fs.c

/*
 * Copyright 2016 Jakub Klama <[email protected]>
 * All rights reserved
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted providing that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 */

/*
 * Based on libixp code: �2007-2010 Kris Maglione <maglione.k at Gmail>
 */

#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stdbool.h>
#include <fcntl.h>
#include <errno.h>
#include <assert.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <sys/param.h>
#include <sys/queue.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <dirent.h>
#include <pwd.h>
#include <grp.h>
#include <libgen.h>
#include <pthread.h>
#include "../lib9p.h"
#include "../lib9p_impl.h"
#include "../fid.h"
#include "../log.h"
#include "../rfuncs.h"
#include "../genacl.h"
#include "backend.h"
#include "fs.h"

#if defined(WITH_CASPER)
  #include <libcasper.h>
  #include <casper/cap_pwd.h>
  #include <casper/cap_grp.h>
#endif

#if defined(__FreeBSD__)
  #include <sys/param.h>
  #if __FreeBSD_version >= 1000000
    #define	HAVE_BINDAT
  #endif
#endif

#if defined(__FreeBSD__)
  #define	HAVE_BIRTHTIME
#endif

#if defined(__APPLE__)
  #include <sys/syscall.h>
  #include "Availability.h"
  #define ACL_TYPE_NFS4 ACL_TYPE_EXTENDED
#endif

struct fs_softc {
	int 	fs_rootfd;
	bool	fs_readonly;
#if defined(WITH_CASPER)
	cap_channel_t *fs_cappwd;
	cap_channel_t *fs_capgrp;
#endif
};

struct fs_fid {
	DIR	*ff_dir;
	int	ff_dirfd;
	int	ff_fd;
	int	ff_flags;
	char	*ff_name;
	struct fs_authinfo *ff_ai;
	pthread_mutex_t ff_mtx;
	struct l9p_acl *ff_acl; /* cached ACL if any */
};

#define	FF_NO_NFSV4_ACL	0x01	/* don't go looking for NFSv4 ACLs */
/*	FF_NO_POSIX_ACL	0x02	-- not yet */

/*
 * Our authinfo consists of:
 *
 *  - a reference count
 *  - a uid
 *  - a gid-set
 *
 * The "default" gid is the first gid in the git-set, provided the
 * set size is at least 1.  The set-size may be zero, though.
 *
 * Adjustments to the ref-count must be atomic, once it's shared.
 * It would be nice to use C11 atomics here but they are not common
 * enough to all systems just yet; for now, we use a mutex.
 *
 * Note that some ops (Linux style ones) pass an effective gid for
 * the op, in which case, that gid may override.  To achieve this
 * effect, permissions testing functions also take an extra gid.
 * If this gid is (gid_t)-1 it is not used and only the remaining
 * gids take part.
 *
 * The uid may also be (uid_t)-1, meaning "no uid was available
 * at all at attach time".  In this case, new files inherit parent
 * directory uids.
 *
 * The refcount is simply the number of "openfile"s using this
 * authinfo (so that when the last ref goes away, we can free it).
 *
 * There are also master ACL flags (same as in ff_flags).
 */
struct fs_authinfo {
	pthread_mutex_t ai_mtx;	/* lock for refcnt */
	uint32_t ai_refcnt;
	int	ai_flags;
	uid_t	ai_uid;
	int	ai_ngids;
	gid_t	ai_gids[];	/* NB: flexible array member */
};

/*
 * We have a global-static mutex for single-threading Tattach
 * requests, which use getpwnam (and indirectly, getgr* functions)
 * which are not reentrant.
 */
static bool fs_attach_mutex_inited;
static pthread_mutex_t fs_attach_mutex;

/*
 * Internal functions (except inline functions).
 */
static struct passwd *fs_getpwuid(struct fs_softc *, uid_t, struct r_pgdata *);
static struct group *fs_getgrgid(struct fs_softc *, gid_t, struct r_pgdata *);
static int fs_buildname(struct l9p_fid *, char *, char *, size_t);
static int fs_pdir(struct fs_softc *, struct l9p_fid *, char *, size_t,
    struct stat *st);
static int fs_dpf(char *, char *, size_t);
static int fs_oflags_dotu(int, int *);
static int fs_oflags_dotl(uint32_t, int *, enum l9p_omode *);
static int fs_nde(struct fs_softc *, struct l9p_fid *, bool, gid_t,
    struct stat *, uid_t *, gid_t *);
static struct fs_fid *open_fid(int, const char *, struct fs_authinfo *, bool);
static void dostat(struct fs_softc *, struct l9p_stat *, char *,
    struct stat *, bool dotu);
static void dostatfs(struct l9p_statfs *, struct statfs *, long);
static void fillacl(struct fs_fid *ff);
static struct l9p_acl *getacl(struct fs_fid *ff, int fd, const char *path);
static void dropacl(struct fs_fid *ff);
static struct l9p_acl *look_for_nfsv4_acl(struct fs_fid *ff, int fd,
    const char *path);
static int check_access(int32_t,
    struct l9p_acl *, struct stat *, struct l9p_acl *, struct stat *,
    struct fs_authinfo *, gid_t);
static void generate_qid(struct stat *, struct l9p_qid *);

static int fs_icreate(void *, struct l9p_fid *, char *, int,
    bool, mode_t, gid_t, struct stat *);
static int fs_iopen(void *, struct l9p_fid *, int, enum l9p_omode,
    gid_t, struct stat *);
static int fs_imkdir(void *, struct l9p_fid *, char *,
    bool, mode_t, gid_t, struct stat *);
static int fs_imkfifo(void *, struct l9p_fid *, char *,
    bool, mode_t, gid_t, struct stat *);
static int fs_imknod(void *, struct l9p_fid *, char *,
    bool, mode_t, dev_t, gid_t, struct stat *);
static int fs_imksocket(void *, struct l9p_fid *, char *,
    bool, mode_t, gid_t, struct stat *);
static int fs_isymlink(void *, struct l9p_fid *, char *, char *,
    gid_t, struct stat *);

/*
 * Internal functions implementing backend.
 */
static int fs_attach(void *, struct l9p_request *);
static int fs_clunk(void *, struct l9p_fid *);
static int fs_create(void *, struct l9p_request *);
static int fs_open(void *, struct l9p_request *);
static int fs_read(void *, struct l9p_request *);
static int fs_remove(void *, struct l9p_fid *);
static int fs_stat(void *, struct l9p_request *);
static int fs_walk(void *, struct l9p_request *);
static int fs_write(void *, struct l9p_request *);
static int fs_wstat(void *, struct l9p_request *);
static int fs_statfs(void *, struct l9p_request *);
static int fs_lopen(void *, struct l9p_request *);
static int fs_lcreate(void *, struct l9p_request *);
static int fs_symlink(void *, struct l9p_request *);
static int fs_mknod(void *, struct l9p_request *);
static int fs_rename(void *, struct l9p_request *);
static int fs_readlink(void *, struct l9p_request *);
static int fs_getattr(void *, struct l9p_request *);
static int fs_setattr(void *, struct l9p_request *);
static int fs_xattrwalk(void *, struct l9p_request *);
static int fs_xattrcreate(void *, struct l9p_request *);
static int fs_readdir(void *, struct l9p_request *);
static int fs_fsync(void *, struct l9p_request *);
static int fs_lock(void *, struct l9p_request *);
static int fs_getlock(void *, struct l9p_request *);
static int fs_link(void *, struct l9p_request *);
static int fs_renameat(void *, struct l9p_request *);
static int fs_unlinkat(void *, struct l9p_request *);
static void fs_freefid(void *, struct l9p_fid *);

/*
 * Convert from 9p2000 open/create mode to Unix-style O_* flags.
 * This includes 9p2000.u extensions, but not 9p2000.L protocol,
 * which has entirely different open, create, etc., flag bits.
 *
 * The <mode> given here is the one-byte (uint8_t) "mode"
 * argument to Tcreate or Topen, so it can have at most 8 bits.
 *
 * https://swtch.com/plan9port/man/man9/open.html and
 * http://plan9.bell-labs.com/magic/man2html/5/open
 * both say:
 *
 *   The [low two bits of the] mode field determines the
 *   type of I/O ... [I]f mode has the OTRUNC (0x10) bit
 *   set, the file is to be truncated, which requires write
 *   permission ...; if the mode has the ORCLOSE (0x40) bit
 *   set, the file is to be removed when the fid is clunked,
 *   which requires permission to remove the file from its
 *   directory.  All other bits in mode should be zero.  It
 *   is illegal to write a directory, truncate it, or
 *   attempt to remove it on close.
 *
 * 9P2000.u may add ODIRECT (0x80); this is not completely clear.
 * The fcall.h header defines OCEXEC (0x20) as well, but it makes
 * no sense to send this to a server.  There seem to be no bits
 * 0x04 and 0x08.
 *
 * We always turn on O_NOCTTY since as a server, we never want
 * to gain a controlling terminal.  We always turn on O_NOFOLLOW
 * for reasons described elsewhere.
 */
static int
fs_oflags_dotu(int mode, int *aflags)
{
	int flags;
#define	CONVERT(theirs, ours) \
	do { \
		if (mode & (theirs)) { \
			mode &= ~(theirs); \
			flags |= ours; \
		} \
	} while (0)

	switch (mode & L9P_OACCMODE) {

	case L9P_OREAD:
	default:
		flags = O_RDONLY;
		break;

	case L9P_OWRITE:
		flags = O_WRONLY;
		break;

	case L9P_ORDWR:
		flags = O_RDWR;
		break;

	case L9P_OEXEC:
		if (mode & L9P_OTRUNC)
			return (EINVAL);
		flags = O_RDONLY;
		break;
	}

	flags |= O_NOCTTY | O_NOFOLLOW;

	CONVERT(L9P_OTRUNC, O_TRUNC);

	/*
	 * Now take away some flags locally:
	 *   the access mode (already translated)
	 *   ORCLOSE - caller only
	 *   OCEXEC - makes no sense in server
	 *   ODIRECT - not applicable here
	 * If there are any flag bits left after this,
	 * we were unable to translate them.  For now, let's
	 * treat this as EINVAL so that we can catch problems.
	 */
	mode &= ~(L9P_OACCMODE | L9P_ORCLOSE | L9P_OCEXEC | L9P_ODIRECT);
	if (mode != 0) {
		L9P_LOG(L9P_INFO,
		    "fs_oflags_dotu: untranslated bits: %#x",
		    (unsigned)mode);
		return (EINVAL);
	}

	*aflags = flags;
	return (0);
#undef CONVERT
}

/*
 * Convert from 9P2000.L (Linux) open mode bits to O_* flags.
 * See fs_oflags_dotu above.
 *
 * Linux currently does not have open-for-exec, but there is a
 * proposal for it using O_PATH|O_NOFOLLOW, now handled here.
 *
 * We may eventually also set L9P_ORCLOSE for L_O_TMPFILE.
 */
static int
fs_oflags_dotl(uint32_t l_mode, int *aflags, enum l9p_omode *ap9)
{
	int flags;
	enum l9p_omode p9;
#define	CLEAR(theirs)	l_mode &= ~(uint32_t)(theirs)
#define	CONVERT(theirs, ours) \
	do { \
		if (l_mode & (theirs)) { \
			CLEAR(theirs); \
			flags |= ours; \
		} \
	} while (0)

	/*
	 * Linux O_RDONLY, O_WRONLY, O_RDWR (0,1,2) match BSD/MacOS.
	 */
	flags = l_mode & O_ACCMODE;
	if (flags == 3)
		return (EINVAL);
	CLEAR(O_ACCMODE);

	if ((l_mode & (L9P_L_O_PATH | L9P_L_O_NOFOLLOW)) ==
		    (L9P_L_O_PATH | L9P_L_O_NOFOLLOW)) {
		CLEAR(L9P_L_O_PATH | L9P_L_O_NOFOLLOW);
		p9 = L9P_OEXEC;
	} else {
		/*
		 * Slightly dirty, but same dirt, really, as
		 * setting flags from l_mode & O_ACCMODE.
		 */
		p9 = (enum l9p_omode)flags;	/* slightly dirty */
	}

	/* turn L_O_TMPFILE into L9P_ORCLOSE in *p9? */
	if (l_mode & L9P_L_O_TRUNC)
		p9 |= L9P_OTRUNC;	/* but don't CLEAR yet */

	flags |= O_NOCTTY | O_NOFOLLOW;

	/*
	 * L_O_CREAT seems to be noise, since we get separate open
	 * and create.  But it is actually set sometimes.  We just
	 * throw it out here; create ops must set it themselves and
	 * open ops have no permissions bits and hence cannot create.
	 *
	 * L_O_EXCL does make sense on create ops, i.e., we can
	 * take a create op with or without L_O_EXCL.  We pass that
	 * through.
	 */
	CLEAR(L9P_L_O_CREAT);
	CONVERT(L9P_L_O_EXCL, O_EXCL);
	CONVERT(L9P_L_O_TRUNC, O_TRUNC);
	CONVERT(L9P_L_O_DIRECTORY, O_DIRECTORY);
	CONVERT(L9P_L_O_APPEND, O_APPEND);
	CONVERT(L9P_L_O_NONBLOCK, O_NONBLOCK);

	/*
	 * Discard these as useless noise at our (server) end.
	 * (NOATIME might be useful but we can only set it on a
	 * per-mount basis.)
	 */
	CLEAR(L9P_L_O_CLOEXEC);
	CLEAR(L9P_L_O_DIRECT);
	CLEAR(L9P_L_O_DSYNC);
	CLEAR(L9P_L_O_FASYNC);
	CLEAR(L9P_L_O_LARGEFILE);
	CLEAR(L9P_L_O_NOATIME);
	CLEAR(L9P_L_O_NOCTTY);
	CLEAR(L9P_L_O_NOFOLLOW);
	CLEAR(L9P_L_O_SYNC);

	if (l_mode != 0) {
		L9P_LOG(L9P_INFO,
		    "fs_oflags_dotl: untranslated bits: %#x",
		    (unsigned)l_mode);
		return (EINVAL);
	}

	*aflags = flags;
	*ap9 = p9;
	return (0);
#undef CLEAR
#undef CONVERT
}

static struct passwd *
fs_getpwuid(struct fs_softc *sc, uid_t uid, struct r_pgdata *pg)
{
#if defined(WITH_CASPER)
	return (r_cap_getpwuid(sc->fs_cappwd, uid, pg));
#else
	(void)sc;
	return (r_getpwuid(uid, pg));
#endif
}

static struct group *
fs_getgrgid(struct fs_softc *sc, gid_t gid, struct r_pgdata *pg)
{
#if defined(WITH_CASPER)
	return (r_cap_getgrgid(sc->fs_capgrp, gid, pg));
#else
	(void)sc;
	return (r_getgrgid(gid, pg));
#endif
}

/*
 * Build full name of file by appending given name to directory name.
 */
static int
fs_buildname(struct l9p_fid *dir, char *name, char *buf, size_t size)
{
	struct fs_fid *dirf = dir->lo_aux;
	size_t dlen, nlen1;

	assert(dirf != NULL);
	dlen = strlen(dirf->ff_name);
	nlen1 = strlen(name) + 1;	/* +1 for '\0' */
	if (dlen + 1 + nlen1 > size)
		return (ENAMETOOLONG);
	memcpy(buf, dirf->ff_name, dlen);
	buf[dlen] = '/';
	memcpy(buf + dlen + 1, name, nlen1);
	return (0);
}

/*
 * Build parent name of file by splitting it off.  Return an error
 * if the given fid represents the root, so that there is no such
 * parent, or if the discovered parent is not a directory.
 */
static int
fs_pdir(struct fs_softc *sc __unused, struct l9p_fid *fid, char *buf,
    size_t size, struct stat *st)
{
	struct fs_fid *ff;
	char *path;

	ff = fid->lo_aux;
	assert(ff != NULL);
	path = ff->ff_name;
	path = r_dirname(path, buf, size);
	if (path == NULL)
		return (ENAMETOOLONG);
	if (fstatat(ff->ff_dirfd, path, st, AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);
	if (!S_ISDIR(st->st_mode))
		return (ENOTDIR);
	return (0);
}

/*
 * Like fs_buildname() but for adding a file name to a buffer
 * already holding a directory name.  Essentially does
 *     strcat(dbuf, "/");
 *     strcat(dbuf, fname);
 * but with size checking and an ENAMETOOLONG error as needed.
 *
 * (Think of the function name as "directory plus-equals file".)
 */
static int
fs_dpf(char *dbuf, char *fname, size_t size)
{
	size_t dlen, nlen1;

	dlen = strlen(dbuf);
	nlen1 = strlen(fname) + 1;
	if (dlen + 1 + nlen1 > size)
		return (ENAMETOOLONG);
	dbuf[dlen] = '/';
	memcpy(dbuf + dlen + 1, fname, nlen1);
	return (0);
}

/*
 * Prepare to create a new directory entry (open with O_CREAT,
 * mkdir, etc -- any operation that creates a new inode),
 * operating in parent data <dir>, based on authinfo <ai> and
 * effective gid <egid>.
 *
 * The new entity should be owned by user/group <*nuid, *ngid>,
 * if it's really a new entity.  It will be a directory if isdir.
 *
 * Returns an error number if the entry should not be created
 * (e.g., read-only file system or no permission to write in
 * parent directory).  Always sets *nuid and *ngid on success:
 * in the worst case, when there is no available ID, this will
 * use the parent directory's IDs.  Fills in <*st> on success.
 */
static int
fs_nde(struct fs_softc *sc, struct l9p_fid *dir, bool isdir, gid_t egid,
    struct stat *st, uid_t *nuid, gid_t *ngid)
{
	struct fs_fid *dirf;
	struct fs_authinfo *ai;
	int32_t op;
	int error;

	if (sc->fs_readonly)
		return (EROFS);
	dirf = dir->lo_aux;
	assert(dirf != NULL);
	if (fstatat(dirf->ff_dirfd, dirf->ff_name, st,
	    AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);
	if (!S_ISDIR(st->st_mode))
		return (ENOTDIR);
	dirf = dir->lo_aux;
	ai = dirf->ff_ai;
	fillacl(dirf);
	op = isdir ? L9P_ACE_ADD_SUBDIRECTORY : L9P_ACE_ADD_FILE;
	error = check_access(op, dirf->ff_acl, st, NULL, NULL, ai, egid);
	if (error)
		return (EPERM);

	*nuid = ai->ai_uid != (uid_t)-1 ? ai->ai_uid : st->st_uid;
	*ngid = egid != (gid_t)-1 ? egid :
	    ai->ai_ngids > 0 ?  ai->ai_gids[0] : st->st_gid;
	return (0);
}

/*
 * Allocate new open-file data structure to attach to a fid.
 *
 * The new file's authinfo is the same as the old one's, and
 * we gain a reference.
 */
static struct fs_fid *
open_fid(int dirfd, const char *path, struct fs_authinfo *ai, bool creating)
{
	struct fs_fid *ret;
	uint32_t newcount;
	int error;

	ret = l9p_calloc(1, sizeof(*ret));
	error = pthread_mutex_init(&ret->ff_mtx, NULL);
	if (error) {
		free(ret);
		return (NULL);
	}
	ret->ff_fd = -1;
	ret->ff_dirfd = dirfd;
	ret->ff_name = strdup(path);
	if (ret->ff_name == NULL) {
		pthread_mutex_destroy(&ret->ff_mtx);
		free(ret);
		return (NULL);
	}
	pthread_mutex_lock(&ai->ai_mtx);
	newcount = ++ai->ai_refcnt;
	pthread_mutex_unlock(&ai->ai_mtx);
	/*
	 * If we just incremented the count to 1, we're the *first*
	 * reference.  This is only allowed when creating the authinfo,
	 * otherwise it means something has gone wrong.  This cannot
	 * catch every bad (re)use of a freed authinfo but it may catch
	 * a few.
	 */
	assert(newcount > 1 || creating);
	L9P_LOG(L9P_DEBUG, "authinfo %p now used by %lu",
	    (void *)ai, (u_long)newcount);
	ret->ff_ai = ai;
	return (ret);
}

static void
dostat(struct fs_softc *sc, struct l9p_stat *s, char *name,
    struct stat *buf, bool dotu)
{
	struct passwd *user;
	struct group *group;

	memset(s, 0, sizeof(struct l9p_stat));

	generate_qid(buf, &s->qid);

	s->type = 0;
	s->dev = 0;
	s->mode = buf->st_mode & 0777;

	if (S_ISDIR(buf->st_mode))
		s->mode |= L9P_DMDIR;

	if (S_ISLNK(buf->st_mode) && dotu)
		s->mode |= L9P_DMSYMLINK;

	if (S_ISCHR(buf->st_mode) || S_ISBLK(buf->st_mode))
		s->mode |= L9P_DMDEVICE;

	if (S_ISSOCK(buf->st_mode))
		s->mode |= L9P_DMSOCKET;

	if (S_ISFIFO(buf->st_mode))
		s->mode |= L9P_DMNAMEDPIPE;

	s->atime = (uint32_t)buf->st_atime;
	s->mtime = (uint32_t)buf->st_mtime;
	s->length = (uint64_t)buf->st_size;

	s->name = r_basename(name, NULL, 0);

	if (!dotu) {
		struct r_pgdata udata, gdata;

		user = fs_getpwuid(sc, buf->st_uid, &udata);
		group = fs_getgrgid(sc, buf->st_gid, &gdata);
		s->uid = user != NULL ? strdup(user->pw_name) : NULL;
		s->gid = group != NULL ? strdup(group->gr_name) : NULL;
		s->muid = user != NULL ? strdup(user->pw_name) : NULL;
		r_pgfree(&udata);
		r_pgfree(&gdata);
	} else {
		/*
		 * When using 9P2000.u, we don't need to bother about
		 * providing user and group names in textual form.
		 *
		 * NB: if the asprintf()s fail, s->extension should
		 * be unset so we can ignore these.
		 */
		s->n_uid = buf->st_uid;
		s->n_gid = buf->st_gid;
		s->n_muid = buf->st_uid;

		if (S_ISLNK(buf->st_mode)) {
			char target[MAXPATHLEN];
			ssize_t ret = readlink(name, target, MAXPATHLEN);

			if (ret < 0) {
				s->extension = NULL;
				return;
			}

			s->extension = strndup(target, (size_t)ret);
		}

		if (S_ISBLK(buf->st_mode)) {
			asprintf(&s->extension, "b %d %d", major(buf->st_rdev),
			    minor(buf->st_rdev));
		}

		if (S_ISCHR(buf->st_mode)) {
			asprintf(&s->extension, "c %d %d", major(buf->st_rdev),
			    minor(buf->st_rdev));
		}
	}
}

static void dostatfs(struct l9p_statfs *out, struct statfs *in, long namelen)
{

	out->type = L9P_FSTYPE;
	out->bsize = in->f_bsize;
	out->blocks = in->f_blocks;
	out->bfree = in->f_bfree;
	out->bavail = in->f_bavail;
	out->files = in->f_files;
	out->ffree = in->f_ffree;
	out->namelen = (uint32_t)namelen;
	out->fsid = ((uint64_t)in->f_fsid.val[0] << 32) |
	    (uint64_t)in->f_fsid.val[1];
}

static void
generate_qid(struct stat *buf, struct l9p_qid *qid)
{
	qid->path = buf->st_ino;
	qid->version = 0;

	if (S_ISREG(buf->st_mode))
		qid->type |= L9P_QTFILE;

	if (S_ISDIR(buf->st_mode))
		qid->type |= L9P_QTDIR;

	if (S_ISLNK(buf->st_mode))
		qid->type |= L9P_QTSYMLINK;
}

/*
 * Fill in ff->ff_acl if it's not set yet.  Skip if the "don't use
 * ACLs" flag is set, and use the flag to remember failure so
 * we don't bother retrying either.
 */
static void
fillacl(struct fs_fid *ff)
{

	if (ff->ff_acl == NULL && (ff->ff_flags & FF_NO_NFSV4_ACL) == 0) {
		ff->ff_acl = look_for_nfsv4_acl(ff, ff->ff_fd, ff->ff_name);
		if (ff->ff_acl == NULL)
			ff->ff_flags |= FF_NO_NFSV4_ACL;
	}
}

/*
 * Get an ACL given fd and/or path name.  We check for the "don't get
 * ACL" flag in the given ff_fid data structure first, but don't set
 * the flag here.  The fillacl() code is similar but will set the
 * flag; it also uses the ff_fd and ff_name directly.
 *
 * (This is used to get ACLs for parent directories, for instance.)
 */
static struct l9p_acl *
getacl(struct fs_fid *ff, int fd, const char *path)
{

	if (ff->ff_flags & FF_NO_NFSV4_ACL)
		return (NULL);
	return look_for_nfsv4_acl(ff, fd, path);
}

/*
 * Drop cached ff->ff_acl, e.g., after moving from one directory to
 * another, where inherited ACLs might change.
 */
static void
dropacl(struct fs_fid *ff)
{

	l9p_acl_free(ff->ff_acl);
	ff->ff_acl = NULL;
	ff->ff_flags = ff->ff_ai->ai_flags;
}

/*
 * Check to see if we can find NFSv4 ACLs for the given file.
 * If we have an open fd, we can use that, otherwise we need
 * to use the path.
 */
static struct l9p_acl *
look_for_nfsv4_acl(struct fs_fid *ff, int fd, const char *path)
{
	struct l9p_acl *acl;
	acl_t sysacl;
	int doclose = 0;

	if (fd < 0) {
		fd = openat(ff->ff_dirfd, path, 0);
		doclose = 1;
	}

	sysacl = acl_get_fd_np(fd, ACL_TYPE_NFS4);
	if (sysacl == NULL) {
		/*
		 * EINVAL means no NFSv4 ACLs apply for this file.
		 * Other error numbers indicate some kind of problem.
		 */
		if (errno != EINVAL) {
			L9P_LOG(L9P_ERROR,
			    "error retrieving NFSv4 ACL from "
			    "fdesc %d (%s): %s", fd,
			    path, strerror(errno));
		}

		if (doclose)
			close(fd);

		return (NULL);
	}
#if defined(HAVE_FREEBSD_ACLS)
	acl = l9p_freebsd_nfsv4acl_to_acl(sysacl);
#else
	acl = NULL; /* XXX need a l9p_darwin_acl_to_acl */
#endif
	acl_free(sysacl);

	if (doclose)
		close(fd);

	return (acl);
}

/*
 * Verify that the user whose authinfo is in <ai> and effective
 * group ID is <egid> ((gid_t)-1 means no egid supplied) has
 * permission to do something.
 *
 * The "something" may be rather complex: we allow NFSv4 style
 * operation masks here, and provide parent and child ACLs and
 * stat data.  At most one of pacl+pst and cacl+cst can be NULL,
 * unless ACLs are not supported; then pacl and cacl can both
 * be NULL but pst or cst must be non-NULL depending on the
 * operation.
 */
static int
check_access(int32_t opmask,
    struct l9p_acl *pacl, struct stat *pst,
    struct l9p_acl *cacl, struct stat *cst,
    struct fs_authinfo *ai, gid_t egid)
{
	struct l9p_acl_check_args args;

	/*
	 * If we have ACLs, use them exclusively, ignoring Unix
	 * permissions.  Otherwise, fall back on stat st_mode
	 * bits, and allow super-user as well.
	 */
	args.aca_uid = ai->ai_uid;
	args.aca_gid = egid;
	args.aca_groups = ai->ai_gids;
	args.aca_ngroups = (size_t)ai->ai_ngids;
	args.aca_parent = pacl;
	args.aca_pstat = pst;
	args.aca_child = cacl;
	args.aca_cstat = cst;
	args.aca_aclmode = pacl == NULL && cacl == NULL
	    ? L9P_ACM_STAT_MODE
	    : L9P_ACM_NFS_ACL | L9P_ACM_ZFS_ACL;

	args.aca_superuser = true;
	return (l9p_acl_check_access(opmask, &args));
}

static int
fs_attach(void *softc, struct l9p_request *req)
{
	struct fs_authinfo *ai;
	struct fs_softc *sc = (struct fs_softc *)softc;
	struct fs_fid *file;
	struct passwd *pwd;
	struct stat st;
	struct r_pgdata udata;
	uint32_t n_uname;
	gid_t *gids;
	uid_t uid;
	int error;
	int ngroups;

	assert(req->lr_fid != NULL);

	/*
	 * Single-thread pwd/group related items.  We have a reentrant
	 * r_getpwuid but not a reentrant r_getpwnam, and l9p_getgrlist
	 * may use non-reentrant C library getgr* routines.
	 */
	pthread_mutex_lock(&fs_attach_mutex);

	n_uname = req->lr_req.tattach.n_uname;
	if (n_uname != L9P_NONUNAME) {
		uid = (uid_t)n_uname;
		pwd = fs_getpwuid(sc, uid, &udata);
		if (pwd == NULL)
			L9P_LOG(L9P_DEBUG,
			    "Tattach: uid %ld: no such user", (long)uid);
	} else {
		uid = (uid_t)-1;
#if defined(WITH_CASPER)
		pwd = cap_getpwnam(sc->fs_cappwd, req->lr_req.tattach.uname);
#else
		pwd = getpwnam(req->lr_req.tattach.uname);
#endif
		if (pwd == NULL)
			L9P_LOG(L9P_DEBUG,
			    "Tattach: %s: no such user",
			    req->lr_req.tattach.uname);
	}

	/*
	 * If caller didn't give a numeric UID, pick it up from pwd
	 * if possible.  If that doesn't work we can't continue.
	 *
	 * Note that pwd also supplies the group set.  This assumes
	 * the server has the right mapping; this needs improvement.
	 * We do at least support ai->ai_ngids==0 properly now though.
	 */
	if (uid == (uid_t)-1 && pwd != NULL)
		uid = pwd->pw_uid;
	if (uid == (uid_t)-1)
		error = EPERM;
	else {
		error = 0;
		if (fstat(sc->fs_rootfd, &st) != 0)
			error = errno;
		else if (!S_ISDIR(st.st_mode))
			error = ENOTDIR;
	}
	if (error) {
		pthread_mutex_unlock(&fs_attach_mutex);
		L9P_LOG(L9P_DEBUG,
		    "Tattach: denying uid=%ld access to rootdir: %s",
		    (long)uid, strerror(error));
		/*
		 * Pass ENOENT and ENOTDIR through for diagnosis;
		 * others become EPERM.  This should not leak too
		 * much security.
		 */
		return (error == ENOENT || error == ENOTDIR ? error : EPERM);
	}

	if (pwd != NULL) {
		/*
		 * This either succeeds and fills in ngroups and
		 * returns non-NULL, or fails and sets ngroups to 0
		 * and returns NULL.  Either way ngroups is correct.
		 */
		gids = l9p_getgrlist(pwd->pw_name, pwd->pw_gid, &ngroups);
	} else {
		gids = NULL;
		ngroups = 0;
	}

	/*
	 * Done with pwd and group related items that may use
	 * non-reentrant C library routines; allow other threads in.
	 */
	pthread_mutex_unlock(&fs_attach_mutex);

	ai = malloc(sizeof(*ai) + (size_t)ngroups * sizeof(gid_t));
	if (ai == NULL) {
		free(gids);
		return (ENOMEM);
	}
	error = pthread_mutex_init(&ai->ai_mtx, NULL);
	if (error) {
		free(gids);
		free(ai);
		return (error);
	}
	ai->ai_refcnt = 0;
	ai->ai_uid = uid;
	ai->ai_flags = 0;	/* XXX for now */
	ai->ai_ngids = ngroups;
	memcpy(ai->ai_gids, gids, (size_t)ngroups * sizeof(gid_t));
	free(gids);

	file = open_fid(sc->fs_rootfd, ".", ai, true);
	if (file == NULL) {
		pthread_mutex_destroy(&ai->ai_mtx);
		free(ai);
		return (ENOMEM);
	}

	req->lr_fid->lo_aux = file;
	generate_qid(&st, &req->lr_resp.rattach.qid);
	return (0);
}

static int
fs_clunk(void *softc __unused, struct l9p_fid *fid)
{
	struct fs_fid *file;

	file = fid->lo_aux;
	assert(file != NULL);

	if (file->ff_dir) {
		closedir(file->ff_dir);
		file->ff_dir = NULL;
	} else if (file->ff_fd != -1) {
		close(file->ff_fd);
		file->ff_fd = -1;
	}

	return (0);
}

/*
 * Create ops.
 *
 * We are to create a new file under some existing path,
 * where the new file's name is in the Tcreate request and the
 * existing path is due to a fid-based file (req->lr_fid).
 *
 * One op (create regular file) sets file->fd, the rest do not.
 */
static int
fs_create(void *softc, struct l9p_request *req)
{
	struct l9p_fid *dir;
	struct stat st;
	uint32_t dmperm;
	mode_t perm;
	char *name;
	int error;

	dir = req->lr_fid;
	name = req->lr_req.tcreate.name;
	dmperm = req->lr_req.tcreate.perm;
	perm = (mode_t)(dmperm & 0777);

	if (dmperm & L9P_DMDIR)
		error = fs_imkdir(softc, dir, name, true,
		    perm, (gid_t)-1, &st);
	else if (dmperm & L9P_DMSYMLINK)
		error = fs_isymlink(softc, dir, name,
		    req->lr_req.tcreate.extension, (gid_t)-1, &st);
	else if (dmperm & L9P_DMNAMEDPIPE)
		error = fs_imkfifo(softc, dir, name, true,
		    perm, (gid_t)-1, &st);
	else if (dmperm & L9P_DMSOCKET)
		error = fs_imksocket(softc, dir, name, true,
		    perm, (gid_t)-1, &st);
	else if (dmperm & L9P_DMDEVICE) {
		unsigned int major, minor;
		char type;
		dev_t dev;

		/*
		 * ??? Should this be testing < 3?  For now, allow a single
		 * integer mode with minor==0 implied.
		 */
		minor = 0;
		if (sscanf(req->lr_req.tcreate.extension, "%c %u %u",
		    &type, &major, &minor) < 2) {
			return (EINVAL);
		}

		switch (type) {
		case 'b':
			perm |= S_IFBLK;
			break;
		case 'c':
			perm |= S_IFCHR;
			break;
		default:
			return (EINVAL);
		}
		dev = makedev(major, minor);
		error = fs_imknod(softc, dir, name, true, perm, dev,
		    (gid_t)-1, &st);
	} else {
		enum l9p_omode p9;
		int flags;

		p9 = req->lr_req.tcreate.mode;
		error = fs_oflags_dotu(p9, &flags);
		if (error)
			return (error);
		error = fs_icreate(softc, dir, name, flags,
		    true, perm, (gid_t)-1, &st);
		req->lr_resp.rcreate.iounit = req->lr_conn->lc_max_io_size;
	}

	if (error == 0)
		generate_qid(&st, &req->lr_resp.rcreate.qid);

	return (error);
}

/*
 * https://swtch.com/plan9port/man/man9/open.html and
 * http://plan9.bell-labs.com/magic/man2html/5/open
 * say that permissions are actually
 *     perm & (~0666 | (dir.perm & 0666))
 * for files, and
 *     perm & (~0777 | (dir.perm & 0777))
 * for directories.  That is, the parent directory may
 * take away permissions granted by the operation.
 *
 * This seems a bit restrictive; probably
 * there should be a control knob for this.
 */
static inline mode_t
fs_p9perm(mode_t perm, mode_t dir_perm, bool isdir)
{

	if (isdir)
		perm &= ~0777 | (dir_perm & 0777);
	else
		perm &= ~0666 | (dir_perm & 0666);
	return (perm);
}

/*
 * Internal form of create (plain file).
 *
 * Our caller takes care of splitting off all the special
 * types of create (mknod, etc), so this is purely for files.
 * We receive the fs_softc <softc>, the directory fid <dir>
 * in which the new file is to be created, the name of the
 * new file, a flag <isp9> indicating whether to do plan9 style
 * permissions or Linux style permissions, the permissions <perm>,
 * an effective group id <egid>, and a pointer to a stat structure
 * <st> to fill in describing the final result on success.
 *
 * On successful create, the fid switches to the newly created
 * file, which is now open; its associated file-name changes too.
 *
 * Note that the original (dir) fid is never currently open,
 * so there is nothing to close.
 */
static int
fs_icreate(void *softc, struct l9p_fid *dir, char *name, int flags,
    bool isp9, mode_t perm, gid_t egid, struct stat *st)
{
	struct fs_fid *file;
	gid_t gid;
	uid_t uid;
	char newname[MAXPATHLEN];
	int error, fd;

	file = dir->lo_aux;

	/*
	 * Build full path name from directory + file name.  We'll
	 * check permissions on the parent directory, then race to
	 * create the file before anything bad happens like symlinks.
	 *
	 * (To close this race we need to use openat(), which is
	 * left for a later version of this code.)
	 */
	error = fs_buildname(dir, name, newname, sizeof(newname));
	if (error)
		return (error);

	/* In case of success, we will need a new file->ff_name. */
	name = strdup(newname);
	if (name == NULL)
		return (ENOMEM);

	/* Check create permission and compute new file ownership. */
	error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
	if (error) {
		free(name);
		return (error);
	}

	/* Adjust new-file permissions for Plan9 protocol. */
	if (isp9)
		perm = fs_p9perm(perm, st->st_mode, false);

	/* Create is always exclusive so O_TRUNC is irrelevant. */
	fd = openat(file->ff_dirfd, newname, flags | O_CREAT | O_EXCL, perm);
	if (fd < 0) {
		error = errno;
		free(name);
		return (error);
	}

	/* Fix permissions and owner. */
	if (fchmod(fd, perm) != 0 ||
	    fchown(fd, uid, gid) != 0 ||
	    fstat(fd, st) != 0) {
		error = errno;
		(void) close(fd);
		/* unlink(newname); ? */
		free(name);
		return (error);
	}

	/* It *was* a directory; now it's a file, and it's open. */
	free(file->ff_name);
	file->ff_name = name;
	file->ff_fd = fd;
	return (0);
}

/*
 * Internal form of open: stat file and verify permissions (from p9
 * argument), then open the file-or-directory, leaving the internal
 * fs_fid fields set up.  If we cannot open the file, return a
 * suitable error number, and leave everything unchanged.
 *
 * To mitigate the race between permissions testing and the actual
 * open, we can stat the file twice (once with lstat() before open,
 * then with fstat() after).  We assume O_NOFOLLOW is set in flags,
 * so if some other race-winner substitutes in a symlink we won't
 * open it here.  (However, embedded symlinks, if they occur, are
 * still an issue.  Ideally we would like to have an O_NEVERFOLLOW
 * that fails on embedded symlinks, and a way to pass this to
 * lstat() as well.)
 *
 * When we use opendir() we cannot pass O_NOFOLLOW, so we must rely
 * on substitution-detection via fstat().  To simplify the code we
 * just always re-check.
 *
 * (For a proper fix in the future, we can require openat(), keep
 * each parent directory open during walk etc, and allow only final
 * name components with O_NOFOLLOW.)
 *
 * On successful return, st has been filled in.
 */
static int
fs_iopen(void *softc, struct l9p_fid *fid, int flags, enum l9p_omode p9,
    gid_t egid __unused, struct stat *st)
{
	struct fs_softc *sc = softc;
	struct fs_fid *file;
	struct stat first;
	int32_t op;
	char *name;
	int error;
	int fd;
	DIR *dirp;

	/* Forbid write ops on read-only file system. */
	if (sc->fs_readonly) {
		if ((flags & O_TRUNC) != 0)
			return (EROFS);
		if ((flags & O_ACCMODE) != O_RDONLY)
			return (EROFS);
		if (p9 & L9P_ORCLOSE)
			return (EROFS);
	}

	file = fid->lo_aux;
	assert(file != NULL);
	name = file->ff_name;

	if (fstatat(file->ff_dirfd, name, &first, AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);
	if (S_ISLNK(first.st_mode))
		return (EPERM);

	/* Can we rely on O_APPEND here?  Best not, can be cleared. */
	switch (flags & O_ACCMODE) {
	case O_RDONLY:
		op = L9P_ACE_READ_DATA;
		break;
	case O_WRONLY:
		op = L9P_ACE_WRITE_DATA;
		break;
	case O_RDWR:
		op = L9P_ACE_READ_DATA | L9P_ACE_WRITE_DATA;
		break;
	default:
		return (EINVAL);
	}
	fillacl(file);
	error = check_access(op, NULL, NULL, file->ff_acl, &first,
	    file->ff_ai, (gid_t)-1);
	if (error)
		return (error);

	if (S_ISDIR(first.st_mode)) {
		/* Forbid write or truncate on directory. */
		if ((flags & O_ACCMODE) != O_RDONLY || (flags & O_TRUNC))
			return (EPERM);
		fd = openat(file->ff_dirfd, name, O_DIRECTORY);
		dirp = fdopendir(fd);
		if (dirp == NULL)
			return (EPERM);
		fd = dirfd(dirp);
	} else {
		dirp = NULL;
		fd = openat(file->ff_dirfd, name, flags);
		if (fd < 0)
			return (EPERM);
	}

	/*
	 * We have a valid fd, and maybe non-null dirp.  Re-check
	 * the file, and fail if st_dev or st_ino changed.
	 */
	if (fstat(fd, st) != 0 ||
	    first.st_dev != st->st_dev ||
	    first.st_ino != st->st_ino) {
		if (dirp != NULL)
			(void) closedir(dirp);
		else
			(void) close(fd);
		return (EPERM);
	}
	if (dirp != NULL)
		file->ff_dir = dirp;
	else
		file->ff_fd = fd;
	return (0);
}

/*
 * Internal form of mkdir (common code for all forms).
 * We receive the fs_softc <softc>, the directory fid <dir>
 * in which the new entry is to be created, the name of the
 * new entry, a flag <isp9> indicating whether to do plan9 style
 * permissions or Linux style permissions, the permissions <perm>,
 * an effective group id <egid>, and a pointer to a stat structure
 * <st> to fill in describing the final result on success.
 *
 * See also fs_icreate() above.
 */
static int
fs_imkdir(void *softc, struct l9p_fid *dir, char *name,
    bool isp9, mode_t perm, gid_t egid, struct stat *st)
{
	struct fs_fid *ff;
	gid_t gid;
	uid_t uid;
	char newname[MAXPATHLEN];
	int error, fd;

	ff = dir->lo_aux;
	error = fs_buildname(dir, name, newname, sizeof(newname));
	if (error)
		return (error);

	error = fs_nde(softc, dir, true, egid, st, &uid, &gid);
	if (error)
		return (error);

	if (isp9)
		perm = fs_p9perm(perm, st->st_mode, true);

	if (mkdirat(ff->ff_dirfd, newname, perm) != 0)
		return (errno);

	fd = openat(ff->ff_dirfd, newname,
	    O_DIRECTORY | O_RDONLY | O_NOFOLLOW);
	if (fd < 0 ||
	    fchown(fd, uid, gid) != 0 ||
	    fchmod(fd, perm) != 0 ||
	    fstat(fd, st) != 0) {
		error = errno;
		/* rmdir(newname) ? */
	}
	if (fd >= 0)
		(void) close(fd);

	return (error);
}

#ifdef __APPLE__
/*
 * This is an undocumented OS X syscall. It would be best to avoid it,
 * but there doesn't seem to be another safe way to implement mknodat.
 * Dear Apple, please implement mknodat before you remove this syscall.
 */
static int fs_ifchdir_thread_local(int fd)
{
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wdeprecated-declarations"
	return syscall(SYS___pthread_fchdir, fd);
#pragma clang diagnostic pop
}
#endif

/*
 * Internal form of mknod (special device).
 *
 * The device type (S_IFBLK, S_IFCHR) is included in the <mode> parameter.
 */
static int
fs_imknod(void *softc, struct l9p_fid *dir, char *name,
    bool isp9, mode_t mode, dev_t dev, gid_t egid, struct stat *st)
{
	struct fs_fid *ff;
	mode_t perm;
	gid_t gid;
	uid_t uid;
	char newname[MAXPATHLEN];
	int error;

	ff = dir->lo_aux;
	error = fs_buildname(dir, name, newname, sizeof(newname));
	if (error)
		return (error);

	error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
	if (error)
		return (error);

	if (isp9) {
		perm = fs_p9perm(mode & 0777, st->st_mode, false);
		mode = (mode & ~0777) | perm;
	} else {
		perm = mode & 0777;
	}

#ifdef __APPLE__
	if (fs_ifchdir_thread_local(ff->ff_dirfd) < 0) {
		return -1;
	}
	error = mknod(newname, mode, dev);
	int preserved_errno = errno;
	/* Stop using the thread-local cwd */
	fs_ifchdir_thread_local(-1);
	if (error < 0) {
		errno = preserved_errno;
		return errno;
	}
#else
	if (mknodat(ff->ff_dirfd, newname, mode, dev) != 0)
		return (errno);
#endif

	/* We cannot open the new name; race to use l* syscalls. */
	if (fchownat(ff->ff_dirfd, newname, uid, gid, AT_SYMLINK_NOFOLLOW) != 0 ||
	    fchmodat(ff->ff_dirfd, newname, perm, AT_SYMLINK_NOFOLLOW) != 0 ||
	    fstatat(ff->ff_dirfd, newname, st, AT_SYMLINK_NOFOLLOW) != 0)
		error = errno;
	else if ((st->st_mode & S_IFMT) != (mode & S_IFMT))
		error = EPERM;		/* ??? lost a race anyway */

	/* if (error) unlink(newname) ? */

	return (error);
}

/*
 * Internal form of mkfifo.
 */
static int
fs_imkfifo(void *softc, struct l9p_fid *dir, char *name,
    bool isp9, mode_t perm, gid_t egid, struct stat *st)
{
	struct fs_fid *ff;
	gid_t gid;
	uid_t uid;
	char newname[MAXPATHLEN];
	int error;

	ff = dir->lo_aux;
	error = fs_buildname(dir, name, newname, sizeof(newname));
	if (error)
		return (error);

	error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
	if (error)
		return (error);

	if (isp9)
		perm = fs_p9perm(perm, st->st_mode, false);

	if (mkfifo(newname, perm) != 0)
		return (errno);

	/* We cannot open the new name; race to use l* syscalls. */
	if (fchownat(ff->ff_dirfd, newname, uid, gid, AT_SYMLINK_NOFOLLOW) != 0 ||
	    fchmodat(ff->ff_dirfd, newname, perm, AT_SYMLINK_NOFOLLOW) != 0 ||
	    fstatat(ff->ff_dirfd, newname, st, AT_SYMLINK_NOFOLLOW) != 0)
		error = errno;
	else if (!S_ISFIFO(st->st_mode))
		error = EPERM;		/* ??? lost a race anyway */

	/* if (error) unlink(newname) ? */

	return (error);
}

/*
 * Internal form of mksocket.
 *
 * This is a bit different because of the horrible socket naming
 * system (bind() with sockaddr_un sun_path).
 */
static int
fs_imksocket(void *softc, struct l9p_fid *dir, char *name,
    bool isp9, mode_t perm, gid_t egid, struct stat *st)
{
	struct fs_fid *ff;
	struct sockaddr_un sun;
	char *path;
	char newname[MAXPATHLEN];
	gid_t gid;
	uid_t uid;
	int error = 0, s, fd;

	ff = dir->lo_aux;
	error = fs_buildname(dir, name, newname, sizeof(newname));
	if (error)
		return (error);

	error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
	if (error)
		return (error);

	if (isp9)
		perm = fs_p9perm(perm, st->st_mode, false);

	s = socket(AF_UNIX, SOCK_STREAM, 0);
	if (s < 0)
		return (errno);

	path = newname;
	fd = -1;
#ifdef HAVE_BINDAT
	/* Try bindat() if needed. */
	if (strlen(path) >= sizeof(sun.sun_path)) {
		fd = openat(ff->ff_dirfd, ff->ff_name,
		    O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
		if (fd >= 0)
			path = name;
	}
#endif

	/*
	 * Can only create the socket if the path will fit.
	 * Even if we are using bindat() there are limits
	 * (the API for AF_UNIX sockets is ... not good).
	 *
	 * Note: in theory we can fill sun_path to the end
	 * (omitting a terminating '\0') but in at least one
	 * Unix-like system, this was known to behave oddly,
	 * so we test for ">=" rather than just ">".
	 */
	if (strlen(path) >= sizeof(sun.sun_path)) {
		error = ENAMETOOLONG;
		goto out;
	}
	sun.sun_family = AF_UNIX;
	sun.sun_len = sizeof(struct sockaddr_un);
	strncpy(sun.sun_path, path, sizeof(sun.sun_path));

#ifdef HAVE_BINDAT
	if (fd >= 0) {
		if (bindat(fd, s, (struct sockaddr *)&sun, sun.sun_len) < 0)
			error = errno;
		goto out;	/* done now, for good or ill */
	}
#endif

	if (bind(s, (struct sockaddr *)&sun, sun.sun_len) < 0)
		error = errno;
out:

	if (error == 0) {
		/*
		 * We believe we created the socket-inode.  Fix
		 * permissions etc.  Note that we cannot use
		 * fstat() on the socket descriptor: it succeeds,
		 * but we get bogus data!
		 */
		if (fchownat(ff->ff_dirfd, newname, uid, gid, AT_SYMLINK_NOFOLLOW) != 0 ||
		    fchmodat(ff->ff_dirfd, newname, perm, AT_SYMLINK_NOFOLLOW) != 0 ||
		    fstatat(ff->ff_dirfd, newname, st, AT_SYMLINK_NOFOLLOW) != 0)
			error = errno;
		else if (!S_ISSOCK(st->st_mode))
			error = EPERM;		/* ??? lost a race anyway */

		/* if (error) unlink(newname) ? */
	}

	/*
	 * It's not clear which error should override, although
	 * ideally we should never see either close() call fail.
	 * In any case we do want to try to close both fd and s,
	 * always.  Let's set error only if it is not already set,
	 * so that all exit paths can use the same code.
	 */
	if (fd >= 0 && close(fd) != 0)
		if (error == 0)
			error = errno;
	if (close(s) != 0)
		if (error == 0)
			error = errno;

	return (error);
}

/*
 * Internal form of symlink.
 *
 * Note that symlinks are presumed to carry no permission bits.
 * They do have owners, however (who may be charged for quotas).
 */
static int
fs_isymlink(void *softc, struct l9p_fid *dir, char *name,
    char *symtgt, gid_t egid, struct stat *st)
{
	struct fs_fid *ff;
	gid_t gid;
	uid_t uid;
	char newname[MAXPATHLEN];
	int error;

	ff = dir->lo_aux;
	error = fs_buildname(dir, name, newname, sizeof(newname));
	if (error)
		return (error);

	error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
	if (error)
		return (error);

	if (symlinkat(symtgt, ff->ff_dirfd, newname) != 0)
		return (errno);

	/* We cannot open the new name; race to use l* syscalls. */
	if (fchownat(ff->ff_dirfd, newname, uid, gid, AT_SYMLINK_NOFOLLOW) != 0 ||
	    fstatat(ff->ff_dirfd, newname, st, AT_SYMLINK_NOFOLLOW) != 0)
		error = errno;
	else if (!S_ISLNK(st->st_mode))
		error = EPERM;		/* ??? lost a race anyway */

	/* if (error) unlink(newname) ? */

	return (error);
}

static int
fs_open(void *softc, struct l9p_request *req)
{
	struct l9p_fid *fid = req->lr_fid;
	struct stat st;
	enum l9p_omode p9;
	int error, flags;

	p9 = req->lr_req.topen.mode;
	error = fs_oflags_dotu(p9, &flags);
	if (error)
		return (error);

	error = fs_iopen(softc, fid, flags, p9, (gid_t)-1, &st);
	if (error)
		return (error);

	generate_qid(&st, &req->lr_resp.ropen.qid);
	req->lr_resp.ropen.iounit = req->lr_conn->lc_max_io_size;
	return (0);
}

/*
 * Helper for directory read.  We want to run an lstat on each
 * file name within the directory.  This is a lot faster if we
 * have lstatat (or fstatat with AT_SYMLINK_NOFOLLOW), but not
 * all systems do, so hide the ifdef-ed code in an inline function.
 */
static inline int
fs_lstatat(struct fs_fid *file, char *name, struct stat *st)
{

	return (fstatat(dirfd(file->ff_dir), name, st, AT_SYMLINK_NOFOLLOW));
}

static int
fs_read(void *softc, struct l9p_request *req)
{
	struct l9p_stat l9stat;
	struct fs_softc *sc;
	struct fs_fid *file;
	bool dotu = req->lr_conn->lc_version >= L9P_2000U;
	ssize_t ret;

	sc = softc;
	file = req->lr_fid->lo_aux;
	assert(file != NULL);

	if (file->ff_dir != NULL) {
		struct dirent *d;
		struct stat st;
		struct l9p_message msg;
		long o;

		pthread_mutex_lock(&file->ff_mtx);

		/*
		 * Must use telldir before readdir since seekdir
		 * takes cookie values.  Unfortunately this wastes
		 * a lot of time (and memory) building unneeded
		 * cookies that can only be flushed by closing
		 * the directory.
		 *
		 * NB: FreeBSD libc seekdir has SINGLEUSE defined,
		 * so in fact, we can discard the cookies by
		 * calling seekdir on them.  This clears up wasted
		 * memory at the cost of even more wasted time...
		 *
		 * XXX: readdir/telldir/seekdir not thread safe
		 */
		l9p_init_msg(&msg, req, L9P_PACK);
		for (;;) {
			o = telldir(file->ff_dir);
			d = readdir(file->ff_dir);
			if (d == NULL)
				break;
			if (fs_lstatat(file, d->d_name, &st))
				continue;
			dostat(sc, &l9stat, d->d_name, &st, dotu);
			if (l9p_pack_stat(&msg, req, &l9stat) != 0) {
				seekdir(file->ff_dir, o);
				break;
			}
#if defined(__FreeBSD__)
			seekdir(file->ff_dir, o);
			(void) readdir(file->ff_dir);
#endif
		}

		pthread_mutex_unlock(&file->ff_mtx);
	} else {
		size_t niov = l9p_truncate_iov(req->lr_data_iov,
                    req->lr_data_niov, req->lr_req.io.count);

#if defined(__FreeBSD__)
		ret = preadv(file->ff_fd, req->lr_data_iov, niov,
		    req->lr_req.io.offset);
#else
		/* XXX: not thread safe, should really use aio_listio. */
		if (lseek(file->ff_fd, (off_t)req->lr_req.io.offset, SEEK_SET) < 0)
			return (errno);

		ret = (uint32_t)readv(file->ff_fd, req->lr_data_iov, (int)niov);
#endif

		if (ret < 0)
			return (errno);

		req->lr_resp.io.count = (uint32_t)ret;
	}

	return (0);
}

static int
fs_remove(void *softc, struct l9p_fid *fid)
{
	struct fs_softc *sc = softc;
	struct l9p_acl *parent_acl;
	struct fs_fid *file;
	struct stat pst, cst;
	char dirname[MAXPATHLEN];
	int error;

	if (sc->fs_readonly)
		return (EROFS);

	error = fs_pdir(sc, fid, dirname, sizeof(dirname), &pst);
	if (error)
		return (error);

	file = fid->lo_aux;
	if (fstatat(file->ff_dirfd, file->ff_name, &cst, AT_SYMLINK_NOFOLLOW) != 0)
		return (error);

	parent_acl = getacl(file, -1, dirname);
	fillacl(file);

	error = check_access(L9P_ACOP_UNLINK,
	    parent_acl, &pst, file->ff_acl, &cst, file->ff_ai, (gid_t)-1);
	l9p_acl_free(parent_acl);
	if (error)
		return (error);

	if (unlinkat(file->ff_dirfd, file->ff_name,
	    S_ISDIR(cst.st_mode) ? AT_REMOVEDIR : 0) != 0)
		error = errno;

	return (error);
}

static int
fs_stat(void *softc, struct l9p_request *req)
{
	struct fs_softc *sc;
	struct fs_fid *file;
	struct stat st;
	bool dotu = req->lr_conn->lc_version >= L9P_2000U;

	sc = softc;
	file = req->lr_fid->lo_aux;
	assert(file);

	if (fstatat(file->ff_dirfd, file->ff_name, &st,
	    AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);

	dostat(sc, &req->lr_resp.rstat.stat, file->ff_name, &st, dotu);
	return (0);
}

static int
fs_walk(void *softc, struct l9p_request *req)
{
	struct l9p_acl *acl;
	struct fs_authinfo *ai;
	struct fs_fid *file = req->lr_fid->lo_aux;
	struct fs_fid *newfile;
	struct stat st;
	size_t clen, namelen, need;
	char *comp, *succ, *next, *swtmp;
	bool atroot;
	bool dotdot;
	int i, nwname;
	int error = 0;
	char namebufs[2][MAXPATHLEN];

	/*
	 * https://swtch.com/plan9port/man/man9/walk.html:
	 *
	 *    It is legal for nwname to be zero, in which case newfid
	 *    will represent the same file as fid and the walk will
	 *    usually succeed; this is equivalent to walking to dot.
	 * [Aside: it's not clear if we should test S_ISDIR here.]
	 *    ...
	 *    The name ".." ... represents the parent directory.
	 *    The name "." ... is not used in the protocol.
	 *    ... A walk of the name ".." in the root directory
	 *    of the server is equivalent to a walk with no name
	 *    elements.
	 *
	 * Note that req.twalk.nwname never exceeds L9P_MAX_WELEM,
	 * so it is safe to convert to plain int.
	 *
	 * We are to return an error only if the first walk fails,
	 * else stop at the end of the names or on the first error.
	 * The final fid is based on the last name successfully
	 * walked.
	 *
	 * Note that we *do* get Twalk requests with nwname==0 on files.
	 *
	 * Set up "successful name" buffer pointer with base fid name,
	 * initially.  We'll swap each new success into it as we go.
	 *
	 * Invariant: atroot and stat data correspond to current
	 * (succ) path.
	 */
	succ = namebufs[0];
	next = namebufs[1];
	namelen = strlcpy(succ, file->ff_name, MAXPATHLEN);
	if (namelen >= MAXPATHLEN)
		return (ENAMETOOLONG);
	if (fstatat(file->ff_dirfd, succ, &st, AT_SYMLINK_NOFOLLOW) < 0)
		return (errno);
	ai = file->ff_ai;
	atroot = strlen(succ) == 0; /* XXX? */
	fillacl(file);
	acl = file->ff_acl;

	nwname = (int)req->lr_req.twalk.nwname;

	for (i = 0; i < nwname; i++) {
		/*
		 * Must have execute permission to search a directory.
		 * Then, look up each component in its directory-so-far.
		 * Check for ".." along the way, handlng specially
		 * as needed.  Forbid "/" in name components.
		 *
		 */
		if (!S_ISDIR(st.st_mode)) {
			error = ENOTDIR;
			goto out;
		}
		error = check_access(L9P_ACE_EXECUTE,
		     NULL, NULL, acl, &st, ai, (gid_t)-1);
		if (error) {
			L9P_LOG(L9P_DEBUG,
			    "Twalk: denying dir-walk on \"%s\" for uid %u",
			    succ, (unsigned)ai->ai_uid);
			error = EPERM;
			goto out;
		}
		comp = req->lr_req.twalk.wname[i];
		if (strchr(comp, '/') != NULL) {
			error = EINVAL;
			break;
		}

		clen = strlen(comp);
		dotdot = false;

		/*
		 * Build next pathname (into "next").  If "..",
		 * just strip one name component off the success
		 * name so far.  Since we know this name fits, the
		 * stripped down version also fits.  Otherwise,
		 * the name is the base name plus '/' plus the
		 * component name plus terminating '\0'; this may
		 * or may not fit.
		 */
		if (comp[0] == '.') {
			if (clen == 1) {
				error = EINVAL;
				break;
			}
			if (comp[1] == '.' && clen == 2)
				dotdot = true;
		}
		if (dotdot) {
			/*
			 * It's not clear how ".." at root should
			 * be handled when i > 0.  Obeying the man
			 * page exactly, we reset i to 0 and stop,
			 * declaring terminal success.
			 *
			 * Otherwise, we just climbed up one level
			 * so adjust "atroot".
			 */
			if (atroot) {
				i = 0;
				break;
			}
			(void) r_dirname(succ, next, MAXPATHLEN);
			namelen = strlen(next);
			atroot = strlen(next) == 0; /* XXX? */
		} else {
			need = namelen + 1 + clen + 1;
			if (need > MAXPATHLEN) {
				error = ENAMETOOLONG;
				break;
			}
			memcpy(next, succ, namelen);
			next[namelen++] = '/';
			memcpy(&next[namelen], comp, clen + 1);
			namelen += clen;
			/*
			 * Since name is never ".", we are necessarily
			 * descending below the root now.
			 */
			atroot = false;
		}

		if (fstatat(file->ff_dirfd, next, &st, AT_SYMLINK_NOFOLLOW) < 0) {
			error = ENOENT;
			break;
		}

		/*
		 * Success: generate qid and swap this
		 * successful name into place.  Update acl.
		 */
		generate_qid(&st, &req->lr_resp.rwalk.wqid[i]);
		swtmp = succ;
		succ = next;
		next = swtmp;
		if (acl != NULL && acl != file->ff_acl)
			l9p_acl_free(acl);
		acl = getacl(file, -1, next);
	}

	/*
	 * Fail only if we failed on the first name.
	 * Otherwise we succeeded on something, and "succ"
	 * points to the last successful name in namebufs[].
	 */
	if (error) {
		if (i == 0)
			goto out;
		error = 0;
	}

	newfile = open_fid(file->ff_dirfd, succ, ai, false);
	if (newfile == NULL) {
		error = ENOMEM;
		goto out;
	}
	if (req->lr_newfid == req->lr_fid) {
		/*
		 * Before overwriting fid->lo_aux, free the old value.
		 * Note that this doesn't free the l9p_fid data,
		 * just the fs_fid data.  (But it does ditch ff_acl.)
		 */
		if (acl == file->ff_acl)
			acl = NULL;
		fs_freefid(softc, req->lr_fid);
		file = NULL;
	}
	req->lr_newfid->lo_aux = newfile;
	if (file != NULL && acl != file->ff_acl) {
		newfile->ff_acl = acl;
		acl = NULL;
	}
	req->lr_resp.rwalk.nwqid = (uint16_t)i;
out:
	if (file != NULL && acl != file->ff_acl)
		l9p_acl_free(acl);
	return (error);
}

static int
fs_write(void *softc, struct l9p_request *req)
{
	struct fs_softc *sc = softc;
	struct fs_fid *file;
	ssize_t ret;

	file = req->lr_fid->lo_aux;
	assert(file != NULL);

	if (sc->fs_readonly)
		return (EROFS);

	size_t niov = l9p_truncate_iov(req->lr_data_iov,
            req->lr_data_niov, req->lr_req.io.count);

#if defined(__FreeBSD__)
	ret = pwritev(file->ff_fd, req->lr_data_iov, niov,
	    req->lr_req.io.offset);
#else
	/* XXX: not thread safe, should really use aio_listio. */
	if (lseek(file->ff_fd, (off_t)req->lr_req.io.offset, SEEK_SET) < 0)
		return (errno);

	ret = writev(file->ff_fd, req->lr_data_iov,
	    (int)niov);
#endif

	if (ret < 0)
		return (errno);

	req->lr_resp.io.count = (uint32_t)ret;
	return (0);
}

static int
fs_wstat(void *softc, struct l9p_request *req)
{
	struct fs_softc *sc = softc;
	struct l9p_stat *l9stat = &req->lr_req.twstat.stat;
	struct l9p_fid *fid;
	struct fs_fid *file;
	int error = 0;

	fid = req->lr_fid;
	file = fid->lo_aux;
	assert(file != NULL);

	/*
	 * XXX:
	 *
	 * stat(9P) sez:
	 *
	 * Either all the changes in wstat request happen, or none of them
	 * does: if the request succeeds, all changes were made; if it fails,
	 * none were.
	 *
	 * Atomicity is clearly missing in current implementation.
	 */

	if (sc->fs_readonly)
		return (EROFS);

	if (l9stat->atime != (uint32_t)~0) {
		/* XXX: not implemented, ignore */
	}

	if (l9stat->mtime != (uint32_t)~0) {
		/* XXX: not implemented, ignore */
	}

	if (l9stat->dev != (uint32_t)~0) {
		error = EPERM;
		goto out;
	}

	if (l9stat->length != (uint64_t)~0) {
		if (file->ff_dir != NULL) {
			error = EINVAL;
			goto out;
		}

		if (truncate(file->ff_name, (off_t)l9stat->length) != 0) {
			error = errno;
			goto out;
		}
	}

	if (req->lr_conn->lc_version >= L9P_2000U) {
		if (fchownat(file->ff_dirfd, file->ff_name, l9stat->n_uid,
		    l9stat->n_gid, AT_SYMLINK_NOFOLLOW) != 0) {
			error = errno;
			goto out;
		}
	}

	if (l9stat->mode != (uint32_t)~0) {
		if (fchmodat(file->ff_dirfd, file->ff_name,
		    l9stat->mode & 0777, 0) != 0) {
			error = errno;
			goto out;
		}
	}

	if (strlen(l9stat->name) > 0) {
		struct l9p_acl *parent_acl;
		struct stat st;
		char *tmp;
		char newname[MAXPATHLEN];

		/*
		 * Rename-within-directory: it's not deleting anything,
		 * but we need write permission on the directory.  This
		 * should suffice.
		 */
		error = fs_pdir(softc, fid, newname, sizeof(newname), &st);
		if (error)
			goto out;
		parent_acl = getacl(file, -1, newname);
		error = check_access(L9P_ACE_ADD_FILE,
		    parent_acl, &st, NULL, NULL, file->ff_ai, (gid_t)-1);
		l9p_acl_free(parent_acl);
		if (error)
			goto out;
		error = fs_dpf(newname, l9stat->name, sizeof(newname));
		if (error)
			goto out;
		tmp = strdup(newname);
		if (tmp == NULL) {
			error = ENOMEM;
			goto out;
		}
		if (renameat(file->ff_dirfd, file->ff_name, file->ff_dirfd,
		    tmp) != 0) {
			error = errno;
			free(tmp);
			goto out;
		}
		/* Successful rename, update file->ff_name.  ACL can stay. */
		free(file->ff_name);
		file->ff_name = tmp;
	}
out:
	return (error);
}

static int
fs_statfs(void *softc __unused, struct l9p_request *req)
{
	struct fs_fid *file;
	struct stat st;
	struct statfs f;
	long name_max;
	int error;
	int fd;

	file = req->lr_fid->lo_aux;
	assert(file);

	if (fstatat(file->ff_dirfd, file->ff_name, &st,
	    AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);

	/*
	 * Not entirely clear what access to require; we'll go
	 * for "read data".
	 */
	fillacl(file);
	error = check_access(L9P_ACE_READ_DATA, NULL, NULL,
	    file->ff_acl, &st, file->ff_ai, (gid_t)-1);
	if (error)
		return (error);

	fd = openat(file->ff_dirfd, file->ff_name, 0);
	if (fd < 0)
		return (errno);

	if (fstatfs(fd, &f) != 0)
		return (errno);

	name_max = fpathconf(fd, _PC_NAME_MAX);
	error = errno;
	close(fd);

	if (name_max == -1)
		return (error);

	dostatfs(&req->lr_resp.rstatfs.statfs, &f, name_max);

	return (0);
}

static int
fs_lopen(void *softc, struct l9p_request *req)
{
	struct l9p_fid *fid = req->lr_fid;
	struct stat st;
	enum l9p_omode p9;
	gid_t gid;
	int error, flags;

	error = fs_oflags_dotl(req->lr_req.tlopen.flags, &flags, &p9);
	if (error)
		return (error);

	gid = req->lr_req.tlopen.gid;
	error = fs_iopen(softc, fid, flags, p9, gid, &st);
	if (error)
		return (error);

	generate_qid(&st, &req->lr_resp.rlopen.qid);
	req->lr_resp.rlopen.iounit = req->lr_conn->lc_max_io_size;
	return (0);
}

static int
fs_lcreate(void *softc, struct l9p_request *req)
{
	struct l9p_fid *dir;
	struct stat st;
	enum l9p_omode p9;
	char *name;
	mode_t perm;
	gid_t gid;
	int error, flags;

	dir = req->lr_fid;
	name = req->lr_req.tlcreate.name;

	error = fs_oflags_dotl(req->lr_req.tlcreate.flags, &flags, &p9);
	if (error)
		return (error);

	perm = (mode_t)req->lr_req.tlcreate.mode & 0777; /* ? set-id bits? */
	gid = req->lr_req.tlcreate.gid;
	error = fs_icreate(softc, dir, name, flags, false, perm, gid, &st);
	if (error == 0)
		generate_qid(&st, &req->lr_resp.rlcreate.qid);
	req->lr_resp.rlcreate.iounit = req->lr_conn->lc_max_io_size;
	return (error);
}

static int
fs_symlink(void *softc, struct l9p_request *req)
{
	struct l9p_fid *dir;
	struct stat st;
	gid_t gid;
	char *name, *symtgt;
	int error;

	dir = req->lr_fid;
	name = req->lr_req.tsymlink.name;
	symtgt = req->lr_req.tsymlink.symtgt;
	gid = req->lr_req.tsymlink.gid;
	error = fs_isymlink(softc, dir, name, symtgt, gid, &st);
	if (error == 0)
		generate_qid(&st, &req->lr_resp.rsymlink.qid);
	return (error);
}

static int
fs_mknod(void *softc, struct l9p_request *req)
{
	struct l9p_fid *dir;
	struct stat st;
	uint32_t mode, major, minor;
	dev_t dev;
	gid_t gid;
	char *name;
	int error;

	dir = req->lr_fid;
	name = req->lr_req.tmknod.name;
	mode = req->lr_req.tmknod.mode;
	gid = req->lr_req.tmknod.gid;

	switch (mode & S_IFMT) {
	case S_IFBLK:
	case S_IFCHR:
		mode = (mode & S_IFMT) | (mode & 0777);	/* ??? */
		major = req->lr_req.tmknod.major;
		minor = req->lr_req.tmknod.major;
		dev = makedev(major, minor);
		error = fs_imknod(softc, dir, name, false,
		    (mode_t)mode, dev, gid, &st);
		break;

	case S_IFIFO:
		error = fs_imkfifo(softc, dir, name, false,
		    (mode_t)(mode & 0777), gid, &st);
		break;

	case S_IFSOCK:
		error = fs_imksocket(softc, dir, name, false,
		    (mode_t)(mode & 0777), gid, &st);
		break;

	default:
		error = EINVAL;
		break;
	}
	if (error == 0)
		generate_qid(&st, &req->lr_resp.rmknod.qid);
	return (error);
}

static int
fs_rename(void *softc, struct l9p_request *req)
{
	struct fs_softc *sc = softc;
	struct fs_authinfo *ai;
	struct l9p_acl *oparent_acl;
	struct l9p_fid *fid, *f2;
	struct fs_fid *file, *f2ff;
	struct stat cst, opst, npst;
	int32_t op;
	bool reparenting;
	char *tmp;
	char olddir[MAXPATHLEN], newname[MAXPATHLEN];
	int error;

	if (sc->fs_readonly)
		return (EROFS);

	/*
	 * Note: lr_fid represents the file that is to be renamed,
	 * so we must locate its parent directory and verify that
	 * both this parent directory and the new directory f2 are
	 * writable.  But if the new parent directory is the same
	 * path as the old parent directory, our job is simpler.
	 */
	fid = req->lr_fid;
	file = fid->lo_aux;
	assert(file != NULL);
	ai = file->ff_ai;

	error = fs_pdir(sc, fid, olddir, sizeof(olddir), &opst);
	if (error)
		return (error);

	f2 = req->lr_fid2;
	f2ff = f2->lo_aux;
	assert(f2ff != NULL);

	reparenting = strcmp(olddir, f2ff->ff_name) != 0;

	fillacl(file);
	fillacl(f2ff);

	if (fstatat(file->ff_dirfd, file->ff_name, &cst,
	    AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);

	/*
	 * Are we moving from olddir?  If so, we're unlinking
	 * from it, in terms of ACL access.
	 */
	if (reparenting) {
		oparent_acl = getacl(file, -1, olddir);
		error = check_access(L9P_ACOP_UNLINK,
		    oparent_acl, &opst, file->ff_acl, &cst, ai, (gid_t)-1);
		l9p_acl_free(oparent_acl);
		if (error)
			return (error);
	}

	/*
	 * Now check that we're allowed to "create" a file or directory in
	 * f2.  (Should we do this, too, only if reparenting?  Maybe check
	 * for dir write permission if not reparenting -- but that's just
	 * add-file/add-subdir, which means doing this always.)
	 */
	if (fstatat(f2ff->ff_dirfd, f2ff->ff_name, &npst,
	    AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);

	op = S_ISDIR(cst.st_mode) ? L9P_ACE_ADD_SUBDIRECTORY : L9P_ACE_ADD_FILE;
	error = check_access(op, f2ff->ff_acl, &npst, NULL, NULL,
	    ai, (gid_t)-1);
	if (error)
		return (error);

	/*
	 * Directories OK, file systems not R/O, etc; build final name.
	 * f2ff->ff_name cannot exceed MAXPATHLEN, but out of general
	 * paranoia, let's double check anyway.
	 */
	if (strlcpy(newname, f2ff->ff_name, sizeof(newname)) >= sizeof(newname))
		return (ENAMETOOLONG);
	error = fs_dpf(newname, req->lr_req.trename.name, sizeof(newname));
	if (error)
		return (error);
	tmp = strdup(newname);
	if (tmp == NULL)
		return (ENOMEM);

	if (renameat(file->ff_dirfd, file->ff_name, file->ff_dirfd, tmp) != 0) {
		error = errno;
		free(tmp);
		return (error);
	}

	/* file has been renamed but old fid is not clunked */
	free(file->ff_name);
	file->ff_name = tmp;

	dropacl(file);
	return (0);
}

static int
fs_readlink(void *softc __unused, struct l9p_request *req)
{
	struct fs_fid *file;
	ssize_t linklen;
	char buf[MAXPATHLEN];
	int error = 0;

	file = req->lr_fid->lo_aux;
	assert(file);

	linklen = readlinkat(file->ff_dirfd, file->ff_name, buf, sizeof(buf));
	if (linklen < 0)
		error = errno;
	else if ((size_t)linklen >= sizeof(buf))
		error = ENOMEM; /* todo: allocate dynamically */
	else if ((req->lr_resp.rreadlink.target = strndup(buf,
	    (size_t)linklen)) == NULL)
		error = ENOMEM;
	return (error);
}

static int
fs_getattr(void *softc __unused, struct l9p_request *req)
{
	uint64_t mask, valid;
	struct fs_fid *file;
	struct stat st;
	int error = 0;

	file = req->lr_fid->lo_aux;
	assert(file);

	valid = 0;
	if (fstatat(file->ff_dirfd, file->ff_name, &st, AT_SYMLINK_NOFOLLOW)) {
		error = errno;
		goto out;
	}
	/* ?? Can we provide items not-requested? If so, can skip tests. */
	mask = req->lr_req.tgetattr.request_mask;
	if (mask & L9PL_GETATTR_MODE) {
		/* It is not clear if we need any translations. */
		req->lr_resp.rgetattr.mode = st.st_mode;
		valid |= L9PL_GETATTR_MODE;
	}
	if (mask & L9PL_GETATTR_NLINK) {
		req->lr_resp.rgetattr.nlink = st.st_nlink;
		valid |= L9PL_GETATTR_NLINK;
	}
	if (mask & L9PL_GETATTR_UID) {
		/* provide st_uid, or file->ff_uid? */
		req->lr_resp.rgetattr.uid = st.st_uid;
		valid |= L9PL_GETATTR_UID;
	}
	if (mask & L9PL_GETATTR_GID) {
		/* provide st_gid, or file->ff_gid? */
		req->lr_resp.rgetattr.gid = st.st_gid;
		valid |= L9PL_GETATTR_GID;
	}
	if (mask & L9PL_GETATTR_RDEV) {
		/* It is not clear if we need any translations. */
		req->lr_resp.rgetattr.rdev = (uint64_t)st.st_rdev;
		valid |= L9PL_GETATTR_RDEV;
	}
	if (mask & L9PL_GETATTR_ATIME) {
		req->lr_resp.rgetattr.atime_sec =
		    (uint64_t)st.st_atimespec.tv_sec;
		req->lr_resp.rgetattr.atime_nsec =
		    (uint64_t)st.st_atimespec.tv_nsec;
		valid |= L9PL_GETATTR_ATIME;
	}
	if (mask & L9PL_GETATTR_MTIME) {
		req->lr_resp.rgetattr.mtime_sec =
		    (uint64_t)st.st_mtimespec.tv_sec;
		req->lr_resp.rgetattr.mtime_nsec =
		    (uint64_t)st.st_mtimespec.tv_nsec;
		valid |= L9PL_GETATTR_MTIME;
	}
	if (mask & L9PL_GETATTR_CTIME) {
		req->lr_resp.rgetattr.ctime_sec =
		    (uint64_t)st.st_ctimespec.tv_sec;
		req->lr_resp.rgetattr.ctime_nsec =
		    (uint64_t)st.st_ctimespec.tv_nsec;
		valid |= L9PL_GETATTR_CTIME;
	}
	if (mask & L9PL_GETATTR_BTIME) {
#if defined(HAVE_BIRTHTIME)
		req->lr_resp.rgetattr.btime_sec =
		    (uint64_t)st.st_birthtim.tv_sec;
		req->lr_resp.rgetattr.btime_nsec =
		    (uint64_t)st.st_birthtim.tv_nsec;
#else
		req->lr_resp.rgetattr.btime_sec = 0;
		req->lr_resp.rgetattr.btime_nsec = 0;
#endif
		valid |= L9PL_GETATTR_BTIME;
	}
	if (mask & L9PL_GETATTR_INO)
		valid |= L9PL_GETATTR_INO;
	if (mask & L9PL_GETATTR_SIZE) {
		req->lr_resp.rgetattr.size = (uint64_t)st.st_size;
		valid |= L9PL_GETATTR_SIZE;
	}
	if (mask & L9PL_GETATTR_BLOCKS) {
		req->lr_resp.rgetattr.blksize = (uint64_t)st.st_blksize;
		req->lr_resp.rgetattr.blocks = (uint64_t)st.st_blocks;
		valid |= L9PL_GETATTR_BLOCKS;
	}
	if (mask & L9PL_GETATTR_GEN) {
		req->lr_resp.rgetattr.gen = st.st_gen;
		valid |= L9PL_GETATTR_GEN;
	}
	/* don't know what to do with data version yet */

	generate_qid(&st, &req->lr_resp.rgetattr.qid);
out:
	req->lr_resp.rgetattr.valid = valid;
	return (error);
}

/*
 * Should combine some of this with wstat code.
 */
static int
fs_setattr(void *softc, struct l9p_request *req)
{
	uint64_t mask;
	struct fs_softc *sc = softc;
	struct timespec ts[2];
	struct fs_fid *file;
	struct stat st;
	int error = 0;
	uid_t uid, gid;

	file = req->lr_fid->lo_aux;
	assert(file);

	if (sc->fs_readonly)
		return (EROFS);

	/*
	 * As with WSTAT we have atomicity issues.
	 */
	mask = req->lr_req.tsetattr.valid;

	if (fstatat(file->ff_dirfd, file->ff_name, &st, AT_SYMLINK_NOFOLLOW)) {
		error = errno;
		goto out;
	}

	if ((mask & L9PL_SETATTR_SIZE) && S_ISDIR(st.st_mode)) {
		error = EISDIR;
		goto out;
	}

	if (mask & L9PL_SETATTR_MODE) {
		if (fchmodat(file->ff_dirfd, file->ff_name,
		    req->lr_req.tsetattr.mode & 0777,
		    AT_SYMLINK_NOFOLLOW)) {
			error = errno;
			goto out;
		}
	}

	if (mask & (L9PL_SETATTR_UID | L9PL_SETATTR_GID)) {
		uid = mask & L9PL_SETATTR_UID
		    ? req->lr_req.tsetattr.uid
		    : (uid_t)-1;

		gid = mask & L9PL_SETATTR_GID
		    ? req->lr_req.tsetattr.gid
		    : (gid_t)-1;

		if (fchownat(file->ff_dirfd, file->ff_name, uid, gid,
		    AT_SYMLINK_NOFOLLOW)) {
			error = errno;
			goto out;
		}
	}

	if (mask & L9PL_SETATTR_SIZE) {
		/* Truncate follows symlinks, is this OK? */
		int fd = openat(file->ff_dirfd, file->ff_name, O_RDWR);
		if (ftruncate(fd, (off_t)req->lr_req.tsetattr.size)) {
			error = errno;
			(void) close(fd);
			goto out;
		}
		(void) close(fd);
	}

	if (mask & (L9PL_SETATTR_ATIME | L9PL_SETATTR_MTIME)) {
		ts[0].tv_sec = st.st_atimespec.tv_sec;
		ts[0].tv_nsec = st.st_atimespec.tv_nsec;
		ts[1].tv_sec = st.st_mtimespec.tv_sec;
		ts[1].tv_nsec = st.st_mtimespec.tv_nsec;

		if (mask & L9PL_SETATTR_ATIME) {
			if (mask & L9PL_SETATTR_ATIME_SET) {
				ts[0].tv_sec = req->lr_req.tsetattr.atime_sec;
				ts[0].tv_nsec = req->lr_req.tsetattr.atime_nsec;
			} else {
				if (clock_gettime(CLOCK_REALTIME, &ts[0]) != 0) {
					error = errno;
					goto out;
				}
			}
		}

		if (mask & L9PL_SETATTR_MTIME) {
			if (mask & L9PL_SETATTR_MTIME_SET) {
				ts[1].tv_sec = req->lr_req.tsetattr.mtime_sec;
				ts[1].tv_nsec = req->lr_req.tsetattr.mtime_nsec;
			} else {
				if (clock_gettime(CLOCK_REALTIME, &ts[1]) != 0) {
					error = errno;
					goto out;
				}
			}
		}

		if (utimensat(file->ff_dirfd, file->ff_name, ts,
		    AT_SYMLINK_NOFOLLOW)) {
			error = errno;
			goto out;
		}
	}
out:
	return (error);
}

static int
fs_xattrwalk(void *softc __unused, struct l9p_request *req __unused)
{
	return (EOPNOTSUPP);
}

static int
fs_xattrcreate(void *softc __unused, struct l9p_request *req __unused)
{
	return (EOPNOTSUPP);
}

static int
fs_readdir(void *softc __unused, struct l9p_request *req)
{
	struct l9p_message msg;
	struct l9p_dirent de;
	struct fs_fid *file;
	struct dirent *dp;
	struct stat st;
	uint32_t count;
	int error = 0;

	file = req->lr_fid->lo_aux;
	assert(file);

	if (file->ff_dir == NULL)
		return (ENOTDIR);

	pthread_mutex_lock(&file->ff_mtx);

	/*
	 * It's not clear whether we can use the same trick for
	 * discarding offsets here as we do in fs_read.  It
	 * probably should work, we'll have to see if some
	 * client(s) use the zero-offset thing to rescan without
	 * clunking the directory first.
	 *
	 * Probably the thing to do is switch to calling
	 * getdirentries() / getdents() directly, instead of
	 * going through libc.
	 */
	if (req->lr_req.io.offset == 0)
		rewinddir(file->ff_dir);
	else
		seekdir(file->ff_dir, (long)req->lr_req.io.offset);

	l9p_init_msg(&msg, req, L9P_PACK);
	count = (uint32_t)msg.lm_size; /* in case we get no entries */
	while ((dp = readdir(file->ff_dir)) != NULL) {
		/*
		 * Although "." is forbidden in naming and ".." is
		 * special cased, testing shows that we must transmit
		 * them through readdir.  (For ".." at root, we
		 * should perhaps alter the inode number, but not
		 * yet.)
		 */

		/*
		 * TODO: we do a full lstat here; could use dp->d_*
		 * to construct the qid more efficiently, as long
		 * as dp->d_type != DT_UNKNOWN.
		 */
		if (fs_lstatat(file, dp->d_name, &st))
			continue;

		de.qid.type = 0;
		generate_qid(&st, &de.qid);
		de.offset = (uint64_t)telldir(file->ff_dir);
		de.type = dp->d_type;
		de.name = dp->d_name;

		/* Update count only if we completely pack the dirent. */
		if (l9p_pudirent(&msg, &de) < 0)
			break;
		count = (uint32_t)msg.lm_size;
	}

	pthread_mutex_unlock(&file->ff_mtx);
	req->lr_resp.io.count = count;
	return (error);
}

static int
fs_fsync(void *softc __unused, struct l9p_request *req)
{
	struct fs_fid *file;
	int error = 0;

	file = req->lr_fid->lo_aux;
	assert(file);
	if (fsync(file->ff_dir != NULL ? dirfd(file->ff_dir) : file->ff_fd))
		error = errno;
	return (error);
}

static int
fs_lock(void *softc __unused, struct l9p_request *req)
{

	switch (req->lr_req.tlock.type) {
	case L9PL_LOCK_TYPE_RDLOCK:
	case L9PL_LOCK_TYPE_WRLOCK:
	case L9PL_LOCK_TYPE_UNLOCK:
		break;
	default:
		return (EINVAL);
	}

	req->lr_resp.rlock.status = L9PL_LOCK_SUCCESS;
	return (0);
}

static int
fs_getlock(void *softc __unused, struct l9p_request *req)
{

	/*
	 * Client wants to see if a request to lock a region would
	 * block.  This is, of course, not atomic anyway, so the
	 * op is useless.  QEMU simply says "unlocked!", so we do
	 * too.
	 */
	switch (req->lr_req.getlock.type) {
	case L9PL_LOCK_TYPE_RDLOCK:
	case L9PL_LOCK_TYPE_WRLOCK:
	case L9PL_LOCK_TYPE_UNLOCK:
		break;
	default:
		return (EINVAL);
	}

	req->lr_resp.getlock = req->lr_req.getlock;
	req->lr_resp.getlock.type = L9PL_LOCK_TYPE_UNLOCK;
	req->lr_resp.getlock.client_id = strdup("");  /* XXX what should go here? */
	return (0);
}

static int
fs_link(void *softc __unused, struct l9p_request *req)
{
	struct l9p_fid *dir;
	struct fs_fid *file;
	struct fs_fid *dirf;
	struct stat fst, tdst;
	int32_t op;
	char *name;
	char newname[MAXPATHLEN];
	int error;

	/* N.B.: lr_fid is the file to link, lr_fid2 is the target dir */
	dir = req->lr_fid2;
	dirf = dir->lo_aux;
	assert(dirf != NULL);

	name = req->lr_req.tlink.name;
	error = fs_buildname(dir, name, newname, sizeof(newname));
	if (error)
		return (error);

	file = req->lr_fid->lo_aux;
	assert(file != NULL);

	if (fstatat(dirf->ff_dirfd, dirf->ff_name, &tdst, AT_SYMLINK_NOFOLLOW) != 0 ||
	    fstatat(file->ff_dirfd, file->ff_name, &fst, AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);
	if (S_ISDIR(fst.st_mode))
		return (EISDIR);
	fillacl(dirf);
	op = S_ISDIR(fst.st_mode) ? L9P_ACE_ADD_SUBDIRECTORY : L9P_ACE_ADD_FILE;
	error = check_access(op,
	    dirf->ff_acl, &tdst, NULL, NULL, file->ff_ai, (gid_t)-1);
	if (error)
		return (error);

	if (linkat(file->ff_dirfd, file->ff_name, file->ff_dirfd,
	    newname, 0) != 0)
		error = errno;
	else
		dropacl(file);

	return (error);
}

static int
fs_mkdir(void *softc, struct l9p_request *req)
{
	struct l9p_fid *dir;
	struct stat st;
	mode_t perm;
	gid_t gid;
	char *name;
	int error;

	dir = req->lr_fid;
	name = req->lr_req.tmkdir.name;
	perm = (mode_t)req->lr_req.tmkdir.mode;
	gid = req->lr_req.tmkdir.gid;

	error = fs_imkdir(softc, dir, name, false, perm, gid, &st);
	if (error == 0)
		generate_qid(&st, &req->lr_resp.rmkdir.qid);
	return (error);
}

static int
fs_renameat(void *softc, struct l9p_request *req)
{
	struct fs_softc *sc = softc;
	struct l9p_fid *olddir, *newdir;
	struct l9p_acl *facl;
	struct fs_fid *off, *nff;
	struct stat odst, ndst, fst;
	int32_t op;
	bool reparenting;
	char *onp, *nnp;
	char onb[MAXPATHLEN], nnb[MAXPATHLEN];
	int error;

	if (sc->fs_readonly)
		return (EROFS);

	olddir = req->lr_fid;
	newdir = req->lr_fid2;
	assert(olddir != NULL && newdir != NULL);
	off = olddir->lo_aux;
	nff = newdir->lo_aux;
	assert(off != NULL && nff != NULL);

	onp = req->lr_req.trenameat.oldname;
	nnp = req->lr_req.trenameat.newname;
	error = fs_buildname(olddir, onp, onb, sizeof(onb));
	if (error)
		return (error);
	error = fs_buildname(newdir, nnp, nnb, sizeof(nnb));
	if (error)
		return (error);
	if (fstatat(off->ff_dirfd, onb, &fst, AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);

	reparenting = olddir != newdir &&
	    strcmp(off->ff_name, nff->ff_name) != 0;

	if (fstatat(off->ff_dirfd, off->ff_name, &odst, AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);
	if (!S_ISDIR(odst.st_mode))
		return (ENOTDIR);
	fillacl(off);

	if (reparenting) {
		if (fstatat(nff->ff_dirfd, nff->ff_name, &ndst, AT_SYMLINK_NOFOLLOW) != 0)
			return (errno);
		if (!S_ISDIR(ndst.st_mode))
			return (ENOTDIR);
		facl = getacl(off, -1, onb);
		fillacl(nff);

		error = check_access(L9P_ACOP_UNLINK,
		    off->ff_acl, &odst, facl, &fst, off->ff_ai, (gid_t)-1);
		l9p_acl_free(facl);
		if (error)
			return (error);
		op = S_ISDIR(fst.st_mode) ? L9P_ACE_ADD_SUBDIRECTORY :
		    L9P_ACE_ADD_FILE;
		error = check_access(op,
		    nff->ff_acl, &ndst, NULL, NULL, nff->ff_ai, (gid_t)-1);
		if (error)
			return (error);
	}

	if (renameat(off->ff_dirfd, onb, nff->ff_dirfd, nnb))
		error = errno;

	return (error);
}

/*
 * Unlink file in given directory, or remove directory in given
 * directory, based on flags.
 */
static int
fs_unlinkat(void *softc, struct l9p_request *req)
{
	struct fs_softc *sc = softc;
	struct l9p_acl *facl;
	struct l9p_fid *dir;
	struct fs_fid *dirff;
	struct stat dirst, fst;
	char *name;
	char newname[MAXPATHLEN];
	int error;

	if (sc->fs_readonly)
		return (EROFS);

	dir = req->lr_fid;
	dirff = dir->lo_aux;
	assert(dirff != NULL);
	name = req->lr_req.tunlinkat.name;
	error = fs_buildname(dir, name, newname, sizeof(newname));
	if (error)
		return (error);
	if (fstatat(dirff->ff_dirfd, newname, &fst, AT_SYMLINK_NOFOLLOW) != 0 ||
	    fstatat(dirff->ff_dirfd, dirff->ff_name, &dirst, AT_SYMLINK_NOFOLLOW) != 0)
		return (errno);
	fillacl(dirff);
	facl = getacl(dirff, -1, newname);
	error = check_access(L9P_ACOP_UNLINK,
	    dirff->ff_acl, &dirst, facl, &fst, dirff->ff_ai, (gid_t)-1);
	l9p_acl_free(facl);
	if (error)
		return (error);

	if (req->lr_req.tunlinkat.flags & L9PL_AT_REMOVEDIR) {
		if (unlinkat(dirff->ff_dirfd, newname, AT_REMOVEDIR) != 0)
			error = errno;
	} else {
		if (unlinkat(dirff->ff_dirfd, newname, 0) != 0)
			error = errno;
	}
	return (error);
}

static void
fs_freefid(void *softc __unused, struct l9p_fid *fid)
{
	struct fs_fid *f = fid->lo_aux;
	struct fs_authinfo *ai;
	uint32_t newcount;

	if (f == NULL) {
		/* Nothing to do here */
		return;
	}

	if (f->ff_fd != -1)
		close(f->ff_fd);

	if (f->ff_dir)
		closedir(f->ff_dir);

	pthread_mutex_destroy(&f->ff_mtx);
	free(f->ff_name);
	ai = f->ff_ai;
	l9p_acl_free(f->ff_acl);
	free(f);
	pthread_mutex_lock(&ai->ai_mtx);
	newcount = --ai->ai_refcnt;
	pthread_mutex_unlock(&ai->ai_mtx);
	if (newcount == 0) {
		/*
		 * We *were* the last ref, no one can have gained a ref.
		 */
		L9P_LOG(L9P_DEBUG, "dropped last ref to authinfo %p",
		    (void *)ai);
		pthread_mutex_destroy(&ai->ai_mtx);
		free(ai);
	} else {
		L9P_LOG(L9P_DEBUG, "authinfo %p now used by %lu",
		    (void *)ai, (u_long)newcount);
	}
}

int
l9p_backend_fs_init(struct l9p_backend **backendp, int rootfd, bool ro)
{
	struct l9p_backend *backend;
	struct fs_softc *sc;
	int error;
#if defined(WITH_CASPER)
	cap_channel_t *capcas;
#endif

	if (!fs_attach_mutex_inited) {
		error = pthread_mutex_init(&fs_attach_mutex, NULL);
		if (error) {
			errno = error;
			return (-1);
		}
		fs_attach_mutex_inited = true;
	}

	backend = l9p_malloc(sizeof(*backend));
	backend->attach = fs_attach;
	backend->clunk = fs_clunk;
	backend->create = fs_create;
	backend->open = fs_open;
	backend->read = fs_read;
	backend->remove = fs_remove;
	backend->stat = fs_stat;
	backend->walk = fs_walk;
	backend->write = fs_write;
	backend->wstat = fs_wstat;
	backend->statfs = fs_statfs;
	backend->lopen = fs_lopen;
	backend->lcreate = fs_lcreate;
	backend->symlink = fs_symlink;
	backend->mknod = fs_mknod;
	backend->rename = fs_rename;
	backend->readlink = fs_readlink;
	backend->getattr = fs_getattr;
	backend->setattr = fs_setattr;
	backend->xattrwalk = fs_xattrwalk;
	backend->xattrcreate = fs_xattrcreate;
	backend->readdir = fs_readdir;
	backend->fsync = fs_fsync;
	backend->lock = fs_lock;
	backend->getlock = fs_getlock;
	backend->link = fs_link;
	backend->mkdir = fs_mkdir;
	backend->renameat = fs_renameat;
	backend->unlinkat = fs_unlinkat;
	backend->freefid = fs_freefid;

	sc = l9p_malloc(sizeof(*sc));
	sc->fs_rootfd = rootfd;
	sc->fs_readonly = ro;
	backend->softc = sc;

#if defined(WITH_CASPER)
	capcas = cap_init();
	if (capcas == NULL)
		return (-1);

	sc->fs_cappwd = cap_service_open(capcas, "system.pwd");
	if (sc->fs_cappwd == NULL)
		return (-1);

	sc->fs_capgrp = cap_service_open(capcas, "system.grp");
	if (sc->fs_capgrp == NULL)
		return (-1);

	cap_setpassent(sc->fs_cappwd, 1);
	cap_setgroupent(sc->fs_capgrp, 1);
	cap_close(capcas);
#else
	setpassent(1);
#endif

	*backendp = backend;
	return (0);
}