Bug Summary

File:nfs/nfs_socket.c
Warning:line 350, column 5
Dereference of null pointer

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name nfs_socket.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/nfs/nfs_socket.c
1/* $OpenBSD: nfs_socket.c,v 1.144 2023/08/03 09:49:09 mvs Exp $ */
2/* $NetBSD: nfs_socket.c,v 1.27 1996/04/15 20:20:00 thorpej Exp $ */
3
4/*
5 * Copyright (c) 1989, 1991, 1993, 1995
6 * The Regents of the University of California. All rights reserved.
7 *
8 * This code is derived from software contributed to Berkeley by
9 * Rick Macklem at The University of Guelph.
10 *
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
13 * are met:
14 * 1. Redistributions of source code must retain the above copyright
15 * notice, this list of conditions and the following disclaimer.
16 * 2. Redistributions in binary form must reproduce the above copyright
17 * notice, this list of conditions and the following disclaimer in the
18 * documentation and/or other materials provided with the distribution.
19 * 3. Neither the name of the University nor the names of its contributors
20 * may be used to endorse or promote products derived from this software
21 * without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33 * SUCH DAMAGE.
34 *
35 * @(#)nfs_socket.c 8.5 (Berkeley) 3/30/95
36 */
37
38/*
39 * Socket operations for use by nfs
40 */
41
42#include <sys/param.h>
43#include <sys/systm.h>
44#include <sys/proc.h>
45#include <sys/mount.h>
46#include <sys/kernel.h>
47#include <sys/mbuf.h>
48#include <sys/vnode.h>
49#include <sys/protosw.h>
50#include <sys/signalvar.h>
51#include <sys/socket.h>
52#include <sys/socketvar.h>
53#include <sys/syslog.h>
54#include <sys/tprintf.h>
55#include <sys/namei.h>
56#include <sys/pool.h>
57#include <sys/queue.h>
58
59#include <netinet/in.h>
60#include <netinet/tcp.h>
61
62#include <nfs/rpcv2.h>
63#include <nfs/nfsproto.h>
64#include <nfs/nfs.h>
65#include <nfs/xdr_subs.h>
66#include <nfs/nfsm_subs.h>
67#include <nfs/nfsmount.h>
68#include <nfs/nfs_var.h>
69
70/* External data, mostly RPC constants in XDR form. */
71extern u_int32_t rpc_reply, rpc_msgdenied, rpc_mismatch, rpc_vers,
72 rpc_auth_unix, rpc_msgaccepted, rpc_call, rpc_autherr;
73extern u_int32_t nfs_prog;
74extern struct nfsstats nfsstats;
75extern int nfsv3_procid[NFS_NPROCS23];
76extern int nfs_ticks;
77
78extern struct pool nfsrv_descript_pl;
79
80/*
81 * There is a congestion window for outstanding rpcs maintained per mount
82 * point. The cwnd size is adjusted in roughly the way that:
83 * Van Jacobson, Congestion avoidance and Control, In "Proceedings of
84 * SIGCOMM '88". ACM, August 1988.
85 * describes for TCP. The cwnd size is chopped in half on a retransmit timeout
86 * and incremented by 1/cwnd when each rpc reply is received and a full cwnd
87 * of rpcs is in progress.
88 * (The sent count and cwnd are scaled for integer arith.)
89 * Variants of "slow start" were tried and were found to be too much of a
90 * performance hit (ave. rtt 3 times larger),
91 * I suspect due to the large rtt that nfs rpcs have.
92 */
93#define NFS_CWNDSCALE256 256
94#define NFS_MAXCWND(256 * 32) (NFS_CWNDSCALE256 * 32)
95int nfs_backoff[8] = { 2, 4, 8, 16, 32, 64, 128, 256 };
96
97/* RTT estimator */
98enum nfs_rto_timers nfs_ptimers[NFS_NPROCS23] = {
99 NFS_DEFAULT_TIMER, /* NULL */
100 NFS_GETATTR_TIMER, /* GETATTR */
101 NFS_DEFAULT_TIMER, /* SETATTR */
102 NFS_LOOKUP_TIMER, /* LOOKUP */
103 NFS_GETATTR_TIMER, /* ACCESS */
104 NFS_READ_TIMER, /* READLINK */
105 NFS_READ_TIMER, /* READ */
106 NFS_WRITE_TIMER, /* WRITE */
107 NFS_DEFAULT_TIMER, /* CREATE */
108 NFS_DEFAULT_TIMER, /* MKDIR */
109 NFS_DEFAULT_TIMER, /* SYMLINK */
110 NFS_DEFAULT_TIMER, /* MKNOD */
111 NFS_DEFAULT_TIMER, /* REMOVE */
112 NFS_DEFAULT_TIMER, /* RMDIR */
113 NFS_DEFAULT_TIMER, /* RENAME */
114 NFS_DEFAULT_TIMER, /* LINK */
115 NFS_READ_TIMER, /* READDIR */
116 NFS_READ_TIMER, /* READDIRPLUS */
117 NFS_DEFAULT_TIMER, /* FSSTAT */
118 NFS_DEFAULT_TIMER, /* FSINFO */
119 NFS_DEFAULT_TIMER, /* PATHCONF */
120 NFS_DEFAULT_TIMER, /* COMMIT */
121 NFS_DEFAULT_TIMER, /* NOOP */
122};
123
124void nfs_init_rtt(struct nfsmount *);
125void nfs_update_rtt(struct nfsreq *);
126int nfs_estimate_rto(struct nfsmount *, u_int32_t procnum);
127
128void nfs_realign(struct mbuf **, int);
129void nfs_realign_fixup(struct mbuf *, struct mbuf *, unsigned int *);
130
131int nfs_rcvlock(struct nfsreq *);
132int nfs_receive(struct nfsreq *, struct mbuf **, struct mbuf **);
133int nfs_reconnect(struct nfsreq *);
134int nfs_reply(struct nfsreq *);
135void nfs_msg(struct nfsreq *, char *);
136void nfs_rcvunlock(int *);
137
138int nfsrv_getstream(struct nfssvc_sock *, int);
139
140unsigned int nfs_realign_test = 0;
141unsigned int nfs_realign_count = 0;
142
143/* Initialize the RTT estimator state for a new mount point. */
144void
145nfs_init_rtt(struct nfsmount *nmp)
146{
147 int i;
148
149 for (i = 0; i < NFS_MAX_TIMER(NFS_WRITE_TIMER); i++)
150 nmp->nm_srtt[i] = NFS_INITRTT((hz / nfs_ticks) << 3);
151 for (i = 0; i < NFS_MAX_TIMER(NFS_WRITE_TIMER); i++)
152 nmp->nm_sdrtt[i] = 0;
153}
154
155/*
156 * Update a mount point's RTT estimator state using data from the
157 * passed-in request.
158 *
159 * Use a gain of 0.125 on the mean and a gain of 0.25 on the deviation.
160 *
161 * NB: Since the timer resolution of NFS_HZ is so course, it can often
162 * result in r_rtt == 0. Since r_rtt == N means that the actual RTT is
163 * between N + dt and N + 2 - dt ticks, add 1 before calculating the
164 * update values.
165 */
166void
167nfs_update_rtt(struct nfsreq *rep)
168{
169 int t1 = rep->r_rtt + 1;
170 int index = nfs_ptimers[rep->r_procnum] - 1;
171 int *srtt = &rep->r_nmp->nm_srtt[index];
172 int *sdrtt = &rep->r_nmp->nm_sdrtt[index];
173
174 t1 -= *srtt >> 3;
175 *srtt += t1;
176 if (t1 < 0)
177 t1 = -t1;
178 t1 -= *sdrtt >> 2;
179 *sdrtt += t1;
180}
181
182/*
183 * Estimate RTO for an NFS RPC sent via an unreliable datagram.
184 *
185 * Use the mean and mean deviation of RTT for the appropriate type
186 * of RPC for the frequent RPCs and a default for the others.
187 * The justification for doing "other" this way is that these RPCs
188 * happen so infrequently that timer est. would probably be stale.
189 * Also, since many of these RPCs are non-idempotent, a conservative
190 * timeout is desired.
191 *
192 * getattr, lookup - A+2D
193 * read, write - A+4D
194 * other - nm_timeo
195 */
196int
197nfs_estimate_rto(struct nfsmount *nmp, u_int32_t procnum)
198{
199 enum nfs_rto_timers timer = nfs_ptimers[procnum];
200 int index = timer - 1;
201 int rto;
202
203 switch (timer) {
204 case NFS_GETATTR_TIMER:
205 case NFS_LOOKUP_TIMER:
206 rto = ((nmp->nm_srtt[index] + 3) >> 2) +
207 ((nmp->nm_sdrtt[index] + 1) >> 1);
208 break;
209 case NFS_READ_TIMER:
210 case NFS_WRITE_TIMER:
211 rto = ((nmp->nm_srtt[index] + 7) >> 3) +
212 (nmp->nm_sdrtt[index] + 1);
213 break;
214 default:
215 rto = nmp->nm_timeo;
216 return (rto);
217 }
218
219 if (rto < NFS_MINRTO((hz / nfs_ticks) >> 2))
220 rto = NFS_MINRTO((hz / nfs_ticks) >> 2);
221 else if (rto > NFS_MAXRTO(20 * (hz / nfs_ticks)))
222 rto = NFS_MAXRTO(20 * (hz / nfs_ticks));
223
224 return (rto);
225}
226
227
228
229/*
230 * Initialize sockets and congestion for a new NFS connection.
231 * We do not free the sockaddr if error.
232 */
233int
234nfs_connect(struct nfsmount *nmp, struct nfsreq *rep)
235{
236 struct socket *so;
237 int error, rcvreserve, sndreserve;
238 struct sockaddr *saddr;
239 struct sockaddr_in *sin;
240 struct mbuf *nam = NULL((void *)0), *mopt = NULL((void *)0);
67
←
'mopt' initialized to a null pointer value
→
241
242 if (!(nmp->nm_sotype
33.1
Field 'nm_sotype' is not equal to SOCK_DGRAM
 == SOCK_DGRAM2 || nmp->nm_sotype == SOCK_STREAM1))
34
←
Assuming field 'nm_sotype' is equal to SOCK_STREAM
→
35
←
Taking false branch
→
68
←
Assuming field 'nm_sotype' is equal to SOCK_DGRAM
→
69
←
Taking false branch
→
243 return (EINVAL22);
244
245 nmp->nm_so = NULL((void *)0);
246 saddr = mtod(nmp->nm_nam, struct sockaddr *)((struct sockaddr *)((nmp->nm_nam)->m_hdr.mh_data));
247 error = socreate(saddr->sa_family, &nmp->nm_so, nmp->nm_sotype,
248 nmp->nm_soproto);
249 if (error) {
36
←
Assuming 'error' is 0
→
70
←
Assuming 'error' is 0
→
250 nfs_disconnect(nmp);
251 return (error);
252 }
253
254 /* Allocate mbufs possibly waiting before grabbing the socket lock. */
255 if (nmp->nm_sotype == SOCK_STREAM1 || saddr->sa_family == AF_INET2)
37
←
Assuming field 'nm_sotype' is not equal to SOCK_STREAM
→
38
←
Assuming field 'sa_family' is not equal to AF_INET
→
39
←
Taking false branch
→
71
←
Assuming field 'nm_sotype' is not equal to SOCK_STREAM
→
72
←
Assuming field 'sa_family' is not equal to AF_INET
→
73
←
Taking false branch
→
256 MGET(mopt, M_WAIT, MT_SOOPTS)mopt = m_get((0x0001), (4));
257 if (saddr->sa_family
39.1
Field 'sa_family' is not equal to AF_INET
73.1
Field 'sa_family' is not equal to AF_INET
 == AF_INET2)
40
←
Taking false branch
→
74
←
Taking false branch
→
258 MGET(nam, M_WAIT, MT_SONAME)nam = m_get((0x0001), (3));
259
260 so = nmp->nm_so;
261 nmp->nm_soflags = so->so_proto->pr_flags;
262
263 /*
264 * Some servers require that the client port be a reserved port number.
265 * We always allocate a reserved port, as this prevents filehandle
266 * disclosure through UDP port capture.
267 */
268 if (saddr->sa_family
40.1
Field 'sa_family' is not equal to AF_INET
74.1
Field 'sa_family' is not equal to AF_INET
 == AF_INET2) {
41
←
Taking false branch
→
75
←
Taking false branch
→
269 int *ip;
270
271 mopt->m_lenm_hdr.mh_len = sizeof(int);
272 ip = mtod(mopt, int *)((int *)((mopt)->m_hdr.mh_data));
273 *ip = IP_PORTRANGE_LOW2;
274 error = sosetopt(so, IPPROTO_IP0, IP_PORTRANGE19, mopt);
275 if (error)
276 goto bad;
277
278 sin = mtod(nam, struct sockaddr_in *)((struct sockaddr_in *)((nam)->m_hdr.mh_data));
279 memset(sin, 0, sizeof(*sin))__builtin_memset((sin), (0), (sizeof(*sin)));
280 sin->sin_len = nam->m_lenm_hdr.mh_len = sizeof(struct sockaddr_in);
281 sin->sin_family = AF_INET2;
282 sin->sin_addr.s_addr = INADDR_ANY((u_int32_t) (__uint32_t)(__builtin_constant_p((u_int32_t)(0x00000000
)) ? (__uint32_t)(((__uint32_t)((u_int32_t)(0x00000000)) &
0xff) << 24 | ((__uint32_t)((u_int32_t)(0x00000000)) &
0xff00) << 8 | ((__uint32_t)((u_int32_t)(0x00000000)) &
0xff0000) >> 8 | ((__uint32_t)((u_int32_t)(0x00000000)
) & 0xff000000) >> 24) : __swap32md((u_int32_t)(0x00000000
))));
283 sin->sin_port = htons(0)(__uint16_t)(__builtin_constant_p(0) ? (__uint16_t)(((__uint16_t
)(0) & 0xffU) << 8 | ((__uint16_t)(0) & 0xff00U
) >> 8) : __swap16md(0));
284 solock(so);
285 error = sobind(so, nam, &proc0);
286 sounlock(so);
287 if (error)
288 goto bad;
289
290 mopt->m_lenm_hdr.mh_len = sizeof(int);
291 ip = mtod(mopt, int *)((int *)((mopt)->m_hdr.mh_data));
292 *ip = IP_PORTRANGE_DEFAULT0;
293 error = sosetopt(so, IPPROTO_IP0, IP_PORTRANGE19, mopt);
294 if (error)
295 goto bad;
296 }
297
298 solock(so);
299 /*
300 * Protocols that do not require connections may be optionally left
301 * unconnected for servers that reply from a port other than NFS_PORT.
302 */
303 if (nmp->nm_flag & NFSMNT_NOCONN0x00000080) {
42
←
Assuming the condition is true
→
43
←
Taking true branch
→
76
←
Assuming the condition is false
→
77
←
Taking false branch
→
304 if (nmp->nm_soflags & PR_CONNREQUIRED0x0004) {
44
←
Assuming the condition is false
→
45
←
Taking false branch
→
305 error = ENOTCONN57;
306 goto bad_locked;
307 }
308 } else {
309 error = soconnect(so, nmp->nm_nam);
310 if (error)
78
←
Assuming 'error' is 0
→
311 goto bad_locked;
312
313 /*
314 * Wait for the connection to complete. Cribbed from the
315 * connect system call but with the wait timing out so
316 * that interruptible mounts don't hang here for a long time.
317 */
318 while ((so->so_state & SS_ISCONNECTING0x004) && so->so_error == 0) {
79
←
Assuming the condition is true
→
80
←
Assuming field 'so_error' is equal to 0
→
81
←
Loop condition is true. Entering loop body
→
85
←
Taking false branch
→
86
←
Loop condition is true. Entering loop body
→
319 sosleep_nsec(so, &so->so_timeo, PSOCK24, "nfscon",
320 SEC_TO_NSEC(2));
321 if ((so->so_state & SS_ISCONNECTING0x004) &&
82
←
Assuming the condition is true
→
87
←
Assuming the condition is false
→
322 so->so_error == 0 && rep
83.1
'rep' is non-null
 &&
83
←
Assuming field 'so_error' is equal to 0
→
323 (error = nfs_sigintr(nmp, rep, rep->r_procp)) != 0){
84
←
Assuming the condition is false
→
324 so->so_state &= ~SS_ISCONNECTING0x004;
325 goto bad_locked;
326 }
327 }
328 if (so->so_error) {
88
←
Assuming field 'so_error' is 0
→
89
←
Taking false branch
→
329 error = so->so_error;
330 so->so_error = 0;
331 goto bad_locked;
332 }
333 }
334 /*
335 * Always set receive timeout to detect server crash and reconnect.
336 * Otherwise, we can get stuck in soreceive forever.
337 */
338 so->so_rcv.sb_timeo_nsecs = SEC_TO_NSEC(5);
339 if (nmp->nm_flag & (NFSMNT_SOFT0x00000001 | NFSMNT_INT0x00000040))
46
←
Assuming the condition is false
→
47
←
Taking false branch
→
90
←
Assuming the condition is false
→
91
←
Taking false branch
→
340 so->so_snd.sb_timeo_nsecs = SEC_TO_NSEC(5);
341 else
342 so->so_snd.sb_timeo_nsecs = INFSLP0xffffffffffffffffULL;
343 sounlock(so);
344 if (nmp->nm_sotype == SOCK_DGRAM2) {
48
←
Assuming field 'nm_sotype' is equal to SOCK_DGRAM
→
49
←
Taking true branch
→
92
←
Assuming field 'nm_sotype' is not equal to SOCK_DGRAM
→
93
←
Taking false branch
→
345 sndreserve = nmp->nm_wsize + NFS_MAXPKTHDR404;
346 rcvreserve = (max(nmp->nm_rsize, nmp->nm_readdirsize) +
347 NFS_MAXPKTHDR404) * 2;
348 } else if (nmp->nm_sotype == SOCK_STREAM1) {
94
←
Assuming field 'nm_sotype' is equal to SOCK_STREAM
→
95
←
Taking true branch
→
349 if (so->so_proto->pr_flags & PR_CONNREQUIRED0x0004) {
96
←
Assuming the condition is true
→
97
←
Taking true branch
→
350 *mtod(mopt, int32_t *)((int32_t *)((mopt)->m_hdr.mh_data)) = 1;
98
←
Dereference of null pointer
351 mopt->m_lenm_hdr.mh_len = sizeof(int32_t);
352 sosetopt(so, SOL_SOCKET0xffff, SO_KEEPALIVE0x0008, mopt);
353 }
354 if (so->so_proto->pr_protocol == IPPROTO_TCP6) {
355 *mtod(mopt, int32_t *)((int32_t *)((mopt)->m_hdr.mh_data)) = 1;
356 mopt->m_lenm_hdr.mh_len = sizeof(int32_t);
357 sosetopt(so, IPPROTO_TCP6, TCP_NODELAY0x01, mopt);
358 }
359 sndreserve = (nmp->nm_wsize + NFS_MAXPKTHDR404 +
360 sizeof (u_int32_t)) * 2;
361 rcvreserve = (nmp->nm_rsize + NFS_MAXPKTHDR404 +
362 sizeof (u_int32_t)) * 2;
363 } else {
364 panic("%s: nm_sotype %d", __func__, nmp->nm_sotype);
365 }
366 solock(so);
367 error = soreserve(so, sndreserve, rcvreserve);
368 if (error)
50
←
Assuming 'error' is 0
→
51
←
Taking false branch
→
369 goto bad_locked;
370 so->so_rcv.sb_flags |= SB_NOINTR0x40;
371 so->so_snd.sb_flags |= SB_NOINTR0x40;
372 sounlock(so);
373
374 m_freem(mopt);
375 m_freem(nam);
376
377 /* Initialize other non-zero congestion variables */
378 nfs_init_rtt(nmp);
52
←
Value assigned to field 'nm_so', which participates in a condition later
→
379 nmp->nm_cwnd = NFS_MAXCWND(256 * 32) / 2; /* Initial send window */
380 nmp->nm_sent = 0;
381 nmp->nm_timeouts = 0;
382 return (0);
53
←
Returning without writing to 'rep->r_mrep', which participates in a condition later
→
383
384bad_locked:
385 sounlock(so);
386bad:
387
388 m_freem(mopt);
389 m_freem(nam);
390
391 nfs_disconnect(nmp);
392 return (error);
393}
394
395/*
396 * Reconnect routine:
397 * Called when a connection is broken on a reliable protocol.
398 * - clean up the old socket
399 * - nfs_connect() again
400 * - set R_MUSTRESEND for all outstanding requests on mount point
401 * If this fails the mount point is DEAD!
402 * nb: Must be called with the nfs_sndlock() set on the mount point.
403 */
404int
405nfs_reconnect(struct nfsreq *rep)
406{
407 struct nfsreq *rp;
408 struct nfsmount *nmp = rep->r_nmp;
409 int error;
410
411 nfs_disconnect(nmp);
412 while ((error = nfs_connect(nmp, rep)) != 0) {
33
←
Calling 'nfs_connect'
→
54
←
Returning from 'nfs_connect'
→
55
←
Loop condition is false. Execution continues on line 422
→
66
←
Calling 'nfs_connect'
→
413 if (error == EINTR4 || error == ERESTART-1)
414 return (EINTR4);
415 tsleep_nsec(&nowake, PSOCK24, "nfsrecon", SEC_TO_NSEC(1));
416 }
417
418 /*
419 * Loop through outstanding request list and fix up all requests
420 * on old socket.
421 */
422 TAILQ_FOREACH(rp, &nmp->nm_reqsq, r_chain)for((rp) = ((&nmp->nm_reqsq)->tqh_first); (rp) != (
(void *)0); (rp) = ((rp)->r_chain.tqe_next)) {
56
←
Assuming 'rp' is equal to null
→
57
←
Loop condition is false. Execution continues on line 426
→
423 rp->r_flags |= R_MUSTRESEND0x40;
424 rp->r_rexmit = 0;
425 }
426 return (0);
58
←
Returning without writing to 'rep->r_mrep', which participates in a condition later
→
59
←
Returning zero, which participates in a condition later
→
427}
428
429/*
430 * NFS disconnect. Clean up and unlink.
431 */
432void
433nfs_disconnect(struct nfsmount *nmp)
434{
435 struct socket *so;
436
437 if (nmp->nm_so) {
438 so = nmp->nm_so;
439 nmp->nm_so = NULL((void *)0);
440 soshutdown(so, SHUT_RDWR2);
441 soclose(so, 0);
442 }
443}
444
445/*
446 * This is the nfs send routine. For connection based socket types, it
447 * must be called with an nfs_sndlock() on the socket.
448 * "rep == NULL" indicates that it has been called from a server.
449 * For the client side:
450 * - return EINTR if the RPC is terminated, 0 otherwise
451 * - set R_MUSTRESEND if the send fails for any reason
452 * - do any cleanup required by recoverable socket errors (???)
453 * For the server side:
454 * - return EINTR or ERESTART if interrupted by a signal
455 * - return EPIPE if a connection is lost for connection based sockets (TCP...)
456 * - do any cleanup required by recoverable socket errors (???)
457 */
458int
459nfs_send(struct socket *so, struct mbuf *nam, struct mbuf *top,
460 struct nfsreq *rep)
461{
462 struct mbuf *sendnam;
463 int error, soflags, flags;
464
465 if (rep) {
466 if (rep->r_flags & R_SOFTTERM0x04) {
467 m_freem(top);
468 return (EINTR4);
469 }
470 if ((so = rep->r_nmp->nm_so) == NULL((void *)0)) {
471 rep->r_flags |= R_MUSTRESEND0x40;
472 m_freem(top);
473 return (0);
474 }
475 rep->r_flags &= ~R_MUSTRESEND0x40;
476 soflags = rep->r_nmp->nm_soflags;
477 } else
478 soflags = so->so_proto->pr_flags;
479 if ((soflags & PR_CONNREQUIRED0x0004) || (so->so_state & SS_ISCONNECTED0x002))
480 sendnam = NULL((void *)0);
481 else
482 sendnam = nam;
483 flags = 0;
484
485 error = sosend(so, sendnam, NULL((void *)0), top, NULL((void *)0), flags);
486 if (error) {
487 if (rep) {
488 /*
489 * Deal with errors for the client side.
490 */
491 if (rep->r_flags & R_SOFTTERM0x04)
492 error = EINTR4;
493 else
494 rep->r_flags |= R_MUSTRESEND0x40;
495 }
496
497 /*
498 * Handle any recoverable (soft) socket errors here. (???)
499 */
500 if (error != EINTR4 && error != ERESTART-1 &&
501 error != EWOULDBLOCK35 && error != EPIPE32)
502 error = 0;
503 }
504 return (error);
505}
506
507#ifdef NFSCLIENT1
508/*
509 * Receive a Sun RPC Request/Reply. For SOCK_DGRAM, the work is all
510 * done by soreceive(), but for SOCK_STREAM we must deal with the Record
511 * Mark and consolidate the data into a new mbuf list.
512 * nb: Sometimes TCP passes the data up to soreceive() in long lists of
513 * small mbufs.
514 * For SOCK_STREAM we must be very careful to read an entire record once
515 * we have read any of it, even if the system call has been interrupted.
516 */
517int
518nfs_receive(struct nfsreq *rep, struct mbuf **aname, struct mbuf **mp)
519{
520 struct socket *so;
521 struct uio auio;
522 struct iovec aio;
523 struct mbuf *m;
524 struct mbuf *control;
525 u_int32_t len;
526 struct mbuf **getnam;
527 int error, sotype, rcvflg;
528 struct proc *p = curproc({struct cpu_info *__ci; asm volatile("movq %%gs:%P1,%0" : "=r"
(__ci) :"n" (__builtin_offsetof(struct cpu_info, ci_self)));
__ci;})->ci_curproc; /* XXX */
529
530 /*
531 * Set up arguments for soreceive()
532 */
533 *mp = NULL((void *)0);
534 *aname = NULL((void *)0);
535 sotype = rep->r_nmp->nm_sotype;
536
537 /*
538 * For reliable protocols, lock against other senders/receivers
539 * in case a reconnect is necessary.
540 * For SOCK_STREAM, first get the Record Mark to find out how much
541 * more there is to get.
542 * We must lock the socket against other receivers
543 * until we have an entire rpc request/reply.
544 */
545 if (sotype != SOCK_DGRAM2) {
19
←
Assuming 'sotype' is not equal to SOCK_DGRAM
→
20
←
Taking true branch
→
546 error = nfs_sndlock(&rep->r_nmp->nm_flag, rep);
21
←
Calling 'nfs_sndlock'
→
28
←
Returning from 'nfs_sndlock'
→
547 if (error
28.1
'error' is 0
)
548 return (error);
549tryagain:
550 /*
551 * Check for fatal errors and resending request.
552 */
553 /*
554 * Ugh: If a reconnect attempt just happened, nm_so
555 * would have changed. NULL indicates a failed
556 * attempt that has essentially shut down this
557 * mount point.
558 */
559 if (rep->r_mrep
28.2
Field 'r_mrep' is null
61.1
Field 'r_mrep' is null
 || (rep->r_flags & R_SOFTTERM0x04)) {
29
←
Taking false branch
→
62
←
Taking false branch
→
560 nfs_sndunlock(&rep->r_nmp->nm_flag);
561 return (EINTR4);
562 }
563 so = rep->r_nmp->nm_so;
564 if (!so) {
30
←
Assuming 'so' is null
→
31
←
Taking true branch
→
63
←
Assuming 'so' is null
→
64
←
Taking true branch
→
565 error = nfs_reconnect(rep);
32
←
Calling 'nfs_reconnect'
→
60
←
Returning from 'nfs_reconnect'
→
65
←
Calling 'nfs_reconnect'
→
566 if (error
60.1
'error' is 0
) {
61
←
Taking false branch
→
567 nfs_sndunlock(&rep->r_nmp->nm_flag);
568 return (error);
569 }
570 goto tryagain;
571 }
572 while (rep->r_flags & R_MUSTRESEND0x40) {
573 m = m_copym(rep->r_mreq, 0, M_COPYALL1000000000, M_WAIT0x0001);
574 nfsstats.rpcretries++;
575 rep->r_rtt = 0;
576 rep->r_flags &= ~R_TIMING0x01;
577 error = nfs_send(so, rep->r_nmp->nm_nam, m, rep);
578 if (error) {
579 if (error == EINTR4 || error == ERESTART-1 ||
580 (error = nfs_reconnect(rep)) != 0) {
581 nfs_sndunlock(&rep->r_nmp->nm_flag);
582 return (error);
583 }
584 goto tryagain;
585 }
586 }
587 nfs_sndunlock(&rep->r_nmp->nm_flag);
588 if (sotype == SOCK_STREAM1) {
589 aio.iov_base = (caddr_t) &len;
590 aio.iov_len = sizeof(u_int32_t);
591 auio.uio_iov = &aio;
592 auio.uio_iovcnt = 1;
593 auio.uio_segflg = UIO_SYSSPACE;
594 auio.uio_rw = UIO_READ;
595 auio.uio_offset = 0;
596 auio.uio_resid = sizeof(u_int32_t);
597 auio.uio_procp = p;
598 do {
599 rcvflg = MSG_WAITALL0x40;
600 error = soreceive(so, NULL((void *)0), &auio, NULL((void *)0), NULL((void *)0),
601 &rcvflg, 0);
602 if (error == EWOULDBLOCK35 && rep) {
603 if (rep->r_flags & R_SOFTTERM0x04)
604 return (EINTR4);
605 /*
606 * looks like the server died after it
607 * received the request, make sure
608 * that we will retransmit and we
609 * don't get stuck here forever.
610 */
611 if (rep->r_rexmit >=
612 rep->r_nmp->nm_retry) {
613 nfsstats.rpctimeouts++;
614 error = EPIPE32;
615 }
616 }
617 } while (error == EWOULDBLOCK35);
618 if (!error && auio.uio_resid > 0) {
619 log(LOG_INFO6,
620 "short receive (%zu/%zu) from nfs server %s\n",
621 sizeof(u_int32_t) - auio.uio_resid,
622 sizeof(u_int32_t),
623 rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname);
624 error = EPIPE32;
625 }
626 if (error)
627 goto errout;
628
629 len = ntohl(len)(__uint32_t)(__builtin_constant_p(len) ? (__uint32_t)(((__uint32_t
)(len) & 0xff) << 24 | ((__uint32_t)(len) & 0xff00
) << 8 | ((__uint32_t)(len) & 0xff0000) >> 8 |
((__uint32_t)(len) & 0xff000000) >> 24) : __swap32md
(len)) & ~0x80000000;
630 /*
631 * This is SERIOUS! We are out of sync with the sender
632 * and forcing a disconnect/reconnect is all I can do.
633 */
634 if (len > NFS_MAXPACKET(404 + (64 * 1024))) {
635 log(LOG_ERR3, "%s (%u) from nfs server %s\n",
636 "impossible packet length",
637 len,
638 rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname);
639 error = EFBIG27;
640 goto errout;
641 }
642 auio.uio_resid = len;
643 do {
644 rcvflg = MSG_WAITALL0x40;
645 error = soreceive(so, NULL((void *)0), &auio, mp, NULL((void *)0),
646 &rcvflg, 0);
647 } while (error == EWOULDBLOCK35 || error == EINTR4 ||
648 error == ERESTART-1);
649 if (!error && auio.uio_resid > 0) {
650 log(LOG_INFO6, "short receive (%zu/%u) from "
651 "nfs server %s\n", len - auio.uio_resid,
652 len, rep->r_nmp->nm_mountp->
653 mnt_stat.f_mntfromname);
654 error = EPIPE32;
655 }
656 } else {
657 /*
658 * NB: Since uio_resid is big, MSG_WAITALL is ignored
659 * and soreceive() will return when it has either a
660 * control msg or a data msg.
661 * We have no use for control msg., but must grab them
662 * and then throw them away so we know what is going
663 * on.
664 */
665 auio.uio_resid = len = 100000000; /* Anything Big */
666 auio.uio_procp = p;
667 do {
668 rcvflg = 0;
669 error = soreceive(so, NULL((void *)0), &auio, mp, &control,
670 &rcvflg, 0);
671 m_freem(control);
672 if (error == EWOULDBLOCK35 && rep) {
673 if (rep->r_flags & R_SOFTTERM0x04)
674 return (EINTR4);
675 }
676 } while (error == EWOULDBLOCK35 ||
677 (!error && *mp == NULL((void *)0) && control));
678 if ((rcvflg & MSG_EOR0x8) == 0)
679 printf("Egad!!\n");
680 if (!error && *mp == NULL((void *)0))
681 error = EPIPE32;
682 len -= auio.uio_resid;
683 }
684errout:
685 if (error && error != EINTR4 && error != ERESTART-1) {
686 m_freemp(mp);
687 if (error != EPIPE32)
688 log(LOG_INFO6,
689 "receive error %d from nfs server %s\n",
690 error,
691 rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname);
692 error = nfs_sndlock(&rep->r_nmp->nm_flag, rep);
693 if (!error) {
694 error = nfs_reconnect(rep);
695 if (!error)
696 goto tryagain;
697 nfs_sndunlock(&rep->r_nmp->nm_flag);
698 }
699 }
700 } else {
701 if ((so = rep->r_nmp->nm_so) == NULL((void *)0))
702 return (EACCES13);
703 if (so->so_state & SS_ISCONNECTED0x002)
704 getnam = NULL((void *)0);
705 else
706 getnam = aname;
707 auio.uio_resid = len = 1000000;
708 auio.uio_procp = p;
709 do {
710 rcvflg = 0;
711 error = soreceive(so, getnam, &auio, mp, NULL((void *)0),
712 &rcvflg, 0);
713 if (error == EWOULDBLOCK35 &&
714 (rep->r_flags & R_SOFTTERM0x04))
715 return (EINTR4);
716 } while (error == EWOULDBLOCK35);
717 len -= auio.uio_resid;
718 }
719 if (error)
720 m_freemp(mp);
721 /*
722 * Search for any mbufs that are not a multiple of 4 bytes long
723 * or with m_data not longword aligned.
724 * These could cause pointer alignment problems, so copy them to
725 * well aligned mbufs.
726 */
727 nfs_realign(mp, 5 * NFSX_UNSIGNED4);
728 return (error);
729}
730
731/*
732 * Implement receipt of reply on a socket.
733 * We must search through the list of received datagrams matching them
734 * with outstanding requests using the xid, until ours is found.
735 */
736int
737nfs_reply(struct nfsreq *myrep)
738{
739 struct nfsreq *rep;
740 struct nfsmount *nmp = myrep->r_nmp;
741 struct nfsm_info info;
742 struct mbuf *nam;
743 u_int32_t rxid, *tl, t1;
744 caddr_t cp2;
745 int error;
746
747 /*
748 * Loop around until we get our own reply
749 */
750 for (;;) {
9
←
Loop condition is true. Entering loop body
→
751 /*
752 * Lock against other receivers so that I don't get stuck in
753 * sbwait() after someone else has received my reply for me.
754 * Also necessary for connection based protocols to avoid
755 * race conditions during a reconnect.
756 */
757 error = nfs_rcvlock(myrep);
10
←
Calling 'nfs_rcvlock'
→
16
←
Returning from 'nfs_rcvlock'
→
758 if (error
16.1
'error' is 0
)
17
←
Taking false branch
→
759 return (error == EALREADY37 ? 0 : error);
760
761 /*
762 * Get the next Rpc reply off the socket
763 */
764 error = nfs_receive(myrep, &nam, &info.nmi_mrep);
18
←
Calling 'nfs_receive'
→
765 nfs_rcvunlock(&nmp->nm_flag);
766 if (error) {
767
768 /*
769 * Ignore routing errors on connectionless protocols??
770 */
771 if (NFSIGNORE_SOERROR(nmp->nm_soflags, error)((error) != 4 && (error) != -1 && (error) != 35
&& ((nmp->nm_soflags) & 0x0004) == 0)) {
772 if (nmp->nm_so)
773 nmp->nm_so->so_error = 0;
774 continue;
775 }
776 return (error);
777 }
778 m_freem(nam);
779
780 /*
781 * Get the xid and check that it is an rpc reply
782 */
783 info.nmi_md = info.nmi_mrep;
784 info.nmi_dpos = mtod(info.nmi_md, caddr_t)((caddr_t)((info.nmi_md)->m_hdr.mh_data));
785 nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= (2 * 4)) { (tl
) = (u_int32_t *)(info.nmi_dpos); info.nmi_dpos += (2 * 4); }
else if ((t1 = nfsm_disct(&info.nmi_md, &info.nmi_dpos
, (2 * 4), t1, &cp2)) != 0) { error = t1; m_freem(info.nmi_mrep
); goto nfsmout; } else { (tl) = (u_int32_t *)cp2; } };
786 rxid = *tl++;
787 if (*tl != rpc_reply) {
788 nfsstats.rpcinvalid++;
789 m_freem(info.nmi_mrep);
790nfsmout:
791 continue;
792 }
793
794 /*
795 * Loop through the request list to match up the reply
796 * Iff no match, just drop the datagram
797 */
798 TAILQ_FOREACH(rep, &nmp->nm_reqsq, r_chain)for((rep) = ((&nmp->nm_reqsq)->tqh_first); (rep) !=
((void *)0); (rep) = ((rep)->r_chain.tqe_next)) {
799 if (rep->r_mrep == NULL((void *)0) && rxid == rep->r_xid) {
800 /* Found it.. */
801 rep->r_mrep = info.nmi_mrep;
802 rep->r_md = info.nmi_md;
803 rep->r_dpos = info.nmi_dpos;
804
805 /*
806 * Update congestion window.
807 * Do the additive increase of
808 * one rpc/rtt.
809 */
810 if (nmp->nm_cwnd <= nmp->nm_sent) {
811 nmp->nm_cwnd +=
812 (NFS_CWNDSCALE256 * NFS_CWNDSCALE256 +
813 (nmp->nm_cwnd >> 1)) / nmp->nm_cwnd;
814 if (nmp->nm_cwnd > NFS_MAXCWND(256 * 32))
815 nmp->nm_cwnd = NFS_MAXCWND(256 * 32);
816 }
817 rep->r_flags &= ~R_SENT0x02;
818 nmp->nm_sent -= NFS_CWNDSCALE256;
819
820 if (rep->r_flags & R_TIMING0x01)
821 nfs_update_rtt(rep);
822
823 nmp->nm_timeouts = 0;
824 break;
825 }
826 }
827 /*
828 * If not matched to a request, drop it.
829 * If it's mine, get out.
830 */
831 if (rep == 0) {
832 nfsstats.rpcunexpected++;
833 m_freem(info.nmi_mrep);
834 } else if (rep == myrep) {
835 if (rep->r_mrep == NULL((void *)0))
836 panic("nfsreply nil");
837 return (0);
838 }
839 }
840}
841
842/*
843 * nfs_request - goes something like this
844 * - fill in request struct
845 * - links it into list
846 * - calls nfs_send() for first transmit
847 * - calls nfs_receive() to get reply
848 * - break down rpc header and return with nfs reply pointed to
849 * by mrep or error
850 * nb: always frees up mreq mbuf list
851 */
852int
853nfs_request(struct vnode *vp, int procnum, struct nfsm_info *infop)
854{
855 struct mbuf *m;
856 u_int32_t *tl;
857 struct nfsmount *nmp;
858 caddr_t cp2;
859 int t1, i, error = 0;
860 int trylater_delay;
861 struct nfsreq *rep;
862 struct nfsm_info info;
863
864 rep = pool_get(&nfsreqpl, PR_WAITOK0x0001);
865 rep->r_nmp = VFSTONFS(vp->v_mount)((struct nfsmount *)((vp->v_mount)->mnt_data));
866 rep->r_vp = vp;
867 rep->r_procp = infop->nmi_procp;
868 rep->r_procnum = procnum;
869
870 /* empty mbuf for AUTH_UNIX header */
871 rep->r_mreq = m_gethdr(M_WAIT0x0001, MT_DATA1);
872 rep->r_mreq->m_nextm_hdr.mh_next = infop->nmi_mreq;
873 rep->r_mreq->m_lenm_hdr.mh_len = 0;
874 m_calchdrlen(rep->r_mreq);
875
876 trylater_delay = NFS_MINTIMEO(1 * (hz / nfs_ticks));
877
878 nmp = rep->r_nmp;
879
880 /* Get the RPC header with authorization. */
881 nfsm_rpchead(rep, infop->nmi_cred, RPCAUTH_UNIX1);
882 m = rep->r_mreq;
883
884 /*
885 * For stream protocols, insert a Sun RPC Record Mark.
886 */
887 if (nmp->nm_sotype == SOCK_STREAM1) {
1
Assuming field 'nm_sotype' is not equal to SOCK_STREAM
→
2
←
Taking false branch
→
888 M_PREPEND(m, NFSX_UNSIGNED, M_WAIT)(m) = m_prepend((m), (4), (0x0001));
889 *mtod(m, u_int32_t *)((u_int32_t *)((m)->m_hdr.mh_data)) = htonl(0x80000000 |(__uint32_t)(__builtin_constant_p(0x80000000 | (m->M_dat.MH
.MH_pkthdr.len - 4)) ? (__uint32_t)(((__uint32_t)(0x80000000 |
(m->M_dat.MH.MH_pkthdr.len - 4)) & 0xff) << 24 |
((__uint32_t)(0x80000000 | (m->M_dat.MH.MH_pkthdr.len - 4
)) & 0xff00) << 8 | ((__uint32_t)(0x80000000 | (m->
M_dat.MH.MH_pkthdr.len - 4)) & 0xff0000) >> 8 | ((__uint32_t
)(0x80000000 | (m->M_dat.MH.MH_pkthdr.len - 4)) & 0xff000000
) >> 24) : __swap32md(0x80000000 | (m->M_dat.MH.MH_pkthdr
.len - 4)))
890 (m->m_pkthdr.len - NFSX_UNSIGNED))(__uint32_t)(__builtin_constant_p(0x80000000 | (m->M_dat.MH
.MH_pkthdr.len - 4)) ? (__uint32_t)(((__uint32_t)(0x80000000 |
(m->M_dat.MH.MH_pkthdr.len - 4)) & 0xff) << 24 |
((__uint32_t)(0x80000000 | (m->M_dat.MH.MH_pkthdr.len - 4
)) & 0xff00) << 8 | ((__uint32_t)(0x80000000 | (m->
M_dat.MH.MH_pkthdr.len - 4)) & 0xff0000) >> 8 | ((__uint32_t
)(0x80000000 | (m->M_dat.MH.MH_pkthdr.len - 4)) & 0xff000000
) >> 24) : __swap32md(0x80000000 | (m->M_dat.MH.MH_pkthdr
.len - 4)));
891 }
892
893tryagain:
894 rep->r_rtt = rep->r_rexmit = 0;
895 if (nfs_ptimers[rep->r_procnum] != NFS_DEFAULT_TIMER)
3
←
Assuming the condition is false
→
4
←
Taking false branch
→
896 rep->r_flags = R_TIMING0x01;
897 else
898 rep->r_flags = 0;
899 rep->r_mrep = NULL((void *)0);
900
901 /*
902 * Do the client side RPC.
903 */
904 nfsstats.rpcrequests++;
905 /*
906 * Chain request into list of outstanding requests. Be sure
907 * to put it LAST so timer finds oldest requests first.
908 */
909 if (TAILQ_EMPTY(&nmp->nm_reqsq)(((&nmp->nm_reqsq)->tqh_first) == ((void *)0)))
5
←
Assuming field 'tqh_first' is not equal to null
→
6
←
Taking false branch
→
910 timeout_add(&nmp->nm_rtimeout, nfs_ticks);
911 TAILQ_INSERT_TAIL(&nmp->nm_reqsq, rep, r_chain)do { (rep)->r_chain.tqe_next = ((void *)0); (rep)->r_chain
.tqe_prev = (&nmp->nm_reqsq)->tqh_last; *(&nmp->
nm_reqsq)->tqh_last = (rep); (&nmp->nm_reqsq)->tqh_last
= &(rep)->r_chain.tqe_next; } while (0);
912
913 /*
914 * If backing off another request or avoiding congestion, don't
915 * send this one now but let timer do it. If not timing a request,
916 * do it now.
917 */
918 if (nmp->nm_so && (nmp->nm_sotype != SOCK_DGRAM2 ||
7
←
Assuming field 'nm_so' is null
→
919 (nmp->nm_flag & NFSMNT_DUMBTIMR0x00000800) ||
920 nmp->nm_sent < nmp->nm_cwnd)) {
921 if (nmp->nm_soflags & PR_CONNREQUIRED0x0004)
922 error = nfs_sndlock(&nmp->nm_flag, rep);
923 if (!error) {
924 error = nfs_send(nmp->nm_so, nmp->nm_nam,
925 m_copym(m, 0, M_COPYALL1000000000, M_WAIT0x0001), rep);
926 if (nmp->nm_soflags & PR_CONNREQUIRED0x0004)
927 nfs_sndunlock(&nmp->nm_flag);
928 }
929 if (!error && (rep->r_flags & R_MUSTRESEND0x40) == 0) {
930 nmp->nm_sent += NFS_CWNDSCALE256;
931 rep->r_flags |= R_SENT0x02;
932 }
933 } else {
934 rep->r_rtt = -1;
935 }
936
937 /*
938 * Wait for the reply from our send or the timer's.
939 */
940 if (!error
7.1
'error' is 0
 || error == EPIPE32)
941 error = nfs_reply(rep);
8
←
Calling 'nfs_reply'
→
942
943 /*
944 * RPC done, unlink the request.
945 */
946 TAILQ_REMOVE(&nmp->nm_reqsq, rep, r_chain)do { if (((rep)->r_chain.tqe_next) != ((void *)0)) (rep)->
r_chain.tqe_next->r_chain.tqe_prev = (rep)->r_chain.tqe_prev
; else (&nmp->nm_reqsq)->tqh_last = (rep)->r_chain
.tqe_prev; *(rep)->r_chain.tqe_prev = (rep)->r_chain.tqe_next
; ((rep)->r_chain.tqe_prev) = ((void *)-1); ((rep)->r_chain
.tqe_next) = ((void *)-1); } while (0);
947 if (TAILQ_EMPTY(&nmp->nm_reqsq)(((&nmp->nm_reqsq)->tqh_first) == ((void *)0)))
948 timeout_del(&nmp->nm_rtimeout);
949
950 /*
951 * Decrement the outstanding request count.
952 */
953 if (rep->r_flags & R_SENT0x02) {
954 rep->r_flags &= ~R_SENT0x02; /* paranoia */
955 nmp->nm_sent -= NFS_CWNDSCALE256;
956 }
957
958 /*
959 * If there was a successful reply and a tprintf msg.
960 * tprintf a response.
961 */
962 if (!error && (rep->r_flags & R_TPRINTFMSG0x20))
963 nfs_msg(rep, "is alive again");
964 info.nmi_mrep = rep->r_mrep;
965 info.nmi_md = rep->r_md;
966 info.nmi_dpos = rep->r_dpos;
967 if (error) {
968 infop->nmi_mrep = NULL((void *)0);
969 goto nfsmout1;
970 }
971
972 /*
973 * break down the rpc header and check if ok
974 */
975 nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= (3 * 4)) { (tl
) = (u_int32_t *)(info.nmi_dpos); info.nmi_dpos += (3 * 4); }
else if ((t1 = nfsm_disct(&info.nmi_md, &info.nmi_dpos
, (3 * 4), t1, &cp2)) != 0) { error = t1; m_freem(info.nmi_mrep
); goto nfsmout; } else { (tl) = (u_int32_t *)cp2; } };
976 if (*tl++ == rpc_msgdenied) {
977 if (*tl == rpc_mismatch)
978 error = EOPNOTSUPP45;
979 else
980 error = EACCES13; /* Should be EAUTH. */
981 infop->nmi_mrep = NULL((void *)0);
982 goto nfsmout1;
983 }
984
985 /*
986 * Since we only support RPCAUTH_UNIX atm we step over the
987 * reply verifer type, and in the (error) case that there really
988 * is any data in it, we advance over it.
989 */
990 tl++; /* Step over verifer type */
991 i = fxdr_unsigned(int32_t, *tl)((int32_t)(__uint32_t)(__builtin_constant_p((int32_t)(*tl)) ?
(__uint32_t)(((__uint32_t)((int32_t)(*tl)) & 0xff) <<
24 | ((__uint32_t)((int32_t)(*tl)) & 0xff00) << 8 |
((__uint32_t)((int32_t)(*tl)) & 0xff0000) >> 8 | (
(__uint32_t)((int32_t)(*tl)) & 0xff000000) >> 24) :
__swap32md((int32_t)(*tl))));
992 if (i > 0)
993 nfsm_adv(nfsm_rndup(i)){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= ((((i)+3)&
(~0x3)))) { info.nmi_dpos += ((((i)+3)&(~0x3))); } else if
((t1 = nfs_adv(&info.nmi_md, &info.nmi_dpos, ((((i)+
3)&(~0x3))), t1)) != 0) { error = t1; m_freem(info.nmi_mrep
); goto nfsmout; } }; /* Should not happen */
994
995 nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= (4)) { (tl) =
(u_int32_t *)(info.nmi_dpos); info.nmi_dpos += (4); } else if
((t1 = nfsm_disct(&info.nmi_md, &info.nmi_dpos, (4),
t1, &cp2)) != 0) { error = t1; m_freem(info.nmi_mrep); goto
nfsmout; } else { (tl) = (u_int32_t *)cp2; } };
996 /* 0 == ok */
997 if (*tl == 0) {
998 nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= (4)) { (tl) =
(u_int32_t *)(info.nmi_dpos); info.nmi_dpos += (4); } else if
((t1 = nfsm_disct(&info.nmi_md, &info.nmi_dpos, (4),
t1, &cp2)) != 0) { error = t1; m_freem(info.nmi_mrep); goto
nfsmout; } else { (tl) = (u_int32_t *)cp2; } };
999 if (*tl != 0) {
1000 error = fxdr_unsigned(int, *tl)((int)(__uint32_t)(__builtin_constant_p((int32_t)(*tl)) ? (__uint32_t
)(((__uint32_t)((int32_t)(*tl)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(*tl)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(*tl)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(
*tl)) & 0xff000000) >> 24) : __swap32md((int32_t)(*
tl))));
1001 if ((nmp->nm_flag & NFSMNT_NFSV30x00000200) &&
1002 error == NFSERR_TRYLATER10008) {
1003 m_freem(info.nmi_mrep);
1004 error = 0;
1005 tsleep_nsec(&nowake, PSOCK24, "nfsretry",
1006 SEC_TO_NSEC(trylater_delay));
1007 trylater_delay *= NFS_TIMEOUTMUL2;
1008 if (trylater_delay > NFS_MAXTIMEO(60 * (hz / nfs_ticks)))
1009 trylater_delay = NFS_MAXTIMEO(60 * (hz / nfs_ticks));
1010
1011 goto tryagain;
1012 }
1013
1014 /*
1015 * If the File Handle was stale, invalidate the
1016 * lookup cache, just in case.
1017 */
1018 if (error == ESTALE70)
1019 cache_purge(rep->r_vp);
1020 }
1021 goto nfsmout;
1022 }
1023
1024 error = EPROTONOSUPPORT43;
1025
1026nfsmout:
1027 infop->nmi_mrep = info.nmi_mrep;
1028 infop->nmi_md = info.nmi_md;
1029 infop->nmi_dpos = info.nmi_dpos;
1030nfsmout1:
1031 m_freem(rep->r_mreq);
1032 pool_put(&nfsreqpl, rep);
1033 return (error);
1034}
1035#endif /* NFSCLIENT */
1036
1037/*
1038 * Generate the rpc reply header
1039 * siz arg. is used to decide if adding a cluster is worthwhile
1040 */
1041int
1042nfs_rephead(int siz, struct nfsrv_descript *nd, struct nfssvc_sock *slp,
1043 int err, struct mbuf **mrq, struct mbuf **mbp)
1044{
1045 u_int32_t *tl;
1046 struct mbuf *mreq;
1047 struct mbuf *mb;
1048
1049 MGETHDR(mreq, M_WAIT, MT_DATA)mreq = m_gethdr((0x0001), (1));
1050 mb = mreq;
1051 /*
1052 * If this is a big reply, use a cluster else
1053 * try and leave leading space for the lower level headers.
1054 */
1055 siz += RPC_REPLYSIZ28;
1056 if (siz >= MHLEN((256 - sizeof(struct m_hdr)) - sizeof(struct pkthdr)) - max_hdr) {
1057 MCLGET(mreq, M_WAIT)(void) m_clget((mreq), (0x0001), (1 << 11));
1058 } else
1059 mreq->m_datam_hdr.mh_data += max_hdr;
1060 tl = mtod(mreq, u_int32_t *)((u_int32_t *)((mreq)->m_hdr.mh_data));
1061 mreq->m_lenm_hdr.mh_len = 6 * NFSX_UNSIGNED4;
1062 *tl++ = txdr_unsigned(nd->nd_retxid)((__uint32_t)(__builtin_constant_p((int32_t)(nd->nd_retxid
)) ? (__uint32_t)(((__uint32_t)((int32_t)(nd->nd_retxid)) &
0xff) << 24 | ((__uint32_t)((int32_t)(nd->nd_retxid
)) & 0xff00) << 8 | ((__uint32_t)((int32_t)(nd->
nd_retxid)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t
)(nd->nd_retxid)) & 0xff000000) >> 24) : __swap32md
((int32_t)(nd->nd_retxid))));
1063 *tl++ = rpc_reply;
1064 if (err == ERPCMISMATCH73 || (err & NFSERR_AUTHERR0x40000000)) {
1065 *tl++ = rpc_msgdenied;
1066 if (err & NFSERR_AUTHERR0x40000000) {
1067 *tl++ = rpc_autherr;
1068 *tl = txdr_unsigned(err & ~NFSERR_AUTHERR)((__uint32_t)(__builtin_constant_p((int32_t)(err & ~0x40000000
)) ? (__uint32_t)(((__uint32_t)((int32_t)(err & ~0x40000000
)) & 0xff) << 24 | ((__uint32_t)((int32_t)(err &
~0x40000000)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(err & ~0x40000000)) & 0xff0000) >> 8 | ((__uint32_t
)((int32_t)(err & ~0x40000000)) & 0xff000000) >>
24) : __swap32md((int32_t)(err & ~0x40000000))));
1069 mreq->m_lenm_hdr.mh_len -= NFSX_UNSIGNED4;
1070 } else {
1071 *tl++ = rpc_mismatch;
1072 *tl++ = txdr_unsigned(RPC_VER2)((__uint32_t)(__builtin_constant_p((int32_t)(2)) ? (__uint32_t
)(((__uint32_t)((int32_t)(2)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(2)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(2)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(2)
) & 0xff000000) >> 24) : __swap32md((int32_t)(2))));
1073 *tl = txdr_unsigned(RPC_VER2)((__uint32_t)(__builtin_constant_p((int32_t)(2)) ? (__uint32_t
)(((__uint32_t)((int32_t)(2)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(2)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(2)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(2)
) & 0xff000000) >> 24) : __swap32md((int32_t)(2))));
1074 }
1075 } else {
1076 *tl++ = rpc_msgaccepted;
1077
1078 /* AUTH_UNIX requires RPCAUTH_NULL. */
1079 *tl++ = 0;
1080 *tl++ = 0;
1081
1082 switch (err) {
1083 case EPROGUNAVAIL74:
1084 *tl = txdr_unsigned(RPC_PROGUNAVAIL)((__uint32_t)(__builtin_constant_p((int32_t)(1)) ? (__uint32_t
)(((__uint32_t)((int32_t)(1)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(1)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(1)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(1)
) & 0xff000000) >> 24) : __swap32md((int32_t)(1))));
1085 break;
1086 case EPROGMISMATCH75:
1087 *tl = txdr_unsigned(RPC_PROGMISMATCH)((__uint32_t)(__builtin_constant_p((int32_t)(2)) ? (__uint32_t
)(((__uint32_t)((int32_t)(2)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(2)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(2)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(2)
) & 0xff000000) >> 24) : __swap32md((int32_t)(2))));
1088 tl = nfsm_build(&mb, 2 * NFSX_UNSIGNED4);
1089 *tl++ = txdr_unsigned(NFS_VER2)((__uint32_t)(__builtin_constant_p((int32_t)(2)) ? (__uint32_t
)(((__uint32_t)((int32_t)(2)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(2)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(2)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(2)
) & 0xff000000) >> 24) : __swap32md((int32_t)(2))));
1090 *tl = txdr_unsigned(NFS_VER3)((__uint32_t)(__builtin_constant_p((int32_t)(3)) ? (__uint32_t
)(((__uint32_t)((int32_t)(3)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(3)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(3)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(3)
) & 0xff000000) >> 24) : __swap32md((int32_t)(3))));
1091 break;
1092 case EPROCUNAVAIL76:
1093 *tl = txdr_unsigned(RPC_PROCUNAVAIL)((__uint32_t)(__builtin_constant_p((int32_t)(3)) ? (__uint32_t
)(((__uint32_t)((int32_t)(3)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(3)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(3)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(3)
) & 0xff000000) >> 24) : __swap32md((int32_t)(3))));
1094 break;
1095 case EBADRPC72:
1096 *tl = txdr_unsigned(RPC_GARBAGE)((__uint32_t)(__builtin_constant_p((int32_t)(4)) ? (__uint32_t
)(((__uint32_t)((int32_t)(4)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(4)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(4)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(4)
) & 0xff000000) >> 24) : __swap32md((int32_t)(4))));
1097 break;
1098 default:
1099 *tl = 0;
1100 if (err != NFSERR_RETVOID0x20000000) {
1101 tl = nfsm_build(&mb, NFSX_UNSIGNED4);
1102 if (err)
1103 *tl = txdr_unsigned(nfsrv_errmap(nd, err))((__uint32_t)(__builtin_constant_p((int32_t)(nfsrv_errmap(nd,
err))) ? (__uint32_t)(((__uint32_t)((int32_t)(nfsrv_errmap(nd
, err))) & 0xff) << 24 | ((__uint32_t)((int32_t)(nfsrv_errmap
(nd, err))) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(nfsrv_errmap(nd, err))) & 0xff0000) >> 8 | ((__uint32_t
)((int32_t)(nfsrv_errmap(nd, err))) & 0xff000000) >>
24) : __swap32md((int32_t)(nfsrv_errmap(nd, err)))));
1104 else
1105 *tl = 0;
1106 }
1107 break;
1108 };
1109 }
1110
1111 *mrq = mreq;
1112 if (mbp != NULL((void *)0))
1113 *mbp = mb;
1114 if (err != 0 && err != NFSERR_RETVOID0x20000000)
1115 nfsstats.srvrpc_errs++;
1116 return (0);
1117}
1118
1119/*
1120 * nfs timer routine
1121 * Scan the nfsreq list and retransmit any requests that have timed out.
1122 */
1123void
1124nfs_timer(void *arg)
1125{
1126 struct nfsmount *nmp = arg;
1127 struct nfsreq *rep;
1128 struct mbuf *m;
1129 struct socket *so;
1130 int timeo, error;
1131
1132 NET_LOCK()do { rw_enter_write(&netlock); } while (0);
1133 TAILQ_FOREACH(rep, &nmp->nm_reqsq, r_chain)for((rep) = ((&nmp->nm_reqsq)->tqh_first); (rep) !=
((void *)0); (rep) = ((rep)->r_chain.tqe_next)) {
1134 if (rep->r_mrep || (rep->r_flags & R_SOFTTERM0x04))
1135 continue;
1136 if (nfs_sigintr(nmp, rep, rep->r_procp)) {
1137 rep->r_flags |= R_SOFTTERM0x04;
1138 continue;
1139 }
1140 if (rep->r_rtt >= 0) {
1141 rep->r_rtt++;
1142 if (nmp->nm_flag & NFSMNT_DUMBTIMR0x00000800)
1143 timeo = nmp->nm_timeo;
1144 else
1145 timeo = nfs_estimate_rto(nmp, rep->r_procnum);
1146 if (nmp->nm_timeouts > 0)
1147 timeo *= nfs_backoff[nmp->nm_timeouts - 1];
1148 if (rep->r_rtt <= timeo)
1149 continue;
1150 if (nmp->nm_timeouts < nitems(nfs_backoff)(sizeof((nfs_backoff)) / sizeof((nfs_backoff)[0])))
1151 nmp->nm_timeouts++;
1152 }
1153
1154 /* Check for server not responding. */
1155 if ((rep->r_flags & R_TPRINTFMSG0x20) == 0 && rep->r_rexmit > 4) {
1156 nfs_msg(rep, "not responding");
1157 rep->r_flags |= R_TPRINTFMSG0x20;
1158 }
1159 if (rep->r_rexmit >= nmp->nm_retry) { /* too many */
1160 nfsstats.rpctimeouts++;
1161 rep->r_flags |= R_SOFTTERM0x04;
1162 continue;
1163 }
1164 if (nmp->nm_sotype != SOCK_DGRAM2) {
1165 if (++rep->r_rexmit > NFS_MAXREXMIT100)
1166 rep->r_rexmit = NFS_MAXREXMIT100;
1167 continue;
1168 }
1169
1170 if ((so = nmp->nm_so) == NULL((void *)0))
1171 continue;
1172
1173 /*
1174 * If there is enough space and the window allows..
1175 * Resend it
1176 * Set r_rtt to -1 in case we fail to send it now.
1177 */
1178 rep->r_rtt = -1;
1179 if (sbspace(so, &so->so_snd) >= rep->r_mreq->m_pkthdrM_dat.MH.MH_pkthdr.len &&
1180 ((nmp->nm_flag & NFSMNT_DUMBTIMR0x00000800) ||
1181 (rep->r_flags & R_SENT0x02) ||
1182 nmp->nm_sent < nmp->nm_cwnd) &&
1183 (m = m_copym(rep->r_mreq, 0, M_COPYALL1000000000, M_DONTWAIT0x0002))){
1184 if ((nmp->nm_flag & NFSMNT_NOCONN0x00000080) == 0)
1185 error = pru_send(so, m, NULL((void *)0), NULL((void *)0));
1186 else
1187 error = pru_send(so, m, nmp->nm_nam, NULL((void *)0));
1188 if (error) {
1189 if (NFSIGNORE_SOERROR(nmp->nm_soflags, error)((error) != 4 && (error) != -1 && (error) != 35
&& ((nmp->nm_soflags) & 0x0004) == 0))
1190 so->so_error = 0;
1191 } else {
1192 /*
1193 * Iff first send, start timing
1194 * else turn timing off, backoff timer
1195 * and divide congestion window by 2.
1196 */
1197 if (rep->r_flags & R_SENT0x02) {
1198 rep->r_flags &= ~R_TIMING0x01;
1199 if (++rep->r_rexmit > NFS_MAXREXMIT100)
1200 rep->r_rexmit = NFS_MAXREXMIT100;
1201 nmp->nm_cwnd >>= 1;
1202 if (nmp->nm_cwnd < NFS_CWNDSCALE256)
1203 nmp->nm_cwnd = NFS_CWNDSCALE256;
1204 nfsstats.rpcretries++;
1205 } else {
1206 rep->r_flags |= R_SENT0x02;
1207 nmp->nm_sent += NFS_CWNDSCALE256;
1208 }
1209 rep->r_rtt = 0;
1210 }
1211 }
1212 }
1213 NET_UNLOCK()do { rw_exit_write(&netlock); } while (0);
1214 timeout_add(&nmp->nm_rtimeout, nfs_ticks);
1215}
1216
1217/*
1218 * Test for a termination condition pending on the process.
1219 * This is used for NFSMNT_INT mounts.
1220 */
1221int
1222nfs_sigintr(struct nfsmount *nmp, struct nfsreq *rep, struct proc *p)
1223{
1224
1225 if (rep && (rep->r_flags & R_SOFTTERM0x04))
1226 return (EINTR4);
1227 if (!(nmp->nm_flag & NFSMNT_INT0x00000040))
1228 return (0);
1229 if (p && (SIGPENDING(p)(((p)->p_siglist | (p)->p_p->ps_siglist) & ~(p)->
p_sigmask) & ~p->p_p->ps_sigacts->ps_sigignore &
1230 NFSINT_SIGMASK((1U << ((2)-1))|(1U << ((15)-1))|(1U << ((
9)-1))| (1U << ((1)-1))|(1U << ((3)-1)))))
1231 return (EINTR4);
1232 return (0);
1233}
1234
1235/*
1236 * Lock a socket against others.
1237 * Necessary for STREAM sockets to ensure you get an entire rpc request/reply
1238 * and also to avoid race conditions between the processes with nfs requests
1239 * in progress when a reconnect is necessary.
1240 */
1241int
1242nfs_sndlock(int *flagp, struct nfsreq *rep)
1243{
1244 uint64_t slptimeo = INFSLP0xffffffffffffffffULL;
1245 struct proc *p;
1246 int slpflag = 0;
1247
1248 if (rep
21.1
'rep' is non-null
) {
22
←
Taking true branch
→
1249 p = rep->r_procp;
1250 if (rep->r_nmp->nm_flag & NFSMNT_INT0x00000040)
23
←
Assuming the condition is false
→
24
←
Taking false branch
→
1251 slpflag = PCATCH0x100;
1252 } else
1253 p = NULL((void *)0);
1254 while (*flagp & NFSMNT_SNDLOCK0x01000000) {
25
←
Loop condition is false. Execution continues on line 1264
→
1255 if (rep && nfs_sigintr(rep->r_nmp, rep, p))
1256 return (EINTR4);
1257 *flagp |= NFSMNT_WANTSND0x02000000;
1258 tsleep_nsec(flagp, slpflag | (PZERO22 - 1), "nfsndlck", slptimeo);
1259 if (slpflag == PCATCH0x100) {
1260 slpflag = 0;
1261 slptimeo = SEC_TO_NSEC(2);
1262 }
1263 }
1264 *flagp |= NFSMNT_SNDLOCK0x01000000;
1265 return (0);
26
←
Returning without writing to '->r_mrep', which participates in a condition later
→
27
←
Returning zero, which participates in a condition later
→
1266}
1267
1268/*
1269 * Unlock the stream socket for others.
1270 */
1271void
1272nfs_sndunlock(int *flagp)
1273{
1274
1275 if ((*flagp & NFSMNT_SNDLOCK0x01000000) == 0)
1276 panic("nfs sndunlock");
1277 *flagp &= ~NFSMNT_SNDLOCK0x01000000;
1278 if (*flagp & NFSMNT_WANTSND0x02000000) {
1279 *flagp &= ~NFSMNT_WANTSND0x02000000;
1280 wakeup((caddr_t)flagp);
1281 }
1282}
1283
1284int
1285nfs_rcvlock(struct nfsreq *rep)
1286{
1287 uint64_t slptimeo = INFSLP0xffffffffffffffffULL;
1288 int *flagp = &rep->r_nmp->nm_flag;
1289 int slpflag;
1290
1291 if (*flagp & NFSMNT_INT0x00000040)
11
←
Assuming the condition is false
→
12
←
Taking false branch
→
1292 slpflag = PCATCH0x100;
1293 else
1294 slpflag = 0;
1295
1296 while (*flagp & NFSMNT_RCVLOCK0x04000000) {
13
←
Loop condition is false. Execution continues on line 1313
→
1297 if (nfs_sigintr(rep->r_nmp, rep, rep->r_procp))
1298 return (EINTR4);
1299 *flagp |= NFSMNT_WANTRCV0x08000000;
1300 tsleep_nsec(flagp, slpflag | (PZERO22 - 1), "nfsrcvlk", slptimeo);
1301 if (rep->r_mrep != NULL((void *)0)) {
1302 /*
1303 * Don't take the lock if our reply has been received
1304 * while we where sleeping.
1305 */
1306 return (EALREADY37);
1307 }
1308 if (slpflag == PCATCH0x100) {
1309 slpflag = 0;
1310 slptimeo = SEC_TO_NSEC(2);
1311 }
1312 }
1313 *flagp |= NFSMNT_RCVLOCK0x04000000;
1314 return (0);
14
←
Returning without writing to '->r_mrep', which participates in a condition later
→
15
←
Returning zero, which participates in a condition later
→
1315}
1316
1317/*
1318 * Unlock the stream socket for others.
1319 */
1320void
1321nfs_rcvunlock(int *flagp)
1322{
1323
1324 if ((*flagp & NFSMNT_RCVLOCK0x04000000) == 0)
1325 panic("nfs rcvunlock");
1326 *flagp &= ~NFSMNT_RCVLOCK0x04000000;
1327 if (*flagp & NFSMNT_WANTRCV0x08000000) {
1328 *flagp &= ~NFSMNT_WANTRCV0x08000000;
1329 wakeup(flagp);
1330 }
1331}
1332
1333/*
1334 * Auxiliary routine to align the length of mbuf copies made with m_copyback().
1335 */
1336void
1337nfs_realign_fixup(struct mbuf *m, struct mbuf *n, unsigned int *off)
1338{
1339 size_t padding;
1340
1341 /*
1342 * The maximum number of bytes that m_copyback() places in a mbuf is
1343 * always an aligned quantity, so realign happens at the chain's tail.
1344 */
1345 while (n->m_nextm_hdr.mh_next != NULL((void *)0))
1346 n = n->m_nextm_hdr.mh_next;
1347
1348 /*
1349 * Pad from the next elements in the source chain. Loop until the
1350 * destination chain is aligned, or the end of the source is reached.
1351 */
1352 do {
1353 m = m->m_nextm_hdr.mh_next;
1354 if (m == NULL((void *)0))
1355 return;
1356
1357 padding = min(ALIGN(n->m_len)(((unsigned long)(n->m_hdr.mh_len) + (sizeof(long) - 1)) &
~(sizeof(long) - 1)) - n->m_lenm_hdr.mh_len, m->m_lenm_hdr.mh_len);
1358 if (padding > m_trailingspace(n))
1359 panic("nfs_realign_fixup: no memory to pad to");
1360
1361 bcopy(mtod(m, void *)((void *)((m)->m_hdr.mh_data)), mtod(n, char *)((char *)((n)->m_hdr.mh_data)) + n->m_lenm_hdr.mh_len, padding);
1362
1363 n->m_lenm_hdr.mh_len += padding;
1364 m_adj(m, padding);
1365 *off += padding;
1366
1367 } while (!ALIGNED_POINTER(n->m_len, void *)1);
1368}
1369
1370/*
1371 * The NFS RPC parsing code uses the data address and the length of mbuf
1372 * structures to calculate on-memory addresses. This function makes sure these
1373 * parameters are correctly aligned.
1374 */
1375void
1376nfs_realign(struct mbuf **pm, int hsiz)
1377{
1378 struct mbuf *m;
1379 struct mbuf *n = NULL((void *)0);
1380 unsigned int off = 0;
1381
1382 ++nfs_realign_test;
1383 while ((m = *pm) != NULL((void *)0)) {
1384 if (!ALIGNED_POINTER(m->m_data, void *)1 ||
1385 !ALIGNED_POINTER(m->m_len, void *)1) {
1386 MGET(n, M_WAIT, MT_DATA)n = m_get((0x0001), (1));
1387#define ALIGN_POINTER(n)((u_int)(((n) + sizeof(void *)) & ~sizeof(void *))) ((u_int)(((n) + sizeof(void *)) & ~sizeof(void *)))
1388 if (ALIGN_POINTER(m->m_len)((u_int)(((m->m_hdr.mh_len) + sizeof(void *)) & ~sizeof
(void *))) >= MINCLSIZE(((256 - sizeof(struct m_hdr)) - sizeof(struct pkthdr)) + (256
- sizeof(struct m_hdr)) + 1)) {
1389 MCLGET(n, M_WAIT)(void) m_clget((n), (0x0001), (1 << 11));
1390 }
1391 n->m_lenm_hdr.mh_len = 0;
1392 break;
1393 }
1394 pm = &m->m_nextm_hdr.mh_next;
1395 }
1396 /*
1397 * If n is non-NULL, loop on m copying data, then replace the
1398 * portion of the chain that had to be realigned.
1399 */
1400 if (n != NULL((void *)0)) {
1401 ++nfs_realign_count;
1402 while (m) {
1403 m_copyback(n, off, m->m_lenm_hdr.mh_len, mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)), M_WAIT0x0001);
1404
1405 /*
1406 * If an unaligned amount of memory was copied, fix up
1407 * the last mbuf created by m_copyback().
1408 */
1409 if (!ALIGNED_POINTER(m->m_len, void *)1)
1410 nfs_realign_fixup(m, n, &off);
1411
1412 off += m->m_lenm_hdr.mh_len;
1413 m = m->m_nextm_hdr.mh_next;
1414 }
1415 m_freemp(pm);
1416 *pm = n;
1417 }
1418}
1419
1420
1421/*
1422 * Parse an RPC request
1423 * - verify it
1424 * - fill in the cred struct.
1425 */
1426int
1427nfs_getreq(struct nfsrv_descript *nd, struct nfsd *nfsd, int has_header)
1428{
1429 int len, i;
1430 u_int32_t *tl;
1431 int32_t t1;
1432 caddr_t cp2;
1433 u_int32_t nfsvers, auth_type;
1434 int error = 0;
1435 struct nfsm_info info;
1436
1437 info.nmi_mrep = nd->nd_mrep;
1438 info.nmi_md = nd->nd_md;
1439 info.nmi_dpos = nd->nd_dpos;
1440 if (has_header) {
1441 nfsm_dissect(tl, u_int32_t *, 10 * NFSX_UNSIGNED){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= (10 * 4)) { (
tl) = (u_int32_t *)(info.nmi_dpos); info.nmi_dpos += (10 * 4)
; } else if ((t1 = nfsm_disct(&info.nmi_md, &info.nmi_dpos
, (10 * 4), t1, &cp2)) != 0) { error = t1; m_freem(info.nmi_mrep
); goto nfsmout; } else { (tl) = (u_int32_t *)cp2; } };
1442 nd->nd_retxid = fxdr_unsigned(u_int32_t, *tl++)((u_int32_t)(__uint32_t)(__builtin_constant_p((int32_t)(*tl++
)) ? (__uint32_t)(((__uint32_t)((int32_t)(*tl++)) & 0xff)
<< 24 | ((__uint32_t)((int32_t)(*tl++)) & 0xff00) <<
8 | ((__uint32_t)((int32_t)(*tl++)) & 0xff0000) >>
8 | ((__uint32_t)((int32_t)(*tl++)) & 0xff000000) >>
24) : __swap32md((int32_t)(*tl++))));
1443 if (*tl++ != rpc_call) {
1444 m_freem(info.nmi_mrep);
1445 return (EBADRPC72);
1446 }
1447 } else
1448 nfsm_dissect(tl, u_int32_t *, 8 * NFSX_UNSIGNED){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= (8 * 4)) { (tl
) = (u_int32_t *)(info.nmi_dpos); info.nmi_dpos += (8 * 4); }
else if ((t1 = nfsm_disct(&info.nmi_md, &info.nmi_dpos
, (8 * 4), t1, &cp2)) != 0) { error = t1; m_freem(info.nmi_mrep
); goto nfsmout; } else { (tl) = (u_int32_t *)cp2; } };
1449 nd->nd_repstat = 0;
1450 nd->nd_flag = 0;
1451 if (*tl++ != rpc_vers) {
1452 nd->nd_repstat = ERPCMISMATCH73;
1453 nd->nd_procnum = NFSPROC_NOOP22;
1454 return (0);
1455 }
1456 if (*tl != nfs_prog) {
1457 nd->nd_repstat = EPROGUNAVAIL74;
1458 nd->nd_procnum = NFSPROC_NOOP22;
1459 return (0);
1460 }
1461 tl++;
1462 nfsvers = fxdr_unsigned(u_int32_t, *tl++)((u_int32_t)(__uint32_t)(__builtin_constant_p((int32_t)(*tl++
)) ? (__uint32_t)(((__uint32_t)((int32_t)(*tl++)) & 0xff)
<< 24 | ((__uint32_t)((int32_t)(*tl++)) & 0xff00) <<
8 | ((__uint32_t)((int32_t)(*tl++)) & 0xff0000) >>
8 | ((__uint32_t)((int32_t)(*tl++)) & 0xff000000) >>
24) : __swap32md((int32_t)(*tl++))));
1463 if (nfsvers != NFS_VER22 && nfsvers != NFS_VER33) {
1464 nd->nd_repstat = EPROGMISMATCH75;
1465 nd->nd_procnum = NFSPROC_NOOP22;
1466 return (0);
1467 }
1468 if (nfsvers == NFS_VER33)
1469 nd->nd_flag = ND_NFSV30x08;
1470 nd->nd_procnum = fxdr_unsigned(u_int32_t, *tl++)((u_int32_t)(__uint32_t)(__builtin_constant_p((int32_t)(*tl++
)) ? (__uint32_t)(((__uint32_t)((int32_t)(*tl++)) & 0xff)
<< 24 | ((__uint32_t)((int32_t)(*tl++)) & 0xff00) <<
8 | ((__uint32_t)((int32_t)(*tl++)) & 0xff0000) >>
8 | ((__uint32_t)((int32_t)(*tl++)) & 0xff000000) >>
24) : __swap32md((int32_t)(*tl++))));
1471 if (nd->nd_procnum == NFSPROC_NULL0)
1472 return (0);
1473 if (nd->nd_procnum >= NFS_NPROCS23 ||
1474 (nd->nd_procnum > NFSPROC_COMMIT21) ||
1475 (!nd->nd_flag && nd->nd_procnum > NFSV2PROC_STATFS17)) {
1476 nd->nd_repstat = EPROCUNAVAIL76;
1477 nd->nd_procnum = NFSPROC_NOOP22;
1478 return (0);
1479 }
1480 if ((nd->nd_flag & ND_NFSV30x08) == 0)
1481 nd->nd_procnum = nfsv3_procid[nd->nd_procnum];
1482 auth_type = *tl++;
1483 len = fxdr_unsigned(int, *tl++)((int)(__uint32_t)(__builtin_constant_p((int32_t)(*tl++)) ? (
__uint32_t)(((__uint32_t)((int32_t)(*tl++)) & 0xff) <<
24 | ((__uint32_t)((int32_t)(*tl++)) & 0xff00) << 8
| ((__uint32_t)((int32_t)(*tl++)) & 0xff0000) >> 8
| ((__uint32_t)((int32_t)(*tl++)) & 0xff000000) >>
24) : __swap32md((int32_t)(*tl++))));
1484 if (len < 0 || len > RPCAUTH_MAXSIZ400) {
1485 m_freem(info.nmi_mrep);
1486 return (EBADRPC72);
1487 }
1488
1489 /* Handle auth_unix */
1490 if (auth_type == rpc_auth_unix) {
1491 len = fxdr_unsigned(int, *++tl)((int)(__uint32_t)(__builtin_constant_p((int32_t)(*++tl)) ? (
__uint32_t)(((__uint32_t)((int32_t)(*++tl)) & 0xff) <<
24 | ((__uint32_t)((int32_t)(*++tl)) & 0xff00) << 8
| ((__uint32_t)((int32_t)(*++tl)) & 0xff0000) >> 8
| ((__uint32_t)((int32_t)(*++tl)) & 0xff000000) >>
24) : __swap32md((int32_t)(*++tl))));
1492 if (len < 0 || len > NFS_MAXNAMLEN255) {
1493 m_freem(info.nmi_mrep);
1494 return (EBADRPC72);
1495 }
1496 nfsm_adv(nfsm_rndup(len)){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= ((((len)+3)&
(~0x3)))) { info.nmi_dpos += ((((len)+3)&(~0x3))); } else
if ((t1 = nfs_adv(&info.nmi_md, &info.nmi_dpos, ((((
len)+3)&(~0x3))), t1)) != 0) { error = t1; m_freem(info.nmi_mrep
); goto nfsmout; } };
1497 nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= (3 * 4)) { (tl
) = (u_int32_t *)(info.nmi_dpos); info.nmi_dpos += (3 * 4); }
else if ((t1 = nfsm_disct(&info.nmi_md, &info.nmi_dpos
, (3 * 4), t1, &cp2)) != 0) { error = t1; m_freem(info.nmi_mrep
); goto nfsmout; } else { (tl) = (u_int32_t *)cp2; } };
1498 memset(&nd->nd_cr, 0, sizeof (struct ucred))__builtin_memset((&nd->nd_cr), (0), (sizeof (struct ucred
)));
1499 refcnt_init(&nd->nd_cr.cr_refcnt);
1500 nd->nd_cr.cr_uid = fxdr_unsigned(uid_t, *tl++)((uid_t)(__uint32_t)(__builtin_constant_p((int32_t)(*tl++)) ?
(__uint32_t)(((__uint32_t)((int32_t)(*tl++)) & 0xff) <<
24 | ((__uint32_t)((int32_t)(*tl++)) & 0xff00) << 8
| ((__uint32_t)((int32_t)(*tl++)) & 0xff0000) >> 8
| ((__uint32_t)((int32_t)(*tl++)) & 0xff000000) >>
24) : __swap32md((int32_t)(*tl++))));
1501 nd->nd_cr.cr_gid = fxdr_unsigned(gid_t, *tl++)((gid_t)(__uint32_t)(__builtin_constant_p((int32_t)(*tl++)) ?
(__uint32_t)(((__uint32_t)((int32_t)(*tl++)) & 0xff) <<
24 | ((__uint32_t)((int32_t)(*tl++)) & 0xff00) << 8
| ((__uint32_t)((int32_t)(*tl++)) & 0xff0000) >> 8
| ((__uint32_t)((int32_t)(*tl++)) & 0xff000000) >>
24) : __swap32md((int32_t)(*tl++))));
1502 len = fxdr_unsigned(int, *tl)((int)(__uint32_t)(__builtin_constant_p((int32_t)(*tl)) ? (__uint32_t
)(((__uint32_t)((int32_t)(*tl)) & 0xff) << 24 | ((__uint32_t
)((int32_t)(*tl)) & 0xff00) << 8 | ((__uint32_t)((int32_t
)(*tl)) & 0xff0000) >> 8 | ((__uint32_t)((int32_t)(
*tl)) & 0xff000000) >> 24) : __swap32md((int32_t)(*
tl))));
1503 if (len < 0 || len > RPCAUTH_UNIXGIDS16) {
1504 m_freem(info.nmi_mrep);
1505 return (EBADRPC72);
1506 }
1507 nfsm_dissect(tl, u_int32_t *, (len + 2) * NFSX_UNSIGNED){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= ((len + 2) * 4
)) { (tl) = (u_int32_t *)(info.nmi_dpos); info.nmi_dpos += ((
len + 2) * 4); } else if ((t1 = nfsm_disct(&info.nmi_md, &
info.nmi_dpos, ((len + 2) * 4), t1, &cp2)) != 0) { error =
t1; m_freem(info.nmi_mrep); goto nfsmout; } else { (tl) = (u_int32_t
*)cp2; } };
1508 for (i = 0; i < len; i++) {
1509 if (i < NGROUPS_MAX16)
1510 nd->nd_cr.cr_groups[i] =
1511 fxdr_unsigned(gid_t, *tl++)((gid_t)(__uint32_t)(__builtin_constant_p((int32_t)(*tl++)) ?
(__uint32_t)(((__uint32_t)((int32_t)(*tl++)) & 0xff) <<
24 | ((__uint32_t)((int32_t)(*tl++)) & 0xff00) << 8
| ((__uint32_t)((int32_t)(*tl++)) & 0xff0000) >> 8
| ((__uint32_t)((int32_t)(*tl++)) & 0xff000000) >>
24) : __swap32md((int32_t)(*tl++))));
1512 else
1513 tl++;
1514 }
1515 nd->nd_cr.cr_ngroups = (len > NGROUPS_MAX16) ? NGROUPS_MAX16 : len;
1516 len = fxdr_unsigned(int, *++tl)((int)(__uint32_t)(__builtin_constant_p((int32_t)(*++tl)) ? (
__uint32_t)(((__uint32_t)((int32_t)(*++tl)) & 0xff) <<
24 | ((__uint32_t)((int32_t)(*++tl)) & 0xff00) << 8
| ((__uint32_t)((int32_t)(*++tl)) & 0xff0000) >> 8
| ((__uint32_t)((int32_t)(*++tl)) & 0xff000000) >>
24) : __swap32md((int32_t)(*++tl))));
1517 if (len < 0 || len > RPCAUTH_MAXSIZ400) {
1518 m_freem(info.nmi_mrep);
1519 return (EBADRPC72);
1520 }
1521 if (len > 0)
1522 nfsm_adv(nfsm_rndup(len)){ t1 = ((caddr_t)((info.nmi_md)->m_hdr.mh_data)) + info.nmi_md
->m_hdr.mh_len - info.nmi_dpos; if (t1 >= ((((len)+3)&
(~0x3)))) { info.nmi_dpos += ((((len)+3)&(~0x3))); } else
if ((t1 = nfs_adv(&info.nmi_md, &info.nmi_dpos, ((((
len)+3)&(~0x3))), t1)) != 0) { error = t1; m_freem(info.nmi_mrep
); goto nfsmout; } };
1523 } else {
1524 nd->nd_repstat = (NFSERR_AUTHERR0x40000000 | AUTH_REJECTCRED2);
1525 nd->nd_procnum = NFSPROC_NOOP22;
1526 return (0);
1527 }
1528
1529 nd->nd_md = info.nmi_md;
1530 nd->nd_dpos = info.nmi_dpos;
1531 return (0);
1532nfsmout:
1533 return (error);
1534}
1535
1536void
1537nfs_msg(struct nfsreq *rep, char *msg)
1538{
1539 tpr_t tpr;
1540
1541 if (rep->r_procp)
1542 tpr = tprintf_open(rep->r_procp);
1543 else
1544 tpr = NULL((void *)0);
1545
1546 tprintf(tpr, "nfs server %s: %s\n",
1547 rep->r_nmp->nm_mountp->mnt_stat.f_mntfromname, msg);
1548 tprintf_close(tpr);
1549}
1550
1551#ifdef NFSSERVER1
1552/*
1553 * Socket upcall routine for the nfsd sockets.
1554 * The caddr_t arg is a pointer to the "struct nfssvc_sock".
1555 * Essentially do as much as possible non-blocking, else punt and it will
1556 * be called with M_WAIT from an nfsd.
1557 */
1558void
1559nfsrv_rcv(struct socket *so, caddr_t arg, int waitflag)
1560{
1561 struct nfssvc_sock *slp = (struct nfssvc_sock *)arg;
1562 struct mbuf *m;
1563 struct mbuf *mp, *nam;
1564 struct uio auio;
1565 int flags, error;
1566
1567 KERNEL_LOCK()_kernel_lock();
1568
1569 if ((slp->ns_flag & SLP_VALID0x01) == 0)
1570 goto out;
1571
1572 /* Defer soreceive() to an nfsd. */
1573 if (waitflag == M_DONTWAIT0x0002) {
1574 slp->ns_flag |= SLP_NEEDQ0x04;
1575 goto dorecs;
1576 }
1577
1578 auio.uio_procp = NULL((void *)0);
1579 if (so->so_type == SOCK_STREAM1) {
1580 /*
1581 * Do soreceive().
1582 */
1583 auio.uio_resid = 1000000000;
1584 flags = MSG_DONTWAIT0x80;
1585 error = soreceive(so, &nam, &auio, &mp, NULL((void *)0),
1586 &flags, 0);
1587 if (error || mp == NULL((void *)0)) {
1588 if (error == EWOULDBLOCK35)
1589 slp->ns_flag |= SLP_NEEDQ0x04;
1590 else
1591 slp->ns_flag |= SLP_DISCONN0x08;
1592 goto dorecs;
1593 }
1594 m = mp;
1595 if (slp->ns_rawend) {
1596 slp->ns_rawend->m_nextm_hdr.mh_next = m;
1597 slp->ns_cc += 1000000000 - auio.uio_resid;
1598 } else {
1599 slp->ns_raw = m;
1600 slp->ns_cc = 1000000000 - auio.uio_resid;
1601 }
1602 while (m->m_nextm_hdr.mh_next)
1603 m = m->m_nextm_hdr.mh_next;
1604 slp->ns_rawend = m;
1605
1606 /*
1607 * Now try and parse record(s) out of the raw stream data.
1608 */
1609 error = nfsrv_getstream(slp, waitflag);
1610 if (error) {
1611 if (error == EPERM1)
1612 slp->ns_flag |= SLP_DISCONN0x08;
1613 else
1614 slp->ns_flag |= SLP_NEEDQ0x04;
1615 }
1616 } else {
1617 do {
1618 auio.uio_resid = 1000000000;
1619 flags = MSG_DONTWAIT0x80;
1620 error = soreceive(so, &nam, &auio, &mp,
1621 NULL((void *)0), &flags, 0);
1622 if (mp) {
1623 if (nam) {
1624 m = nam;
1625 m->m_nextm_hdr.mh_next = mp;
1626 } else
1627 m = mp;
1628 if (slp->ns_recend)
1629 slp->ns_recend->m_nextpktm_hdr.mh_nextpkt = m;
1630 else
1631 slp->ns_rec = m;
1632 slp->ns_recend = m;
1633 m->m_nextpktm_hdr.mh_nextpkt = NULL((void *)0);
1634 }
1635 if (error) {
1636 if ((so->so_proto->pr_flags & PR_CONNREQUIRED0x0004)
1637 && error != EWOULDBLOCK35) {
1638 slp->ns_flag |= SLP_DISCONN0x08;
1639 goto dorecs;
1640 }
1641 }
1642 } while (mp);
1643 }
1644
1645 /*
1646 * Now try and process the request records, non-blocking.
1647 */
1648dorecs:
1649 if (waitflag == M_DONTWAIT0x0002 &&
1650 (slp->ns_rec || (slp->ns_flag & (SLP_NEEDQ0x04 | SLP_DISCONN0x08))))
1651 nfsrv_wakenfsd(slp);
1652
1653out:
1654 KERNEL_UNLOCK()_kernel_unlock();
1655}
1656
1657/*
1658 * Try and extract an RPC request from the mbuf data list received on a
1659 * stream socket. The "waitflag" argument indicates whether or not it
1660 * can sleep.
1661 */
1662int
1663nfsrv_getstream(struct nfssvc_sock *slp, int waitflag)
1664{
1665 struct mbuf *m, **mpp;
1666 char *cp1, *cp2;
1667 int len;
1668 struct mbuf *om, *m2, *recm;
1669 u_int32_t recmark;
1670
1671 if (slp->ns_flag & SLP_GETSTREAM0x10)
1672 return (0);
1673 slp->ns_flag |= SLP_GETSTREAM0x10;
1674 for (;;) {
1675 if (slp->ns_reclen == 0) {
1676 if (slp->ns_cc < NFSX_UNSIGNED4) {
1677 slp->ns_flag &= ~SLP_GETSTREAM0x10;
1678 return (0);
1679 }
1680 m = slp->ns_raw;
1681 if (m->m_lenm_hdr.mh_len >= NFSX_UNSIGNED4) {
1682 bcopy(mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data)), &recmark,
1683 NFSX_UNSIGNED4);
1684 m->m_datam_hdr.mh_data += NFSX_UNSIGNED4;
1685 m->m_lenm_hdr.mh_len -= NFSX_UNSIGNED4;
1686 } else {
1687 cp1 = (caddr_t)&recmark;
1688 cp2 = mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data));
1689 while (cp1 < ((caddr_t)&recmark) + NFSX_UNSIGNED4) {
1690 while (m->m_lenm_hdr.mh_len == 0) {
1691 m = m->m_nextm_hdr.mh_next;
1692 cp2 = mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data));
1693 }
1694 *cp1++ = *cp2++;
1695 m->m_datam_hdr.mh_data++;
1696 m->m_lenm_hdr.mh_len--;
1697 }
1698 }
1699 slp->ns_cc -= NFSX_UNSIGNED4;
1700 recmark = ntohl(recmark)(__uint32_t)(__builtin_constant_p(recmark) ? (__uint32_t)(((__uint32_t
)(recmark) & 0xff) << 24 | ((__uint32_t)(recmark) &
0xff00) << 8 | ((__uint32_t)(recmark) & 0xff0000) >>
8 | ((__uint32_t)(recmark) & 0xff000000) >> 24) : __swap32md
(recmark));
1701 slp->ns_reclen = recmark & ~0x80000000;
1702 if (recmark & 0x80000000)
1703 slp->ns_flag |= SLP_LASTFRAG0x20;
1704 else
1705 slp->ns_flag &= ~SLP_LASTFRAG0x20;
1706 if (slp->ns_reclen > NFS_MAXPACKET(404 + (64 * 1024))) {
1707 slp->ns_flag &= ~SLP_GETSTREAM0x10;
1708 return (EPERM1);
1709 }
1710 }
1711
1712 /*
1713 * Now get the record part.
1714 */
1715 recm = NULL((void *)0);
1716 if (slp->ns_cc == slp->ns_reclen) {
1717 recm = slp->ns_raw;
1718 slp->ns_raw = slp->ns_rawend = NULL((void *)0);
1719 slp->ns_cc = slp->ns_reclen = 0;
1720 } else if (slp->ns_cc > slp->ns_reclen) {
1721 len = 0;
1722 m = slp->ns_raw;
1723 om = NULL((void *)0);
1724 while (len < slp->ns_reclen) {
1725 if ((len + m->m_lenm_hdr.mh_len) > slp->ns_reclen) {
1726 m2 = m_copym(m, 0, slp->ns_reclen - len,
1727 waitflag);
1728 if (m2) {
1729 if (om) {
1730 om->m_nextm_hdr.mh_next = m2;
1731 recm = slp->ns_raw;
1732 } else
1733 recm = m2;
1734 m->m_datam_hdr.mh_data += slp->ns_reclen-len;
1735 m->m_lenm_hdr.mh_len -= slp->ns_reclen-len;
1736 len = slp->ns_reclen;
1737 } else {
1738 slp->ns_flag &= ~SLP_GETSTREAM0x10;
1739 return (EWOULDBLOCK35);
1740 }
1741 } else if ((len + m->m_lenm_hdr.mh_len) == slp->ns_reclen) {
1742 om = m;
1743 len += m->m_lenm_hdr.mh_len;
1744 m = m->m_nextm_hdr.mh_next;
1745 recm = slp->ns_raw;
1746 om->m_nextm_hdr.mh_next = NULL((void *)0);
1747 } else {
1748 om = m;
1749 len += m->m_lenm_hdr.mh_len;
1750 m = m->m_nextm_hdr.mh_next;
1751 }
1752 }
1753 slp->ns_raw = m;
1754 slp->ns_cc -= len;
1755 slp->ns_reclen = 0;
1756 } else {
1757 slp->ns_flag &= ~SLP_GETSTREAM0x10;
1758 return (0);
1759 }
1760
1761 /*
1762 * Accumulate the fragments into a record.
1763 */
1764 mpp = &slp->ns_frag;
1765 while (*mpp)
1766 mpp = &((*mpp)->m_nextm_hdr.mh_next);
1767 *mpp = recm;
1768 if (slp->ns_flag & SLP_LASTFRAG0x20) {
1769 if (slp->ns_recend)
1770 slp->ns_recend->m_nextpktm_hdr.mh_nextpkt = slp->ns_frag;
1771 else
1772 slp->ns_rec = slp->ns_frag;
1773 slp->ns_recend = slp->ns_frag;
1774 slp->ns_frag = NULL((void *)0);
1775 }
1776 }
1777}
1778
1779/*
1780 * Parse an RPC header.
1781 */
1782int
1783nfsrv_dorec(struct nfssvc_sock *slp, struct nfsd *nfsd,
1784 struct nfsrv_descript **ndp)
1785{
1786 struct mbuf *m, *nam;
1787 struct nfsrv_descript *nd;
1788 int error;
1789
1790 *ndp = NULL((void *)0);
1791 if ((slp->ns_flag & SLP_VALID0x01) == 0 ||
1792 (m = slp->ns_rec) == NULL((void *)0))
1793 return (ENOBUFS55);
1794 slp->ns_rec = m->m_nextpktm_hdr.mh_nextpkt;
1795 if (slp->ns_rec)
1796 m->m_nextpktm_hdr.mh_nextpkt = NULL((void *)0);
1797 else
1798 slp->ns_recend = NULL((void *)0);
1799 if (m->m_typem_hdr.mh_type == MT_SONAME3) {
1800 nam = m;
1801 m = m->m_nextm_hdr.mh_next;
1802 nam->m_nextm_hdr.mh_next = NULL((void *)0);
1803 } else
1804 nam = NULL((void *)0);
1805 nd = pool_get(&nfsrv_descript_pl, PR_WAITOK0x0001);
1806 nfs_realign(&m, 10 * NFSX_UNSIGNED4);
1807 nd->nd_md = nd->nd_mrep = m;
1808 nd->nd_nam2 = nam;
1809 nd->nd_dpos = mtod(m, caddr_t)((caddr_t)((m)->m_hdr.mh_data));
1810 error = nfs_getreq(nd, nfsd, 1);
1811 if (error) {
1812 m_freem(nam);
1813 pool_put(&nfsrv_descript_pl, nd);
1814 return (error);
1815 }
1816 *ndp = nd;
1817 nfsd->nfsd_nd = nd;
1818 return (0);
1819}
1820
1821
1822/*
1823 * Search for a sleeping nfsd and wake it up.
1824 * SIDE EFFECT: If none found, set NFSD_CHECKSLP flag, so that one of the
1825 * running nfsds will go look for the work in the nfssvc_sock list.
1826 */
1827void
1828nfsrv_wakenfsd(struct nfssvc_sock *slp)
1829{
1830 struct nfsd *nfsd;
1831
1832 if ((slp->ns_flag & SLP_VALID0x01) == 0)
1833 return;
1834
1835 TAILQ_FOREACH(nfsd, &nfsd_head, nfsd_chain)for((nfsd) = ((&nfsd_head)->tqh_first); (nfsd) != ((void
*)0); (nfsd) = ((nfsd)->nfsd_chain.tqe_next)) {
1836 if (nfsd->nfsd_flag & NFSD_WAITING0x01) {
1837 nfsd->nfsd_flag &= ~NFSD_WAITING0x01;
1838 if (nfsd->nfsd_slp)
1839 panic("nfsd wakeup");
1840 slp->ns_sref++;
1841 nfsd->nfsd_slp = slp;
1842 wakeup_one(nfsd)wakeup_n((nfsd), 1);
1843 return;
1844 }
1845 }
1846
1847 slp->ns_flag |= SLP_DOREC0x02;
1848 nfsd_head_flag |= NFSD_CHECKSLP0x01;
1849}
1850#endif /* NFSSERVER */