just call nfs_writebp() with the force argument set to 1.
3525  *
3526  * NOTE: B_DONE may or may not be set in a_bp on call.
3527  */
3528 static int
nfs_bwrite(struct buf * bp)3529 nfs_bwrite(struct buf *bp)
3530 {
3531 
3532 	return (nfs_writebp(bp, 1, curthread));
3533 }
3534 
3535 struct buf_ops buf_ops_nfs = {
3536 	.bop_name	=	"buf_ops_nfs",
3537 	.bop_write	=	nfs_bwrite,
3538 	.bop_strategy	=	bufstrategy,
3539 	.bop_sync	=	bufsync,
3540 	.bop_bdflush	=	bufbdflush,
3541 };
3542