xref: /freebsd/sys/fs/nfsserver/nfs_nfsdserv.c (revision 62cfcf62f627e5093fb37026a6d8c98e4d2ef04c)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include "opt_inet.h"
40 #include "opt_inet6.h"
41 /*
42  * nfs version 2, 3 and 4 server calls to vnode ops
43  * - these routines generally have 3 phases
44  *   1 - break down and validate rpc request in mbuf list
45  *   2 - do the vnode ops for the request, usually by calling a nfsvno_XXX()
46  *       function in nfsd_port.c
47  *   3 - build the rpc reply in an mbuf list
48  * For nfsv4, these functions are called for each Op within the Compound RPC.
49  */
50 
51 #include <fs/nfs/nfsport.h>
52 #include <sys/extattr.h>
53 #include <sys/filio.h>
54 
55 /* Global vars */
56 extern u_int32_t newnfs_false, newnfs_true;
57 extern enum vtype nv34tov_type[8];
58 extern struct timeval nfsboottime;
59 extern int nfs_rootfhset;
60 extern int nfsrv_enable_crossmntpt;
61 extern int nfsrv_statehashsize;
62 extern int nfsrv_layouthashsize;
63 extern time_t nfsdev_time;
64 extern volatile int nfsrv_devidcnt;
65 extern int nfsd_debuglevel;
66 extern u_long sb_max_adj;
67 extern int nfsrv_pnfsatime;
68 extern int nfsrv_maxpnfsmirror;
69 extern int nfs_maxcopyrange;
70 
71 static int	nfs_async = 0;
72 SYSCTL_DECL(_vfs_nfsd);
73 SYSCTL_INT(_vfs_nfsd, OID_AUTO, async, CTLFLAG_RW, &nfs_async, 0,
74     "Tell client that writes were synced even though they were not");
75 extern int	nfsrv_doflexfile;
76 SYSCTL_INT(_vfs_nfsd, OID_AUTO, default_flexfile, CTLFLAG_RW,
77     &nfsrv_doflexfile, 0, "Make Flex File Layout the default for pNFS");
78 static int	nfsrv_linux42server = 1;
79 SYSCTL_INT(_vfs_nfsd, OID_AUTO, linux42server, CTLFLAG_RW,
80     &nfsrv_linux42server, 0,
81     "Enable Linux style NFSv4.2 server (non-RFC compliant)");
82 static bool	nfsrv_openaccess = true;
83 SYSCTL_BOOL(_vfs_nfsd, OID_AUTO, v4openaccess, CTLFLAG_RW,
84     &nfsrv_openaccess, 0,
85     "Enable Linux style NFSv4 Open access check");
86 
87 /*
88  * This list defines the GSS mechanisms supported.
89  * (Don't ask me how you get these strings from the RFC stuff like
90  *  iso(1), org(3)... but someone did it, so I don't need to know.)
91  */
92 static struct nfsgss_mechlist nfsgss_mechlist[] = {
93 	{ 9, "\052\206\110\206\367\022\001\002\002", 11 },
94 	{ 0, "", 0 },
95 };
96 
97 /* local functions */
98 static void nfsrvd_symlinksub(struct nfsrv_descript *nd, struct nameidata *ndp,
99     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
100     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
101     int *diraft_retp, nfsattrbit_t *attrbitp,
102     NFSACL_T *aclp, NFSPROC_T *p, struct nfsexstuff *exp, char *pathcp,
103     int pathlen);
104 static void nfsrvd_mkdirsub(struct nfsrv_descript *nd, struct nameidata *ndp,
105     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
106     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
107     int *diraft_retp, nfsattrbit_t *attrbitp, NFSACL_T *aclp,
108     NFSPROC_T *p, struct nfsexstuff *exp);
109 
110 /*
111  * nfs access service (not a part of NFS V2)
112  */
113 int
114 nfsrvd_access(struct nfsrv_descript *nd, __unused int isdgram,
115     vnode_t vp, struct nfsexstuff *exp)
116 {
117 	u_int32_t *tl;
118 	int getret, error = 0;
119 	struct nfsvattr nva;
120 	u_int32_t testmode, nfsmode, supported = 0;
121 	accmode_t deletebit;
122 	struct thread *p = curthread;
123 
124 	if (nd->nd_repstat) {
125 		nfsrv_postopattr(nd, 1, &nva);
126 		goto out;
127 	}
128 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
129 	nfsmode = fxdr_unsigned(u_int32_t, *tl);
130 	if ((nd->nd_flag & ND_NFSV4) &&
131 	    (nfsmode & ~(NFSACCESS_READ | NFSACCESS_LOOKUP |
132 	     NFSACCESS_MODIFY | NFSACCESS_EXTEND | NFSACCESS_DELETE |
133 	     NFSACCESS_EXECUTE | NFSACCESS_XAREAD | NFSACCESS_XAWRITE |
134 	     NFSACCESS_XALIST))) {
135 		nd->nd_repstat = NFSERR_INVAL;
136 		vput(vp);
137 		goto out;
138 	}
139 	if (nfsmode & NFSACCESS_READ) {
140 		supported |= NFSACCESS_READ;
141 		if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
142 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
143 			nfsmode &= ~NFSACCESS_READ;
144 	}
145 	if (nfsmode & NFSACCESS_MODIFY) {
146 		supported |= NFSACCESS_MODIFY;
147 		if (nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp, p,
148 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
149 			nfsmode &= ~NFSACCESS_MODIFY;
150 	}
151 	if (nfsmode & NFSACCESS_EXTEND) {
152 		supported |= NFSACCESS_EXTEND;
153 		if (nfsvno_accchk(vp, VWRITE | VAPPEND, nd->nd_cred, exp, p,
154 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
155 			nfsmode &= ~NFSACCESS_EXTEND;
156 	}
157 	if (nfsmode & NFSACCESS_XAREAD) {
158 		supported |= NFSACCESS_XAREAD;
159 		if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
160 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
161 			nfsmode &= ~NFSACCESS_XAREAD;
162 	}
163 	if (nfsmode & NFSACCESS_XAWRITE) {
164 		supported |= NFSACCESS_XAWRITE;
165 		if (nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp, p,
166 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
167 			nfsmode &= ~NFSACCESS_XAWRITE;
168 	}
169 	if (nfsmode & NFSACCESS_XALIST) {
170 		supported |= NFSACCESS_XALIST;
171 		if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
172 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
173 			nfsmode &= ~NFSACCESS_XALIST;
174 	}
175 	if (nfsmode & NFSACCESS_DELETE) {
176 		supported |= NFSACCESS_DELETE;
177 		if (vp->v_type == VDIR)
178 			deletebit = VDELETE_CHILD;
179 		else
180 			deletebit = VDELETE;
181 		if (nfsvno_accchk(vp, deletebit, nd->nd_cred, exp, p,
182 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
183 			nfsmode &= ~NFSACCESS_DELETE;
184 	}
185 	if (vnode_vtype(vp) == VDIR)
186 		testmode = NFSACCESS_LOOKUP;
187 	else
188 		testmode = NFSACCESS_EXECUTE;
189 	if (nfsmode & testmode) {
190 		supported |= (nfsmode & testmode);
191 		if (nfsvno_accchk(vp, VEXEC, nd->nd_cred, exp, p,
192 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
193 			nfsmode &= ~testmode;
194 	}
195 	nfsmode &= supported;
196 	if (nd->nd_flag & ND_NFSV3) {
197 		getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
198 		nfsrv_postopattr(nd, getret, &nva);
199 	}
200 	vput(vp);
201 	if (nd->nd_flag & ND_NFSV4) {
202 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
203 		*tl++ = txdr_unsigned(supported);
204 	} else
205 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
206 	*tl = txdr_unsigned(nfsmode);
207 
208 out:
209 	NFSEXITCODE2(0, nd);
210 	return (0);
211 nfsmout:
212 	vput(vp);
213 	NFSEXITCODE2(error, nd);
214 	return (error);
215 }
216 
217 /*
218  * nfs getattr service
219  */
220 int
221 nfsrvd_getattr(struct nfsrv_descript *nd, int isdgram,
222     vnode_t vp, __unused struct nfsexstuff *exp)
223 {
224 	struct nfsvattr nva;
225 	fhandle_t fh;
226 	int at_root = 0, error = 0, supports_nfsv4acls;
227 	struct nfsreferral *refp;
228 	nfsattrbit_t attrbits, tmpbits;
229 	struct mount *mp;
230 	struct vnode *tvp = NULL;
231 	struct vattr va;
232 	uint64_t mounted_on_fileno = 0;
233 	accmode_t accmode;
234 	struct thread *p = curthread;
235 
236 	if (nd->nd_repstat)
237 		goto out;
238 	if (nd->nd_flag & ND_NFSV4) {
239 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
240 		if (error) {
241 			vput(vp);
242 			goto out;
243 		}
244 
245 		/*
246 		 * Check for a referral.
247 		 */
248 		refp = nfsv4root_getreferral(vp, NULL, 0);
249 		if (refp != NULL) {
250 			(void) nfsrv_putreferralattr(nd, &attrbits, refp, 1,
251 			    &nd->nd_repstat);
252 			vput(vp);
253 			goto out;
254 		}
255 		if (nd->nd_repstat == 0) {
256 			accmode = 0;
257 			NFSSET_ATTRBIT(&tmpbits, &attrbits);
258 
259 			/*
260 			 * GETATTR with write-only attr time_access_set and time_modify_set
261 			 * should return NFS4ERR_INVAL.
262 			 */
263 			if (NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_TIMEACCESSSET) ||
264 					NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_TIMEMODIFYSET)){
265 				error = NFSERR_INVAL;
266 				vput(vp);
267 				goto out;
268 			}
269 			if (NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_ACL)) {
270 				NFSCLRBIT_ATTRBIT(&tmpbits, NFSATTRBIT_ACL);
271 				accmode |= VREAD_ACL;
272 			}
273 			if (NFSNONZERO_ATTRBIT(&tmpbits))
274 				accmode |= VREAD_ATTRIBUTES;
275 			if (accmode != 0)
276 				nd->nd_repstat = nfsvno_accchk(vp, accmode,
277 				    nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
278 				    NFSACCCHK_VPISLOCKED, NULL);
279 		}
280 	}
281 	if (!nd->nd_repstat)
282 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
283 	if (!nd->nd_repstat) {
284 		if (nd->nd_flag & ND_NFSV4) {
285 			if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_FILEHANDLE))
286 				nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
287 			if (!nd->nd_repstat)
288 				nd->nd_repstat = nfsrv_checkgetattr(nd, vp,
289 				    &nva, &attrbits, p);
290 			if (nd->nd_repstat == 0) {
291 				supports_nfsv4acls = nfs_supportsnfsv4acls(vp);
292 				mp = vp->v_mount;
293 				if (nfsrv_enable_crossmntpt != 0 &&
294 				    vp->v_type == VDIR &&
295 				    (vp->v_vflag & VV_ROOT) != 0 &&
296 				    vp != rootvnode) {
297 					tvp = mp->mnt_vnodecovered;
298 					VREF(tvp);
299 					at_root = 1;
300 				} else
301 					at_root = 0;
302 				vfs_ref(mp);
303 				NFSVOPUNLOCK(vp);
304 				if (at_root != 0) {
305 					if ((nd->nd_repstat =
306 					     NFSVOPLOCK(tvp, LK_SHARED)) == 0) {
307 						nd->nd_repstat = VOP_GETATTR(
308 						    tvp, &va, nd->nd_cred);
309 						vput(tvp);
310 					} else
311 						vrele(tvp);
312 					if (nd->nd_repstat == 0)
313 						mounted_on_fileno = (uint64_t)
314 						    va.va_fileid;
315 					else
316 						at_root = 0;
317 				}
318 				if (nd->nd_repstat == 0)
319 					nd->nd_repstat = vfs_busy(mp, 0);
320 				vfs_rel(mp);
321 				if (nd->nd_repstat == 0) {
322 					(void)nfsvno_fillattr(nd, mp, vp, &nva,
323 					    &fh, 0, &attrbits, nd->nd_cred, p,
324 					    isdgram, 1, supports_nfsv4acls,
325 					    at_root, mounted_on_fileno);
326 					vfs_unbusy(mp);
327 				}
328 				vrele(vp);
329 			} else
330 				vput(vp);
331 		} else {
332 			nfsrv_fillattr(nd, &nva);
333 			vput(vp);
334 		}
335 	} else {
336 		vput(vp);
337 	}
338 
339 out:
340 	NFSEXITCODE2(error, nd);
341 	return (error);
342 }
343 
344 /*
345  * nfs setattr service
346  */
347 int
348 nfsrvd_setattr(struct nfsrv_descript *nd, __unused int isdgram,
349     vnode_t vp, struct nfsexstuff *exp)
350 {
351 	struct nfsvattr nva, nva2;
352 	u_int32_t *tl;
353 	int preat_ret = 1, postat_ret = 1, gcheck = 0, error = 0;
354 	int gotproxystateid;
355 	struct timespec guard = { 0, 0 };
356 	nfsattrbit_t attrbits, retbits;
357 	nfsv4stateid_t stateid;
358 	NFSACL_T *aclp = NULL;
359 	struct thread *p = curthread;
360 
361 	if (nd->nd_repstat) {
362 		nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
363 		goto out;
364 	}
365 #ifdef NFS4_ACL_EXTATTR_NAME
366 	aclp = acl_alloc(M_WAITOK);
367 	aclp->acl_cnt = 0;
368 #endif
369 	gotproxystateid = 0;
370 	NFSVNO_ATTRINIT(&nva);
371 	if (nd->nd_flag & ND_NFSV4) {
372 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
373 		stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
374 		stateid.other[0] = *tl++;
375 		stateid.other[1] = *tl++;
376 		stateid.other[2] = *tl;
377 		if (stateid.other[0] == 0x55555555 &&
378 		    stateid.other[1] == 0x55555555 &&
379 		    stateid.other[2] == 0x55555555 &&
380 		    stateid.seqid == 0xffffffff)
381 			gotproxystateid = 1;
382 	}
383 	error = nfsrv_sattr(nd, vp, &nva, &attrbits, aclp, p);
384 	if (error)
385 		goto nfsmout;
386 
387 	/* For NFSv4, only va_uid is used from nva2. */
388 	NFSZERO_ATTRBIT(&retbits);
389 	NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNER);
390 	preat_ret = nfsvno_getattr(vp, &nva2, nd, p, 1, &retbits);
391 	if (!nd->nd_repstat)
392 		nd->nd_repstat = preat_ret;
393 
394 	NFSZERO_ATTRBIT(&retbits);
395 	if (nd->nd_flag & ND_NFSV3) {
396 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
397 		gcheck = fxdr_unsigned(int, *tl);
398 		if (gcheck) {
399 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
400 			fxdr_nfsv3time(tl, &guard);
401 		}
402 		if (!nd->nd_repstat && gcheck &&
403 		    (nva2.na_ctime.tv_sec != guard.tv_sec ||
404 		     nva2.na_ctime.tv_nsec != guard.tv_nsec))
405 			nd->nd_repstat = NFSERR_NOT_SYNC;
406 		if (nd->nd_repstat) {
407 			vput(vp);
408 #ifdef NFS4_ACL_EXTATTR_NAME
409 			acl_free(aclp);
410 #endif
411 			nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
412 			goto out;
413 		}
414 	} else if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4))
415 		nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
416 
417 	/*
418 	 * Now that we have all the fields, lets do it.
419 	 * If the size is being changed write access is required, otherwise
420 	 * just check for a read only file system.
421 	 */
422 	if (!nd->nd_repstat) {
423 		if (NFSVNO_NOTSETSIZE(&nva)) {
424 			if (NFSVNO_EXRDONLY(exp) ||
425 			    (vfs_flags(vp->v_mount) & MNT_RDONLY))
426 				nd->nd_repstat = EROFS;
427 		} else {
428 			if (vnode_vtype(vp) != VREG)
429 				nd->nd_repstat = EINVAL;
430 			else if (nva2.na_uid != nd->nd_cred->cr_uid ||
431 			    NFSVNO_EXSTRICTACCESS(exp))
432 				nd->nd_repstat = nfsvno_accchk(vp,
433 				    VWRITE, nd->nd_cred, exp, p,
434 				    NFSACCCHK_NOOVERRIDE,
435 				    NFSACCCHK_VPISLOCKED, NULL);
436 		}
437 	}
438 	/*
439 	 * Proxy operations from the MDS are allowed via the all 0s special
440 	 * stateid.
441 	 */
442 	if (nd->nd_repstat == 0 && (nd->nd_flag & ND_NFSV4) != 0 &&
443 	    gotproxystateid == 0)
444 		nd->nd_repstat = nfsrv_checksetattr(vp, nd, &stateid,
445 		    &nva, &attrbits, exp, p);
446 
447 	if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4)) {
448 	    /*
449 	     * For V4, try setting the attrbutes in sets, so that the
450 	     * reply bitmap will be correct for an error case.
451 	     */
452 	    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNER) ||
453 		NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNERGROUP)) {
454 		NFSVNO_ATTRINIT(&nva2);
455 		NFSVNO_SETATTRVAL(&nva2, uid, nva.na_uid);
456 		NFSVNO_SETATTRVAL(&nva2, gid, nva.na_gid);
457 		nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
458 		    exp);
459 		if (!nd->nd_repstat) {
460 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNER))
461 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNER);
462 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNERGROUP))
463 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNERGROUP);
464 		}
465 	    }
466 	    if (!nd->nd_repstat &&
467 		NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_SIZE)) {
468 		NFSVNO_ATTRINIT(&nva2);
469 		NFSVNO_SETATTRVAL(&nva2, size, nva.na_size);
470 		nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
471 		    exp);
472 		if (!nd->nd_repstat)
473 		    NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_SIZE);
474 	    }
475 	    if (!nd->nd_repstat &&
476 		(NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET) ||
477 		 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFYSET))) {
478 		NFSVNO_ATTRINIT(&nva2);
479 		NFSVNO_SETATTRVAL(&nva2, atime, nva.na_atime);
480 		NFSVNO_SETATTRVAL(&nva2, mtime, nva.na_mtime);
481 		if (nva.na_vaflags & VA_UTIMES_NULL) {
482 			nva2.na_vaflags |= VA_UTIMES_NULL;
483 			NFSVNO_SETACTIVE(&nva2, vaflags);
484 		}
485 		nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
486 		    exp);
487 		if (!nd->nd_repstat) {
488 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET))
489 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMEACCESSSET);
490 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFYSET))
491 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMEMODIFYSET);
492 		}
493 	    }
494 	    if (!nd->nd_repstat &&
495 		(NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODE) ||
496 		 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODESETMASKED))) {
497 		NFSVNO_ATTRINIT(&nva2);
498 		NFSVNO_SETATTRVAL(&nva2, mode, nva.na_mode);
499 		nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
500 		    exp);
501 		if (!nd->nd_repstat) {
502 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODE))
503 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_MODE);
504 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODESETMASKED))
505 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_MODESETMASKED);
506 		}
507 	    }
508 
509 #ifdef NFS4_ACL_EXTATTR_NAME
510 	    if (!nd->nd_repstat && aclp->acl_cnt > 0 &&
511 		NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_ACL)) {
512 		nd->nd_repstat = nfsrv_setacl(vp, aclp, nd->nd_cred, p);
513 		if (!nd->nd_repstat)
514 		    NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_ACL);
515 	    }
516 #endif
517 	} else if (!nd->nd_repstat) {
518 		nd->nd_repstat = nfsvno_setattr(vp, &nva, nd->nd_cred, p,
519 		    exp);
520 	}
521 	if (nd->nd_flag & (ND_NFSV2 | ND_NFSV3)) {
522 		postat_ret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
523 		if (!nd->nd_repstat)
524 			nd->nd_repstat = postat_ret;
525 	}
526 	vput(vp);
527 #ifdef NFS4_ACL_EXTATTR_NAME
528 	acl_free(aclp);
529 #endif
530 	if (nd->nd_flag & ND_NFSV3)
531 		nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
532 	else if (nd->nd_flag & ND_NFSV4)
533 		(void) nfsrv_putattrbit(nd, &retbits);
534 	else if (!nd->nd_repstat)
535 		nfsrv_fillattr(nd, &nva);
536 
537 out:
538 	NFSEXITCODE2(0, nd);
539 	return (0);
540 nfsmout:
541 	vput(vp);
542 #ifdef NFS4_ACL_EXTATTR_NAME
543 	acl_free(aclp);
544 #endif
545 	if (nd->nd_flag & ND_NFSV4) {
546 		/*
547 		 * For all nd_repstat, the V4 reply includes a bitmap,
548 		 * even NFSERR_BADXDR, which is what this will end up
549 		 * returning.
550 		 */
551 		(void) nfsrv_putattrbit(nd, &retbits);
552 	}
553 	NFSEXITCODE2(error, nd);
554 	return (error);
555 }
556 
557 /*
558  * nfs lookup rpc
559  * (Also performs lookup parent for v4)
560  */
561 int
562 nfsrvd_lookup(struct nfsrv_descript *nd, __unused int isdgram,
563     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
564 {
565 	struct nameidata named;
566 	vnode_t vp, dirp = NULL;
567 	int error = 0, dattr_ret = 1;
568 	struct nfsvattr nva, dattr;
569 	char *bufp;
570 	u_long *hashp;
571 	struct thread *p = curthread;
572 
573 	if (nd->nd_repstat) {
574 		nfsrv_postopattr(nd, dattr_ret, &dattr);
575 		goto out;
576 	}
577 
578 	/*
579 	 * For some reason, if dp is a symlink, the error
580 	 * returned is supposed to be NFSERR_SYMLINK and not NFSERR_NOTDIR.
581 	 */
582 	if (dp->v_type == VLNK && (nd->nd_flag & ND_NFSV4)) {
583 		nd->nd_repstat = NFSERR_SYMLINK;
584 		vrele(dp);
585 		goto out;
586 	}
587 
588 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
589 	    LOCKLEAF | SAVESTART);
590 	nfsvno_setpathbuf(&named, &bufp, &hashp);
591 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
592 	if (error) {
593 		vrele(dp);
594 		nfsvno_relpathbuf(&named);
595 		goto out;
596 	}
597 	if (!nd->nd_repstat) {
598 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, p, &dirp);
599 	} else {
600 		vrele(dp);
601 		nfsvno_relpathbuf(&named);
602 	}
603 	if (nd->nd_repstat) {
604 		if (dirp) {
605 			if (nd->nd_flag & ND_NFSV3)
606 				dattr_ret = nfsvno_getattr(dirp, &dattr, nd, p,
607 				    0, NULL);
608 			vrele(dirp);
609 		}
610 		if (nd->nd_flag & ND_NFSV3)
611 			nfsrv_postopattr(nd, dattr_ret, &dattr);
612 		goto out;
613 	}
614 	if (named.ni_startdir)
615 		vrele(named.ni_startdir);
616 	nfsvno_relpathbuf(&named);
617 	vp = named.ni_vp;
618 	if ((nd->nd_flag & ND_NFSV4) != 0 && !NFSVNO_EXPORTED(exp) &&
619 	    vp->v_type != VDIR && vp->v_type != VLNK)
620 		/*
621 		 * Only allow lookup of VDIR and VLNK for traversal of
622 		 * non-exported volumes during NFSv4 mounting.
623 		 */
624 		nd->nd_repstat = ENOENT;
625 	if (nd->nd_repstat == 0)
626 		nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
627 	if (!(nd->nd_flag & ND_NFSV4) && !nd->nd_repstat)
628 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
629 	if (vpp != NULL && nd->nd_repstat == 0)
630 		*vpp = vp;
631 	else
632 		vput(vp);
633 	if (dirp) {
634 		if (nd->nd_flag & ND_NFSV3)
635 			dattr_ret = nfsvno_getattr(dirp, &dattr, nd, p, 0,
636 			    NULL);
637 		vrele(dirp);
638 	}
639 	if (nd->nd_repstat) {
640 		if (nd->nd_flag & ND_NFSV3)
641 			nfsrv_postopattr(nd, dattr_ret, &dattr);
642 		goto out;
643 	}
644 	if (nd->nd_flag & ND_NFSV2) {
645 		(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
646 		nfsrv_fillattr(nd, &nva);
647 	} else if (nd->nd_flag & ND_NFSV3) {
648 		(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
649 		nfsrv_postopattr(nd, 0, &nva);
650 		nfsrv_postopattr(nd, dattr_ret, &dattr);
651 	}
652 
653 out:
654 	NFSEXITCODE2(error, nd);
655 	return (error);
656 }
657 
658 /*
659  * nfs readlink service
660  */
661 int
662 nfsrvd_readlink(struct nfsrv_descript *nd, __unused int isdgram,
663     vnode_t vp, __unused struct nfsexstuff *exp)
664 {
665 	u_int32_t *tl;
666 	struct mbuf *mp = NULL, *mpend = NULL;
667 	int getret = 1, len;
668 	struct nfsvattr nva;
669 	struct thread *p = curthread;
670 
671 	if (nd->nd_repstat) {
672 		nfsrv_postopattr(nd, getret, &nva);
673 		goto out;
674 	}
675 	if (vnode_vtype(vp) != VLNK) {
676 		if (nd->nd_flag & ND_NFSV2)
677 			nd->nd_repstat = ENXIO;
678 		else
679 			nd->nd_repstat = EINVAL;
680 	}
681 	if (!nd->nd_repstat)
682 		nd->nd_repstat = nfsvno_readlink(vp, nd->nd_cred, p,
683 		    &mp, &mpend, &len);
684 	if (nd->nd_flag & ND_NFSV3)
685 		getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
686 	vput(vp);
687 	if (nd->nd_flag & ND_NFSV3)
688 		nfsrv_postopattr(nd, getret, &nva);
689 	if (nd->nd_repstat)
690 		goto out;
691 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
692 	*tl = txdr_unsigned(len);
693 	nd->nd_mb->m_next = mp;
694 	nd->nd_mb = mpend;
695 	nd->nd_bpos = mtod(mpend, caddr_t) + mpend->m_len;
696 
697 out:
698 	NFSEXITCODE2(0, nd);
699 	return (0);
700 }
701 
702 /*
703  * nfs read service
704  */
705 int
706 nfsrvd_read(struct nfsrv_descript *nd, __unused int isdgram,
707     vnode_t vp, struct nfsexstuff *exp)
708 {
709 	u_int32_t *tl;
710 	int error = 0, cnt, getret = 1, gotproxystateid, reqlen, eof = 0;
711 	struct mbuf *m2, *m3;
712 	struct nfsvattr nva;
713 	off_t off = 0x0;
714 	struct nfsstate st, *stp = &st;
715 	struct nfslock lo, *lop = &lo;
716 	nfsv4stateid_t stateid;
717 	nfsquad_t clientid;
718 	struct thread *p = curthread;
719 
720 	if (nd->nd_repstat) {
721 		nfsrv_postopattr(nd, getret, &nva);
722 		goto out;
723 	}
724 	if (nd->nd_flag & ND_NFSV2) {
725 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
726 		off = (off_t)fxdr_unsigned(u_int32_t, *tl++);
727 		reqlen = fxdr_unsigned(int, *tl);
728 	} else if (nd->nd_flag & ND_NFSV3) {
729 		NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
730 		off = fxdr_hyper(tl);
731 		tl += 2;
732 		reqlen = fxdr_unsigned(int, *tl);
733 	} else {
734 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 3*NFSX_UNSIGNED);
735 		reqlen = fxdr_unsigned(int, *(tl + 6));
736 	}
737 	if (reqlen > NFS_SRVMAXDATA(nd)) {
738 		reqlen = NFS_SRVMAXDATA(nd);
739 	} else if (reqlen < 0) {
740 		error = EBADRPC;
741 		goto nfsmout;
742 	}
743 	gotproxystateid = 0;
744 	if (nd->nd_flag & ND_NFSV4) {
745 		stp->ls_flags = (NFSLCK_CHECK | NFSLCK_READACCESS);
746 		lop->lo_flags = NFSLCK_READ;
747 		stp->ls_ownerlen = 0;
748 		stp->ls_op = NULL;
749 		stp->ls_uid = nd->nd_cred->cr_uid;
750 		stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
751 		clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
752 		clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
753 		if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
754 			if ((nd->nd_flag & ND_NFSV41) != 0)
755 				clientid.qval = nd->nd_clientid.qval;
756 			else if (nd->nd_clientid.qval != clientid.qval)
757 				printf("EEK1 multiple clids\n");
758 		} else {
759 			if ((nd->nd_flag & ND_NFSV41) != 0)
760 				printf("EEK! no clientid from session\n");
761 			nd->nd_flag |= ND_IMPLIEDCLID;
762 			nd->nd_clientid.qval = clientid.qval;
763 		}
764 		stp->ls_stateid.other[2] = *tl++;
765 		/*
766 		 * Don't allow the client to use a special stateid for a DS op.
767 		 */
768 		if ((nd->nd_flag & ND_DSSERVER) != 0 &&
769 		    ((stp->ls_stateid.other[0] == 0x0 &&
770 		    stp->ls_stateid.other[1] == 0x0 &&
771 		    stp->ls_stateid.other[2] == 0x0) ||
772 		    (stp->ls_stateid.other[0] == 0xffffffff &&
773 		    stp->ls_stateid.other[1] == 0xffffffff &&
774 		    stp->ls_stateid.other[2] == 0xffffffff) ||
775 		    stp->ls_stateid.seqid != 0))
776 			nd->nd_repstat = NFSERR_BADSTATEID;
777 		/* However, allow the proxy stateid. */
778 		if (stp->ls_stateid.seqid == 0xffffffff &&
779 		    stp->ls_stateid.other[0] == 0x55555555 &&
780 		    stp->ls_stateid.other[1] == 0x55555555 &&
781 		    stp->ls_stateid.other[2] == 0x55555555)
782 			gotproxystateid = 1;
783 		off = fxdr_hyper(tl);
784 		lop->lo_first = off;
785 		tl += 2;
786 		lop->lo_end = off + reqlen;
787 		/*
788 		 * Paranoia, just in case it wraps around.
789 		 */
790 		if (lop->lo_end < off)
791 			lop->lo_end = NFS64BITSSET;
792 	}
793 	if (vnode_vtype(vp) != VREG) {
794 		if (nd->nd_flag & ND_NFSV3)
795 			nd->nd_repstat = EINVAL;
796 		else
797 			nd->nd_repstat = (vnode_vtype(vp) == VDIR) ? EISDIR :
798 			    EINVAL;
799 	}
800 	getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
801 	if (!nd->nd_repstat)
802 		nd->nd_repstat = getret;
803 	if (!nd->nd_repstat &&
804 	    (nva.na_uid != nd->nd_cred->cr_uid ||
805 	     NFSVNO_EXSTRICTACCESS(exp))) {
806 		nd->nd_repstat = nfsvno_accchk(vp, VREAD,
807 		    nd->nd_cred, exp, p,
808 		    NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED, NULL);
809 		if (nd->nd_repstat)
810 			nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
811 			    nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
812 			    NFSACCCHK_VPISLOCKED, NULL);
813 	}
814 	/*
815 	 * DS reads are marked by ND_DSSERVER or use the proxy special
816 	 * stateid.
817 	 */
818 	if (nd->nd_repstat == 0 && (nd->nd_flag & (ND_NFSV4 | ND_DSSERVER)) ==
819 	    ND_NFSV4 && gotproxystateid == 0)
820 		nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
821 		    &stateid, exp, nd, p);
822 	if (nd->nd_repstat) {
823 		vput(vp);
824 		if (nd->nd_flag & ND_NFSV3)
825 			nfsrv_postopattr(nd, getret, &nva);
826 		goto out;
827 	}
828 	if (off >= nva.na_size) {
829 		cnt = 0;
830 		eof = 1;
831 	} else if (reqlen == 0)
832 		cnt = 0;
833 	else if ((off + reqlen) >= nva.na_size) {
834 		cnt = nva.na_size - off;
835 		eof = 1;
836 	} else
837 		cnt = reqlen;
838 	m3 = NULL;
839 	if (cnt > 0) {
840 		nd->nd_repstat = nfsvno_read(vp, off, cnt, nd->nd_cred, p,
841 		    &m3, &m2);
842 		if (!(nd->nd_flag & ND_NFSV4)) {
843 			getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
844 			if (!nd->nd_repstat)
845 				nd->nd_repstat = getret;
846 		}
847 		if (nd->nd_repstat) {
848 			vput(vp);
849 			if (m3)
850 				m_freem(m3);
851 			if (nd->nd_flag & ND_NFSV3)
852 				nfsrv_postopattr(nd, getret, &nva);
853 			goto out;
854 		}
855 	}
856 	vput(vp);
857 	if (nd->nd_flag & ND_NFSV2) {
858 		nfsrv_fillattr(nd, &nva);
859 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
860 	} else {
861 		if (nd->nd_flag & ND_NFSV3) {
862 			nfsrv_postopattr(nd, getret, &nva);
863 			NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
864 			*tl++ = txdr_unsigned(cnt);
865 		} else
866 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
867 		if (eof)
868 			*tl++ = newnfs_true;
869 		else
870 			*tl++ = newnfs_false;
871 	}
872 	*tl = txdr_unsigned(cnt);
873 	if (m3) {
874 		nd->nd_mb->m_next = m3;
875 		nd->nd_mb = m2;
876 		nd->nd_bpos = mtod(m2, caddr_t) + m2->m_len;
877 	}
878 
879 out:
880 	NFSEXITCODE2(0, nd);
881 	return (0);
882 nfsmout:
883 	vput(vp);
884 	NFSEXITCODE2(error, nd);
885 	return (error);
886 }
887 
888 /*
889  * nfs write service
890  */
891 int
892 nfsrvd_write(struct nfsrv_descript *nd, __unused int isdgram,
893     vnode_t vp, struct nfsexstuff *exp)
894 {
895 	u_int32_t *tl;
896 	struct nfsvattr nva, forat;
897 	int aftat_ret = 1, retlen, len, error = 0, forat_ret = 1;
898 	int gotproxystateid, stable = NFSWRITE_FILESYNC;
899 	off_t off;
900 	struct nfsstate st, *stp = &st;
901 	struct nfslock lo, *lop = &lo;
902 	nfsv4stateid_t stateid;
903 	nfsquad_t clientid;
904 	nfsattrbit_t attrbits;
905 	struct thread *p = curthread;
906 
907 	if (nd->nd_repstat) {
908 		nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
909 		goto out;
910 	}
911 	gotproxystateid = 0;
912 	if (nd->nd_flag & ND_NFSV2) {
913 		NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
914 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
915 		tl += 2;
916 		retlen = len = fxdr_unsigned(int32_t, *tl);
917 	} else if (nd->nd_flag & ND_NFSV3) {
918 		NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
919 		off = fxdr_hyper(tl);
920 		tl += 3;
921 		stable = fxdr_unsigned(int, *tl++);
922 		retlen = len = fxdr_unsigned(int32_t, *tl);
923 	} else {
924 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 4 * NFSX_UNSIGNED);
925 		stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
926 		lop->lo_flags = NFSLCK_WRITE;
927 		stp->ls_ownerlen = 0;
928 		stp->ls_op = NULL;
929 		stp->ls_uid = nd->nd_cred->cr_uid;
930 		stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
931 		clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
932 		clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
933 		if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
934 			if ((nd->nd_flag & ND_NFSV41) != 0)
935 				clientid.qval = nd->nd_clientid.qval;
936 			else if (nd->nd_clientid.qval != clientid.qval)
937 				printf("EEK2 multiple clids\n");
938 		} else {
939 			if ((nd->nd_flag & ND_NFSV41) != 0)
940 				printf("EEK! no clientid from session\n");
941 			nd->nd_flag |= ND_IMPLIEDCLID;
942 			nd->nd_clientid.qval = clientid.qval;
943 		}
944 		stp->ls_stateid.other[2] = *tl++;
945 		/*
946 		 * Don't allow the client to use a special stateid for a DS op.
947 		 */
948 		if ((nd->nd_flag & ND_DSSERVER) != 0 &&
949 		    ((stp->ls_stateid.other[0] == 0x0 &&
950 		    stp->ls_stateid.other[1] == 0x0 &&
951 		    stp->ls_stateid.other[2] == 0x0) ||
952 		    (stp->ls_stateid.other[0] == 0xffffffff &&
953 		    stp->ls_stateid.other[1] == 0xffffffff &&
954 		    stp->ls_stateid.other[2] == 0xffffffff) ||
955 		    stp->ls_stateid.seqid != 0))
956 			nd->nd_repstat = NFSERR_BADSTATEID;
957 		/* However, allow the proxy stateid. */
958 		if (stp->ls_stateid.seqid == 0xffffffff &&
959 		    stp->ls_stateid.other[0] == 0x55555555 &&
960 		    stp->ls_stateid.other[1] == 0x55555555 &&
961 		    stp->ls_stateid.other[2] == 0x55555555)
962 			gotproxystateid = 1;
963 		off = fxdr_hyper(tl);
964 		lop->lo_first = off;
965 		tl += 2;
966 		stable = fxdr_unsigned(int, *tl++);
967 		retlen = len = fxdr_unsigned(int32_t, *tl);
968 		lop->lo_end = off + len;
969 		/*
970 		 * Paranoia, just in case it wraps around, which shouldn't
971 		 * ever happen anyhow.
972 		 */
973 		if (lop->lo_end < lop->lo_first)
974 			lop->lo_end = NFS64BITSSET;
975 	}
976 
977 	if (retlen > NFS_SRVMAXIO || retlen < 0)
978 		nd->nd_repstat = EIO;
979 	if (vnode_vtype(vp) != VREG && !nd->nd_repstat) {
980 		if (nd->nd_flag & ND_NFSV3)
981 			nd->nd_repstat = EINVAL;
982 		else
983 			nd->nd_repstat = (vnode_vtype(vp) == VDIR) ? EISDIR :
984 			    EINVAL;
985 	}
986 	NFSZERO_ATTRBIT(&attrbits);
987 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
988 	forat_ret = nfsvno_getattr(vp, &forat, nd, p, 1, &attrbits);
989 	if (!nd->nd_repstat)
990 		nd->nd_repstat = forat_ret;
991 	if (!nd->nd_repstat &&
992 	    (forat.na_uid != nd->nd_cred->cr_uid ||
993 	     NFSVNO_EXSTRICTACCESS(exp)))
994 		nd->nd_repstat = nfsvno_accchk(vp, VWRITE,
995 		    nd->nd_cred, exp, p,
996 		    NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED, NULL);
997 	/*
998 	 * DS reads are marked by ND_DSSERVER or use the proxy special
999 	 * stateid.
1000 	 */
1001 	if (nd->nd_repstat == 0 && (nd->nd_flag & (ND_NFSV4 | ND_DSSERVER)) ==
1002 	    ND_NFSV4 && gotproxystateid == 0)
1003 		nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
1004 		    &stateid, exp, nd, p);
1005 	if (nd->nd_repstat) {
1006 		vput(vp);
1007 		if (nd->nd_flag & ND_NFSV3)
1008 			nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
1009 		goto out;
1010 	}
1011 
1012 	/*
1013 	 * For NFS Version 2, it is not obvious what a write of zero length
1014 	 * should do, but I might as well be consistent with Version 3,
1015 	 * which is to return ok so long as there are no permission problems.
1016 	 */
1017 	if (retlen > 0) {
1018 		nd->nd_repstat = nfsvno_write(vp, off, retlen, &stable,
1019 		    nd->nd_md, nd->nd_dpos, nd->nd_cred, p);
1020 		error = nfsm_advance(nd, NFSM_RNDUP(retlen), -1);
1021 		if (error)
1022 			goto nfsmout;
1023 	}
1024 	if (nd->nd_flag & ND_NFSV4)
1025 		aftat_ret = 0;
1026 	else
1027 		aftat_ret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
1028 	vput(vp);
1029 	if (!nd->nd_repstat)
1030 		nd->nd_repstat = aftat_ret;
1031 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
1032 		if (nd->nd_flag & ND_NFSV3)
1033 			nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
1034 		if (nd->nd_repstat)
1035 			goto out;
1036 		NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1037 		*tl++ = txdr_unsigned(retlen);
1038 		/*
1039 		 * If nfs_async is set, then pretend the write was FILESYNC.
1040 		 * Warning: Doing this violates RFC1813 and runs a risk
1041 		 * of data written by a client being lost when the server
1042 		 * crashes/reboots.
1043 		 */
1044 		if (stable == NFSWRITE_UNSTABLE && nfs_async == 0)
1045 			*tl++ = txdr_unsigned(stable);
1046 		else
1047 			*tl++ = txdr_unsigned(NFSWRITE_FILESYNC);
1048 		/*
1049 		 * Actually, there is no need to txdr these fields,
1050 		 * but it may make the values more human readable,
1051 		 * for debugging purposes.
1052 		 */
1053 		*tl++ = txdr_unsigned(nfsboottime.tv_sec);
1054 		*tl = txdr_unsigned(nfsboottime.tv_usec);
1055 	} else if (!nd->nd_repstat)
1056 		nfsrv_fillattr(nd, &nva);
1057 
1058 out:
1059 	NFSEXITCODE2(0, nd);
1060 	return (0);
1061 nfsmout:
1062 	vput(vp);
1063 	NFSEXITCODE2(error, nd);
1064 	return (error);
1065 }
1066 
1067 /*
1068  * nfs create service (creates regular files for V2 and V3. Spec. files for V2.)
1069  * now does a truncate to 0 length via. setattr if it already exists
1070  * The core creation routine has been extracted out into nfsrv_creatsub(),
1071  * so it can also be used by nfsrv_open() for V4.
1072  */
1073 int
1074 nfsrvd_create(struct nfsrv_descript *nd, __unused int isdgram,
1075     vnode_t dp, struct nfsexstuff *exp)
1076 {
1077 	struct nfsvattr nva, dirfor, diraft;
1078 	struct nfsv2_sattr *sp;
1079 	struct nameidata named;
1080 	u_int32_t *tl;
1081 	int error = 0, tsize, dirfor_ret = 1, diraft_ret = 1;
1082 	int how = NFSCREATE_UNCHECKED, exclusive_flag = 0;
1083 	NFSDEV_T rdev = 0;
1084 	vnode_t vp = NULL, dirp = NULL;
1085 	fhandle_t fh;
1086 	char *bufp;
1087 	u_long *hashp;
1088 	enum vtype vtyp;
1089 	int32_t cverf[2], tverf[2] = { 0, 0 };
1090 	struct thread *p = curthread;
1091 
1092 	if (nd->nd_repstat) {
1093 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1094 		goto out;
1095 	}
1096 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1097 	    LOCKPARENT | LOCKLEAF | SAVESTART | NOCACHE);
1098 	nfsvno_setpathbuf(&named, &bufp, &hashp);
1099 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1100 	if (error)
1101 		goto nfsmout;
1102 	if (!nd->nd_repstat) {
1103 		NFSVNO_ATTRINIT(&nva);
1104 		if (nd->nd_flag & ND_NFSV2) {
1105 			NFSM_DISSECT(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1106 			vtyp = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1107 			if (vtyp == VNON)
1108 				vtyp = VREG;
1109 			NFSVNO_SETATTRVAL(&nva, type, vtyp);
1110 			NFSVNO_SETATTRVAL(&nva, mode,
1111 			    nfstov_mode(sp->sa_mode));
1112 			switch (nva.na_type) {
1113 			case VREG:
1114 				tsize = fxdr_unsigned(int32_t, sp->sa_size);
1115 				if (tsize != -1)
1116 					NFSVNO_SETATTRVAL(&nva, size,
1117 					    (u_quad_t)tsize);
1118 				break;
1119 			case VCHR:
1120 			case VBLK:
1121 			case VFIFO:
1122 				rdev = fxdr_unsigned(NFSDEV_T, sp->sa_size);
1123 				break;
1124 			default:
1125 				break;
1126 			}
1127 		} else {
1128 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1129 			how = fxdr_unsigned(int, *tl);
1130 			switch (how) {
1131 			case NFSCREATE_GUARDED:
1132 			case NFSCREATE_UNCHECKED:
1133 				error = nfsrv_sattr(nd, NULL, &nva, NULL, NULL, p);
1134 				if (error)
1135 					goto nfsmout;
1136 				break;
1137 			case NFSCREATE_EXCLUSIVE:
1138 				NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
1139 				cverf[0] = *tl++;
1140 				cverf[1] = *tl;
1141 				exclusive_flag = 1;
1142 				break;
1143 			}
1144 			NFSVNO_SETATTRVAL(&nva, type, VREG);
1145 		}
1146 	}
1147 	if (nd->nd_repstat) {
1148 		nfsvno_relpathbuf(&named);
1149 		if (nd->nd_flag & ND_NFSV3) {
1150 			dirfor_ret = nfsvno_getattr(dp, &dirfor, nd, p, 1,
1151 			    NULL);
1152 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1153 			    &diraft);
1154 		}
1155 		vput(dp);
1156 		goto out;
1157 	}
1158 
1159 	nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, p, &dirp);
1160 	if (dirp) {
1161 		if (nd->nd_flag & ND_NFSV2) {
1162 			vrele(dirp);
1163 			dirp = NULL;
1164 		} else {
1165 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1166 			    NULL);
1167 		}
1168 	}
1169 	if (nd->nd_repstat) {
1170 		if (nd->nd_flag & ND_NFSV3)
1171 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1172 			    &diraft);
1173 		if (dirp)
1174 			vrele(dirp);
1175 		goto out;
1176 	}
1177 
1178 	if (!(nd->nd_flag & ND_NFSV2)) {
1179 		switch (how) {
1180 		case NFSCREATE_GUARDED:
1181 			if (named.ni_vp)
1182 				nd->nd_repstat = EEXIST;
1183 			break;
1184 		case NFSCREATE_UNCHECKED:
1185 			break;
1186 		case NFSCREATE_EXCLUSIVE:
1187 			if (named.ni_vp == NULL)
1188 				NFSVNO_SETATTRVAL(&nva, mode, 0);
1189 			break;
1190 		}
1191 	}
1192 
1193 	/*
1194 	 * Iff doesn't exist, create it
1195 	 * otherwise just truncate to 0 length
1196 	 *   should I set the mode too ?
1197 	 */
1198 	nd->nd_repstat = nfsvno_createsub(nd, &named, &vp, &nva,
1199 	    &exclusive_flag, cverf, rdev, exp);
1200 
1201 	if (!nd->nd_repstat) {
1202 		nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
1203 		if (!nd->nd_repstat)
1204 			nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1,
1205 			    NULL);
1206 		vput(vp);
1207 		if (!nd->nd_repstat) {
1208 			tverf[0] = nva.na_atime.tv_sec;
1209 			tverf[1] = nva.na_atime.tv_nsec;
1210 		}
1211 	}
1212 	if (nd->nd_flag & ND_NFSV2) {
1213 		if (!nd->nd_repstat) {
1214 			(void) nfsm_fhtom(nd, (u_int8_t *)&fh, 0, 0);
1215 			nfsrv_fillattr(nd, &nva);
1216 		}
1217 	} else {
1218 		if (exclusive_flag && !nd->nd_repstat && (cverf[0] != tverf[0]
1219 		    || cverf[1] != tverf[1]))
1220 			nd->nd_repstat = EEXIST;
1221 		diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1222 		vrele(dirp);
1223 		if (!nd->nd_repstat) {
1224 			(void) nfsm_fhtom(nd, (u_int8_t *)&fh, 0, 1);
1225 			nfsrv_postopattr(nd, 0, &nva);
1226 		}
1227 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1228 	}
1229 
1230 out:
1231 	NFSEXITCODE2(0, nd);
1232 	return (0);
1233 nfsmout:
1234 	vput(dp);
1235 	nfsvno_relpathbuf(&named);
1236 	NFSEXITCODE2(error, nd);
1237 	return (error);
1238 }
1239 
1240 /*
1241  * nfs v3 mknod service (and v4 create)
1242  */
1243 int
1244 nfsrvd_mknod(struct nfsrv_descript *nd, __unused int isdgram,
1245     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1246 {
1247 	struct nfsvattr nva, dirfor, diraft;
1248 	u_int32_t *tl;
1249 	struct nameidata named;
1250 	int error = 0, dirfor_ret = 1, diraft_ret = 1, pathlen;
1251 	u_int32_t major, minor;
1252 	enum vtype vtyp = VNON;
1253 	nfstype nfs4type = NFNON;
1254 	vnode_t vp, dirp = NULL;
1255 	nfsattrbit_t attrbits;
1256 	char *bufp = NULL, *pathcp = NULL;
1257 	u_long *hashp, cnflags;
1258 	NFSACL_T *aclp = NULL;
1259 	struct thread *p = curthread;
1260 
1261 	NFSVNO_ATTRINIT(&nva);
1262 	cnflags = (LOCKPARENT | SAVESTART);
1263 	if (nd->nd_repstat) {
1264 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1265 		goto out;
1266 	}
1267 #ifdef NFS4_ACL_EXTATTR_NAME
1268 	aclp = acl_alloc(M_WAITOK);
1269 	aclp->acl_cnt = 0;
1270 #endif
1271 
1272 	/*
1273 	 * For V4, the creation stuff is here, Yuck!
1274 	 */
1275 	if (nd->nd_flag & ND_NFSV4) {
1276 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1277 		vtyp = nfsv34tov_type(*tl);
1278 		nfs4type = fxdr_unsigned(nfstype, *tl);
1279 		switch (nfs4type) {
1280 		case NFLNK:
1281 			error = nfsvno_getsymlink(nd, &nva, p, &pathcp,
1282 			    &pathlen);
1283 			if (error)
1284 				goto nfsmout;
1285 			break;
1286 		case NFCHR:
1287 		case NFBLK:
1288 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1289 			major = fxdr_unsigned(u_int32_t, *tl++);
1290 			minor = fxdr_unsigned(u_int32_t, *tl);
1291 			nva.na_rdev = NFSMAKEDEV(major, minor);
1292 			break;
1293 		case NFSOCK:
1294 		case NFFIFO:
1295 			break;
1296 		case NFDIR:
1297 			cnflags = (LOCKPARENT | SAVENAME);
1298 			break;
1299 		default:
1300 			nd->nd_repstat = NFSERR_BADTYPE;
1301 			vrele(dp);
1302 #ifdef NFS4_ACL_EXTATTR_NAME
1303 			acl_free(aclp);
1304 #endif
1305 			goto out;
1306 		}
1307 	}
1308 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE, cnflags | NOCACHE);
1309 	nfsvno_setpathbuf(&named, &bufp, &hashp);
1310 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1311 	if (error)
1312 		goto nfsmout;
1313 	if (!nd->nd_repstat) {
1314 		if (nd->nd_flag & ND_NFSV3) {
1315 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1316 			vtyp = nfsv34tov_type(*tl);
1317 		}
1318 		error = nfsrv_sattr(nd, NULL, &nva, &attrbits, aclp, p);
1319 		if (error)
1320 			goto nfsmout;
1321 		nva.na_type = vtyp;
1322 		if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV3) &&
1323 		    (vtyp == VCHR || vtyp == VBLK)) {
1324 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1325 			major = fxdr_unsigned(u_int32_t, *tl++);
1326 			minor = fxdr_unsigned(u_int32_t, *tl);
1327 			nva.na_rdev = NFSMAKEDEV(major, minor);
1328 		}
1329 	}
1330 
1331 	dirfor_ret = nfsvno_getattr(dp, &dirfor, nd, p, 0, NULL);
1332 	if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4)) {
1333 		if (!dirfor_ret && NFSVNO_ISSETGID(&nva) &&
1334 		    dirfor.na_gid == nva.na_gid)
1335 			NFSVNO_UNSET(&nva, gid);
1336 		nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
1337 	}
1338 	if (nd->nd_repstat) {
1339 		vrele(dp);
1340 #ifdef NFS4_ACL_EXTATTR_NAME
1341 		acl_free(aclp);
1342 #endif
1343 		nfsvno_relpathbuf(&named);
1344 		if (pathcp)
1345 			free(pathcp, M_TEMP);
1346 		if (nd->nd_flag & ND_NFSV3)
1347 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1348 			    &diraft);
1349 		goto out;
1350 	}
1351 
1352 	/*
1353 	 * Yuck! For V4, mkdir and link are here and some V4 clients don't fill
1354 	 * in va_mode, so we'll have to set a default here.
1355 	 */
1356 	if (NFSVNO_NOTSETMODE(&nva)) {
1357 		if (vtyp == VLNK)
1358 			nva.na_mode = 0755;
1359 		else
1360 			nva.na_mode = 0400;
1361 	}
1362 
1363 	if (vtyp == VDIR)
1364 		named.ni_cnd.cn_flags |= WILLBEDIR;
1365 	nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, p, &dirp);
1366 	if (nd->nd_repstat) {
1367 		if (dirp) {
1368 			if (nd->nd_flag & ND_NFSV3)
1369 				dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd,
1370 				    p, 0, NULL);
1371 			vrele(dirp);
1372 		}
1373 #ifdef NFS4_ACL_EXTATTR_NAME
1374 		acl_free(aclp);
1375 #endif
1376 		if (nd->nd_flag & ND_NFSV3)
1377 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1378 			    &diraft);
1379 		goto out;
1380 	}
1381 	if (dirp)
1382 		dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1383 
1384 	if ((nd->nd_flag & ND_NFSV4) && (vtyp == VDIR || vtyp == VLNK)) {
1385 		if (vtyp == VDIR) {
1386 			nfsrvd_mkdirsub(nd, &named, &nva, fhp, vpp, dirp,
1387 			    &dirfor, &diraft, &diraft_ret, &attrbits, aclp, p,
1388 			    exp);
1389 #ifdef NFS4_ACL_EXTATTR_NAME
1390 			acl_free(aclp);
1391 #endif
1392 			goto out;
1393 		} else if (vtyp == VLNK) {
1394 			nfsrvd_symlinksub(nd, &named, &nva, fhp, vpp, dirp,
1395 			    &dirfor, &diraft, &diraft_ret, &attrbits,
1396 			    aclp, p, exp, pathcp, pathlen);
1397 #ifdef NFS4_ACL_EXTATTR_NAME
1398 			acl_free(aclp);
1399 #endif
1400 			free(pathcp, M_TEMP);
1401 			goto out;
1402 		}
1403 	}
1404 
1405 	nd->nd_repstat = nfsvno_mknod(&named, &nva, nd->nd_cred, p);
1406 	if (!nd->nd_repstat) {
1407 		vp = named.ni_vp;
1408 		nfsrv_fixattr(nd, vp, &nva, aclp, p, &attrbits, exp);
1409 		nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
1410 		if ((nd->nd_flag & ND_NFSV3) && !nd->nd_repstat)
1411 			nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1,
1412 			    NULL);
1413 		if (vpp != NULL && nd->nd_repstat == 0) {
1414 			NFSVOPUNLOCK(vp);
1415 			*vpp = vp;
1416 		} else
1417 			vput(vp);
1418 	}
1419 
1420 	diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1421 	vrele(dirp);
1422 	if (!nd->nd_repstat) {
1423 		if (nd->nd_flag & ND_NFSV3) {
1424 			(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 1);
1425 			nfsrv_postopattr(nd, 0, &nva);
1426 		} else {
1427 			NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1428 			*tl++ = newnfs_false;
1429 			txdr_hyper(dirfor.na_filerev, tl);
1430 			tl += 2;
1431 			txdr_hyper(diraft.na_filerev, tl);
1432 			(void) nfsrv_putattrbit(nd, &attrbits);
1433 		}
1434 	}
1435 	if (nd->nd_flag & ND_NFSV3)
1436 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1437 #ifdef NFS4_ACL_EXTATTR_NAME
1438 	acl_free(aclp);
1439 #endif
1440 
1441 out:
1442 	NFSEXITCODE2(0, nd);
1443 	return (0);
1444 nfsmout:
1445 	vrele(dp);
1446 #ifdef NFS4_ACL_EXTATTR_NAME
1447 	acl_free(aclp);
1448 #endif
1449 	if (bufp)
1450 		nfsvno_relpathbuf(&named);
1451 	if (pathcp)
1452 		free(pathcp, M_TEMP);
1453 
1454 	NFSEXITCODE2(error, nd);
1455 	return (error);
1456 }
1457 
1458 /*
1459  * nfs remove service
1460  */
1461 int
1462 nfsrvd_remove(struct nfsrv_descript *nd, __unused int isdgram,
1463     vnode_t dp, struct nfsexstuff *exp)
1464 {
1465 	struct nameidata named;
1466 	u_int32_t *tl;
1467 	int error = 0, dirfor_ret = 1, diraft_ret = 1;
1468 	vnode_t dirp = NULL;
1469 	struct nfsvattr dirfor, diraft;
1470 	char *bufp;
1471 	u_long *hashp;
1472 	struct thread *p = curthread;
1473 
1474 	if (nd->nd_repstat) {
1475 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1476 		goto out;
1477 	}
1478 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, DELETE,
1479 	    LOCKPARENT | LOCKLEAF);
1480 	nfsvno_setpathbuf(&named, &bufp, &hashp);
1481 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1482 	if (error) {
1483 		vput(dp);
1484 		nfsvno_relpathbuf(&named);
1485 		goto out;
1486 	}
1487 	if (!nd->nd_repstat) {
1488 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, p, &dirp);
1489 	} else {
1490 		vput(dp);
1491 		nfsvno_relpathbuf(&named);
1492 	}
1493 	if (dirp) {
1494 		if (!(nd->nd_flag & ND_NFSV2)) {
1495 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1496 			    NULL);
1497 		} else {
1498 			vrele(dirp);
1499 			dirp = NULL;
1500 		}
1501 	}
1502 	if (!nd->nd_repstat) {
1503 		if (nd->nd_flag & ND_NFSV4) {
1504 			if (vnode_vtype(named.ni_vp) == VDIR)
1505 				nd->nd_repstat = nfsvno_rmdirsub(&named, 1,
1506 				    nd->nd_cred, p, exp);
1507 			else
1508 				nd->nd_repstat = nfsvno_removesub(&named, 1,
1509 				    nd->nd_cred, p, exp);
1510 		} else if (nd->nd_procnum == NFSPROC_RMDIR) {
1511 			nd->nd_repstat = nfsvno_rmdirsub(&named, 0,
1512 			    nd->nd_cred, p, exp);
1513 		} else {
1514 			nd->nd_repstat = nfsvno_removesub(&named, 0,
1515 			    nd->nd_cred, p, exp);
1516 		}
1517 	}
1518 	if (!(nd->nd_flag & ND_NFSV2)) {
1519 		if (dirp) {
1520 			diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0,
1521 			    NULL);
1522 			vrele(dirp);
1523 		}
1524 		if (nd->nd_flag & ND_NFSV3) {
1525 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1526 			    &diraft);
1527 		} else if (!nd->nd_repstat) {
1528 			NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1529 			*tl++ = newnfs_false;
1530 			txdr_hyper(dirfor.na_filerev, tl);
1531 			tl += 2;
1532 			txdr_hyper(diraft.na_filerev, tl);
1533 		}
1534 	}
1535 
1536 out:
1537 	NFSEXITCODE2(error, nd);
1538 	return (error);
1539 }
1540 
1541 /*
1542  * nfs rename service
1543  */
1544 int
1545 nfsrvd_rename(struct nfsrv_descript *nd, int isdgram,
1546     vnode_t dp, vnode_t todp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
1547 {
1548 	u_int32_t *tl;
1549 	int error = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1550 	int tdirfor_ret = 1, tdiraft_ret = 1;
1551 	struct nameidata fromnd, tond;
1552 	vnode_t fdirp = NULL, tdirp = NULL, tdp = NULL;
1553 	struct nfsvattr fdirfor, fdiraft, tdirfor, tdiraft;
1554 	struct nfsexstuff tnes;
1555 	struct nfsrvfh tfh;
1556 	char *bufp, *tbufp = NULL;
1557 	u_long *hashp;
1558 	fhandle_t fh;
1559 	struct thread *p = curthread;
1560 
1561 	if (nd->nd_repstat) {
1562 		nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1563 		nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1564 		goto out;
1565 	}
1566 	if (!(nd->nd_flag & ND_NFSV2))
1567 		fdirfor_ret = nfsvno_getattr(dp, &fdirfor, nd, p, 1, NULL);
1568 	tond.ni_cnd.cn_nameiop = 0;
1569 	tond.ni_startdir = NULL;
1570 	NFSNAMEICNDSET(&fromnd.ni_cnd, nd->nd_cred, DELETE, WANTPARENT | SAVESTART);
1571 	nfsvno_setpathbuf(&fromnd, &bufp, &hashp);
1572 	error = nfsrv_parsename(nd, bufp, hashp, &fromnd.ni_pathlen);
1573 	if (error) {
1574 		vput(dp);
1575 		if (todp)
1576 			vrele(todp);
1577 		nfsvno_relpathbuf(&fromnd);
1578 		goto out;
1579 	}
1580 	/*
1581 	 * Unlock dp in this code section, so it is unlocked before
1582 	 * tdp gets locked. This avoids a potential LOR if tdp is the
1583 	 * parent directory of dp.
1584 	 */
1585 	if (nd->nd_flag & ND_NFSV4) {
1586 		tdp = todp;
1587 		tnes = *toexp;
1588 		if (dp != tdp) {
1589 			NFSVOPUNLOCK(dp);
1590 			/* Might lock tdp. */
1591 			tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 0,
1592 			    NULL);
1593 		} else {
1594 			tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 1,
1595 			    NULL);
1596 			NFSVOPUNLOCK(dp);
1597 		}
1598 	} else {
1599 		tfh.nfsrvfh_len = 0;
1600 		error = nfsrv_mtofh(nd, &tfh);
1601 		if (error == 0)
1602 			error = nfsvno_getfh(dp, &fh, p);
1603 		if (error) {
1604 			vput(dp);
1605 			/* todp is always NULL except NFSv4 */
1606 			nfsvno_relpathbuf(&fromnd);
1607 			goto out;
1608 		}
1609 
1610 		/* If this is the same file handle, just VREF() the vnode. */
1611 		if (tfh.nfsrvfh_len == NFSX_MYFH &&
1612 		    !NFSBCMP(tfh.nfsrvfh_data, &fh, NFSX_MYFH)) {
1613 			VREF(dp);
1614 			tdp = dp;
1615 			tnes = *exp;
1616 			tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 1,
1617 			    NULL);
1618 			NFSVOPUNLOCK(dp);
1619 		} else {
1620 			NFSVOPUNLOCK(dp);
1621 			nd->nd_cred->cr_uid = nd->nd_saveduid;
1622 			nfsd_fhtovp(nd, &tfh, LK_EXCLUSIVE, &tdp, &tnes, NULL,
1623 			    0);	/* Locks tdp. */
1624 			if (tdp) {
1625 				tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd,
1626 				    p, 1, NULL);
1627 				NFSVOPUNLOCK(tdp);
1628 			}
1629 		}
1630 	}
1631 	NFSNAMEICNDSET(&tond.ni_cnd, nd->nd_cred, RENAME, LOCKPARENT | LOCKLEAF | NOCACHE | SAVESTART);
1632 	nfsvno_setpathbuf(&tond, &tbufp, &hashp);
1633 	if (!nd->nd_repstat) {
1634 		error = nfsrv_parsename(nd, tbufp, hashp, &tond.ni_pathlen);
1635 		if (error) {
1636 			if (tdp)
1637 				vrele(tdp);
1638 			vrele(dp);
1639 			nfsvno_relpathbuf(&fromnd);
1640 			nfsvno_relpathbuf(&tond);
1641 			goto out;
1642 		}
1643 	}
1644 	if (nd->nd_repstat) {
1645 		if (nd->nd_flag & ND_NFSV3) {
1646 			nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret,
1647 			    &fdiraft);
1648 			nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret,
1649 			    &tdiraft);
1650 		}
1651 		if (tdp)
1652 			vrele(tdp);
1653 		vrele(dp);
1654 		nfsvno_relpathbuf(&fromnd);
1655 		nfsvno_relpathbuf(&tond);
1656 		goto out;
1657 	}
1658 
1659 	/*
1660 	 * Done parsing, now down to business.
1661 	 */
1662 	nd->nd_repstat = nfsvno_namei(nd, &fromnd, dp, 0, exp, p, &fdirp);
1663 	if (nd->nd_repstat) {
1664 		if (nd->nd_flag & ND_NFSV3) {
1665 			nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret,
1666 			    &fdiraft);
1667 			nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret,
1668 			    &tdiraft);
1669 		}
1670 		if (fdirp)
1671 			vrele(fdirp);
1672 		if (tdp)
1673 			vrele(tdp);
1674 		nfsvno_relpathbuf(&tond);
1675 		goto out;
1676 	}
1677 	if (vnode_vtype(fromnd.ni_vp) == VDIR)
1678 		tond.ni_cnd.cn_flags |= WILLBEDIR;
1679 	nd->nd_repstat = nfsvno_namei(nd, &tond, tdp, 0, &tnes, p, &tdirp);
1680 	nd->nd_repstat = nfsvno_rename(&fromnd, &tond, nd->nd_repstat,
1681 	    nd->nd_flag, nd->nd_cred, p);
1682 	if (fdirp)
1683 		fdiraft_ret = nfsvno_getattr(fdirp, &fdiraft, nd, p, 0, NULL);
1684 	if (tdirp)
1685 		tdiraft_ret = nfsvno_getattr(tdirp, &tdiraft, nd, p, 0, NULL);
1686 	if (fdirp)
1687 		vrele(fdirp);
1688 	if (tdirp)
1689 		vrele(tdirp);
1690 	if (nd->nd_flag & ND_NFSV3) {
1691 		nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1692 		nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1693 	} else if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1694 		NFSM_BUILD(tl, u_int32_t *, 10 * NFSX_UNSIGNED);
1695 		*tl++ = newnfs_false;
1696 		txdr_hyper(fdirfor.na_filerev, tl);
1697 		tl += 2;
1698 		txdr_hyper(fdiraft.na_filerev, tl);
1699 		tl += 2;
1700 		*tl++ = newnfs_false;
1701 		txdr_hyper(tdirfor.na_filerev, tl);
1702 		tl += 2;
1703 		txdr_hyper(tdiraft.na_filerev, tl);
1704 	}
1705 
1706 out:
1707 	NFSEXITCODE2(error, nd);
1708 	return (error);
1709 }
1710 
1711 /*
1712  * nfs link service
1713  */
1714 int
1715 nfsrvd_link(struct nfsrv_descript *nd, int isdgram,
1716     vnode_t vp, vnode_t tovp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
1717 {
1718 	struct nameidata named;
1719 	u_int32_t *tl;
1720 	int error = 0, dirfor_ret = 1, diraft_ret = 1, getret = 1;
1721 	vnode_t dirp = NULL, dp = NULL;
1722 	struct nfsvattr dirfor, diraft, at;
1723 	struct nfsexstuff tnes;
1724 	struct nfsrvfh dfh;
1725 	char *bufp;
1726 	u_long *hashp;
1727 	struct thread *p = curthread;
1728 
1729 	if (nd->nd_repstat) {
1730 		nfsrv_postopattr(nd, getret, &at);
1731 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1732 		goto out;
1733 	}
1734 	NFSVOPUNLOCK(vp);
1735 	if (vnode_vtype(vp) == VDIR) {
1736 		if (nd->nd_flag & ND_NFSV4)
1737 			nd->nd_repstat = NFSERR_ISDIR;
1738 		else
1739 			nd->nd_repstat = NFSERR_INVAL;
1740 		if (tovp)
1741 			vrele(tovp);
1742 	}
1743 	if (!nd->nd_repstat) {
1744 		if (nd->nd_flag & ND_NFSV4) {
1745 			dp = tovp;
1746 			tnes = *toexp;
1747 		} else {
1748 			error = nfsrv_mtofh(nd, &dfh);
1749 			if (error) {
1750 				vrele(vp);
1751 				/* tovp is always NULL unless NFSv4 */
1752 				goto out;
1753 			}
1754 			nfsd_fhtovp(nd, &dfh, LK_EXCLUSIVE, &dp, &tnes, NULL, 0);
1755 			if (dp)
1756 				NFSVOPUNLOCK(dp);
1757 		}
1758 	}
1759 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1760 	    LOCKPARENT | SAVENAME | NOCACHE);
1761 	if (!nd->nd_repstat) {
1762 		nfsvno_setpathbuf(&named, &bufp, &hashp);
1763 		error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1764 		if (error) {
1765 			vrele(vp);
1766 			if (dp)
1767 				vrele(dp);
1768 			nfsvno_relpathbuf(&named);
1769 			goto out;
1770 		}
1771 		if (!nd->nd_repstat) {
1772 			nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, &tnes,
1773 			    p, &dirp);
1774 		} else {
1775 			if (dp)
1776 				vrele(dp);
1777 			nfsvno_relpathbuf(&named);
1778 		}
1779 	}
1780 	if (dirp) {
1781 		if (nd->nd_flag & ND_NFSV2) {
1782 			vrele(dirp);
1783 			dirp = NULL;
1784 		} else {
1785 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1786 			    NULL);
1787 		}
1788 	}
1789 	if (!nd->nd_repstat)
1790 		nd->nd_repstat = nfsvno_link(&named, vp, nd->nd_cred, p, exp);
1791 	if (nd->nd_flag & ND_NFSV3)
1792 		getret = nfsvno_getattr(vp, &at, nd, p, 0, NULL);
1793 	if (dirp) {
1794 		diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1795 		vrele(dirp);
1796 	}
1797 	vrele(vp);
1798 	if (nd->nd_flag & ND_NFSV3) {
1799 		nfsrv_postopattr(nd, getret, &at);
1800 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1801 	} else if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1802 		NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1803 		*tl++ = newnfs_false;
1804 		txdr_hyper(dirfor.na_filerev, tl);
1805 		tl += 2;
1806 		txdr_hyper(diraft.na_filerev, tl);
1807 	}
1808 
1809 out:
1810 	NFSEXITCODE2(error, nd);
1811 	return (error);
1812 }
1813 
1814 /*
1815  * nfs symbolic link service
1816  */
1817 int
1818 nfsrvd_symlink(struct nfsrv_descript *nd, __unused int isdgram,
1819     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1820 {
1821 	struct nfsvattr nva, dirfor, diraft;
1822 	struct nameidata named;
1823 	int error = 0, dirfor_ret = 1, diraft_ret = 1, pathlen;
1824 	vnode_t dirp = NULL;
1825 	char *bufp, *pathcp = NULL;
1826 	u_long *hashp;
1827 	struct thread *p = curthread;
1828 
1829 	if (nd->nd_repstat) {
1830 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1831 		goto out;
1832 	}
1833 	if (vpp)
1834 		*vpp = NULL;
1835 	NFSVNO_ATTRINIT(&nva);
1836 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1837 	    LOCKPARENT | SAVESTART | NOCACHE);
1838 	nfsvno_setpathbuf(&named, &bufp, &hashp);
1839 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1840 	if (!error && !nd->nd_repstat)
1841 		error = nfsvno_getsymlink(nd, &nva, p, &pathcp, &pathlen);
1842 	if (error) {
1843 		vrele(dp);
1844 		nfsvno_relpathbuf(&named);
1845 		goto out;
1846 	}
1847 	if (!nd->nd_repstat) {
1848 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, p, &dirp);
1849 	} else {
1850 		vrele(dp);
1851 		nfsvno_relpathbuf(&named);
1852 	}
1853 	if (dirp != NULL && !(nd->nd_flag & ND_NFSV3)) {
1854 		vrele(dirp);
1855 		dirp = NULL;
1856 	}
1857 
1858 	/*
1859 	 * And call nfsrvd_symlinksub() to do the common code. It will
1860 	 * return EBADRPC upon a parsing error, 0 otherwise.
1861 	 */
1862 	if (!nd->nd_repstat) {
1863 		if (dirp != NULL)
1864 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1865 			    NULL);
1866 		nfsrvd_symlinksub(nd, &named, &nva, fhp, vpp, dirp,
1867 		    &dirfor, &diraft, &diraft_ret, NULL, NULL, p, exp,
1868 		    pathcp, pathlen);
1869 	} else if (dirp != NULL) {
1870 		dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1871 		vrele(dirp);
1872 	}
1873 	if (pathcp)
1874 		free(pathcp, M_TEMP);
1875 
1876 	if (nd->nd_flag & ND_NFSV3) {
1877 		if (!nd->nd_repstat) {
1878 			(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 1);
1879 			nfsrv_postopattr(nd, 0, &nva);
1880 		}
1881 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1882 	}
1883 
1884 out:
1885 	NFSEXITCODE2(error, nd);
1886 	return (error);
1887 }
1888 
1889 /*
1890  * Common code for creating a symbolic link.
1891  */
1892 static void
1893 nfsrvd_symlinksub(struct nfsrv_descript *nd, struct nameidata *ndp,
1894     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
1895     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
1896     int *diraft_retp, nfsattrbit_t *attrbitp,
1897     NFSACL_T *aclp, NFSPROC_T *p, struct nfsexstuff *exp, char *pathcp,
1898     int pathlen)
1899 {
1900 	u_int32_t *tl;
1901 
1902 	nd->nd_repstat = nfsvno_symlink(ndp, nvap, pathcp, pathlen,
1903 	    !(nd->nd_flag & ND_NFSV2), nd->nd_saveduid, nd->nd_cred, p, exp);
1904 	if (!nd->nd_repstat && !(nd->nd_flag & ND_NFSV2)) {
1905 		nfsrv_fixattr(nd, ndp->ni_vp, nvap, aclp, p, attrbitp, exp);
1906 		if (nd->nd_flag & ND_NFSV3) {
1907 			nd->nd_repstat = nfsvno_getfh(ndp->ni_vp, fhp, p);
1908 			if (!nd->nd_repstat)
1909 				nd->nd_repstat = nfsvno_getattr(ndp->ni_vp,
1910 				    nvap, nd, p, 1, NULL);
1911 		}
1912 		if (vpp != NULL && nd->nd_repstat == 0) {
1913 			NFSVOPUNLOCK(ndp->ni_vp);
1914 			*vpp = ndp->ni_vp;
1915 		} else
1916 			vput(ndp->ni_vp);
1917 	}
1918 	if (dirp) {
1919 		*diraft_retp = nfsvno_getattr(dirp, diraftp, nd, p, 0, NULL);
1920 		vrele(dirp);
1921 	}
1922 	if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1923 		NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1924 		*tl++ = newnfs_false;
1925 		txdr_hyper(dirforp->na_filerev, tl);
1926 		tl += 2;
1927 		txdr_hyper(diraftp->na_filerev, tl);
1928 		(void) nfsrv_putattrbit(nd, attrbitp);
1929 	}
1930 
1931 	NFSEXITCODE2(0, nd);
1932 }
1933 
1934 /*
1935  * nfs mkdir service
1936  */
1937 int
1938 nfsrvd_mkdir(struct nfsrv_descript *nd, __unused int isdgram,
1939     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1940 {
1941 	struct nfsvattr nva, dirfor, diraft;
1942 	struct nameidata named;
1943 	u_int32_t *tl;
1944 	int error = 0, dirfor_ret = 1, diraft_ret = 1;
1945 	vnode_t dirp = NULL;
1946 	char *bufp;
1947 	u_long *hashp;
1948 	struct thread *p = curthread;
1949 
1950 	if (nd->nd_repstat) {
1951 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1952 		goto out;
1953 	}
1954 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1955 	    LOCKPARENT | SAVENAME | NOCACHE);
1956 	nfsvno_setpathbuf(&named, &bufp, &hashp);
1957 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1958 	if (error)
1959 		goto nfsmout;
1960 	if (!nd->nd_repstat) {
1961 		NFSVNO_ATTRINIT(&nva);
1962 		if (nd->nd_flag & ND_NFSV3) {
1963 			error = nfsrv_sattr(nd, NULL, &nva, NULL, NULL, p);
1964 			if (error)
1965 				goto nfsmout;
1966 		} else {
1967 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1968 			nva.na_mode = nfstov_mode(*tl++);
1969 		}
1970 	}
1971 	if (!nd->nd_repstat) {
1972 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, p, &dirp);
1973 	} else {
1974 		vrele(dp);
1975 		nfsvno_relpathbuf(&named);
1976 	}
1977 	if (dirp != NULL && !(nd->nd_flag & ND_NFSV3)) {
1978 		vrele(dirp);
1979 		dirp = NULL;
1980 	}
1981 	if (nd->nd_repstat) {
1982 		if (dirp != NULL) {
1983 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1984 			    NULL);
1985 			vrele(dirp);
1986 		}
1987 		if (nd->nd_flag & ND_NFSV3)
1988 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1989 			    &diraft);
1990 		goto out;
1991 	}
1992 	if (dirp != NULL)
1993 		dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1994 
1995 	/*
1996 	 * Call nfsrvd_mkdirsub() for the code common to V4 as well.
1997 	 */
1998 	nfsrvd_mkdirsub(nd, &named, &nva, fhp, vpp, dirp, &dirfor, &diraft,
1999 	    &diraft_ret, NULL, NULL, p, exp);
2000 
2001 	if (nd->nd_flag & ND_NFSV3) {
2002 		if (!nd->nd_repstat) {
2003 			(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 1);
2004 			nfsrv_postopattr(nd, 0, &nva);
2005 		}
2006 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
2007 	} else if (!nd->nd_repstat) {
2008 		(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
2009 		nfsrv_fillattr(nd, &nva);
2010 	}
2011 
2012 out:
2013 	NFSEXITCODE2(0, nd);
2014 	return (0);
2015 nfsmout:
2016 	vrele(dp);
2017 	nfsvno_relpathbuf(&named);
2018 	NFSEXITCODE2(error, nd);
2019 	return (error);
2020 }
2021 
2022 /*
2023  * Code common to mkdir for V2,3 and 4.
2024  */
2025 static void
2026 nfsrvd_mkdirsub(struct nfsrv_descript *nd, struct nameidata *ndp,
2027     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
2028     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
2029     int *diraft_retp, nfsattrbit_t *attrbitp, NFSACL_T *aclp,
2030     NFSPROC_T *p, struct nfsexstuff *exp)
2031 {
2032 	vnode_t vp;
2033 	u_int32_t *tl;
2034 
2035 	NFSVNO_SETATTRVAL(nvap, type, VDIR);
2036 	nd->nd_repstat = nfsvno_mkdir(ndp, nvap, nd->nd_saveduid,
2037 	    nd->nd_cred, p, exp);
2038 	if (!nd->nd_repstat) {
2039 		vp = ndp->ni_vp;
2040 		nfsrv_fixattr(nd, vp, nvap, aclp, p, attrbitp, exp);
2041 		nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
2042 		if (!(nd->nd_flag & ND_NFSV4) && !nd->nd_repstat)
2043 			nd->nd_repstat = nfsvno_getattr(vp, nvap, nd, p, 1,
2044 			    NULL);
2045 		if (vpp && !nd->nd_repstat) {
2046 			NFSVOPUNLOCK(vp);
2047 			*vpp = vp;
2048 		} else {
2049 			vput(vp);
2050 		}
2051 	}
2052 	if (dirp) {
2053 		*diraft_retp = nfsvno_getattr(dirp, diraftp, nd, p, 0, NULL);
2054 		vrele(dirp);
2055 	}
2056 	if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
2057 		NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2058 		*tl++ = newnfs_false;
2059 		txdr_hyper(dirforp->na_filerev, tl);
2060 		tl += 2;
2061 		txdr_hyper(diraftp->na_filerev, tl);
2062 		(void) nfsrv_putattrbit(nd, attrbitp);
2063 	}
2064 
2065 	NFSEXITCODE2(0, nd);
2066 }
2067 
2068 /*
2069  * nfs commit service
2070  */
2071 int
2072 nfsrvd_commit(struct nfsrv_descript *nd, __unused int isdgram,
2073     vnode_t vp, __unused struct nfsexstuff *exp)
2074 {
2075 	struct nfsvattr bfor, aft;
2076 	u_int32_t *tl;
2077 	int error = 0, for_ret = 1, aft_ret = 1, cnt;
2078 	u_int64_t off;
2079 	struct thread *p = curthread;
2080 
2081        if (nd->nd_repstat) {
2082 		nfsrv_wcc(nd, for_ret, &bfor, aft_ret, &aft);
2083 		goto out;
2084 	}
2085 
2086 	/* Return NFSERR_ISDIR in NFSv4 when commit on a directory. */
2087 	if (vp->v_type != VREG) {
2088 		if (nd->nd_flag & ND_NFSV3)
2089 			error = NFSERR_NOTSUPP;
2090 		else
2091 			error = (vp->v_type == VDIR) ? NFSERR_ISDIR : NFSERR_INVAL;
2092 		goto nfsmout;
2093 	}
2094 	NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
2095 
2096 	/*
2097 	 * XXX At this time VOP_FSYNC() does not accept offset and byte
2098 	 * count parameters, so these arguments are useless (someday maybe).
2099 	 */
2100 	off = fxdr_hyper(tl);
2101 	tl += 2;
2102 	cnt = fxdr_unsigned(int, *tl);
2103 	if (nd->nd_flag & ND_NFSV3)
2104 		for_ret = nfsvno_getattr(vp, &bfor, nd, p, 1, NULL);
2105 	nd->nd_repstat = nfsvno_fsync(vp, off, cnt, nd->nd_cred, p);
2106 	if (nd->nd_flag & ND_NFSV3) {
2107 		aft_ret = nfsvno_getattr(vp, &aft, nd, p, 1, NULL);
2108 		nfsrv_wcc(nd, for_ret, &bfor, aft_ret, &aft);
2109 	}
2110 	vput(vp);
2111 	if (!nd->nd_repstat) {
2112 		NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
2113 		*tl++ = txdr_unsigned(nfsboottime.tv_sec);
2114 		*tl = txdr_unsigned(nfsboottime.tv_usec);
2115 	}
2116 
2117 out:
2118 	NFSEXITCODE2(0, nd);
2119 	return (0);
2120 nfsmout:
2121 	vput(vp);
2122 	NFSEXITCODE2(error, nd);
2123 	return (error);
2124 }
2125 
2126 /*
2127  * nfs statfs service
2128  */
2129 int
2130 nfsrvd_statfs(struct nfsrv_descript *nd, __unused int isdgram,
2131     vnode_t vp, __unused struct nfsexstuff *exp)
2132 {
2133 	struct statfs *sf;
2134 	u_int32_t *tl;
2135 	int getret = 1;
2136 	struct nfsvattr at;
2137 	u_quad_t tval;
2138 	struct thread *p = curthread;
2139 
2140 	sf = NULL;
2141 	if (nd->nd_repstat) {
2142 		nfsrv_postopattr(nd, getret, &at);
2143 		goto out;
2144 	}
2145 	sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
2146 	nd->nd_repstat = nfsvno_statfs(vp, sf);
2147 	getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2148 	vput(vp);
2149 	if (nd->nd_flag & ND_NFSV3)
2150 		nfsrv_postopattr(nd, getret, &at);
2151 	if (nd->nd_repstat)
2152 		goto out;
2153 	if (nd->nd_flag & ND_NFSV2) {
2154 		NFSM_BUILD(tl, u_int32_t *, NFSX_V2STATFS);
2155 		*tl++ = txdr_unsigned(NFS_V2MAXDATA);
2156 		*tl++ = txdr_unsigned(sf->f_bsize);
2157 		*tl++ = txdr_unsigned(sf->f_blocks);
2158 		*tl++ = txdr_unsigned(sf->f_bfree);
2159 		*tl = txdr_unsigned(sf->f_bavail);
2160 	} else {
2161 		NFSM_BUILD(tl, u_int32_t *, NFSX_V3STATFS);
2162 		tval = (u_quad_t)sf->f_blocks;
2163 		tval *= (u_quad_t)sf->f_bsize;
2164 		txdr_hyper(tval, tl); tl += 2;
2165 		tval = (u_quad_t)sf->f_bfree;
2166 		tval *= (u_quad_t)sf->f_bsize;
2167 		txdr_hyper(tval, tl); tl += 2;
2168 		tval = (u_quad_t)sf->f_bavail;
2169 		tval *= (u_quad_t)sf->f_bsize;
2170 		txdr_hyper(tval, tl); tl += 2;
2171 		tval = (u_quad_t)sf->f_files;
2172 		txdr_hyper(tval, tl); tl += 2;
2173 		tval = (u_quad_t)sf->f_ffree;
2174 		txdr_hyper(tval, tl); tl += 2;
2175 		tval = (u_quad_t)sf->f_ffree;
2176 		txdr_hyper(tval, tl); tl += 2;
2177 		*tl = 0;
2178 	}
2179 
2180 out:
2181 	free(sf, M_STATFS);
2182 	NFSEXITCODE2(0, nd);
2183 	return (0);
2184 }
2185 
2186 /*
2187  * nfs fsinfo service
2188  */
2189 int
2190 nfsrvd_fsinfo(struct nfsrv_descript *nd, int isdgram,
2191     vnode_t vp, __unused struct nfsexstuff *exp)
2192 {
2193 	u_int32_t *tl;
2194 	struct nfsfsinfo fs;
2195 	int getret = 1;
2196 	struct nfsvattr at;
2197 	struct thread *p = curthread;
2198 
2199 	if (nd->nd_repstat) {
2200 		nfsrv_postopattr(nd, getret, &at);
2201 		goto out;
2202 	}
2203 	getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2204 	nfsvno_getfs(&fs, isdgram);
2205 	vput(vp);
2206 	nfsrv_postopattr(nd, getret, &at);
2207 	NFSM_BUILD(tl, u_int32_t *, NFSX_V3FSINFO);
2208 	*tl++ = txdr_unsigned(fs.fs_rtmax);
2209 	*tl++ = txdr_unsigned(fs.fs_rtpref);
2210 	*tl++ = txdr_unsigned(fs.fs_rtmult);
2211 	*tl++ = txdr_unsigned(fs.fs_wtmax);
2212 	*tl++ = txdr_unsigned(fs.fs_wtpref);
2213 	*tl++ = txdr_unsigned(fs.fs_wtmult);
2214 	*tl++ = txdr_unsigned(fs.fs_dtpref);
2215 	txdr_hyper(fs.fs_maxfilesize, tl);
2216 	tl += 2;
2217 	txdr_nfsv3time(&fs.fs_timedelta, tl);
2218 	tl += 2;
2219 	*tl = txdr_unsigned(fs.fs_properties);
2220 
2221 out:
2222 	NFSEXITCODE2(0, nd);
2223 	return (0);
2224 }
2225 
2226 /*
2227  * nfs pathconf service
2228  */
2229 int
2230 nfsrvd_pathconf(struct nfsrv_descript *nd, __unused int isdgram,
2231     vnode_t vp, __unused struct nfsexstuff *exp)
2232 {
2233 	struct nfsv3_pathconf *pc;
2234 	int getret = 1;
2235 	long linkmax, namemax, chownres, notrunc;
2236 	struct nfsvattr at;
2237 	struct thread *p = curthread;
2238 
2239 	if (nd->nd_repstat) {
2240 		nfsrv_postopattr(nd, getret, &at);
2241 		goto out;
2242 	}
2243 	nd->nd_repstat = nfsvno_pathconf(vp, _PC_LINK_MAX, &linkmax,
2244 	    nd->nd_cred, p);
2245 	if (!nd->nd_repstat)
2246 		nd->nd_repstat = nfsvno_pathconf(vp, _PC_NAME_MAX, &namemax,
2247 		    nd->nd_cred, p);
2248 	if (!nd->nd_repstat)
2249 		nd->nd_repstat=nfsvno_pathconf(vp, _PC_CHOWN_RESTRICTED,
2250 		    &chownres, nd->nd_cred, p);
2251 	if (!nd->nd_repstat)
2252 		nd->nd_repstat = nfsvno_pathconf(vp, _PC_NO_TRUNC, &notrunc,
2253 		    nd->nd_cred, p);
2254 	getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2255 	vput(vp);
2256 	nfsrv_postopattr(nd, getret, &at);
2257 	if (!nd->nd_repstat) {
2258 		NFSM_BUILD(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
2259 		pc->pc_linkmax = txdr_unsigned(linkmax);
2260 		pc->pc_namemax = txdr_unsigned(namemax);
2261 		pc->pc_notrunc = txdr_unsigned(notrunc);
2262 		pc->pc_chownrestricted = txdr_unsigned(chownres);
2263 
2264 		/*
2265 		 * These should probably be supported by VOP_PATHCONF(), but
2266 		 * until msdosfs is exportable (why would you want to?), the
2267 		 * Unix defaults should be ok.
2268 		 */
2269 		pc->pc_caseinsensitive = newnfs_false;
2270 		pc->pc_casepreserving = newnfs_true;
2271 	}
2272 
2273 out:
2274 	NFSEXITCODE2(0, nd);
2275 	return (0);
2276 }
2277 
2278 /*
2279  * nfsv4 lock service
2280  */
2281 int
2282 nfsrvd_lock(struct nfsrv_descript *nd, __unused int isdgram,
2283     vnode_t vp, struct nfsexstuff *exp)
2284 {
2285 	u_int32_t *tl;
2286 	int i;
2287 	struct nfsstate *stp = NULL;
2288 	struct nfslock *lop;
2289 	struct nfslockconflict cf;
2290 	int error = 0;
2291 	u_short flags = NFSLCK_LOCK, lflags;
2292 	u_int64_t offset, len;
2293 	nfsv4stateid_t stateid;
2294 	nfsquad_t clientid;
2295 	struct thread *p = curthread;
2296 
2297 	NFSM_DISSECT(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2298 	i = fxdr_unsigned(int, *tl++);
2299 	switch (i) {
2300 	case NFSV4LOCKT_READW:
2301 		flags |= NFSLCK_BLOCKING;
2302 	case NFSV4LOCKT_READ:
2303 		lflags = NFSLCK_READ;
2304 		break;
2305 	case NFSV4LOCKT_WRITEW:
2306 		flags |= NFSLCK_BLOCKING;
2307 	case NFSV4LOCKT_WRITE:
2308 		lflags = NFSLCK_WRITE;
2309 		break;
2310 	default:
2311 		nd->nd_repstat = NFSERR_BADXDR;
2312 		goto nfsmout;
2313 	}
2314 	if (*tl++ == newnfs_true)
2315 		flags |= NFSLCK_RECLAIM;
2316 	offset = fxdr_hyper(tl);
2317 	tl += 2;
2318 	len = fxdr_hyper(tl);
2319 	tl += 2;
2320 	if (*tl == newnfs_true)
2321 		flags |= NFSLCK_OPENTOLOCK;
2322 	if (flags & NFSLCK_OPENTOLOCK) {
2323 		NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED + NFSX_STATEID);
2324 		i = fxdr_unsigned(int, *(tl+4+(NFSX_STATEID / NFSX_UNSIGNED)));
2325 		if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2326 			nd->nd_repstat = NFSERR_BADXDR;
2327 			goto nfsmout;
2328 		}
2329 		stp = malloc(sizeof (struct nfsstate) + i,
2330 			M_NFSDSTATE, M_WAITOK);
2331 		stp->ls_ownerlen = i;
2332 		stp->ls_op = nd->nd_rp;
2333 		stp->ls_seq = fxdr_unsigned(int, *tl++);
2334 		stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2335 		NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2336 			NFSX_STATEIDOTHER);
2337 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2338 
2339 		/*
2340 		 * For the special stateid of other all 0s and seqid == 1, set
2341 		 * the stateid to the current stateid, if it is set.
2342 		 */
2343 		if ((nd->nd_flag & ND_NFSV41) != 0 &&
2344 		    stp->ls_stateid.seqid == 1 &&
2345 		    stp->ls_stateid.other[0] == 0 &&
2346 		    stp->ls_stateid.other[1] == 0 &&
2347 		    stp->ls_stateid.other[2] == 0) {
2348 			if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2349 				stp->ls_stateid = nd->nd_curstateid;
2350 				stp->ls_stateid.seqid = 0;
2351 			} else {
2352 				nd->nd_repstat = NFSERR_BADSTATEID;
2353 				goto nfsmout;
2354 			}
2355 		}
2356 
2357 		stp->ls_opentolockseq = fxdr_unsigned(int, *tl++);
2358 		clientid.lval[0] = *tl++;
2359 		clientid.lval[1] = *tl++;
2360 		if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2361 			if ((nd->nd_flag & ND_NFSV41) != 0)
2362 				clientid.qval = nd->nd_clientid.qval;
2363 			else if (nd->nd_clientid.qval != clientid.qval)
2364 				printf("EEK3 multiple clids\n");
2365 		} else {
2366 			if ((nd->nd_flag & ND_NFSV41) != 0)
2367 				printf("EEK! no clientid from session\n");
2368 			nd->nd_flag |= ND_IMPLIEDCLID;
2369 			nd->nd_clientid.qval = clientid.qval;
2370 		}
2371 		error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2372 		if (error)
2373 			goto nfsmout;
2374 	} else {
2375 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
2376 		stp = malloc(sizeof (struct nfsstate),
2377 			M_NFSDSTATE, M_WAITOK);
2378 		stp->ls_ownerlen = 0;
2379 		stp->ls_op = nd->nd_rp;
2380 		stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2381 		NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2382 			NFSX_STATEIDOTHER);
2383 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2384 
2385 		/*
2386 		 * For the special stateid of other all 0s and seqid == 1, set
2387 		 * the stateid to the current stateid, if it is set.
2388 		 */
2389 		if ((nd->nd_flag & ND_NFSV41) != 0 &&
2390 		    stp->ls_stateid.seqid == 1 &&
2391 		    stp->ls_stateid.other[0] == 0 &&
2392 		    stp->ls_stateid.other[1] == 0 &&
2393 		    stp->ls_stateid.other[2] == 0) {
2394 			if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2395 				stp->ls_stateid = nd->nd_curstateid;
2396 				stp->ls_stateid.seqid = 0;
2397 			} else {
2398 				nd->nd_repstat = NFSERR_BADSTATEID;
2399 				goto nfsmout;
2400 			}
2401 		}
2402 
2403 		stp->ls_seq = fxdr_unsigned(int, *tl);
2404 		clientid.lval[0] = stp->ls_stateid.other[0];
2405 		clientid.lval[1] = stp->ls_stateid.other[1];
2406 		if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2407 			if ((nd->nd_flag & ND_NFSV41) != 0)
2408 				clientid.qval = nd->nd_clientid.qval;
2409 			else if (nd->nd_clientid.qval != clientid.qval)
2410 				printf("EEK4 multiple clids\n");
2411 		} else {
2412 			if ((nd->nd_flag & ND_NFSV41) != 0)
2413 				printf("EEK! no clientid from session\n");
2414 			nd->nd_flag |= ND_IMPLIEDCLID;
2415 			nd->nd_clientid.qval = clientid.qval;
2416 		}
2417 	}
2418 	lop = malloc(sizeof (struct nfslock),
2419 		M_NFSDLOCK, M_WAITOK);
2420 	lop->lo_first = offset;
2421 	if (len == NFS64BITSSET) {
2422 		lop->lo_end = NFS64BITSSET;
2423 	} else {
2424 		lop->lo_end = offset + len;
2425 		if (lop->lo_end <= lop->lo_first)
2426 			nd->nd_repstat = NFSERR_INVAL;
2427 	}
2428 	lop->lo_flags = lflags;
2429 	stp->ls_flags = flags;
2430 	stp->ls_uid = nd->nd_cred->cr_uid;
2431 
2432 	/*
2433 	 * Do basic access checking.
2434 	 */
2435 	if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
2436 	    if (vnode_vtype(vp) == VDIR)
2437 		nd->nd_repstat = NFSERR_ISDIR;
2438 	    else
2439 		nd->nd_repstat = NFSERR_INVAL;
2440 	}
2441 	if (!nd->nd_repstat) {
2442 	    if (lflags & NFSLCK_WRITE) {
2443 		nd->nd_repstat = nfsvno_accchk(vp, VWRITE,
2444 		    nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2445 		    NFSACCCHK_VPISLOCKED, NULL);
2446 	    } else {
2447 		nd->nd_repstat = nfsvno_accchk(vp, VREAD,
2448 		    nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2449 		    NFSACCCHK_VPISLOCKED, NULL);
2450 		if (nd->nd_repstat)
2451 		    nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
2452 			nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2453 			NFSACCCHK_VPISLOCKED, NULL);
2454 	    }
2455 	}
2456 
2457 	/*
2458 	 * We call nfsrv_lockctrl() even if nd_repstat set, so that the
2459 	 * seqid# gets updated. nfsrv_lockctrl() will return the value
2460 	 * of nd_repstat, if it gets that far.
2461 	 */
2462 	nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, &cf, clientid,
2463 		&stateid, exp, nd, p);
2464 	if (lop)
2465 		free(lop, M_NFSDLOCK);
2466 	if (stp)
2467 		free(stp, M_NFSDSTATE);
2468 	if (!nd->nd_repstat) {
2469 		/* For NFSv4.1, set the Current StateID. */
2470 		if ((nd->nd_flag & ND_NFSV41) != 0) {
2471 			nd->nd_curstateid = stateid;
2472 			nd->nd_flag |= ND_CURSTATEID;
2473 		}
2474 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2475 		*tl++ = txdr_unsigned(stateid.seqid);
2476 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
2477 	} else if (nd->nd_repstat == NFSERR_DENIED) {
2478 		NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2479 		txdr_hyper(cf.cl_first, tl);
2480 		tl += 2;
2481 		if (cf.cl_end == NFS64BITSSET)
2482 			len = NFS64BITSSET;
2483 		else
2484 			len = cf.cl_end - cf.cl_first;
2485 		txdr_hyper(len, tl);
2486 		tl += 2;
2487 		if (cf.cl_flags == NFSLCK_WRITE)
2488 			*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
2489 		else
2490 			*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
2491 		*tl++ = stateid.other[0];
2492 		*tl = stateid.other[1];
2493 		(void) nfsm_strtom(nd, cf.cl_owner, cf.cl_ownerlen);
2494 	}
2495 	vput(vp);
2496 	NFSEXITCODE2(0, nd);
2497 	return (0);
2498 nfsmout:
2499 	vput(vp);
2500 	if (stp)
2501 		free(stp, M_NFSDSTATE);
2502 	NFSEXITCODE2(error, nd);
2503 	return (error);
2504 }
2505 
2506 /*
2507  * nfsv4 lock test service
2508  */
2509 int
2510 nfsrvd_lockt(struct nfsrv_descript *nd, __unused int isdgram,
2511     vnode_t vp, struct nfsexstuff *exp)
2512 {
2513 	u_int32_t *tl;
2514 	int i;
2515 	struct nfsstate *stp = NULL;
2516 	struct nfslock lo, *lop = &lo;
2517 	struct nfslockconflict cf;
2518 	int error = 0;
2519 	nfsv4stateid_t stateid;
2520 	nfsquad_t clientid;
2521 	u_int64_t len;
2522 	struct thread *p = curthread;
2523 
2524 	NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
2525 	i = fxdr_unsigned(int, *(tl + 7));
2526 	if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2527 		nd->nd_repstat = NFSERR_BADXDR;
2528 		goto nfsmout;
2529 	}
2530 	stp = malloc(sizeof (struct nfsstate) + i,
2531 	    M_NFSDSTATE, M_WAITOK);
2532 	stp->ls_ownerlen = i;
2533 	stp->ls_op = NULL;
2534 	stp->ls_flags = NFSLCK_TEST;
2535 	stp->ls_uid = nd->nd_cred->cr_uid;
2536 	i = fxdr_unsigned(int, *tl++);
2537 	switch (i) {
2538 	case NFSV4LOCKT_READW:
2539 		stp->ls_flags |= NFSLCK_BLOCKING;
2540 	case NFSV4LOCKT_READ:
2541 		lo.lo_flags = NFSLCK_READ;
2542 		break;
2543 	case NFSV4LOCKT_WRITEW:
2544 		stp->ls_flags |= NFSLCK_BLOCKING;
2545 	case NFSV4LOCKT_WRITE:
2546 		lo.lo_flags = NFSLCK_WRITE;
2547 		break;
2548 	default:
2549 		nd->nd_repstat = NFSERR_BADXDR;
2550 		goto nfsmout;
2551 	}
2552 	lo.lo_first = fxdr_hyper(tl);
2553 	tl += 2;
2554 	len = fxdr_hyper(tl);
2555 	if (len == NFS64BITSSET) {
2556 		lo.lo_end = NFS64BITSSET;
2557 	} else {
2558 		lo.lo_end = lo.lo_first + len;
2559 		if (lo.lo_end <= lo.lo_first)
2560 			nd->nd_repstat = NFSERR_INVAL;
2561 	}
2562 	tl += 2;
2563 	clientid.lval[0] = *tl++;
2564 	clientid.lval[1] = *tl;
2565 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2566 		if ((nd->nd_flag & ND_NFSV41) != 0)
2567 			clientid.qval = nd->nd_clientid.qval;
2568 		else if (nd->nd_clientid.qval != clientid.qval)
2569 			printf("EEK5 multiple clids\n");
2570 	} else {
2571 		if ((nd->nd_flag & ND_NFSV41) != 0)
2572 			printf("EEK! no clientid from session\n");
2573 		nd->nd_flag |= ND_IMPLIEDCLID;
2574 		nd->nd_clientid.qval = clientid.qval;
2575 	}
2576 	error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2577 	if (error)
2578 		goto nfsmout;
2579 	if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
2580 	    if (vnode_vtype(vp) == VDIR)
2581 		nd->nd_repstat = NFSERR_ISDIR;
2582 	    else
2583 		nd->nd_repstat = NFSERR_INVAL;
2584 	}
2585 	if (!nd->nd_repstat)
2586 	  nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, &cf, clientid,
2587 	    &stateid, exp, nd, p);
2588 	if (nd->nd_repstat) {
2589 	    if (nd->nd_repstat == NFSERR_DENIED) {
2590 		NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2591 		txdr_hyper(cf.cl_first, tl);
2592 		tl += 2;
2593 		if (cf.cl_end == NFS64BITSSET)
2594 			len = NFS64BITSSET;
2595 		else
2596 			len = cf.cl_end - cf.cl_first;
2597 		txdr_hyper(len, tl);
2598 		tl += 2;
2599 		if (cf.cl_flags == NFSLCK_WRITE)
2600 			*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
2601 		else
2602 			*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
2603 		*tl++ = stp->ls_stateid.other[0];
2604 		*tl = stp->ls_stateid.other[1];
2605 		(void) nfsm_strtom(nd, cf.cl_owner, cf.cl_ownerlen);
2606 	    }
2607 	}
2608 	vput(vp);
2609 	if (stp)
2610 		free(stp, M_NFSDSTATE);
2611 	NFSEXITCODE2(0, nd);
2612 	return (0);
2613 nfsmout:
2614 	vput(vp);
2615 	if (stp)
2616 		free(stp, M_NFSDSTATE);
2617 	NFSEXITCODE2(error, nd);
2618 	return (error);
2619 }
2620 
2621 /*
2622  * nfsv4 unlock service
2623  */
2624 int
2625 nfsrvd_locku(struct nfsrv_descript *nd, __unused int isdgram,
2626     vnode_t vp, struct nfsexstuff *exp)
2627 {
2628 	u_int32_t *tl;
2629 	int i;
2630 	struct nfsstate *stp;
2631 	struct nfslock *lop;
2632 	int error = 0;
2633 	nfsv4stateid_t stateid;
2634 	nfsquad_t clientid;
2635 	u_int64_t len;
2636 	struct thread *p = curthread;
2637 
2638 	NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED + NFSX_STATEID);
2639 	stp = malloc(sizeof (struct nfsstate),
2640 	    M_NFSDSTATE, M_WAITOK);
2641 	lop = malloc(sizeof (struct nfslock),
2642 	    M_NFSDLOCK, M_WAITOK);
2643 	stp->ls_flags = NFSLCK_UNLOCK;
2644 	lop->lo_flags = NFSLCK_UNLOCK;
2645 	stp->ls_op = nd->nd_rp;
2646 	i = fxdr_unsigned(int, *tl++);
2647 	switch (i) {
2648 	case NFSV4LOCKT_READW:
2649 		stp->ls_flags |= NFSLCK_BLOCKING;
2650 	case NFSV4LOCKT_READ:
2651 		break;
2652 	case NFSV4LOCKT_WRITEW:
2653 		stp->ls_flags |= NFSLCK_BLOCKING;
2654 	case NFSV4LOCKT_WRITE:
2655 		break;
2656 	default:
2657 		nd->nd_repstat = NFSERR_BADXDR;
2658 		free(stp, M_NFSDSTATE);
2659 		free(lop, M_NFSDLOCK);
2660 		goto nfsmout;
2661 	}
2662 	stp->ls_ownerlen = 0;
2663 	stp->ls_uid = nd->nd_cred->cr_uid;
2664 	stp->ls_seq = fxdr_unsigned(int, *tl++);
2665 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2666 	NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2667 	    NFSX_STATEIDOTHER);
2668 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2669 
2670 	/*
2671 	 * For the special stateid of other all 0s and seqid == 1, set the
2672 	 * stateid to the current stateid, if it is set.
2673 	 */
2674 	if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
2675 	    stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
2676 	    stp->ls_stateid.other[2] == 0) {
2677 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2678 			stp->ls_stateid = nd->nd_curstateid;
2679 			stp->ls_stateid.seqid = 0;
2680 		} else {
2681 			nd->nd_repstat = NFSERR_BADSTATEID;
2682 			goto nfsmout;
2683 		}
2684 	}
2685 
2686 	lop->lo_first = fxdr_hyper(tl);
2687 	tl += 2;
2688 	len = fxdr_hyper(tl);
2689 	if (len == NFS64BITSSET) {
2690 		lop->lo_end = NFS64BITSSET;
2691 	} else {
2692 		lop->lo_end = lop->lo_first + len;
2693 		if (lop->lo_end <= lop->lo_first)
2694 			nd->nd_repstat = NFSERR_INVAL;
2695 	}
2696 	clientid.lval[0] = stp->ls_stateid.other[0];
2697 	clientid.lval[1] = stp->ls_stateid.other[1];
2698 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2699 		if ((nd->nd_flag & ND_NFSV41) != 0)
2700 			clientid.qval = nd->nd_clientid.qval;
2701 		else if (nd->nd_clientid.qval != clientid.qval)
2702 			printf("EEK6 multiple clids\n");
2703 	} else {
2704 		if ((nd->nd_flag & ND_NFSV41) != 0)
2705 			printf("EEK! no clientid from session\n");
2706 		nd->nd_flag |= ND_IMPLIEDCLID;
2707 		nd->nd_clientid.qval = clientid.qval;
2708 	}
2709 	if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
2710 	    if (vnode_vtype(vp) == VDIR)
2711 		nd->nd_repstat = NFSERR_ISDIR;
2712 	    else
2713 		nd->nd_repstat = NFSERR_INVAL;
2714 	}
2715 	/*
2716 	 * Call nfsrv_lockctrl() even if nd_repstat is set, so that the
2717 	 * seqid# gets incremented. nfsrv_lockctrl() will return the
2718 	 * value of nd_repstat, if it gets that far.
2719 	 */
2720 	nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
2721 	    &stateid, exp, nd, p);
2722 	if (stp)
2723 		free(stp, M_NFSDSTATE);
2724 	if (lop)
2725 		free(lop, M_NFSDLOCK);
2726 	if (!nd->nd_repstat) {
2727 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2728 		*tl++ = txdr_unsigned(stateid.seqid);
2729 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
2730 	}
2731 nfsmout:
2732 	vput(vp);
2733 	NFSEXITCODE2(error, nd);
2734 	return (error);
2735 }
2736 
2737 /*
2738  * nfsv4 open service
2739  */
2740 int
2741 nfsrvd_open(struct nfsrv_descript *nd, __unused int isdgram,
2742     vnode_t dp, vnode_t *vpp, __unused fhandle_t *fhp, struct nfsexstuff *exp)
2743 {
2744 	u_int32_t *tl;
2745 	int i, retext;
2746 	struct nfsstate *stp = NULL;
2747 	int error = 0, create, claim, exclusive_flag = 0, override;
2748 	u_int32_t rflags = NFSV4OPEN_LOCKTYPEPOSIX, acemask;
2749 	int how = NFSCREATE_UNCHECKED;
2750 	int32_t cverf[2], tverf[2] = { 0, 0 };
2751 	vnode_t vp = NULL, dirp = NULL;
2752 	struct nfsvattr nva, dirfor, diraft;
2753 	struct nameidata named;
2754 	nfsv4stateid_t stateid, delegstateid;
2755 	nfsattrbit_t attrbits;
2756 	nfsquad_t clientid;
2757 	char *bufp = NULL;
2758 	u_long *hashp;
2759 	NFSACL_T *aclp = NULL;
2760 	struct thread *p = curthread;
2761 
2762 #ifdef NFS4_ACL_EXTATTR_NAME
2763 	aclp = acl_alloc(M_WAITOK);
2764 	aclp->acl_cnt = 0;
2765 #endif
2766 	NFSZERO_ATTRBIT(&attrbits);
2767 	named.ni_startdir = NULL;
2768 	named.ni_cnd.cn_nameiop = 0;
2769 	NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2770 	i = fxdr_unsigned(int, *(tl + 5));
2771 	if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2772 		nd->nd_repstat = NFSERR_BADXDR;
2773 		goto nfsmout;
2774 	}
2775 	stp = malloc(sizeof (struct nfsstate) + i,
2776 	    M_NFSDSTATE, M_WAITOK);
2777 	stp->ls_ownerlen = i;
2778 	stp->ls_op = nd->nd_rp;
2779 	stp->ls_flags = NFSLCK_OPEN;
2780 	stp->ls_uid = nd->nd_cred->cr_uid;
2781 	stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
2782 	i = fxdr_unsigned(int, *tl++);
2783 	retext = 0;
2784 	if ((i & (NFSV4OPEN_WANTDELEGMASK | NFSV4OPEN_WANTSIGNALDELEG |
2785 	    NFSV4OPEN_WANTPUSHDELEG)) != 0 && (nd->nd_flag & ND_NFSV41) != 0) {
2786 		retext = 1;
2787 		/* For now, ignore these. */
2788 		i &= ~(NFSV4OPEN_WANTPUSHDELEG | NFSV4OPEN_WANTSIGNALDELEG);
2789 		switch (i & NFSV4OPEN_WANTDELEGMASK) {
2790 		case NFSV4OPEN_WANTANYDELEG:
2791 			stp->ls_flags |= (NFSLCK_WANTRDELEG |
2792 			    NFSLCK_WANTWDELEG);
2793 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2794 			break;
2795 		case NFSV4OPEN_WANTREADDELEG:
2796 			stp->ls_flags |= NFSLCK_WANTRDELEG;
2797 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2798 			break;
2799 		case NFSV4OPEN_WANTWRITEDELEG:
2800 			stp->ls_flags |= NFSLCK_WANTWDELEG;
2801 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2802 			break;
2803 		case NFSV4OPEN_WANTNODELEG:
2804 			stp->ls_flags |= NFSLCK_WANTNODELEG;
2805 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2806 			break;
2807 		case NFSV4OPEN_WANTCANCEL:
2808 			printf("NFSv4: ignore Open WantCancel\n");
2809 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2810 			break;
2811 		default:
2812 			/* nd_repstat will be set to NFSERR_INVAL below. */
2813 			break;
2814 		}
2815 	}
2816 	switch (i) {
2817 	case NFSV4OPEN_ACCESSREAD:
2818 		stp->ls_flags |= NFSLCK_READACCESS;
2819 		break;
2820 	case NFSV4OPEN_ACCESSWRITE:
2821 		stp->ls_flags |= NFSLCK_WRITEACCESS;
2822 		break;
2823 	case NFSV4OPEN_ACCESSBOTH:
2824 		stp->ls_flags |= (NFSLCK_READACCESS | NFSLCK_WRITEACCESS);
2825 		break;
2826 	default:
2827 		nd->nd_repstat = NFSERR_INVAL;
2828 	}
2829 	i = fxdr_unsigned(int, *tl++);
2830 	switch (i) {
2831 	case NFSV4OPEN_DENYNONE:
2832 		break;
2833 	case NFSV4OPEN_DENYREAD:
2834 		stp->ls_flags |= NFSLCK_READDENY;
2835 		break;
2836 	case NFSV4OPEN_DENYWRITE:
2837 		stp->ls_flags |= NFSLCK_WRITEDENY;
2838 		break;
2839 	case NFSV4OPEN_DENYBOTH:
2840 		stp->ls_flags |= (NFSLCK_READDENY | NFSLCK_WRITEDENY);
2841 		break;
2842 	default:
2843 		nd->nd_repstat = NFSERR_INVAL;
2844 	}
2845 	clientid.lval[0] = *tl++;
2846 	clientid.lval[1] = *tl;
2847 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2848 		if ((nd->nd_flag & ND_NFSV41) != 0)
2849 			clientid.qval = nd->nd_clientid.qval;
2850 		else if (nd->nd_clientid.qval != clientid.qval)
2851 			printf("EEK7 multiple clids\n");
2852 	} else {
2853 		if ((nd->nd_flag & ND_NFSV41) != 0)
2854 			printf("EEK! no clientid from session\n");
2855 		nd->nd_flag |= ND_IMPLIEDCLID;
2856 		nd->nd_clientid.qval = clientid.qval;
2857 	}
2858 	error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2859 	if (error)
2860 		goto nfsmout;
2861 	NFSVNO_ATTRINIT(&nva);
2862 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2863 	create = fxdr_unsigned(int, *tl);
2864 	if (!nd->nd_repstat)
2865 		nd->nd_repstat = nfsvno_getattr(dp, &dirfor, nd, p, 0, NULL);
2866 	if (create == NFSV4OPEN_CREATE) {
2867 		nva.na_type = VREG;
2868 		nva.na_mode = 0;
2869 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2870 		how = fxdr_unsigned(int, *tl);
2871 		switch (how) {
2872 		case NFSCREATE_UNCHECKED:
2873 		case NFSCREATE_GUARDED:
2874 			error = nfsv4_sattr(nd, NULL, &nva, &attrbits, aclp, p);
2875 			if (error)
2876 				goto nfsmout;
2877 			/*
2878 			 * If the na_gid being set is the same as that of
2879 			 * the directory it is going in, clear it, since
2880 			 * that is what will be set by default. This allows
2881 			 * a user that isn't in that group to do the create.
2882 			 */
2883 			if (!nd->nd_repstat && NFSVNO_ISSETGID(&nva) &&
2884 			    nva.na_gid == dirfor.na_gid)
2885 				NFSVNO_UNSET(&nva, gid);
2886 			if (!nd->nd_repstat)
2887 				nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
2888 			break;
2889 		case NFSCREATE_EXCLUSIVE:
2890 			NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
2891 			cverf[0] = *tl++;
2892 			cverf[1] = *tl;
2893 			break;
2894 		case NFSCREATE_EXCLUSIVE41:
2895 			NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
2896 			cverf[0] = *tl++;
2897 			cverf[1] = *tl;
2898 			error = nfsv4_sattr(nd, NULL, &nva, &attrbits, aclp, p);
2899 			if (error != 0)
2900 				goto nfsmout;
2901 			if (NFSISSET_ATTRBIT(&attrbits,
2902 			    NFSATTRBIT_TIMEACCESSSET))
2903 				nd->nd_repstat = NFSERR_INVAL;
2904 			/*
2905 			 * If the na_gid being set is the same as that of
2906 			 * the directory it is going in, clear it, since
2907 			 * that is what will be set by default. This allows
2908 			 * a user that isn't in that group to do the create.
2909 			 */
2910 			if (nd->nd_repstat == 0 && NFSVNO_ISSETGID(&nva) &&
2911 			    nva.na_gid == dirfor.na_gid)
2912 				NFSVNO_UNSET(&nva, gid);
2913 			if (nd->nd_repstat == 0)
2914 				nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
2915 			break;
2916 		default:
2917 			nd->nd_repstat = NFSERR_BADXDR;
2918 			goto nfsmout;
2919 		}
2920 	} else if (create != NFSV4OPEN_NOCREATE) {
2921 		nd->nd_repstat = NFSERR_BADXDR;
2922 		goto nfsmout;
2923 	}
2924 
2925 	/*
2926 	 * Now, handle the claim, which usually includes looking up a
2927 	 * name in the directory referenced by dp. The exception is
2928 	 * NFSV4OPEN_CLAIMPREVIOUS.
2929 	 */
2930 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2931 	claim = fxdr_unsigned(int, *tl);
2932 	if (claim == NFSV4OPEN_CLAIMDELEGATECUR) {
2933 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
2934 		stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2935 		NFSBCOPY((caddr_t)tl,(caddr_t)stateid.other,NFSX_STATEIDOTHER);
2936 		stp->ls_flags |= NFSLCK_DELEGCUR;
2937 	} else if (claim == NFSV4OPEN_CLAIMDELEGATEPREV) {
2938 		stp->ls_flags |= NFSLCK_DELEGPREV;
2939 	}
2940 	if (claim == NFSV4OPEN_CLAIMNULL || claim == NFSV4OPEN_CLAIMDELEGATECUR
2941 	    || claim == NFSV4OPEN_CLAIMDELEGATEPREV) {
2942 		if (!nd->nd_repstat && create == NFSV4OPEN_CREATE &&
2943 		    claim != NFSV4OPEN_CLAIMNULL)
2944 			nd->nd_repstat = NFSERR_INVAL;
2945 		if (nd->nd_repstat) {
2946 			nd->nd_repstat = nfsrv_opencheck(clientid,
2947 			    &stateid, stp, NULL, nd, p, nd->nd_repstat);
2948 			goto nfsmout;
2949 		}
2950 		if (create == NFSV4OPEN_CREATE)
2951 		    NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
2952 			LOCKPARENT | LOCKLEAF | SAVESTART | NOCACHE);
2953 		else
2954 		    NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
2955 			LOCKLEAF | SAVESTART);
2956 		nfsvno_setpathbuf(&named, &bufp, &hashp);
2957 		error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
2958 		if (error) {
2959 			vrele(dp);
2960 #ifdef NFS4_ACL_EXTATTR_NAME
2961 			acl_free(aclp);
2962 #endif
2963 			free(stp, M_NFSDSTATE);
2964 			nfsvno_relpathbuf(&named);
2965 			NFSEXITCODE2(error, nd);
2966 			return (error);
2967 		}
2968 		if (!nd->nd_repstat) {
2969 			nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp,
2970 			    p, &dirp);
2971 		} else {
2972 			vrele(dp);
2973 			nfsvno_relpathbuf(&named);
2974 		}
2975 		if (create == NFSV4OPEN_CREATE) {
2976 		    switch (how) {
2977 		    case NFSCREATE_UNCHECKED:
2978 			if (named.ni_vp) {
2979 				/*
2980 				 * Clear the setable attribute bits, except
2981 				 * for Size, if it is being truncated.
2982 				 */
2983 				NFSZERO_ATTRBIT(&attrbits);
2984 				if (NFSVNO_ISSETSIZE(&nva))
2985 					NFSSETBIT_ATTRBIT(&attrbits,
2986 					    NFSATTRBIT_SIZE);
2987 			}
2988 			break;
2989 		    case NFSCREATE_GUARDED:
2990 			if (named.ni_vp && !nd->nd_repstat)
2991 				nd->nd_repstat = EEXIST;
2992 			break;
2993 		    case NFSCREATE_EXCLUSIVE:
2994 			exclusive_flag = 1;
2995 			if (!named.ni_vp)
2996 				nva.na_mode = 0;
2997 			break;
2998 		    case NFSCREATE_EXCLUSIVE41:
2999 			exclusive_flag = 1;
3000 			break;
3001 		    }
3002 		}
3003 		nfsvno_open(nd, &named, clientid, &stateid, stp,
3004 		    &exclusive_flag, &nva, cverf, create, aclp, &attrbits,
3005 		    nd->nd_cred, exp, &vp);
3006 	} else if (claim == NFSV4OPEN_CLAIMPREVIOUS || claim ==
3007 	    NFSV4OPEN_CLAIMFH) {
3008 		if (claim == NFSV4OPEN_CLAIMPREVIOUS) {
3009 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3010 			i = fxdr_unsigned(int, *tl);
3011 			switch (i) {
3012 			case NFSV4OPEN_DELEGATEREAD:
3013 				stp->ls_flags |= NFSLCK_DELEGREAD;
3014 				break;
3015 			case NFSV4OPEN_DELEGATEWRITE:
3016 				stp->ls_flags |= NFSLCK_DELEGWRITE;
3017 			case NFSV4OPEN_DELEGATENONE:
3018 				break;
3019 			default:
3020 				nd->nd_repstat = NFSERR_BADXDR;
3021 				goto nfsmout;
3022 			}
3023 			stp->ls_flags |= NFSLCK_RECLAIM;
3024 		} else {
3025 			/* CLAIM_NULL_FH */
3026 			if (nd->nd_repstat == 0 && create == NFSV4OPEN_CREATE)
3027 				nd->nd_repstat = NFSERR_INVAL;
3028 		}
3029 		vp = dp;
3030 		NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY);
3031 		if (!VN_IS_DOOMED(vp))
3032 			nd->nd_repstat = nfsrv_opencheck(clientid, &stateid,
3033 			    stp, vp, nd, p, nd->nd_repstat);
3034 		else
3035 			nd->nd_repstat = NFSERR_PERM;
3036 	} else {
3037 		nd->nd_repstat = NFSERR_BADXDR;
3038 		goto nfsmout;
3039 	}
3040 
3041 	/*
3042 	 * Do basic access checking.
3043 	 */
3044 	if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
3045 		/*
3046 		 * The IETF working group decided that this is the correct
3047 		 * error return for all non-regular files.
3048 		 */
3049 		nd->nd_repstat = (vp->v_type == VDIR) ? NFSERR_ISDIR : NFSERR_SYMLINK;
3050 	}
3051 
3052 	/*
3053 	 * If the Open is being done for a file that already exists, apply
3054 	 * normal permission checking including for the file owner, if
3055 	 * vfs.nfsd.v4openaccess is set.
3056 	 * Previously, the owner was always allowed to open the file to
3057 	 * be consistent with the NFS tradition of always allowing the
3058 	 * owner of the file to write to the file regardless of permissions.
3059 	 * It now appears that the Linux client expects the owner
3060 	 * permissions to be checked for opens that are not creating the
3061 	 * file.  I believe the correct approach is to use the Access
3062 	 * operation's results to be consistent with NFSv3, but that is
3063 	 * not what the current Linux client appears to be doing.
3064 	 * Since both the Linux and OpenSolaris NFSv4 servers do this check,
3065 	 * I have enabled it by default.
3066 	 * If this semantic change causes a problem, it can be disabled by
3067 	 * setting the sysctl vfs.nfsd.v4openaccess to 0 to re-enable the
3068 	 * previous semantics.
3069 	 */
3070 	if (nfsrv_openaccess && create == NFSV4OPEN_NOCREATE)
3071 		override = NFSACCCHK_NOOVERRIDE;
3072 	else
3073 		override = NFSACCCHK_ALLOWOWNER;
3074 	if (!nd->nd_repstat && (stp->ls_flags & NFSLCK_WRITEACCESS))
3075 	    nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred,
3076 	        exp, p, override, NFSACCCHK_VPISLOCKED, NULL);
3077 	if (!nd->nd_repstat && (stp->ls_flags & NFSLCK_READACCESS)) {
3078 	    nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred,
3079 	        exp, p, override, NFSACCCHK_VPISLOCKED, NULL);
3080 	    if (nd->nd_repstat)
3081 		nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
3082 		    nd->nd_cred, exp, p, override,
3083 		    NFSACCCHK_VPISLOCKED, NULL);
3084 	}
3085 
3086 	if (!nd->nd_repstat) {
3087 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
3088 		if (!nd->nd_repstat) {
3089 			tverf[0] = nva.na_atime.tv_sec;
3090 			tverf[1] = nva.na_atime.tv_nsec;
3091 		}
3092 	}
3093 	if (!nd->nd_repstat && exclusive_flag && (cverf[0] != tverf[0] ||
3094 	    cverf[1] != tverf[1]))
3095 		nd->nd_repstat = EEXIST;
3096 	/*
3097 	 * Do the open locking/delegation stuff.
3098 	 */
3099 	if (!nd->nd_repstat)
3100 	    nd->nd_repstat = nfsrv_openctrl(nd, vp, &stp, clientid, &stateid,
3101 		&delegstateid, &rflags, exp, p, nva.na_filerev);
3102 
3103 	/*
3104 	 * vp must be unlocked before the call to nfsvno_getattr(dirp,...)
3105 	 * below, to avoid a deadlock with the lookup in nfsvno_namei() above.
3106 	 * (ie: Leave the NFSVOPUNLOCK() about here.)
3107 	 */
3108 	if (vp)
3109 		NFSVOPUNLOCK(vp);
3110 	if (stp)
3111 		free(stp, M_NFSDSTATE);
3112 	if (!nd->nd_repstat && dirp)
3113 		nd->nd_repstat = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
3114 	if (!nd->nd_repstat) {
3115 		/* For NFSv4.1, set the Current StateID. */
3116 		if ((nd->nd_flag & ND_NFSV41) != 0) {
3117 			nd->nd_curstateid = stateid;
3118 			nd->nd_flag |= ND_CURSTATEID;
3119 		}
3120 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 6 * NFSX_UNSIGNED);
3121 		*tl++ = txdr_unsigned(stateid.seqid);
3122 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3123 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3124 		if (claim == NFSV4OPEN_CLAIMPREVIOUS) {
3125 			*tl++ = newnfs_true;
3126 			*tl++ = 0;
3127 			*tl++ = 0;
3128 			*tl++ = 0;
3129 			*tl++ = 0;
3130 		} else {
3131 			*tl++ = newnfs_false;	/* Since dirp is not locked */
3132 			txdr_hyper(dirfor.na_filerev, tl);
3133 			tl += 2;
3134 			txdr_hyper(diraft.na_filerev, tl);
3135 			tl += 2;
3136 		}
3137 		*tl = txdr_unsigned(rflags & NFSV4OPEN_RFLAGS);
3138 		(void) nfsrv_putattrbit(nd, &attrbits);
3139 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3140 		if (rflags & NFSV4OPEN_READDELEGATE)
3141 			*tl = txdr_unsigned(NFSV4OPEN_DELEGATEREAD);
3142 		else if (rflags & NFSV4OPEN_WRITEDELEGATE)
3143 			*tl = txdr_unsigned(NFSV4OPEN_DELEGATEWRITE);
3144 		else if (retext != 0) {
3145 			*tl = txdr_unsigned(NFSV4OPEN_DELEGATENONEEXT);
3146 			if ((rflags & NFSV4OPEN_WDNOTWANTED) != 0) {
3147 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3148 				*tl = txdr_unsigned(NFSV4OPEN_NOTWANTED);
3149 			} else if ((rflags & NFSV4OPEN_WDSUPPFTYPE) != 0) {
3150 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3151 				*tl = txdr_unsigned(NFSV4OPEN_NOTSUPPFTYPE);
3152 			} else if ((rflags & NFSV4OPEN_WDCONTENTION) != 0) {
3153 				NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3154 				*tl++ = txdr_unsigned(NFSV4OPEN_CONTENTION);
3155 				*tl = newnfs_false;
3156 			} else if ((rflags & NFSV4OPEN_WDRESOURCE) != 0) {
3157 				NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3158 				*tl++ = txdr_unsigned(NFSV4OPEN_RESOURCE);
3159 				*tl = newnfs_false;
3160 			} else {
3161 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3162 				*tl = txdr_unsigned(NFSV4OPEN_NOTWANTED);
3163 			}
3164 		} else
3165 			*tl = txdr_unsigned(NFSV4OPEN_DELEGATENONE);
3166 		if (rflags & (NFSV4OPEN_READDELEGATE|NFSV4OPEN_WRITEDELEGATE)) {
3167 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID+NFSX_UNSIGNED);
3168 			*tl++ = txdr_unsigned(delegstateid.seqid);
3169 			NFSBCOPY((caddr_t)delegstateid.other, (caddr_t)tl,
3170 			    NFSX_STATEIDOTHER);
3171 			tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3172 			if (rflags & NFSV4OPEN_RECALL)
3173 				*tl = newnfs_true;
3174 			else
3175 				*tl = newnfs_false;
3176 			if (rflags & NFSV4OPEN_WRITEDELEGATE) {
3177 				NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3178 				*tl++ = txdr_unsigned(NFSV4OPEN_LIMITSIZE);
3179 				txdr_hyper(nva.na_size, tl);
3180 			}
3181 			NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3182 			*tl++ = txdr_unsigned(NFSV4ACE_ALLOWEDTYPE);
3183 			*tl++ = txdr_unsigned(0x0);
3184 			acemask = NFSV4ACE_ALLFILESMASK;
3185 			if (nva.na_mode & S_IRUSR)
3186 			    acemask |= NFSV4ACE_READMASK;
3187 			if (nva.na_mode & S_IWUSR)
3188 			    acemask |= NFSV4ACE_WRITEMASK;
3189 			if (nva.na_mode & S_IXUSR)
3190 			    acemask |= NFSV4ACE_EXECUTEMASK;
3191 			*tl = txdr_unsigned(acemask);
3192 			(void) nfsm_strtom(nd, "OWNER@", 6);
3193 		}
3194 		*vpp = vp;
3195 	} else if (vp) {
3196 		vrele(vp);
3197 	}
3198 	if (dirp)
3199 		vrele(dirp);
3200 #ifdef NFS4_ACL_EXTATTR_NAME
3201 	acl_free(aclp);
3202 #endif
3203 	NFSEXITCODE2(0, nd);
3204 	return (0);
3205 nfsmout:
3206 	vrele(dp);
3207 #ifdef NFS4_ACL_EXTATTR_NAME
3208 	acl_free(aclp);
3209 #endif
3210 	if (stp)
3211 		free(stp, M_NFSDSTATE);
3212 	NFSEXITCODE2(error, nd);
3213 	return (error);
3214 }
3215 
3216 /*
3217  * nfsv4 close service
3218  */
3219 int
3220 nfsrvd_close(struct nfsrv_descript *nd, __unused int isdgram,
3221     vnode_t vp, __unused struct nfsexstuff *exp)
3222 {
3223 	u_int32_t *tl;
3224 	struct nfsstate st, *stp = &st;
3225 	int error = 0, writeacc;
3226 	nfsv4stateid_t stateid;
3227 	nfsquad_t clientid;
3228 	struct nfsvattr na;
3229 	struct thread *p = curthread;
3230 
3231 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
3232 	stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
3233 	stp->ls_ownerlen = 0;
3234 	stp->ls_op = nd->nd_rp;
3235 	stp->ls_uid = nd->nd_cred->cr_uid;
3236 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3237 	NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3238 	    NFSX_STATEIDOTHER);
3239 
3240 	/*
3241 	 * For the special stateid of other all 0s and seqid == 1, set the
3242 	 * stateid to the current stateid, if it is set.
3243 	 */
3244 	if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
3245 	    stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
3246 	    stp->ls_stateid.other[2] == 0) {
3247 		if ((nd->nd_flag & ND_CURSTATEID) != 0)
3248 			stp->ls_stateid = nd->nd_curstateid;
3249 		else {
3250 			nd->nd_repstat = NFSERR_BADSTATEID;
3251 			goto nfsmout;
3252 		}
3253 	}
3254 
3255 	stp->ls_flags = NFSLCK_CLOSE;
3256 	clientid.lval[0] = stp->ls_stateid.other[0];
3257 	clientid.lval[1] = stp->ls_stateid.other[1];
3258 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3259 		if ((nd->nd_flag & ND_NFSV41) != 0)
3260 			clientid.qval = nd->nd_clientid.qval;
3261 		else if (nd->nd_clientid.qval != clientid.qval)
3262 			printf("EEK8 multiple clids\n");
3263 	} else {
3264 		if ((nd->nd_flag & ND_NFSV41) != 0)
3265 			printf("EEK! no clientid from session\n");
3266 		nd->nd_flag |= ND_IMPLIEDCLID;
3267 		nd->nd_clientid.qval = clientid.qval;
3268 	}
3269 	nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid, nd, p,
3270 	    &writeacc);
3271 	/* For pNFS, update the attributes. */
3272 	if (writeacc != 0 || nfsrv_pnfsatime != 0)
3273 		nfsrv_updatemdsattr(vp, &na, p);
3274 	vput(vp);
3275 	if (!nd->nd_repstat) {
3276 		/*
3277 		 * If the stateid that has been closed is the current stateid,
3278 		 * unset it.
3279 		 */
3280 		if ((nd->nd_flag & ND_CURSTATEID) != 0 &&
3281 		    stateid.other[0] == nd->nd_curstateid.other[0] &&
3282 		    stateid.other[1] == nd->nd_curstateid.other[1] &&
3283 		    stateid.other[2] == nd->nd_curstateid.other[2])
3284 			nd->nd_flag &= ~ND_CURSTATEID;
3285 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3286 		*tl++ = txdr_unsigned(stateid.seqid);
3287 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3288 	}
3289 	NFSEXITCODE2(0, nd);
3290 	return (0);
3291 nfsmout:
3292 	vput(vp);
3293 	NFSEXITCODE2(error, nd);
3294 	return (error);
3295 }
3296 
3297 /*
3298  * nfsv4 delegpurge service
3299  */
3300 int
3301 nfsrvd_delegpurge(struct nfsrv_descript *nd, __unused int isdgram,
3302     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3303 {
3304 	u_int32_t *tl;
3305 	int error = 0;
3306 	nfsquad_t clientid;
3307 	struct thread *p = curthread;
3308 
3309 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3310 		nd->nd_repstat = NFSERR_WRONGSEC;
3311 		goto nfsmout;
3312 	}
3313 	NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3314 	clientid.lval[0] = *tl++;
3315 	clientid.lval[1] = *tl;
3316 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3317 		if ((nd->nd_flag & ND_NFSV41) != 0)
3318 			clientid.qval = nd->nd_clientid.qval;
3319 		else if (nd->nd_clientid.qval != clientid.qval)
3320 			printf("EEK9 multiple clids\n");
3321 	} else {
3322 		if ((nd->nd_flag & ND_NFSV41) != 0)
3323 			printf("EEK! no clientid from session\n");
3324 		nd->nd_flag |= ND_IMPLIEDCLID;
3325 		nd->nd_clientid.qval = clientid.qval;
3326 	}
3327 	nd->nd_repstat = nfsrv_delegupdate(nd, clientid, NULL, NULL,
3328 	    NFSV4OP_DELEGPURGE, nd->nd_cred, p, NULL);
3329 nfsmout:
3330 	NFSEXITCODE2(error, nd);
3331 	return (error);
3332 }
3333 
3334 /*
3335  * nfsv4 delegreturn service
3336  */
3337 int
3338 nfsrvd_delegreturn(struct nfsrv_descript *nd, __unused int isdgram,
3339     vnode_t vp, __unused struct nfsexstuff *exp)
3340 {
3341 	u_int32_t *tl;
3342 	int error = 0, writeacc;
3343 	nfsv4stateid_t stateid;
3344 	nfsquad_t clientid;
3345 	struct nfsvattr na;
3346 	struct thread *p = curthread;
3347 
3348 	NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
3349 	stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3350 	NFSBCOPY((caddr_t)tl, (caddr_t)stateid.other, NFSX_STATEIDOTHER);
3351 	clientid.lval[0] = stateid.other[0];
3352 	clientid.lval[1] = stateid.other[1];
3353 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3354 		if ((nd->nd_flag & ND_NFSV41) != 0)
3355 			clientid.qval = nd->nd_clientid.qval;
3356 		else if (nd->nd_clientid.qval != clientid.qval)
3357 			printf("EEK10 multiple clids\n");
3358 	} else {
3359 		if ((nd->nd_flag & ND_NFSV41) != 0)
3360 			printf("EEK! no clientid from session\n");
3361 		nd->nd_flag |= ND_IMPLIEDCLID;
3362 		nd->nd_clientid.qval = clientid.qval;
3363 	}
3364 	nd->nd_repstat = nfsrv_delegupdate(nd, clientid, &stateid, vp,
3365 	    NFSV4OP_DELEGRETURN, nd->nd_cred, p, &writeacc);
3366 	/* For pNFS, update the attributes. */
3367 	if (writeacc != 0 || nfsrv_pnfsatime != 0)
3368 		nfsrv_updatemdsattr(vp, &na, p);
3369 nfsmout:
3370 	vput(vp);
3371 	NFSEXITCODE2(error, nd);
3372 	return (error);
3373 }
3374 
3375 /*
3376  * nfsv4 get file handle service
3377  */
3378 int
3379 nfsrvd_getfh(struct nfsrv_descript *nd, __unused int isdgram,
3380     vnode_t vp, __unused struct nfsexstuff *exp)
3381 {
3382 	fhandle_t fh;
3383 	struct thread *p = curthread;
3384 
3385 	nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
3386 	vput(vp);
3387 	if (!nd->nd_repstat)
3388 		(void) nfsm_fhtom(nd, (u_int8_t *)&fh, 0, 0);
3389 	NFSEXITCODE2(0, nd);
3390 	return (0);
3391 }
3392 
3393 /*
3394  * nfsv4 open confirm service
3395  */
3396 int
3397 nfsrvd_openconfirm(struct nfsrv_descript *nd, __unused int isdgram,
3398     vnode_t vp, __unused struct nfsexstuff *exp)
3399 {
3400 	u_int32_t *tl;
3401 	struct nfsstate st, *stp = &st;
3402 	int error = 0;
3403 	nfsv4stateid_t stateid;
3404 	nfsquad_t clientid;
3405 	struct thread *p = curthread;
3406 
3407 	if ((nd->nd_flag & ND_NFSV41) != 0) {
3408 		nd->nd_repstat = NFSERR_NOTSUPP;
3409 		goto nfsmout;
3410 	}
3411 	NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
3412 	stp->ls_ownerlen = 0;
3413 	stp->ls_op = nd->nd_rp;
3414 	stp->ls_uid = nd->nd_cred->cr_uid;
3415 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3416 	NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3417 	    NFSX_STATEIDOTHER);
3418 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3419 	stp->ls_seq = fxdr_unsigned(u_int32_t, *tl);
3420 	stp->ls_flags = NFSLCK_CONFIRM;
3421 	clientid.lval[0] = stp->ls_stateid.other[0];
3422 	clientid.lval[1] = stp->ls_stateid.other[1];
3423 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3424 		if ((nd->nd_flag & ND_NFSV41) != 0)
3425 			clientid.qval = nd->nd_clientid.qval;
3426 		else if (nd->nd_clientid.qval != clientid.qval)
3427 			printf("EEK11 multiple clids\n");
3428 	} else {
3429 		if ((nd->nd_flag & ND_NFSV41) != 0)
3430 			printf("EEK! no clientid from session\n");
3431 		nd->nd_flag |= ND_IMPLIEDCLID;
3432 		nd->nd_clientid.qval = clientid.qval;
3433 	}
3434 	nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid, nd, p,
3435 	    NULL);
3436 	if (!nd->nd_repstat) {
3437 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3438 		*tl++ = txdr_unsigned(stateid.seqid);
3439 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3440 	}
3441 nfsmout:
3442 	vput(vp);
3443 	NFSEXITCODE2(error, nd);
3444 	return (error);
3445 }
3446 
3447 /*
3448  * nfsv4 open downgrade service
3449  */
3450 int
3451 nfsrvd_opendowngrade(struct nfsrv_descript *nd, __unused int isdgram,
3452     vnode_t vp, __unused struct nfsexstuff *exp)
3453 {
3454 	u_int32_t *tl;
3455 	int i;
3456 	struct nfsstate st, *stp = &st;
3457 	int error = 0;
3458 	nfsv4stateid_t stateid;
3459 	nfsquad_t clientid;
3460 	struct thread *p = curthread;
3461 
3462 	/* opendowngrade can only work on a file object.*/
3463 	if (vp->v_type != VREG) {
3464 		error = NFSERR_INVAL;
3465 		goto nfsmout;
3466 	}
3467 	NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 3 * NFSX_UNSIGNED);
3468 	stp->ls_ownerlen = 0;
3469 	stp->ls_op = nd->nd_rp;
3470 	stp->ls_uid = nd->nd_cred->cr_uid;
3471 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3472 	NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3473 	    NFSX_STATEIDOTHER);
3474 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3475 
3476 	/*
3477 	 * For the special stateid of other all 0s and seqid == 1, set the
3478 	 * stateid to the current stateid, if it is set.
3479 	 */
3480 	if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
3481 	    stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
3482 	    stp->ls_stateid.other[2] == 0) {
3483 		if ((nd->nd_flag & ND_CURSTATEID) != 0)
3484 			stp->ls_stateid = nd->nd_curstateid;
3485 		else {
3486 			nd->nd_repstat = NFSERR_BADSTATEID;
3487 			goto nfsmout;
3488 		}
3489 	}
3490 
3491 	stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
3492 	i = fxdr_unsigned(int, *tl++);
3493 	if ((nd->nd_flag & ND_NFSV41) != 0)
3494 		i &= ~NFSV4OPEN_WANTDELEGMASK;
3495 	switch (i) {
3496 	case NFSV4OPEN_ACCESSREAD:
3497 		stp->ls_flags = (NFSLCK_READACCESS | NFSLCK_DOWNGRADE);
3498 		break;
3499 	case NFSV4OPEN_ACCESSWRITE:
3500 		stp->ls_flags = (NFSLCK_WRITEACCESS | NFSLCK_DOWNGRADE);
3501 		break;
3502 	case NFSV4OPEN_ACCESSBOTH:
3503 		stp->ls_flags = (NFSLCK_READACCESS | NFSLCK_WRITEACCESS |
3504 		    NFSLCK_DOWNGRADE);
3505 		break;
3506 	default:
3507 		nd->nd_repstat = NFSERR_INVAL;
3508 	}
3509 	i = fxdr_unsigned(int, *tl);
3510 	switch (i) {
3511 	case NFSV4OPEN_DENYNONE:
3512 		break;
3513 	case NFSV4OPEN_DENYREAD:
3514 		stp->ls_flags |= NFSLCK_READDENY;
3515 		break;
3516 	case NFSV4OPEN_DENYWRITE:
3517 		stp->ls_flags |= NFSLCK_WRITEDENY;
3518 		break;
3519 	case NFSV4OPEN_DENYBOTH:
3520 		stp->ls_flags |= (NFSLCK_READDENY | NFSLCK_WRITEDENY);
3521 		break;
3522 	default:
3523 		nd->nd_repstat = NFSERR_INVAL;
3524 	}
3525 
3526 	clientid.lval[0] = stp->ls_stateid.other[0];
3527 	clientid.lval[1] = stp->ls_stateid.other[1];
3528 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3529 		if ((nd->nd_flag & ND_NFSV41) != 0)
3530 			clientid.qval = nd->nd_clientid.qval;
3531 		else if (nd->nd_clientid.qval != clientid.qval)
3532 			printf("EEK12 multiple clids\n");
3533 	} else {
3534 		if ((nd->nd_flag & ND_NFSV41) != 0)
3535 			printf("EEK! no clientid from session\n");
3536 		nd->nd_flag |= ND_IMPLIEDCLID;
3537 		nd->nd_clientid.qval = clientid.qval;
3538 	}
3539 	if (!nd->nd_repstat)
3540 		nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid,
3541 		    nd, p, NULL);
3542 	if (!nd->nd_repstat) {
3543 		/* For NFSv4.1, set the Current StateID. */
3544 		if ((nd->nd_flag & ND_NFSV41) != 0) {
3545 			nd->nd_curstateid = stateid;
3546 			nd->nd_flag |= ND_CURSTATEID;
3547 		}
3548 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3549 		*tl++ = txdr_unsigned(stateid.seqid);
3550 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3551 	}
3552 nfsmout:
3553 	vput(vp);
3554 	NFSEXITCODE2(error, nd);
3555 	return (error);
3556 }
3557 
3558 /*
3559  * nfsv4 renew lease service
3560  */
3561 int
3562 nfsrvd_renew(struct nfsrv_descript *nd, __unused int isdgram,
3563     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3564 {
3565 	u_int32_t *tl;
3566 	int error = 0;
3567 	nfsquad_t clientid;
3568 	struct thread *p = curthread;
3569 
3570 	if ((nd->nd_flag & ND_NFSV41) != 0) {
3571 		nd->nd_repstat = NFSERR_NOTSUPP;
3572 		goto nfsmout;
3573 	}
3574 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3575 		nd->nd_repstat = NFSERR_WRONGSEC;
3576 		goto nfsmout;
3577 	}
3578 	NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
3579 	clientid.lval[0] = *tl++;
3580 	clientid.lval[1] = *tl;
3581 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3582 		if ((nd->nd_flag & ND_NFSV41) != 0)
3583 			clientid.qval = nd->nd_clientid.qval;
3584 		else if (nd->nd_clientid.qval != clientid.qval)
3585 			printf("EEK13 multiple clids\n");
3586 	} else {
3587 		if ((nd->nd_flag & ND_NFSV41) != 0)
3588 			printf("EEK! no clientid from session\n");
3589 		nd->nd_flag |= ND_IMPLIEDCLID;
3590 		nd->nd_clientid.qval = clientid.qval;
3591 	}
3592 	nd->nd_repstat = nfsrv_getclient(clientid, (CLOPS_RENEWOP|CLOPS_RENEW),
3593 	    NULL, NULL, (nfsquad_t)((u_quad_t)0), 0, nd, p);
3594 nfsmout:
3595 	NFSEXITCODE2(error, nd);
3596 	return (error);
3597 }
3598 
3599 /*
3600  * nfsv4 security info service
3601  */
3602 int
3603 nfsrvd_secinfo(struct nfsrv_descript *nd, int isdgram,
3604     vnode_t dp, struct nfsexstuff *exp)
3605 {
3606 	u_int32_t *tl;
3607 	int len;
3608 	struct nameidata named;
3609 	vnode_t dirp = NULL, vp;
3610 	struct nfsrvfh fh;
3611 	struct nfsexstuff retnes;
3612 	u_int32_t *sizp;
3613 	int error = 0, savflag, i;
3614 	char *bufp;
3615 	u_long *hashp;
3616 	struct thread *p = curthread;
3617 
3618 	/*
3619 	 * All this just to get the export flags for the name.
3620 	 */
3621 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
3622 	    LOCKLEAF | SAVESTART);
3623 	nfsvno_setpathbuf(&named, &bufp, &hashp);
3624 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
3625 	if (error) {
3626 		vput(dp);
3627 		nfsvno_relpathbuf(&named);
3628 		goto out;
3629 	}
3630 	if (!nd->nd_repstat) {
3631 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, p, &dirp);
3632 	} else {
3633 		vput(dp);
3634 		nfsvno_relpathbuf(&named);
3635 	}
3636 	if (dirp)
3637 		vrele(dirp);
3638 	if (nd->nd_repstat)
3639 		goto out;
3640 	vrele(named.ni_startdir);
3641 	nfsvno_relpathbuf(&named);
3642 	fh.nfsrvfh_len = NFSX_MYFH;
3643 	vp = named.ni_vp;
3644 	nd->nd_repstat = nfsvno_getfh(vp, (fhandle_t *)fh.nfsrvfh_data, p);
3645 	vput(vp);
3646 	savflag = nd->nd_flag;
3647 	if (!nd->nd_repstat) {
3648 		nfsd_fhtovp(nd, &fh, LK_SHARED, &vp, &retnes, NULL, 0);
3649 		if (vp)
3650 			vput(vp);
3651 	}
3652 	nd->nd_flag = savflag;
3653 	if (nd->nd_repstat)
3654 		goto out;
3655 
3656 	/*
3657 	 * Finally have the export flags for name, so we can create
3658 	 * the security info.
3659 	 */
3660 	len = 0;
3661 	NFSM_BUILD(sizp, u_int32_t *, NFSX_UNSIGNED);
3662 	for (i = 0; i < retnes.nes_numsecflavor; i++) {
3663 		if (retnes.nes_secflavors[i] == AUTH_SYS) {
3664 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3665 			*tl = txdr_unsigned(RPCAUTH_UNIX);
3666 			len++;
3667 		} else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5) {
3668 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3669 			*tl++ = txdr_unsigned(RPCAUTH_GSS);
3670 			(void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3671 			    nfsgss_mechlist[KERBV_MECH].len);
3672 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3673 			*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3674 			*tl = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3675 			len++;
3676 		} else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5I) {
3677 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3678 			*tl++ = txdr_unsigned(RPCAUTH_GSS);
3679 			(void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3680 			    nfsgss_mechlist[KERBV_MECH].len);
3681 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3682 			*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3683 			*tl = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3684 			len++;
3685 		} else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5P) {
3686 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3687 			*tl++ = txdr_unsigned(RPCAUTH_GSS);
3688 			(void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3689 			    nfsgss_mechlist[KERBV_MECH].len);
3690 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3691 			*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3692 			*tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3693 			len++;
3694 		}
3695 	}
3696 	*sizp = txdr_unsigned(len);
3697 
3698 out:
3699 	NFSEXITCODE2(error, nd);
3700 	return (error);
3701 }
3702 
3703 /*
3704  * nfsv4 set client id service
3705  */
3706 int
3707 nfsrvd_setclientid(struct nfsrv_descript *nd, __unused int isdgram,
3708     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3709 {
3710 	u_int32_t *tl;
3711 	int i;
3712 	int error = 0, idlen;
3713 	struct nfsclient *clp = NULL;
3714 #ifdef INET
3715 	struct sockaddr_in *rin;
3716 #endif
3717 #ifdef INET6
3718 	struct sockaddr_in6 *rin6;
3719 #endif
3720 #if defined(INET) || defined(INET6)
3721 	u_char *ucp, *ucp2;
3722 #endif
3723 	u_char *verf, *addrbuf;
3724 	nfsquad_t clientid, confirm;
3725 	struct thread *p = curthread;
3726 
3727 	if ((nd->nd_flag & ND_NFSV41) != 0) {
3728 		nd->nd_repstat = NFSERR_NOTSUPP;
3729 		goto nfsmout;
3730 	}
3731 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3732 		nd->nd_repstat = NFSERR_WRONGSEC;
3733 		goto out;
3734 	}
3735 	NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF + NFSX_UNSIGNED);
3736 	verf = (u_char *)tl;
3737 	tl += (NFSX_VERF / NFSX_UNSIGNED);
3738 	i = fxdr_unsigned(int, *tl);
3739 	if (i > NFSV4_OPAQUELIMIT || i <= 0) {
3740 		nd->nd_repstat = NFSERR_BADXDR;
3741 		goto nfsmout;
3742 	}
3743 	idlen = i;
3744 	if (nd->nd_flag & ND_GSS)
3745 		i += nd->nd_princlen;
3746 	clp = malloc(sizeof(struct nfsclient) + i, M_NFSDCLIENT, M_WAITOK |
3747 	    M_ZERO);
3748 	clp->lc_stateid = malloc(sizeof(struct nfsstatehead) *
3749 	    nfsrv_statehashsize, M_NFSDCLIENT, M_WAITOK);
3750 	NFSINITSOCKMUTEX(&clp->lc_req.nr_mtx);
3751 	/* Allocated large enough for an AF_INET or AF_INET6 socket. */
3752 	clp->lc_req.nr_nam = malloc(sizeof(struct sockaddr_in6), M_SONAME,
3753 	    M_WAITOK | M_ZERO);
3754 	clp->lc_req.nr_cred = NULL;
3755 	NFSBCOPY(verf, clp->lc_verf, NFSX_VERF);
3756 	clp->lc_idlen = idlen;
3757 	error = nfsrv_mtostr(nd, clp->lc_id, idlen);
3758 	if (error)
3759 		goto nfsmout;
3760 	if (nd->nd_flag & ND_GSS) {
3761 		clp->lc_flags = LCL_GSS;
3762 		if (nd->nd_flag & ND_GSSINTEGRITY)
3763 			clp->lc_flags |= LCL_GSSINTEGRITY;
3764 		else if (nd->nd_flag & ND_GSSPRIVACY)
3765 			clp->lc_flags |= LCL_GSSPRIVACY;
3766 	} else {
3767 		clp->lc_flags = 0;
3768 	}
3769 	if ((nd->nd_flag & ND_GSS) && nd->nd_princlen > 0) {
3770 		clp->lc_flags |= LCL_NAME;
3771 		clp->lc_namelen = nd->nd_princlen;
3772 		clp->lc_name = &clp->lc_id[idlen];
3773 		NFSBCOPY(nd->nd_principal, clp->lc_name, clp->lc_namelen);
3774 	} else {
3775 		clp->lc_uid = nd->nd_cred->cr_uid;
3776 		clp->lc_gid = nd->nd_cred->cr_gid;
3777 	}
3778 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3779 	clp->lc_program = fxdr_unsigned(u_int32_t, *tl);
3780 	error = nfsrv_getclientipaddr(nd, clp);
3781 	if (error)
3782 		goto nfsmout;
3783 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3784 	clp->lc_callback = fxdr_unsigned(u_int32_t, *tl);
3785 
3786 	/*
3787 	 * nfsrv_setclient() does the actual work of adding it to the
3788 	 * client list. If there is no error, the structure has been
3789 	 * linked into the client list and clp should no longer be used
3790 	 * here. When an error is returned, it has not been linked in,
3791 	 * so it should be free'd.
3792 	 */
3793 	nd->nd_repstat = nfsrv_setclient(nd, &clp, &clientid, &confirm, p);
3794 	if (nd->nd_repstat == NFSERR_CLIDINUSE) {
3795 		/*
3796 		 * 8 is the maximum length of the port# string.
3797 		 */
3798 		addrbuf = malloc(INET6_ADDRSTRLEN + 8, M_TEMP, M_WAITOK);
3799 		switch (clp->lc_req.nr_nam->sa_family) {
3800 #ifdef INET
3801 		case AF_INET:
3802 			if (clp->lc_flags & LCL_TCPCALLBACK)
3803 				(void) nfsm_strtom(nd, "tcp", 3);
3804 			else
3805 				(void) nfsm_strtom(nd, "udp", 3);
3806 			rin = (struct sockaddr_in *)clp->lc_req.nr_nam;
3807 			ucp = (u_char *)&rin->sin_addr.s_addr;
3808 			ucp2 = (u_char *)&rin->sin_port;
3809 			sprintf(addrbuf, "%d.%d.%d.%d.%d.%d", ucp[0] & 0xff,
3810 			    ucp[1] & 0xff, ucp[2] & 0xff, ucp[3] & 0xff,
3811 			    ucp2[0] & 0xff, ucp2[1] & 0xff);
3812 			break;
3813 #endif
3814 #ifdef INET6
3815 		case AF_INET6:
3816 			if (clp->lc_flags & LCL_TCPCALLBACK)
3817 				(void) nfsm_strtom(nd, "tcp6", 4);
3818 			else
3819 				(void) nfsm_strtom(nd, "udp6", 4);
3820 			rin6 = (struct sockaddr_in6 *)clp->lc_req.nr_nam;
3821 			ucp = inet_ntop(AF_INET6, &rin6->sin6_addr, addrbuf,
3822 			    INET6_ADDRSTRLEN);
3823 			if (ucp != NULL)
3824 				i = strlen(ucp);
3825 			else
3826 				i = 0;
3827 			ucp2 = (u_char *)&rin6->sin6_port;
3828 			sprintf(&addrbuf[i], ".%d.%d", ucp2[0] & 0xff,
3829 			    ucp2[1] & 0xff);
3830 			break;
3831 #endif
3832 		}
3833 		(void) nfsm_strtom(nd, addrbuf, strlen(addrbuf));
3834 		free(addrbuf, M_TEMP);
3835 	}
3836 	if (clp) {
3837 		free(clp->lc_req.nr_nam, M_SONAME);
3838 		NFSFREEMUTEX(&clp->lc_req.nr_mtx);
3839 		free(clp->lc_stateid, M_NFSDCLIENT);
3840 		free(clp, M_NFSDCLIENT);
3841 	}
3842 	if (!nd->nd_repstat) {
3843 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_HYPER);
3844 		*tl++ = clientid.lval[0];
3845 		*tl++ = clientid.lval[1];
3846 		*tl++ = confirm.lval[0];
3847 		*tl = confirm.lval[1];
3848 	}
3849 
3850 out:
3851 	NFSEXITCODE2(0, nd);
3852 	return (0);
3853 nfsmout:
3854 	if (clp) {
3855 		free(clp->lc_req.nr_nam, M_SONAME);
3856 		NFSFREEMUTEX(&clp->lc_req.nr_mtx);
3857 		free(clp->lc_stateid, M_NFSDCLIENT);
3858 		free(clp, M_NFSDCLIENT);
3859 	}
3860 	NFSEXITCODE2(error, nd);
3861 	return (error);
3862 }
3863 
3864 /*
3865  * nfsv4 set client id confirm service
3866  */
3867 int
3868 nfsrvd_setclientidcfrm(struct nfsrv_descript *nd,
3869     __unused int isdgram, __unused vnode_t vp,
3870     __unused struct nfsexstuff *exp)
3871 {
3872 	u_int32_t *tl;
3873 	int error = 0;
3874 	nfsquad_t clientid, confirm;
3875 	struct thread *p = curthread;
3876 
3877 	if ((nd->nd_flag & ND_NFSV41) != 0) {
3878 		nd->nd_repstat = NFSERR_NOTSUPP;
3879 		goto nfsmout;
3880 	}
3881 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3882 		nd->nd_repstat = NFSERR_WRONGSEC;
3883 		goto nfsmout;
3884 	}
3885 	NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_HYPER);
3886 	clientid.lval[0] = *tl++;
3887 	clientid.lval[1] = *tl++;
3888 	confirm.lval[0] = *tl++;
3889 	confirm.lval[1] = *tl;
3890 
3891 	/*
3892 	 * nfsrv_getclient() searches the client list for a match and
3893 	 * returns the appropriate NFSERR status.
3894 	 */
3895 	nd->nd_repstat = nfsrv_getclient(clientid, (CLOPS_CONFIRM|CLOPS_RENEW),
3896 	    NULL, NULL, confirm, 0, nd, p);
3897 nfsmout:
3898 	NFSEXITCODE2(error, nd);
3899 	return (error);
3900 }
3901 
3902 /*
3903  * nfsv4 verify service
3904  */
3905 int
3906 nfsrvd_verify(struct nfsrv_descript *nd, int isdgram,
3907     vnode_t vp, __unused struct nfsexstuff *exp)
3908 {
3909 	int error = 0, ret, fhsize = NFSX_MYFH;
3910 	struct nfsvattr nva;
3911 	struct statfs *sf;
3912 	struct nfsfsinfo fs;
3913 	fhandle_t fh;
3914 	struct thread *p = curthread;
3915 
3916 	sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
3917 	nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
3918 	if (!nd->nd_repstat)
3919 		nd->nd_repstat = nfsvno_statfs(vp, sf);
3920 	if (!nd->nd_repstat)
3921 		nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
3922 	if (!nd->nd_repstat) {
3923 		nfsvno_getfs(&fs, isdgram);
3924 		error = nfsv4_loadattr(nd, vp, &nva, NULL, &fh, fhsize, NULL,
3925 		    sf, NULL, &fs, NULL, 1, &ret, NULL, NULL, p, nd->nd_cred);
3926 		if (!error) {
3927 			if (nd->nd_procnum == NFSV4OP_NVERIFY) {
3928 				if (ret == 0)
3929 					nd->nd_repstat = NFSERR_SAME;
3930 				else if (ret != NFSERR_NOTSAME)
3931 					nd->nd_repstat = ret;
3932 			} else if (ret)
3933 				nd->nd_repstat = ret;
3934 		}
3935 	}
3936 	vput(vp);
3937 	free(sf, M_STATFS);
3938 	NFSEXITCODE2(error, nd);
3939 	return (error);
3940 }
3941 
3942 /*
3943  * nfs openattr rpc
3944  */
3945 int
3946 nfsrvd_openattr(struct nfsrv_descript *nd, __unused int isdgram,
3947     vnode_t dp, __unused vnode_t *vpp, __unused fhandle_t *fhp,
3948     __unused struct nfsexstuff *exp)
3949 {
3950 	u_int32_t *tl;
3951 	int error = 0, createdir __unused;
3952 
3953 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3954 	createdir = fxdr_unsigned(int, *tl);
3955 	nd->nd_repstat = NFSERR_NOTSUPP;
3956 nfsmout:
3957 	vrele(dp);
3958 	NFSEXITCODE2(error, nd);
3959 	return (error);
3960 }
3961 
3962 /*
3963  * nfsv4 release lock owner service
3964  */
3965 int
3966 nfsrvd_releaselckown(struct nfsrv_descript *nd, __unused int isdgram,
3967     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3968 {
3969 	u_int32_t *tl;
3970 	struct nfsstate *stp = NULL;
3971 	int error = 0, len;
3972 	nfsquad_t clientid;
3973 	struct thread *p = curthread;
3974 
3975 	if ((nd->nd_flag & ND_NFSV41) != 0) {
3976 		nd->nd_repstat = NFSERR_NOTSUPP;
3977 		goto nfsmout;
3978 	}
3979 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3980 		nd->nd_repstat = NFSERR_WRONGSEC;
3981 		goto nfsmout;
3982 	}
3983 	NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3984 	len = fxdr_unsigned(int, *(tl + 2));
3985 	if (len <= 0 || len > NFSV4_OPAQUELIMIT) {
3986 		nd->nd_repstat = NFSERR_BADXDR;
3987 		goto nfsmout;
3988 	}
3989 	stp = malloc(sizeof (struct nfsstate) + len,
3990 	    M_NFSDSTATE, M_WAITOK);
3991 	stp->ls_ownerlen = len;
3992 	stp->ls_op = NULL;
3993 	stp->ls_flags = NFSLCK_RELEASE;
3994 	stp->ls_uid = nd->nd_cred->cr_uid;
3995 	clientid.lval[0] = *tl++;
3996 	clientid.lval[1] = *tl;
3997 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3998 		if ((nd->nd_flag & ND_NFSV41) != 0)
3999 			clientid.qval = nd->nd_clientid.qval;
4000 		else if (nd->nd_clientid.qval != clientid.qval)
4001 			printf("EEK14 multiple clids\n");
4002 	} else {
4003 		if ((nd->nd_flag & ND_NFSV41) != 0)
4004 			printf("EEK! no clientid from session\n");
4005 		nd->nd_flag |= ND_IMPLIEDCLID;
4006 		nd->nd_clientid.qval = clientid.qval;
4007 	}
4008 	error = nfsrv_mtostr(nd, stp->ls_owner, len);
4009 	if (error)
4010 		goto nfsmout;
4011 	nd->nd_repstat = nfsrv_releaselckown(stp, clientid, p);
4012 	free(stp, M_NFSDSTATE);
4013 
4014 	NFSEXITCODE2(0, nd);
4015 	return (0);
4016 nfsmout:
4017 	if (stp)
4018 		free(stp, M_NFSDSTATE);
4019 	NFSEXITCODE2(error, nd);
4020 	return (error);
4021 }
4022 
4023 /*
4024  * nfsv4 exchange_id service
4025  */
4026 int
4027 nfsrvd_exchangeid(struct nfsrv_descript *nd, __unused int isdgram,
4028     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4029 {
4030 	uint32_t *tl;
4031 	int error = 0, i, idlen;
4032 	struct nfsclient *clp = NULL;
4033 	nfsquad_t clientid, confirm;
4034 	uint8_t *verf;
4035 	uint32_t sp4type, v41flags;
4036 	uint64_t owner_minor;
4037 	struct timespec verstime;
4038 #ifdef INET
4039 	struct sockaddr_in *sin, *rin;
4040 #endif
4041 #ifdef INET6
4042 	struct sockaddr_in6 *sin6, *rin6;
4043 #endif
4044 	struct thread *p = curthread;
4045 
4046 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4047 		nd->nd_repstat = NFSERR_WRONGSEC;
4048 		goto nfsmout;
4049 	}
4050 	NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF + NFSX_UNSIGNED);
4051 	verf = (uint8_t *)tl;
4052 	tl += (NFSX_VERF / NFSX_UNSIGNED);
4053 	i = fxdr_unsigned(int, *tl);
4054 	if (i > NFSV4_OPAQUELIMIT || i <= 0) {
4055 		nd->nd_repstat = NFSERR_BADXDR;
4056 		goto nfsmout;
4057 	}
4058 	idlen = i;
4059 	if (nd->nd_flag & ND_GSS)
4060 		i += nd->nd_princlen;
4061 	clp = malloc(sizeof(struct nfsclient) + i, M_NFSDCLIENT, M_WAITOK |
4062 	    M_ZERO);
4063 	clp->lc_stateid = malloc(sizeof(struct nfsstatehead) *
4064 	    nfsrv_statehashsize, M_NFSDCLIENT, M_WAITOK);
4065 	NFSINITSOCKMUTEX(&clp->lc_req.nr_mtx);
4066 	/* Allocated large enough for an AF_INET or AF_INET6 socket. */
4067 	clp->lc_req.nr_nam = malloc(sizeof(struct sockaddr_in6), M_SONAME,
4068 	    M_WAITOK | M_ZERO);
4069 	switch (nd->nd_nam->sa_family) {
4070 #ifdef INET
4071 	case AF_INET:
4072 		rin = (struct sockaddr_in *)clp->lc_req.nr_nam;
4073 		sin = (struct sockaddr_in *)nd->nd_nam;
4074 		rin->sin_family = AF_INET;
4075 		rin->sin_len = sizeof(struct sockaddr_in);
4076 		rin->sin_port = 0;
4077 		rin->sin_addr.s_addr = sin->sin_addr.s_addr;
4078 		break;
4079 #endif
4080 #ifdef INET6
4081 	case AF_INET6:
4082 		rin6 = (struct sockaddr_in6 *)clp->lc_req.nr_nam;
4083 		sin6 = (struct sockaddr_in6 *)nd->nd_nam;
4084 		rin6->sin6_family = AF_INET6;
4085 		rin6->sin6_len = sizeof(struct sockaddr_in6);
4086 		rin6->sin6_port = 0;
4087 		rin6->sin6_addr = sin6->sin6_addr;
4088 		break;
4089 #endif
4090 	}
4091 	clp->lc_req.nr_cred = NULL;
4092 	NFSBCOPY(verf, clp->lc_verf, NFSX_VERF);
4093 	clp->lc_idlen = idlen;
4094 	error = nfsrv_mtostr(nd, clp->lc_id, idlen);
4095 	if (error != 0)
4096 		goto nfsmout;
4097 	if ((nd->nd_flag & ND_GSS) != 0) {
4098 		clp->lc_flags = LCL_GSS | LCL_NFSV41;
4099 		if ((nd->nd_flag & ND_GSSINTEGRITY) != 0)
4100 			clp->lc_flags |= LCL_GSSINTEGRITY;
4101 		else if ((nd->nd_flag & ND_GSSPRIVACY) != 0)
4102 			clp->lc_flags |= LCL_GSSPRIVACY;
4103 	} else
4104 		clp->lc_flags = LCL_NFSV41;
4105 	if ((nd->nd_flag & ND_NFSV42) != 0)
4106 		clp->lc_flags |= LCL_NFSV42;
4107 	if ((nd->nd_flag & ND_GSS) != 0 && nd->nd_princlen > 0) {
4108 		clp->lc_flags |= LCL_NAME;
4109 		clp->lc_namelen = nd->nd_princlen;
4110 		clp->lc_name = &clp->lc_id[idlen];
4111 		NFSBCOPY(nd->nd_principal, clp->lc_name, clp->lc_namelen);
4112 	} else {
4113 		clp->lc_uid = nd->nd_cred->cr_uid;
4114 		clp->lc_gid = nd->nd_cred->cr_gid;
4115 	}
4116 	NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
4117 	v41flags = fxdr_unsigned(uint32_t, *tl++);
4118 	if ((v41flags & ~(NFSV4EXCH_SUPPMOVEDREFER | NFSV4EXCH_SUPPMOVEDMIGR |
4119 	    NFSV4EXCH_BINDPRINCSTATEID | NFSV4EXCH_MASKPNFS |
4120 	    NFSV4EXCH_UPDCONFIRMEDRECA)) != 0) {
4121 		nd->nd_repstat = NFSERR_INVAL;
4122 		goto nfsmout;
4123 	}
4124 	if ((v41flags & NFSV4EXCH_UPDCONFIRMEDRECA) != 0)
4125 		confirm.lval[1] = 1;
4126 	else
4127 		confirm.lval[1] = 0;
4128 	if (nfsrv_devidcnt == 0)
4129 		v41flags = NFSV4EXCH_USENONPNFS | NFSV4EXCH_USEPNFSDS;
4130  	else
4131  		v41flags = NFSV4EXCH_USEPNFSMDS;
4132 	sp4type = fxdr_unsigned(uint32_t, *tl);
4133 	if (sp4type != NFSV4EXCH_SP4NONE) {
4134 		nd->nd_repstat = NFSERR_NOTSUPP;
4135 		goto nfsmout;
4136 	}
4137 
4138 	/*
4139 	 * nfsrv_setclient() does the actual work of adding it to the
4140 	 * client list. If there is no error, the structure has been
4141 	 * linked into the client list and clp should no longer be used
4142 	 * here. When an error is returned, it has not been linked in,
4143 	 * so it should be free'd.
4144 	 */
4145 	nd->nd_repstat = nfsrv_setclient(nd, &clp, &clientid, &confirm, p);
4146 	if (clp != NULL) {
4147 		free(clp->lc_req.nr_nam, M_SONAME);
4148 		NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4149 		free(clp->lc_stateid, M_NFSDCLIENT);
4150 		free(clp, M_NFSDCLIENT);
4151 	}
4152 	if (nd->nd_repstat == 0) {
4153 		if (confirm.lval[1] != 0)
4154 			v41flags |= NFSV4EXCH_CONFIRMEDR;
4155 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + 3 * NFSX_UNSIGNED);
4156 		*tl++ = clientid.lval[0];			/* ClientID */
4157 		*tl++ = clientid.lval[1];
4158 		*tl++ = txdr_unsigned(confirm.lval[0]);		/* SequenceID */
4159 		*tl++ = txdr_unsigned(v41flags);		/* Exch flags */
4160 		*tl++ = txdr_unsigned(NFSV4EXCH_SP4NONE);	/* No SSV */
4161 		owner_minor = 0;				/* Owner */
4162 		txdr_hyper(owner_minor, tl);			/* Minor */
4163 		(void)nfsm_strtom(nd, nd->nd_cred->cr_prison->pr_hostuuid,
4164 		    strlen(nd->nd_cred->cr_prison->pr_hostuuid)); /* Major */
4165 		(void)nfsm_strtom(nd, nd->nd_cred->cr_prison->pr_hostuuid,
4166 		    strlen(nd->nd_cred->cr_prison->pr_hostuuid)); /* Scope */
4167 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4168 		*tl = txdr_unsigned(1);
4169 		(void)nfsm_strtom(nd, "freebsd.org", strlen("freebsd.org"));
4170 		(void)nfsm_strtom(nd, version, strlen(version));
4171 		NFSM_BUILD(tl, uint32_t *, NFSX_V4TIME);
4172 		verstime.tv_sec = 1293840000;		/* Jan 1, 2011 */
4173 		verstime.tv_nsec = 0;
4174 		txdr_nfsv4time(&verstime, tl);
4175 	}
4176 	NFSEXITCODE2(0, nd);
4177 	return (0);
4178 nfsmout:
4179 	if (clp != NULL) {
4180 		free(clp->lc_req.nr_nam, M_SONAME);
4181 		NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4182 		free(clp->lc_stateid, M_NFSDCLIENT);
4183 		free(clp, M_NFSDCLIENT);
4184 	}
4185 	NFSEXITCODE2(error, nd);
4186 	return (error);
4187 }
4188 
4189 /*
4190  * nfsv4 create session service
4191  */
4192 int
4193 nfsrvd_createsession(struct nfsrv_descript *nd, __unused int isdgram,
4194     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4195 {
4196 	uint32_t *tl;
4197 	int error = 0;
4198 	nfsquad_t clientid, confirm;
4199 	struct nfsdsession *sep = NULL;
4200 	uint32_t rdmacnt;
4201 	struct thread *p = curthread;
4202 
4203 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4204 		nd->nd_repstat = NFSERR_WRONGSEC;
4205 		goto nfsmout;
4206 	}
4207 	sep = (struct nfsdsession *)malloc(sizeof(struct nfsdsession),
4208 	    M_NFSDSESSION, M_WAITOK | M_ZERO);
4209 	sep->sess_refcnt = 1;
4210 	mtx_init(&sep->sess_cbsess.nfsess_mtx, "nfscbsession", NULL, MTX_DEF);
4211 	NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + 2 * NFSX_UNSIGNED);
4212 	clientid.lval[0] = *tl++;
4213 	clientid.lval[1] = *tl++;
4214 	confirm.lval[0] = fxdr_unsigned(uint32_t, *tl++);
4215 	sep->sess_crflags = fxdr_unsigned(uint32_t, *tl);
4216 	/* Persistent sessions and RDMA are not supported. */
4217 	sep->sess_crflags &= NFSV4CRSESS_CONNBACKCHAN;
4218 
4219 	/* Fore channel attributes. */
4220 	NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
4221 	tl++;					/* Header pad always 0. */
4222 	sep->sess_maxreq = fxdr_unsigned(uint32_t, *tl++);
4223 	if (sep->sess_maxreq > sb_max_adj - NFS_MAXXDR) {
4224 		sep->sess_maxreq = sb_max_adj - NFS_MAXXDR;
4225 		printf("Consider increasing kern.ipc.maxsockbuf\n");
4226 	}
4227 	sep->sess_maxresp = fxdr_unsigned(uint32_t, *tl++);
4228 	if (sep->sess_maxresp > sb_max_adj - NFS_MAXXDR) {
4229 		sep->sess_maxresp = sb_max_adj - NFS_MAXXDR;
4230 		printf("Consider increasing kern.ipc.maxsockbuf\n");
4231 	}
4232 	sep->sess_maxrespcached = fxdr_unsigned(uint32_t, *tl++);
4233 	sep->sess_maxops = fxdr_unsigned(uint32_t, *tl++);
4234 	sep->sess_maxslots = fxdr_unsigned(uint32_t, *tl++);
4235 	if (sep->sess_maxslots > NFSV4_SLOTS)
4236 		sep->sess_maxslots = NFSV4_SLOTS;
4237 	rdmacnt = fxdr_unsigned(uint32_t, *tl);
4238 	if (rdmacnt > 1) {
4239 		nd->nd_repstat = NFSERR_BADXDR;
4240 		goto nfsmout;
4241 	} else if (rdmacnt == 1)
4242 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4243 
4244 	/* Back channel attributes. */
4245 	NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
4246 	tl++;					/* Header pad always 0. */
4247 	sep->sess_cbmaxreq = fxdr_unsigned(uint32_t, *tl++);
4248 	sep->sess_cbmaxresp = fxdr_unsigned(uint32_t, *tl++);
4249 	sep->sess_cbmaxrespcached = fxdr_unsigned(uint32_t, *tl++);
4250 	sep->sess_cbmaxops = fxdr_unsigned(uint32_t, *tl++);
4251 	sep->sess_cbsess.nfsess_foreslots = fxdr_unsigned(uint32_t, *tl++);
4252 	rdmacnt = fxdr_unsigned(uint32_t, *tl);
4253 	if (rdmacnt > 1) {
4254 		nd->nd_repstat = NFSERR_BADXDR;
4255 		goto nfsmout;
4256 	} else if (rdmacnt == 1)
4257 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4258 
4259 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4260 	sep->sess_cbprogram = fxdr_unsigned(uint32_t, *tl);
4261 
4262 	/*
4263 	 * nfsrv_getclient() searches the client list for a match and
4264 	 * returns the appropriate NFSERR status.
4265 	 */
4266 	nd->nd_repstat = nfsrv_getclient(clientid, CLOPS_CONFIRM | CLOPS_RENEW,
4267 	    NULL, sep, confirm, sep->sess_cbprogram, nd, p);
4268 	if (nd->nd_repstat == 0) {
4269 		NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
4270 		NFSBCOPY(sep->sess_sessionid, tl, NFSX_V4SESSIONID);
4271 		NFSM_BUILD(tl, uint32_t *, 18 * NFSX_UNSIGNED);
4272 		*tl++ = txdr_unsigned(confirm.lval[0]);	/* sequenceid */
4273 		*tl++ = txdr_unsigned(sep->sess_crflags);
4274 
4275 		/* Fore channel attributes. */
4276 		*tl++ = 0;
4277 		*tl++ = txdr_unsigned(sep->sess_maxreq);
4278 		*tl++ = txdr_unsigned(sep->sess_maxresp);
4279 		*tl++ = txdr_unsigned(sep->sess_maxrespcached);
4280 		*tl++ = txdr_unsigned(sep->sess_maxops);
4281 		*tl++ = txdr_unsigned(sep->sess_maxslots);
4282 		*tl++ = txdr_unsigned(1);
4283 		*tl++ = txdr_unsigned(0);			/* No RDMA. */
4284 
4285 		/* Back channel attributes. */
4286 		*tl++ = 0;
4287 		*tl++ = txdr_unsigned(sep->sess_cbmaxreq);
4288 		*tl++ = txdr_unsigned(sep->sess_cbmaxresp);
4289 		*tl++ = txdr_unsigned(sep->sess_cbmaxrespcached);
4290 		*tl++ = txdr_unsigned(sep->sess_cbmaxops);
4291 		*tl++ = txdr_unsigned(sep->sess_cbsess.nfsess_foreslots);
4292 		*tl++ = txdr_unsigned(1);
4293 		*tl = txdr_unsigned(0);			/* No RDMA. */
4294 	}
4295 nfsmout:
4296 	if (nd->nd_repstat != 0 && sep != NULL)
4297 		free(sep, M_NFSDSESSION);
4298 	NFSEXITCODE2(error, nd);
4299 	return (error);
4300 }
4301 
4302 /*
4303  * nfsv4 sequence service
4304  */
4305 int
4306 nfsrvd_sequence(struct nfsrv_descript *nd, __unused int isdgram,
4307     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4308 {
4309 	uint32_t *tl;
4310 	uint32_t highest_slotid, sequenceid, sflags, target_highest_slotid;
4311 	int cache_this, error = 0;
4312 	struct thread *p = curthread;
4313 
4314 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4315 		nd->nd_repstat = NFSERR_WRONGSEC;
4316 		goto nfsmout;
4317 	}
4318 	NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID);
4319 	NFSBCOPY(tl, nd->nd_sessionid, NFSX_V4SESSIONID);
4320 	NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED);
4321 	sequenceid = fxdr_unsigned(uint32_t, *tl++);
4322 	nd->nd_slotid = fxdr_unsigned(uint32_t, *tl++);
4323 	highest_slotid = fxdr_unsigned(uint32_t, *tl++);
4324 	if (*tl == newnfs_true)
4325 		cache_this = 1;
4326 	else
4327 		cache_this = 0;
4328 	nd->nd_flag |= ND_HASSEQUENCE;
4329 	nd->nd_repstat = nfsrv_checksequence(nd, sequenceid, &highest_slotid,
4330 	    &target_highest_slotid, cache_this, &sflags, p);
4331 	if (nd->nd_repstat == 0) {
4332 		NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
4333 		NFSBCOPY(nd->nd_sessionid, tl, NFSX_V4SESSIONID);
4334 		NFSM_BUILD(tl, uint32_t *, 5 * NFSX_UNSIGNED);
4335 		*tl++ = txdr_unsigned(sequenceid);
4336 		*tl++ = txdr_unsigned(nd->nd_slotid);
4337 		*tl++ = txdr_unsigned(highest_slotid);
4338 		*tl++ = txdr_unsigned(target_highest_slotid);
4339 		*tl = txdr_unsigned(sflags);
4340 	}
4341 nfsmout:
4342 	NFSEXITCODE2(error, nd);
4343 	return (error);
4344 }
4345 
4346 /*
4347  * nfsv4 reclaim complete service
4348  */
4349 int
4350 nfsrvd_reclaimcomplete(struct nfsrv_descript *nd, __unused int isdgram,
4351     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4352 {
4353 	uint32_t *tl;
4354 	int error = 0, onefs;
4355 
4356 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4357 		nd->nd_repstat = NFSERR_WRONGSEC;
4358 		goto nfsmout;
4359 	}
4360 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4361 	/*
4362 	 * I believe that a ReclaimComplete with rca_one_fs == TRUE is only
4363 	 * to be used after a file system has been transferred to a different
4364 	 * file server.  However, RFC5661 is somewhat vague w.r.t. this and
4365 	 * the ESXi 6.7 client does both a ReclaimComplete with rca_one_fs
4366 	 * == TRUE and one with ReclaimComplete with rca_one_fs == FALSE.
4367 	 * Therefore, just ignore the rca_one_fs == TRUE operation and return
4368 	 * NFS_OK without doing anything.
4369 	 */
4370 	onefs = 0;
4371 	if (*tl == newnfs_true)
4372 		onefs = 1;
4373 	nd->nd_repstat = nfsrv_checkreclaimcomplete(nd, onefs);
4374 nfsmout:
4375 	NFSEXITCODE2(error, nd);
4376 	return (error);
4377 }
4378 
4379 /*
4380  * nfsv4 destroy clientid service
4381  */
4382 int
4383 nfsrvd_destroyclientid(struct nfsrv_descript *nd, __unused int isdgram,
4384     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4385 {
4386 	uint32_t *tl;
4387 	nfsquad_t clientid;
4388 	int error = 0;
4389 	struct thread *p = curthread;
4390 
4391 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4392 		nd->nd_repstat = NFSERR_WRONGSEC;
4393 		goto nfsmout;
4394 	}
4395 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
4396 	clientid.lval[0] = *tl++;
4397 	clientid.lval[1] = *tl;
4398 	nd->nd_repstat = nfsrv_destroyclient(clientid, p);
4399 nfsmout:
4400 	NFSEXITCODE2(error, nd);
4401 	return (error);
4402 }
4403 
4404 /*
4405  * nfsv4 bind connection to session service
4406  */
4407 int
4408 nfsrvd_bindconnsess(struct nfsrv_descript *nd, __unused int isdgram,
4409     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4410 {
4411 	uint32_t *tl;
4412 	uint8_t sessid[NFSX_V4SESSIONID];
4413 	int error = 0, foreaft;
4414 
4415 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4416 		nd->nd_repstat = NFSERR_WRONGSEC;
4417 		goto nfsmout;
4418 	}
4419 	NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID + 2 * NFSX_UNSIGNED);
4420 	NFSBCOPY(tl, sessid, NFSX_V4SESSIONID);
4421 	tl += (NFSX_V4SESSIONID / NFSX_UNSIGNED);
4422 	foreaft = fxdr_unsigned(int, *tl++);
4423 	if (*tl == newnfs_true) {
4424 		/* RDMA is not supported. */
4425 		nd->nd_repstat = NFSERR_NOTSUPP;
4426 		goto nfsmout;
4427 	}
4428 
4429 	nd->nd_repstat = nfsrv_bindconnsess(nd, sessid, &foreaft);
4430 	if (nd->nd_repstat == 0) {
4431 		NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID + 2 *
4432 		    NFSX_UNSIGNED);
4433 		NFSBCOPY(sessid, tl, NFSX_V4SESSIONID);
4434 		tl += (NFSX_V4SESSIONID / NFSX_UNSIGNED);
4435 		*tl++ = txdr_unsigned(foreaft);
4436 		*tl = newnfs_false;
4437 	}
4438 nfsmout:
4439 	NFSEXITCODE2(error, nd);
4440 	return (error);
4441 }
4442 
4443 /*
4444  * nfsv4 destroy session service
4445  */
4446 int
4447 nfsrvd_destroysession(struct nfsrv_descript *nd, __unused int isdgram,
4448     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4449 {
4450 	uint8_t *cp, sessid[NFSX_V4SESSIONID];
4451 	int error = 0;
4452 
4453 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4454 		nd->nd_repstat = NFSERR_WRONGSEC;
4455 		goto nfsmout;
4456 	}
4457 	NFSM_DISSECT(cp, uint8_t *, NFSX_V4SESSIONID);
4458 	NFSBCOPY(cp, sessid, NFSX_V4SESSIONID);
4459 	nd->nd_repstat = nfsrv_destroysession(nd, sessid);
4460 nfsmout:
4461 	NFSEXITCODE2(error, nd);
4462 	return (error);
4463 }
4464 
4465 /*
4466  * nfsv4 free stateid service
4467  */
4468 int
4469 nfsrvd_freestateid(struct nfsrv_descript *nd, __unused int isdgram,
4470     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4471 {
4472 	uint32_t *tl;
4473 	nfsv4stateid_t stateid;
4474 	int error = 0;
4475 	struct thread *p = curthread;
4476 
4477 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4478 		nd->nd_repstat = NFSERR_WRONGSEC;
4479 		goto nfsmout;
4480 	}
4481 	NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
4482 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4483 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4484 
4485 	/*
4486 	 * For the special stateid of other all 0s and seqid == 1, set the
4487 	 * stateid to the current stateid, if it is set.
4488 	 */
4489 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4490 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
4491 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4492 			stateid = nd->nd_curstateid;
4493 			stateid.seqid = 0;
4494 		} else {
4495 			nd->nd_repstat = NFSERR_BADSTATEID;
4496 			goto nfsmout;
4497 		}
4498 	}
4499 
4500 	nd->nd_repstat = nfsrv_freestateid(nd, &stateid, p);
4501 
4502 	/* If the current stateid has been free'd, unset it. */
4503 	if (nd->nd_repstat == 0 && (nd->nd_flag & ND_CURSTATEID) != 0 &&
4504 	    stateid.other[0] == nd->nd_curstateid.other[0] &&
4505 	    stateid.other[1] == nd->nd_curstateid.other[1] &&
4506 	    stateid.other[2] == nd->nd_curstateid.other[2])
4507 		nd->nd_flag &= ~ND_CURSTATEID;
4508 nfsmout:
4509 	NFSEXITCODE2(error, nd);
4510 	return (error);
4511 }
4512 
4513 /*
4514  * nfsv4 layoutget service
4515  */
4516 int
4517 nfsrvd_layoutget(struct nfsrv_descript *nd, __unused int isdgram,
4518     vnode_t vp, struct nfsexstuff *exp)
4519 {
4520 	uint32_t *tl;
4521 	nfsv4stateid_t stateid;
4522 	int error = 0, layoutlen, layouttype, iomode, maxcnt, retonclose;
4523 	uint64_t offset, len, minlen;
4524 	char *layp;
4525 	struct thread *p = curthread;
4526 
4527 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4528 		nd->nd_repstat = NFSERR_WRONGSEC;
4529 		goto nfsmout;
4530 	}
4531 	NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED + 3 * NFSX_HYPER +
4532 	    NFSX_STATEID);
4533 	tl++;		/* Signal layout available. Ignore for now. */
4534 	layouttype = fxdr_unsigned(int, *tl++);
4535 	iomode = fxdr_unsigned(int, *tl++);
4536 	offset = fxdr_hyper(tl); tl += 2;
4537 	len = fxdr_hyper(tl); tl += 2;
4538 	minlen = fxdr_hyper(tl); tl += 2;
4539 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4540 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4541 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4542 	maxcnt = fxdr_unsigned(int, *tl);
4543 	NFSD_DEBUG(4, "layoutget ltyp=%d iom=%d off=%ju len=%ju mlen=%ju\n",
4544 	    layouttype, iomode, (uintmax_t)offset, (uintmax_t)len,
4545 	    (uintmax_t)minlen);
4546 	if (len < minlen ||
4547 	    (minlen != UINT64_MAX && offset + minlen < offset) ||
4548 	    (len != UINT64_MAX && offset + len < offset)) {
4549 		nd->nd_repstat = NFSERR_INVAL;
4550 		goto nfsmout;
4551 	}
4552 
4553 	/*
4554 	 * For the special stateid of other all 0s and seqid == 1, set the
4555 	 * stateid to the current stateid, if it is set.
4556 	 */
4557 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4558 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
4559 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4560 			stateid = nd->nd_curstateid;
4561 			stateid.seqid = 0;
4562 		} else {
4563 			nd->nd_repstat = NFSERR_BADSTATEID;
4564 			goto nfsmout;
4565 		}
4566 	}
4567 
4568 	layp = NULL;
4569 	if (layouttype == NFSLAYOUT_NFSV4_1_FILES && nfsrv_maxpnfsmirror == 1)
4570 		layp = malloc(NFSX_V4FILELAYOUT, M_TEMP, M_WAITOK);
4571 	else if (layouttype == NFSLAYOUT_FLEXFILE)
4572 		layp = malloc(NFSX_V4FLEXLAYOUT(nfsrv_maxpnfsmirror), M_TEMP,
4573 		    M_WAITOK);
4574 	else
4575 		nd->nd_repstat = NFSERR_UNKNLAYOUTTYPE;
4576 	if (layp != NULL)
4577 		nd->nd_repstat = nfsrv_layoutget(nd, vp, exp, layouttype,
4578 		    &iomode, &offset, &len, minlen, &stateid, maxcnt,
4579 		    &retonclose, &layoutlen, layp, nd->nd_cred, p);
4580 	NFSD_DEBUG(4, "nfsrv_layoutget stat=%u layoutlen=%d\n", nd->nd_repstat,
4581 	    layoutlen);
4582 	if (nd->nd_repstat == 0) {
4583 		/* For NFSv4.1, set the Current StateID. */
4584 		if ((nd->nd_flag & ND_NFSV41) != 0) {
4585 			nd->nd_curstateid = stateid;
4586 			nd->nd_flag |= ND_CURSTATEID;
4587 		}
4588 		NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + NFSX_STATEID +
4589 		    2 * NFSX_HYPER);
4590 		*tl++ = txdr_unsigned(retonclose);
4591 		*tl++ = txdr_unsigned(stateid.seqid);
4592 		NFSBCOPY(stateid.other, tl, NFSX_STATEIDOTHER);
4593 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4594 		*tl++ = txdr_unsigned(1);	/* Only returns one layout. */
4595 		txdr_hyper(offset, tl); tl += 2;
4596 		txdr_hyper(len, tl); tl += 2;
4597 		*tl++ = txdr_unsigned(iomode);
4598 		*tl = txdr_unsigned(layouttype);
4599 		nfsm_strtom(nd, layp, layoutlen);
4600 	} else if (nd->nd_repstat == NFSERR_LAYOUTTRYLATER) {
4601 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4602 		*tl = newnfs_false;
4603 	}
4604 	free(layp, M_TEMP);
4605 nfsmout:
4606 	vput(vp);
4607 	NFSEXITCODE2(error, nd);
4608 	return (error);
4609 }
4610 
4611 /*
4612  * nfsv4 layoutcommit service
4613  */
4614 int
4615 nfsrvd_layoutcommit(struct nfsrv_descript *nd, __unused int isdgram,
4616     vnode_t vp, struct nfsexstuff *exp)
4617 {
4618 	uint32_t *tl;
4619 	nfsv4stateid_t stateid;
4620 	int error = 0, hasnewoff, hasnewmtime, layouttype, maxcnt, reclaim;
4621 	int hasnewsize;
4622 	uint64_t offset, len, newoff = 0, newsize;
4623 	struct timespec newmtime;
4624 	char *layp;
4625 	struct thread *p = curthread;
4626 
4627 	layp = NULL;
4628 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4629 		nd->nd_repstat = NFSERR_WRONGSEC;
4630 		goto nfsmout;
4631 	}
4632 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED + 2 * NFSX_HYPER +
4633 	    NFSX_STATEID);
4634 	offset = fxdr_hyper(tl); tl += 2;
4635 	len = fxdr_hyper(tl); tl += 2;
4636 	reclaim = fxdr_unsigned(int, *tl++);
4637 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4638 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4639 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4640 	/*
4641 	 * For the special stateid of other all 0s and seqid == 1, set the
4642 	 * stateid to the current stateid, if it is set.
4643 	 */
4644 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4645 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
4646 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4647 			stateid = nd->nd_curstateid;
4648 			stateid.seqid = 0;
4649 		} else {
4650 			nd->nd_repstat = NFSERR_BADSTATEID;
4651 			goto nfsmout;
4652 		}
4653 	}
4654 
4655 	hasnewoff = fxdr_unsigned(int, *tl);
4656 	if (hasnewoff != 0) {
4657 		NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
4658 		newoff = fxdr_hyper(tl); tl += 2;
4659 	} else
4660 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4661 	hasnewmtime = fxdr_unsigned(int, *tl);
4662 	if (hasnewmtime != 0) {
4663 		NFSM_DISSECT(tl, uint32_t *, NFSX_V4TIME + 2 * NFSX_UNSIGNED);
4664 		fxdr_nfsv4time(tl, &newmtime);
4665 		tl += (NFSX_V4TIME / NFSX_UNSIGNED);
4666 	} else
4667 		NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
4668 	layouttype = fxdr_unsigned(int, *tl++);
4669 	maxcnt = fxdr_unsigned(int, *tl);
4670 	if (maxcnt > 0) {
4671 		layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK);
4672 		error = nfsrv_mtostr(nd, layp, maxcnt);
4673 		if (error != 0)
4674 			goto nfsmout;
4675 	}
4676 	nd->nd_repstat = nfsrv_layoutcommit(nd, vp, layouttype, hasnewoff,
4677 	    newoff, offset, len, hasnewmtime, &newmtime, reclaim, &stateid,
4678 	    maxcnt, layp, &hasnewsize, &newsize, nd->nd_cred, p);
4679 	NFSD_DEBUG(4, "nfsrv_layoutcommit stat=%u\n", nd->nd_repstat);
4680 	if (nd->nd_repstat == 0) {
4681 		if (hasnewsize != 0) {
4682 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED + NFSX_HYPER);
4683 			*tl++ = newnfs_true;
4684 			txdr_hyper(newsize, tl);
4685 		} else {
4686 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4687 			*tl = newnfs_false;
4688 		}
4689 	}
4690 nfsmout:
4691 	free(layp, M_TEMP);
4692 	vput(vp);
4693 	NFSEXITCODE2(error, nd);
4694 	return (error);
4695 }
4696 
4697 /*
4698  * nfsv4 layoutreturn service
4699  */
4700 int
4701 nfsrvd_layoutreturn(struct nfsrv_descript *nd, __unused int isdgram,
4702     vnode_t vp, struct nfsexstuff *exp)
4703 {
4704 	uint32_t *tl, *layp;
4705 	nfsv4stateid_t stateid;
4706 	int error = 0, fnd, kind, layouttype, iomode, maxcnt, reclaim;
4707 	uint64_t offset, len;
4708 	struct thread *p = curthread;
4709 
4710 	layp = NULL;
4711 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4712 		nd->nd_repstat = NFSERR_WRONGSEC;
4713 		goto nfsmout;
4714 	}
4715 	NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED);
4716 	reclaim = *tl++;
4717 	layouttype = fxdr_unsigned(int, *tl++);
4718 	iomode = fxdr_unsigned(int, *tl++);
4719 	kind = fxdr_unsigned(int, *tl);
4720 	NFSD_DEBUG(4, "layoutreturn recl=%d ltyp=%d iom=%d kind=%d\n", reclaim,
4721 	    layouttype, iomode, kind);
4722 	if (kind == NFSV4LAYOUTRET_FILE) {
4723 		NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
4724 		    NFSX_UNSIGNED);
4725 		offset = fxdr_hyper(tl); tl += 2;
4726 		len = fxdr_hyper(tl); tl += 2;
4727 		stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4728 		NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4729 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4730 
4731 		/*
4732 		 * For the special stateid of other all 0s and seqid == 1, set
4733 		 * the stateid to the current stateid, if it is set.
4734 		 */
4735 		if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4736 		    stateid.other[1] == 0 && stateid.other[2] == 0) {
4737 			if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4738 				stateid = nd->nd_curstateid;
4739 				stateid.seqid = 0;
4740 			} else {
4741 				nd->nd_repstat = NFSERR_BADSTATEID;
4742 				goto nfsmout;
4743 			}
4744 		}
4745 
4746 		maxcnt = fxdr_unsigned(int, *tl);
4747 		if (maxcnt > 0) {
4748 			layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK);
4749 			error = nfsrv_mtostr(nd, (char *)layp, maxcnt);
4750 			if (error != 0)
4751 				goto nfsmout;
4752 		}
4753 	} else {
4754 		if (reclaim == newnfs_true) {
4755 			nd->nd_repstat = NFSERR_INVAL;
4756 			goto nfsmout;
4757 		}
4758 		offset = len = 0;
4759 		maxcnt = 0;
4760 	}
4761 	nd->nd_repstat = nfsrv_layoutreturn(nd, vp, layouttype, iomode,
4762 	    offset, len, reclaim, kind, &stateid, maxcnt, layp, &fnd,
4763 	    nd->nd_cred, p);
4764 	NFSD_DEBUG(4, "nfsrv_layoutreturn stat=%u fnd=%d\n", nd->nd_repstat,
4765 	    fnd);
4766 	if (nd->nd_repstat == 0) {
4767 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4768 		if (fnd != 0) {
4769 			*tl = newnfs_true;
4770 			NFSM_BUILD(tl, uint32_t *, NFSX_STATEID);
4771 			*tl++ = txdr_unsigned(stateid.seqid);
4772 			NFSBCOPY(stateid.other, tl, NFSX_STATEIDOTHER);
4773 		} else
4774 			*tl = newnfs_false;
4775 	}
4776 nfsmout:
4777 	free(layp, M_TEMP);
4778 	vput(vp);
4779 	NFSEXITCODE2(error, nd);
4780 	return (error);
4781 }
4782 
4783 /*
4784  * nfsv4 layout error service
4785  */
4786 int
4787 nfsrvd_layouterror(struct nfsrv_descript *nd, __unused int isdgram,
4788     vnode_t vp, struct nfsexstuff *exp)
4789 {
4790 	uint32_t *tl;
4791 	nfsv4stateid_t stateid;
4792 	int cnt, error = 0, i, stat;
4793 	int opnum __unused;
4794 	char devid[NFSX_V4DEVICEID];
4795 	uint64_t offset, len;
4796 
4797 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4798 		nd->nd_repstat = NFSERR_WRONGSEC;
4799 		goto nfsmout;
4800 	}
4801 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
4802 	    NFSX_UNSIGNED);
4803 	offset = fxdr_hyper(tl); tl += 2;
4804 	len = fxdr_hyper(tl); tl += 2;
4805 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4806 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4807 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4808 	cnt = fxdr_unsigned(int, *tl);
4809 	NFSD_DEBUG(4, "layouterror off=%ju len=%ju cnt=%d\n", (uintmax_t)offset,
4810 	    (uintmax_t)len, cnt);
4811 	/*
4812 	 * For the special stateid of other all 0s and seqid == 1, set
4813 	 * the stateid to the current stateid, if it is set.
4814 	 */
4815 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4816 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
4817 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4818 			stateid = nd->nd_curstateid;
4819 			stateid.seqid = 0;
4820 		} else {
4821 			nd->nd_repstat = NFSERR_BADSTATEID;
4822 			goto nfsmout;
4823 		}
4824 	}
4825 
4826 	/*
4827 	 * Ignore offset, len and stateid for now.
4828 	 */
4829 	for (i = 0; i < cnt; i++) {
4830 		NFSM_DISSECT(tl, uint32_t *, NFSX_V4DEVICEID + 2 *
4831 		    NFSX_UNSIGNED);
4832 		NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
4833 		tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
4834 		stat = fxdr_unsigned(int, *tl++);
4835 		opnum = fxdr_unsigned(int, *tl);
4836 		NFSD_DEBUG(4, "nfsrvd_layouterr op=%d stat=%d\n", opnum, stat);
4837 		/*
4838 		 * Except for NFSERR_ACCES and NFSERR_STALE errors,
4839 		 * disable the mirror.
4840 		 */
4841 		if (stat != NFSERR_ACCES && stat != NFSERR_STALE)
4842 			nfsrv_delds(devid, curthread);
4843 	}
4844 nfsmout:
4845 	vput(vp);
4846 	NFSEXITCODE2(error, nd);
4847 	return (error);
4848 }
4849 
4850 /*
4851  * nfsv4 layout stats service
4852  */
4853 int
4854 nfsrvd_layoutstats(struct nfsrv_descript *nd, __unused int isdgram,
4855     vnode_t vp, struct nfsexstuff *exp)
4856 {
4857 	uint32_t *tl;
4858 	nfsv4stateid_t stateid;
4859 	int cnt, error = 0;
4860 	int layouttype __unused;
4861 	char devid[NFSX_V4DEVICEID] __unused;
4862 	uint64_t offset, len, readcount, readbytes, writecount, writebytes
4863 	    __unused;
4864 
4865 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4866 		nd->nd_repstat = NFSERR_WRONGSEC;
4867 		goto nfsmout;
4868 	}
4869 	NFSM_DISSECT(tl, uint32_t *, 6 * NFSX_HYPER + NFSX_STATEID +
4870 	    NFSX_V4DEVICEID + 2 * NFSX_UNSIGNED);
4871 	offset = fxdr_hyper(tl); tl += 2;
4872 	len = fxdr_hyper(tl); tl += 2;
4873 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4874 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4875 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4876 	readcount = fxdr_hyper(tl); tl += 2;
4877 	readbytes = fxdr_hyper(tl); tl += 2;
4878 	writecount = fxdr_hyper(tl); tl += 2;
4879 	writebytes = fxdr_hyper(tl); tl += 2;
4880 	NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
4881 	tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
4882 	layouttype = fxdr_unsigned(int, *tl++);
4883 	cnt = fxdr_unsigned(int, *tl);
4884 	error = nfsm_advance(nd, NFSM_RNDUP(cnt), -1);
4885 	if (error != 0)
4886 		goto nfsmout;
4887 	NFSD_DEBUG(4, "layoutstats cnt=%d\n", cnt);
4888 	/*
4889 	 * For the special stateid of other all 0s and seqid == 1, set
4890 	 * the stateid to the current stateid, if it is set.
4891 	 */
4892 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4893 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
4894 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4895 			stateid = nd->nd_curstateid;
4896 			stateid.seqid = 0;
4897 		} else {
4898 			nd->nd_repstat = NFSERR_BADSTATEID;
4899 			goto nfsmout;
4900 		}
4901 	}
4902 
4903 	/*
4904 	 * No use for the stats for now.
4905 	 */
4906 nfsmout:
4907 	vput(vp);
4908 	NFSEXITCODE2(error, nd);
4909 	return (error);
4910 }
4911 
4912 /*
4913  * nfsv4 io_advise service
4914  */
4915 int
4916 nfsrvd_ioadvise(struct nfsrv_descript *nd, __unused int isdgram,
4917     vnode_t vp, struct nfsexstuff *exp)
4918 {
4919 	uint32_t *tl;
4920 	nfsv4stateid_t stateid;
4921 	nfsattrbit_t hints;
4922 	int error = 0, ret;
4923 	off_t offset, len;
4924 
4925 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4926 		nd->nd_repstat = NFSERR_WRONGSEC;
4927 		goto nfsmout;
4928 	}
4929 	NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
4930 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4931 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4932 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4933 	offset = fxdr_hyper(tl); tl += 2;
4934 	len = fxdr_hyper(tl);
4935 	error = nfsrv_getattrbits(nd, &hints, NULL, NULL);
4936 	if (error != 0)
4937 		goto nfsmout;
4938 	/*
4939 	 * For the special stateid of other all 0s and seqid == 1, set
4940 	 * the stateid to the current stateid, if it is set.
4941 	 */
4942 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4943 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
4944 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4945 			stateid = nd->nd_curstateid;
4946 			stateid.seqid = 0;
4947 		} else {
4948 			nd->nd_repstat = NFSERR_BADSTATEID;
4949 			goto nfsmout;
4950 		}
4951 	}
4952 
4953 	if (offset < 0) {
4954 		nd->nd_repstat = NFSERR_INVAL;
4955 		goto nfsmout;
4956 	}
4957 	if (len < 0)
4958 		len = 0;
4959 	if (vp->v_type != VREG) {
4960 		if (vp->v_type == VDIR)
4961 			nd->nd_repstat = NFSERR_ISDIR;
4962 		else
4963 			nd->nd_repstat = NFSERR_WRONGTYPE;
4964 		goto nfsmout;
4965 	}
4966 
4967 	/*
4968 	 * For now, we can only handle WILLNEED and DONTNEED and don't use
4969 	 * the stateid.
4970 	 */
4971 	if ((NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED) &&
4972 	    !NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED)) ||
4973 	    (NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED) &&
4974 	    !NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED))) {
4975 		NFSVOPUNLOCK(vp);
4976 		if (NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED)) {
4977 			ret = VOP_ADVISE(vp, offset, len, POSIX_FADV_WILLNEED);
4978 			NFSZERO_ATTRBIT(&hints);
4979 			if (ret == 0)
4980 				NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED);
4981 			else
4982 				NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
4983 		} else {
4984 			ret = VOP_ADVISE(vp, offset, len, POSIX_FADV_DONTNEED);
4985 			NFSZERO_ATTRBIT(&hints);
4986 			if (ret == 0)
4987 				NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED);
4988 			else
4989 				NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
4990 		}
4991 		vrele(vp);
4992 	} else {
4993 		NFSZERO_ATTRBIT(&hints);
4994 		NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
4995 		vput(vp);
4996 	}
4997 	nfsrv_putattrbit(nd, &hints);
4998 	NFSEXITCODE2(error, nd);
4999 	return (error);
5000 nfsmout:
5001 	vput(vp);
5002 	NFSEXITCODE2(error, nd);
5003 	return (error);
5004 }
5005 
5006 /*
5007  * nfsv4 getdeviceinfo service
5008  */
5009 int
5010 nfsrvd_getdevinfo(struct nfsrv_descript *nd, __unused int isdgram,
5011     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5012 {
5013 	uint32_t *tl, maxcnt, notify[NFSV4_NOTIFYBITMAP];
5014 	int cnt, devaddrlen, error = 0, i, layouttype;
5015 	char devid[NFSX_V4DEVICEID], *devaddr;
5016 	time_t dev_time;
5017 
5018 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5019 		nd->nd_repstat = NFSERR_WRONGSEC;
5020 		goto nfsmout;
5021 	}
5022 	NFSM_DISSECT(tl, uint32_t *, 3 * NFSX_UNSIGNED + NFSX_V4DEVICEID);
5023 	NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
5024 	tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
5025 	layouttype = fxdr_unsigned(int, *tl++);
5026 	maxcnt = fxdr_unsigned(uint32_t, *tl++);
5027 	cnt = fxdr_unsigned(int, *tl);
5028 	NFSD_DEBUG(4, "getdevinfo ltyp=%d maxcnt=%u bitcnt=%d\n", layouttype,
5029 	    maxcnt, cnt);
5030 	if (cnt > NFSV4_NOTIFYBITMAP || cnt < 0) {
5031 		nd->nd_repstat = NFSERR_INVAL;
5032 		goto nfsmout;
5033 	}
5034 	if (cnt > 0) {
5035 		NFSM_DISSECT(tl, uint32_t *, cnt * NFSX_UNSIGNED);
5036 		for (i = 0; i < cnt; i++)
5037 			notify[i] = fxdr_unsigned(uint32_t, *tl++);
5038 	}
5039 	for (i = cnt; i < NFSV4_NOTIFYBITMAP; i++)
5040 		notify[i] = 0;
5041 
5042 	/*
5043 	 * Check that the device id is not stale.  Device ids are recreated
5044 	 * each time the nfsd threads are restarted.
5045 	 */
5046 	NFSBCOPY(devid, &dev_time, sizeof(dev_time));
5047 	if (dev_time != nfsdev_time) {
5048 		nd->nd_repstat = NFSERR_NOENT;
5049 		goto nfsmout;
5050 	}
5051 
5052 	/* Look for the device id. */
5053 	nd->nd_repstat = nfsrv_getdevinfo(devid, layouttype, &maxcnt,
5054 	    notify, &devaddrlen, &devaddr);
5055 	NFSD_DEBUG(4, "nfsrv_getdevinfo stat=%u\n", nd->nd_repstat);
5056 	if (nd->nd_repstat == 0) {
5057 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5058 		*tl = txdr_unsigned(layouttype);
5059 		nfsm_strtom(nd, devaddr, devaddrlen);
5060 		cnt = 0;
5061 		for (i = 0; i < NFSV4_NOTIFYBITMAP; i++) {
5062 			if (notify[i] != 0)
5063 				cnt = i + 1;
5064 		}
5065 		NFSM_BUILD(tl, uint32_t *, (cnt + 1) * NFSX_UNSIGNED);
5066 		*tl++ = txdr_unsigned(cnt);
5067 		for (i = 0; i < cnt; i++)
5068 			*tl++ = txdr_unsigned(notify[i]);
5069 	} else if (nd->nd_repstat == NFSERR_TOOSMALL) {
5070 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5071 		*tl = txdr_unsigned(maxcnt);
5072 	}
5073 nfsmout:
5074 	NFSEXITCODE2(error, nd);
5075 	return (error);
5076 }
5077 
5078 /*
5079  * nfsv4 test stateid service
5080  */
5081 int
5082 nfsrvd_teststateid(struct nfsrv_descript *nd, __unused int isdgram,
5083     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5084 {
5085 	uint32_t *tl;
5086 	nfsv4stateid_t *stateidp = NULL, *tstateidp;
5087 	int cnt, error = 0, i, ret;
5088 	struct thread *p = curthread;
5089 
5090 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5091 		nd->nd_repstat = NFSERR_WRONGSEC;
5092 		goto nfsmout;
5093 	}
5094 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5095 	cnt = fxdr_unsigned(int, *tl);
5096 	if (cnt <= 0 || cnt > 1024) {
5097 		nd->nd_repstat = NFSERR_BADXDR;
5098 		goto nfsmout;
5099 	}
5100 	stateidp = mallocarray(cnt, sizeof(nfsv4stateid_t), M_TEMP, M_WAITOK);
5101 	tstateidp = stateidp;
5102 	for (i = 0; i < cnt; i++) {
5103 		NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
5104 		tstateidp->seqid = fxdr_unsigned(uint32_t, *tl++);
5105 		NFSBCOPY(tl, tstateidp->other, NFSX_STATEIDOTHER);
5106 		tstateidp++;
5107 	}
5108 	NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5109 	*tl = txdr_unsigned(cnt);
5110 	tstateidp = stateidp;
5111 	for (i = 0; i < cnt; i++) {
5112 		ret = nfsrv_teststateid(nd, tstateidp, p);
5113 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5114 		*tl = txdr_unsigned(ret);
5115 		tstateidp++;
5116 	}
5117 nfsmout:
5118 	free(stateidp, M_TEMP);
5119 	NFSEXITCODE2(error, nd);
5120 	return (error);
5121 }
5122 
5123 /*
5124  * nfs allocate service
5125  */
5126 int
5127 nfsrvd_allocate(struct nfsrv_descript *nd, __unused int isdgram,
5128     vnode_t vp, struct nfsexstuff *exp)
5129 {
5130 	uint32_t *tl;
5131 	struct nfsvattr forat;
5132 	int error = 0, forat_ret = 1, gotproxystateid;
5133 	off_t off, len;
5134 	struct nfsstate st, *stp = &st;
5135 	struct nfslock lo, *lop = &lo;
5136 	nfsv4stateid_t stateid;
5137 	nfsquad_t clientid;
5138 	nfsattrbit_t attrbits;
5139 
5140 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5141 		nd->nd_repstat = NFSERR_WRONGSEC;
5142 		goto nfsmout;
5143 	}
5144 	gotproxystateid = 0;
5145 	NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
5146 	stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5147 	lop->lo_flags = NFSLCK_WRITE;
5148 	stp->ls_ownerlen = 0;
5149 	stp->ls_op = NULL;
5150 	stp->ls_uid = nd->nd_cred->cr_uid;
5151 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
5152 	clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
5153 	clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
5154 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
5155 		if ((nd->nd_flag & ND_NFSV41) != 0)
5156 			clientid.qval = nd->nd_clientid.qval;
5157 		else if (nd->nd_clientid.qval != clientid.qval)
5158 			printf("EEK2 multiple clids\n");
5159 	} else {
5160 		if ((nd->nd_flag & ND_NFSV41) != 0)
5161 			printf("EEK! no clientid from session\n");
5162 		nd->nd_flag |= ND_IMPLIEDCLID;
5163 		nd->nd_clientid.qval = clientid.qval;
5164 	}
5165 	stp->ls_stateid.other[2] = *tl++;
5166 	/*
5167 	 * Don't allow this to be done for a DS.
5168 	 */
5169 	if ((nd->nd_flag & ND_DSSERVER) != 0)
5170 		nd->nd_repstat = NFSERR_NOTSUPP;
5171 	/* However, allow the proxy stateid. */
5172 	if (stp->ls_stateid.seqid == 0xffffffff &&
5173 	    stp->ls_stateid.other[0] == 0x55555555 &&
5174 	    stp->ls_stateid.other[1] == 0x55555555 &&
5175 	    stp->ls_stateid.other[2] == 0x55555555)
5176 		gotproxystateid = 1;
5177 	off = fxdr_hyper(tl); tl += 2;
5178 	lop->lo_first = off;
5179 	len = fxdr_hyper(tl);
5180 	lop->lo_end = off + len;
5181 	/*
5182 	 * Paranoia, just in case it wraps around, which shouldn't
5183 	 * ever happen anyhow.
5184 	 */
5185 	if (nd->nd_repstat == 0 && (lop->lo_end < lop->lo_first || len <= 0))
5186 		nd->nd_repstat = NFSERR_INVAL;
5187 
5188 	if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5189 		nd->nd_repstat = NFSERR_WRONGTYPE;
5190 	NFSZERO_ATTRBIT(&attrbits);
5191 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5192 	forat_ret = nfsvno_getattr(vp, &forat, nd, curthread, 1, &attrbits);
5193 	if (nd->nd_repstat == 0)
5194 		nd->nd_repstat = forat_ret;
5195 	if (nd->nd_repstat == 0 && (forat.na_uid != nd->nd_cred->cr_uid ||
5196 	     NFSVNO_EXSTRICTACCESS(exp)))
5197 		nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp,
5198 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5199 		    NULL);
5200 	if (nd->nd_repstat == 0 && gotproxystateid == 0)
5201 		nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
5202 		    &stateid, exp, nd, curthread);
5203 
5204 	if (nd->nd_repstat == 0)
5205 		nd->nd_repstat = nfsvno_allocate(vp, off, len, nd->nd_cred,
5206 		    curthread);
5207 	vput(vp);
5208 	NFSEXITCODE2(0, nd);
5209 	return (0);
5210 nfsmout:
5211 	vput(vp);
5212 	NFSEXITCODE2(error, nd);
5213 	return (error);
5214 }
5215 
5216 /*
5217  * nfs copy service
5218  */
5219 int
5220 nfsrvd_copy_file_range(struct nfsrv_descript *nd, __unused int isdgram,
5221     vnode_t vp, vnode_t tovp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
5222 {
5223 	uint32_t *tl;
5224 	struct nfsvattr at;
5225 	int cnt, error = 0, ret;
5226 	off_t inoff, outoff;
5227 	uint64_t len;
5228 	size_t xfer;
5229 	struct nfsstate inst, outst, *instp = &inst, *outstp = &outst;
5230 	struct nfslock inlo, outlo, *inlop = &inlo, *outlop = &outlo;
5231 	nfsquad_t clientid;
5232 	nfsv4stateid_t stateid;
5233 	nfsattrbit_t attrbits;
5234 	void *rl_rcookie, *rl_wcookie;
5235 
5236 	rl_rcookie = rl_wcookie = NULL;
5237 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5238 		nd->nd_repstat = NFSERR_WRONGSEC;
5239 		goto nfsmout;
5240 	}
5241 	if (nfsrv_devidcnt > 0) {
5242 		/*
5243 		 * For a pNFS server, reply NFSERR_NOTSUPP so that the client
5244 		 * will do the copy via I/O on the DS(s).
5245 		 */
5246 		nd->nd_repstat = NFSERR_NOTSUPP;
5247 		goto nfsmout;
5248 	}
5249 	if (vp == tovp) {
5250 		/* Copying a byte range within the same file is not allowed. */
5251 		nd->nd_repstat = NFSERR_INVAL;
5252 		goto nfsmout;
5253 	}
5254 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_STATEID + 3 * NFSX_HYPER +
5255 	    3 * NFSX_UNSIGNED);
5256 	instp->ls_flags = (NFSLCK_CHECK | NFSLCK_READACCESS);
5257 	inlop->lo_flags = NFSLCK_READ;
5258 	instp->ls_ownerlen = 0;
5259 	instp->ls_op = NULL;
5260 	instp->ls_uid = nd->nd_cred->cr_uid;
5261 	instp->ls_stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5262 	clientid.lval[0] = instp->ls_stateid.other[0] = *tl++;
5263 	clientid.lval[1] = instp->ls_stateid.other[1] = *tl++;
5264 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0)
5265 		clientid.qval = nd->nd_clientid.qval;
5266 	instp->ls_stateid.other[2] = *tl++;
5267 	outstp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5268 	outlop->lo_flags = NFSLCK_WRITE;
5269 	outstp->ls_ownerlen = 0;
5270 	outstp->ls_op = NULL;
5271 	outstp->ls_uid = nd->nd_cred->cr_uid;
5272 	outstp->ls_stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5273 	outstp->ls_stateid.other[0] = *tl++;
5274 	outstp->ls_stateid.other[1] = *tl++;
5275 	outstp->ls_stateid.other[2] = *tl++;
5276 	inoff = fxdr_hyper(tl); tl += 2;
5277 	inlop->lo_first = inoff;
5278 	outoff = fxdr_hyper(tl); tl += 2;
5279 	outlop->lo_first = outoff;
5280 	len = fxdr_hyper(tl); tl += 2;
5281 	if (len == 0) {
5282 		/* len == 0 means to EOF. */
5283 		inlop->lo_end = OFF_MAX;
5284 		outlop->lo_end = OFF_MAX;
5285 	} else {
5286 		inlop->lo_end = inlop->lo_first + len;
5287 		outlop->lo_end = outlop->lo_first + len;
5288 	}
5289 
5290 	/*
5291 	 * At this time only consecutive, synchronous copy is supported,
5292 	 * so ca_consecutive and ca_synchronous can be ignored.
5293 	 */
5294 	tl += 2;
5295 
5296 	cnt = fxdr_unsigned(int, *tl);
5297 	if ((nd->nd_flag & ND_DSSERVER) != 0 || cnt != 0)
5298 		nd->nd_repstat = NFSERR_NOTSUPP;
5299 	if (nd->nd_repstat == 0 && (inoff > OFF_MAX || outoff > OFF_MAX ||
5300 	    inlop->lo_end > OFF_MAX || outlop->lo_end > OFF_MAX ||
5301 	    inlop->lo_end < inlop->lo_first || outlop->lo_end <
5302 	    outlop->lo_first))
5303 		nd->nd_repstat = NFSERR_INVAL;
5304 
5305 	if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5306 		nd->nd_repstat = NFSERR_WRONGTYPE;
5307 
5308 	/* Check permissions for the input file. */
5309 	NFSZERO_ATTRBIT(&attrbits);
5310 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5311 	ret = nfsvno_getattr(vp, &at, nd, curthread, 1, &attrbits);
5312 	if (nd->nd_repstat == 0)
5313 		nd->nd_repstat = ret;
5314 	if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5315 	     NFSVNO_EXSTRICTACCESS(exp)))
5316 		nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred, exp,
5317 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5318 		    NULL);
5319 	if (nd->nd_repstat == 0)
5320 		nd->nd_repstat = nfsrv_lockctrl(vp, &instp, &inlop, NULL,
5321 		    clientid, &stateid, exp, nd, curthread);
5322 	NFSVOPUNLOCK(vp);
5323 	if (nd->nd_repstat != 0)
5324 		goto out;
5325 
5326 	error = NFSVOPLOCK(tovp, LK_SHARED);
5327 	if (error != 0)
5328 		goto out;
5329 	if (vnode_vtype(tovp) != VREG)
5330 		nd->nd_repstat = NFSERR_WRONGTYPE;
5331 
5332 	/* For the output file, we only need the Owner attribute. */
5333 	ret = nfsvno_getattr(tovp, &at, nd, curthread, 1, &attrbits);
5334 	if (nd->nd_repstat == 0)
5335 		nd->nd_repstat = ret;
5336 	if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5337 	     NFSVNO_EXSTRICTACCESS(exp)))
5338 		nd->nd_repstat = nfsvno_accchk(tovp, VWRITE, nd->nd_cred, toexp,
5339 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5340 		    NULL);
5341 	if (nd->nd_repstat == 0)
5342 		nd->nd_repstat = nfsrv_lockctrl(tovp, &outstp, &outlop, NULL,
5343 		    clientid, &stateid, toexp, nd, curthread);
5344 	NFSVOPUNLOCK(tovp);
5345 
5346 	/* Range lock the byte ranges for both invp and outvp. */
5347 	if (nd->nd_repstat == 0) {
5348 		for (;;) {
5349 			if (len == 0) {
5350 				rl_wcookie = vn_rangelock_wlock(tovp, outoff,
5351 				    OFF_MAX);
5352 				rl_rcookie = vn_rangelock_tryrlock(vp, inoff,
5353 				    OFF_MAX);
5354 			} else {
5355 				rl_wcookie = vn_rangelock_wlock(tovp, outoff,
5356 				    outoff + len);
5357 				rl_rcookie = vn_rangelock_tryrlock(vp, inoff,
5358 				    inoff + len);
5359 			}
5360 			if (rl_rcookie != NULL)
5361 				break;
5362 			vn_rangelock_unlock(tovp, rl_wcookie);
5363 			if (len == 0)
5364 				rl_rcookie = vn_rangelock_rlock(vp, inoff,
5365 				    OFF_MAX);
5366 			else
5367 				rl_rcookie = vn_rangelock_rlock(vp, inoff,
5368 				    inoff + len);
5369 			vn_rangelock_unlock(vp, rl_rcookie);
5370 		}
5371 
5372 		error = NFSVOPLOCK(vp, LK_SHARED);
5373 		if (error == 0) {
5374 			ret = nfsvno_getattr(vp, &at, nd, curthread, 1, NULL);
5375 			if (ret == 0) {
5376 				/*
5377 				 * Since invp is range locked, na_size should
5378 				 * not change.
5379 				 */
5380 				if (len == 0 && at.na_size > inoff) {
5381 					/*
5382 					 * If len == 0, set it based on invp's
5383 					 * size. If offset is past EOF, just
5384 					 * leave len == 0.
5385 					 */
5386 					len = at.na_size - inoff;
5387 				} else if (nfsrv_linux42server == 0 &&
5388 				    inoff + len > at.na_size) {
5389 					/*
5390 					 * RFC-7862 says that NFSERR_INVAL must
5391 					 * be returned when inoff + len exceeds
5392 					 * the file size, however the NFSv4.2
5393 					 * Linux client likes to do this, so
5394 					 * only check if nfsrv_linux42server
5395 					 * is not set.
5396 					 */
5397 					nd->nd_repstat = NFSERR_INVAL;
5398 				}
5399 			}
5400 			NFSVOPUNLOCK(vp);
5401 			if (ret != 0 && nd->nd_repstat == 0)
5402 				nd->nd_repstat = ret;
5403 		} else if (nd->nd_repstat == 0)
5404 			nd->nd_repstat = error;
5405 	}
5406 
5407 	/*
5408 	 * Do the actual copy to an upper limit of vfs.nfs.maxcopyrange.
5409 	 * This limit is applied to ensure that the RPC replies in a
5410 	 * reasonable time.
5411 	 */
5412 	if (len > nfs_maxcopyrange)
5413 		xfer = nfs_maxcopyrange;
5414 	else
5415 		xfer = len;
5416 	if (nd->nd_repstat == 0) {
5417 		nd->nd_repstat = vn_copy_file_range(vp, &inoff, tovp, &outoff,
5418 		    &xfer, 0, nd->nd_cred, nd->nd_cred, NULL);
5419 		if (nd->nd_repstat == 0)
5420 			len = xfer;
5421 	}
5422 
5423 	/* Unlock the ranges. */
5424 	if (rl_rcookie != NULL)
5425 		vn_rangelock_unlock(vp, rl_rcookie);
5426 	if (rl_wcookie != NULL)
5427 		vn_rangelock_unlock(tovp, rl_wcookie);
5428 
5429 	if (nd->nd_repstat == 0) {
5430 		NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + NFSX_HYPER +
5431 		    NFSX_VERF);
5432 		*tl++ = txdr_unsigned(0);	/* No callback ids. */
5433 		txdr_hyper(len, tl); tl += 2;
5434 		*tl++ = txdr_unsigned(NFSWRITE_UNSTABLE);
5435 		*tl++ = txdr_unsigned(nfsboottime.tv_sec);
5436 		*tl++ = txdr_unsigned(nfsboottime.tv_usec);
5437 		*tl++ = newnfs_true;
5438 		*tl = newnfs_true;
5439 	}
5440 out:
5441 	vrele(vp);
5442 	vrele(tovp);
5443 	NFSEXITCODE2(error, nd);
5444 	return (error);
5445 nfsmout:
5446 	vput(vp);
5447 	vrele(tovp);
5448 	NFSEXITCODE2(error, nd);
5449 	return (error);
5450 }
5451 
5452 /*
5453  * nfs seek service
5454  */
5455 int
5456 nfsrvd_seek(struct nfsrv_descript *nd, __unused int isdgram,
5457     vnode_t vp, struct nfsexstuff *exp)
5458 {
5459 	uint32_t *tl;
5460 	struct nfsvattr at;
5461 	int content, error = 0;
5462 	off_t off;
5463 	u_long cmd;
5464 	nfsattrbit_t attrbits;
5465 	bool eof;
5466 
5467 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5468 		nd->nd_repstat = NFSERR_WRONGSEC;
5469 		goto nfsmout;
5470 	}
5471 	NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + NFSX_HYPER + NFSX_UNSIGNED);
5472 	/* Ignore the stateid for now. */
5473 	tl += (NFSX_STATEID / NFSX_UNSIGNED);
5474 	off = fxdr_hyper(tl); tl += 2;
5475 	content = fxdr_unsigned(int, *tl);
5476 	if (content == NFSV4CONTENT_DATA)
5477 		cmd = FIOSEEKDATA;
5478 	else if (content == NFSV4CONTENT_HOLE)
5479 		cmd = FIOSEEKHOLE;
5480 	else
5481 		nd->nd_repstat = NFSERR_BADXDR;
5482 	if (nd->nd_repstat == 0 && vnode_vtype(vp) == VDIR)
5483 		nd->nd_repstat = NFSERR_ISDIR;
5484 	if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5485 		nd->nd_repstat = NFSERR_WRONGTYPE;
5486 	if (nd->nd_repstat == 0 && off < 0)
5487 		nd->nd_repstat = NFSERR_NXIO;
5488 	if (nd->nd_repstat == 0) {
5489 		/* Check permissions for the input file. */
5490 		NFSZERO_ATTRBIT(&attrbits);
5491 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5492 		nd->nd_repstat = nfsvno_getattr(vp, &at, nd, curthread, 1,
5493 		    &attrbits);
5494 	}
5495 	if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5496 	     NFSVNO_EXSTRICTACCESS(exp)))
5497 		nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred, exp,
5498 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5499 		    NULL);
5500 	if (nd->nd_repstat != 0)
5501 		goto nfsmout;
5502 
5503 	/* nfsvno_seek() unlocks and vrele()s the vp. */
5504 	nd->nd_repstat = nfsvno_seek(nd, vp, cmd, &off, content, &eof,
5505 	    nd->nd_cred, curthread);
5506 	if (nd->nd_repstat == 0 && eof && content == NFSV4CONTENT_DATA &&
5507 	    nfsrv_linux42server != 0)
5508 		nd->nd_repstat = NFSERR_NXIO;
5509 	if (nd->nd_repstat == 0) {
5510 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED + NFSX_HYPER);
5511 		if (eof)
5512 			*tl++ = newnfs_true;
5513 		else
5514 			*tl++ = newnfs_false;
5515 		txdr_hyper(off, tl);
5516 	}
5517 	NFSEXITCODE2(error, nd);
5518 	return (error);
5519 nfsmout:
5520 	vput(vp);
5521 	NFSEXITCODE2(error, nd);
5522 	return (error);
5523 }
5524 
5525 /*
5526  * nfs get extended attribute service
5527  */
5528 int
5529 nfsrvd_getxattr(struct nfsrv_descript *nd, __unused int isdgram,
5530     vnode_t vp, __unused struct nfsexstuff *exp)
5531 {
5532 	uint32_t *tl;
5533 	struct mbuf *mp = NULL, *mpend = NULL;
5534 	int error, len;
5535 	char *name;
5536 	struct thread *p = curthread;
5537 
5538 	error = 0;
5539 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5540 		nd->nd_repstat = NFSERR_WRONGSEC;
5541 		goto nfsmout;
5542 	}
5543 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5544 	len = fxdr_unsigned(int, *tl);
5545 	if (len <= 0) {
5546 		nd->nd_repstat = NFSERR_BADXDR;
5547 		goto nfsmout;
5548 	}
5549 	if (len > EXTATTR_MAXNAMELEN) {
5550 		nd->nd_repstat = NFSERR_NOXATTR;
5551 		goto nfsmout;
5552 	}
5553 	name = malloc(len + 1, M_TEMP, M_WAITOK);
5554 	nd->nd_repstat = nfsrv_mtostr(nd, name, len);
5555 	if (nd->nd_repstat == 0)
5556 		nd->nd_repstat = nfsvno_getxattr(vp, name, nd->nd_maxresp,
5557 		    nd->nd_cred, p, &mp, &mpend, &len);
5558 	if (nd->nd_repstat == ENOATTR)
5559 		nd->nd_repstat = NFSERR_NOXATTR;
5560 	else if (nd->nd_repstat == EOPNOTSUPP)
5561 		nd->nd_repstat = NFSERR_NOTSUPP;
5562 	if (nd->nd_repstat == 0) {
5563 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5564 		*tl = txdr_unsigned(len);
5565 		if (len > 0) {
5566 			nd->nd_mb->m_next = mp;
5567 			nd->nd_mb = mpend;
5568 			nd->nd_bpos = mtod(mpend, caddr_t) + mpend->m_len;
5569 		}
5570 	}
5571 	free(name, M_TEMP);
5572 
5573 nfsmout:
5574 	if (nd->nd_repstat == 0)
5575 		nd->nd_repstat = error;
5576 	vput(vp);
5577 	NFSEXITCODE2(0, nd);
5578 	return (0);
5579 }
5580 
5581 /*
5582  * nfs set extended attribute service
5583  */
5584 int
5585 nfsrvd_setxattr(struct nfsrv_descript *nd, __unused int isdgram,
5586     vnode_t vp, __unused struct nfsexstuff *exp)
5587 {
5588 	uint32_t *tl;
5589 	struct nfsvattr ova, nva;
5590 	nfsattrbit_t attrbits;
5591 	int error, len, opt;
5592 	char *name;
5593 	size_t siz;
5594 	struct thread *p = curthread;
5595 
5596 	error = 0;
5597 	name = NULL;
5598 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5599 		nd->nd_repstat = NFSERR_WRONGSEC;
5600 		goto nfsmout;
5601 	}
5602 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
5603 	opt = fxdr_unsigned(int, *tl++);
5604 	len = fxdr_unsigned(int, *tl);
5605 	if (len <= 0) {
5606 		nd->nd_repstat = NFSERR_BADXDR;
5607 		goto nfsmout;
5608 	}
5609 	if (len > EXTATTR_MAXNAMELEN) {
5610 		nd->nd_repstat = NFSERR_NOXATTR;
5611 		goto nfsmout;
5612 	}
5613 	name = malloc(len + 1, M_TEMP, M_WAITOK);
5614 	error = nfsrv_mtostr(nd, name, len);
5615 	if (error != 0)
5616 		goto nfsmout;
5617 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5618 	len = fxdr_unsigned(int, *tl);
5619 	if (len < 0 || len > IOSIZE_MAX) {
5620 		nd->nd_repstat = NFSERR_XATTR2BIG;
5621 		goto nfsmout;
5622 	}
5623 	switch (opt) {
5624 	case NFSV4SXATTR_CREATE:
5625 		error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
5626 		    &siz, nd->nd_cred, p);
5627 		if (error != ENOATTR)
5628 			nd->nd_repstat = NFSERR_EXIST;
5629 		error = 0;
5630 		break;
5631 	case NFSV4SXATTR_REPLACE:
5632 		error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
5633 		    &siz, nd->nd_cred, p);
5634 		if (error != 0)
5635 			nd->nd_repstat = NFSERR_NOXATTR;
5636 		break;
5637 	case NFSV4SXATTR_EITHER:
5638 		break;
5639 	default:
5640 		nd->nd_repstat = NFSERR_BADXDR;
5641 	}
5642 	if (nd->nd_repstat != 0)
5643 		goto nfsmout;
5644 
5645 	/* Now, do the Set Extended attribute, with Change before and after. */
5646 	NFSZERO_ATTRBIT(&attrbits);
5647 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
5648 	nd->nd_repstat = nfsvno_getattr(vp, &ova, nd, p, 1, &attrbits);
5649 	if (nd->nd_repstat == 0) {
5650 		nd->nd_repstat = nfsvno_setxattr(vp, name, len, nd->nd_md,
5651 		    nd->nd_dpos, nd->nd_cred, p);
5652 		if (nd->nd_repstat == ENXIO)
5653 			nd->nd_repstat = NFSERR_XATTR2BIG;
5654 	}
5655 	if (nd->nd_repstat == 0 && len > 0)
5656 		nd->nd_repstat = nfsm_advance(nd, NFSM_RNDUP(len), -1);
5657 	if (nd->nd_repstat == 0)
5658 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
5659 	if (nd->nd_repstat == 0) {
5660 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_UNSIGNED);
5661 		*tl++ = newnfs_true;
5662 		txdr_hyper(ova.na_filerev, tl); tl += 2;
5663 		txdr_hyper(nva.na_filerev, tl);
5664 	}
5665 
5666 nfsmout:
5667 	free(name, M_TEMP);
5668 	if (nd->nd_repstat == 0)
5669 		nd->nd_repstat = error;
5670 	vput(vp);
5671 	NFSEXITCODE2(0, nd);
5672 	return (0);
5673 }
5674 
5675 /*
5676  * nfs remove extended attribute service
5677  */
5678 int
5679 nfsrvd_rmxattr(struct nfsrv_descript *nd, __unused int isdgram,
5680     vnode_t vp, __unused struct nfsexstuff *exp)
5681 {
5682 	uint32_t *tl;
5683 	struct nfsvattr ova, nva;
5684 	nfsattrbit_t attrbits;
5685 	int error, len;
5686 	char *name;
5687 	struct thread *p = curthread;
5688 
5689 	error = 0;
5690 	name = NULL;
5691 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5692 		nd->nd_repstat = NFSERR_WRONGSEC;
5693 		goto nfsmout;
5694 	}
5695 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5696 	len = fxdr_unsigned(int, *tl);
5697 	if (len <= 0) {
5698 		nd->nd_repstat = NFSERR_BADXDR;
5699 		goto nfsmout;
5700 	}
5701 	if (len > EXTATTR_MAXNAMELEN) {
5702 		nd->nd_repstat = NFSERR_NOXATTR;
5703 		goto nfsmout;
5704 	}
5705 	name = malloc(len + 1, M_TEMP, M_WAITOK);
5706 	error = nfsrv_mtostr(nd, name, len);
5707 	if (error != 0)
5708 		goto nfsmout;
5709 
5710 	if ((nd->nd_flag & ND_IMPLIEDCLID) == 0) {
5711 		printf("EEK! nfsrvd_rmxattr: no implied clientid\n");
5712 		error = NFSERR_NOXATTR;
5713 		goto nfsmout;
5714 	}
5715 	/*
5716 	 * Now, do the Remove Extended attribute, with Change before and
5717 	 * after.
5718 	*/
5719 	NFSZERO_ATTRBIT(&attrbits);
5720 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
5721 	nd->nd_repstat = nfsvno_getattr(vp, &ova, nd, p, 1, &attrbits);
5722 	if (nd->nd_repstat == 0) {
5723 		nd->nd_repstat = nfsvno_rmxattr(nd, vp, name, nd->nd_cred, p);
5724 		if (nd->nd_repstat == ENOATTR)
5725 			nd->nd_repstat = NFSERR_NOXATTR;
5726 	}
5727 	if (nd->nd_repstat == 0)
5728 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
5729 	if (nd->nd_repstat == 0) {
5730 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_UNSIGNED);
5731 		*tl++ = newnfs_true;
5732 		txdr_hyper(ova.na_filerev, tl); tl += 2;
5733 		txdr_hyper(nva.na_filerev, tl);
5734 	}
5735 
5736 nfsmout:
5737 	free(name, M_TEMP);
5738 	if (nd->nd_repstat == 0)
5739 		nd->nd_repstat = error;
5740 	vput(vp);
5741 	NFSEXITCODE2(0, nd);
5742 	return (0);
5743 }
5744 
5745 /*
5746  * nfs list extended attribute service
5747  */
5748 int
5749 nfsrvd_listxattr(struct nfsrv_descript *nd, __unused int isdgram,
5750     vnode_t vp, __unused struct nfsexstuff *exp)
5751 {
5752 	uint32_t cnt, *tl, len, len2, i, pos, retlen;
5753 	int error;
5754 	uint64_t cookie, cookie2;
5755 	u_char *buf;
5756 	bool eof;
5757 	struct thread *p = curthread;
5758 
5759 	error = 0;
5760 	buf = NULL;
5761 	if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5762 		nd->nd_repstat = NFSERR_WRONGSEC;
5763 		goto nfsmout;
5764 	}
5765 	NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
5766 	/*
5767 	 * The cookie doesn't need to be in net byte order, but FreeBSD
5768 	 * does so to make it more readable in packet traces.
5769 	 */
5770 	cookie = fxdr_hyper(tl); tl += 2;
5771 	len = fxdr_unsigned(uint32_t, *tl);
5772 	if (len == 0 || cookie >= IOSIZE_MAX) {
5773 		nd->nd_repstat = NFSERR_BADXDR;
5774 		goto nfsmout;
5775 	}
5776 	if (len > nd->nd_maxresp - NFS_MAXXDR)
5777 		len = nd->nd_maxresp - NFS_MAXXDR;
5778 	len2 = len;
5779 	nd->nd_repstat = nfsvno_listxattr(vp, cookie, nd->nd_cred, p, &buf,
5780 	    &len, &eof);
5781 	if (nd->nd_repstat == EOPNOTSUPP)
5782 		nd->nd_repstat = NFSERR_NOTSUPP;
5783 	if (nd->nd_repstat == 0) {
5784 		cookie2 = cookie + len;
5785 		if (cookie2 < cookie)
5786 			nd->nd_repstat = NFSERR_BADXDR;
5787 	}
5788 	if (nd->nd_repstat == 0) {
5789 		/* Now copy the entries out. */
5790 		retlen = NFSX_HYPER + 2 * NFSX_UNSIGNED;
5791 		if (len == 0 && retlen <= len2) {
5792 			/* The cookie was at eof. */
5793 			NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + 2 *
5794 			    NFSX_UNSIGNED);
5795 			txdr_hyper(cookie2, tl); tl += 2;
5796 			*tl++ = txdr_unsigned(0);
5797 			*tl = newnfs_true;
5798 			goto nfsmout;
5799 		}
5800 
5801 		/* Sanity check the cookie. */
5802 		for (pos = 0; pos < len; pos += (i + 1)) {
5803 			if (pos == cookie)
5804 				break;
5805 			i = buf[pos];
5806 		}
5807 		if (pos != cookie) {
5808 			nd->nd_repstat = NFSERR_INVAL;
5809 			goto nfsmout;
5810 		}
5811 
5812 		/* Loop around copying the entrie(s) out. */
5813 		cnt = 0;
5814 		len -= cookie;
5815 		i = buf[pos];
5816 		while (i < len && len2 >= retlen + NFSM_RNDUP(i) +
5817 		    NFSX_UNSIGNED) {
5818 			if (cnt == 0) {
5819 				NFSM_BUILD(tl, uint32_t *, NFSX_HYPER +
5820 				    NFSX_UNSIGNED);
5821 				txdr_hyper(cookie2, tl); tl += 2;
5822 			}
5823 			retlen += nfsm_strtom(nd, &buf[pos + 1], i);
5824 			len -= (i + 1);
5825 			pos += (i + 1);
5826 			i = buf[pos];
5827 			cnt++;
5828 		}
5829 		/*
5830 		 * eof is set true/false by nfsvno_listxattr(), but if we
5831 		 * can't copy all entries returned by nfsvno_listxattr(),
5832 		 * we are not at eof.
5833 		 */
5834 		if (len > 0)
5835 			eof = false;
5836 		if (cnt > 0) {
5837 			/* *tl is set above. */
5838 			*tl = txdr_unsigned(cnt);
5839 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5840 			if (eof)
5841 				*tl = newnfs_true;
5842 			else
5843 				*tl = newnfs_false;
5844 		} else
5845 			nd->nd_repstat = NFSERR_TOOSMALL;
5846 	}
5847 
5848 nfsmout:
5849 	free(buf, M_TEMP);
5850 	if (nd->nd_repstat == 0)
5851 		nd->nd_repstat = error;
5852 	vput(vp);
5853 	NFSEXITCODE2(0, nd);
5854 	return (0);
5855 }
5856 
5857 /*
5858  * nfsv4 service not supported
5859  */
5860 int
5861 nfsrvd_notsupp(struct nfsrv_descript *nd, __unused int isdgram,
5862     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5863 {
5864 
5865 	nd->nd_repstat = NFSERR_NOTSUPP;
5866 	NFSEXITCODE2(0, nd);
5867 	return (0);
5868 }
5869 
5870