xref: /freebsd/sys/fs/nfsserver/nfs_nfsdserv.c (revision 994297b01b98816bea1abf45ae4bac1bc69ee7a0)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1989, 1993
5  *	The Regents of the University of California.  All rights reserved.
6  *
7  * This code is derived from software contributed to Berkeley by
8  * Rick Macklem at The University of Guelph.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  */
35 
36 #include <sys/cdefs.h>
37 __FBSDID("$FreeBSD$");
38 
39 #include "opt_inet.h"
40 #include "opt_inet6.h"
41 /*
42  * nfs version 2, 3 and 4 server calls to vnode ops
43  * - these routines generally have 3 phases
44  *   1 - break down and validate rpc request in mbuf list
45  *   2 - do the vnode ops for the request, usually by calling a nfsvno_XXX()
46  *       function in nfsd_port.c
47  *   3 - build the rpc reply in an mbuf list
48  * For nfsv4, these functions are called for each Op within the Compound RPC.
49  */
50 
51 #include <fs/nfs/nfsport.h>
52 #include <sys/extattr.h>
53 #include <sys/filio.h>
54 
55 /* Global vars */
56 extern u_int32_t newnfs_false, newnfs_true;
57 extern enum vtype nv34tov_type[8];
58 extern struct timeval nfsboottime;
59 extern int nfsrv_enable_crossmntpt;
60 extern int nfsrv_statehashsize;
61 extern int nfsrv_layouthashsize;
62 extern time_t nfsdev_time;
63 extern volatile int nfsrv_devidcnt;
64 extern int nfsd_debuglevel;
65 extern u_long sb_max_adj;
66 extern int nfsrv_pnfsatime;
67 extern int nfsrv_maxpnfsmirror;
68 extern uint32_t nfs_srvmaxio;
69 
70 static int	nfs_async = 0;
71 SYSCTL_DECL(_vfs_nfsd);
72 SYSCTL_INT(_vfs_nfsd, OID_AUTO, async, CTLFLAG_RW, &nfs_async, 0,
73     "Tell client that writes were synced even though they were not");
74 extern int	nfsrv_doflexfile;
75 SYSCTL_INT(_vfs_nfsd, OID_AUTO, default_flexfile, CTLFLAG_RW,
76     &nfsrv_doflexfile, 0, "Make Flex File Layout the default for pNFS");
77 static int	nfsrv_linux42server = 1;
78 SYSCTL_INT(_vfs_nfsd, OID_AUTO, linux42server, CTLFLAG_RW,
79     &nfsrv_linux42server, 0,
80     "Enable Linux style NFSv4.2 server (non-RFC compliant)");
81 static bool	nfsrv_openaccess = true;
82 SYSCTL_BOOL(_vfs_nfsd, OID_AUTO, v4openaccess, CTLFLAG_RW,
83     &nfsrv_openaccess, 0,
84     "Enable Linux style NFSv4 Open access check");
85 static char nfsrv_scope[NFSV4_OPAQUELIMIT];
86 SYSCTL_STRING(_vfs_nfsd, OID_AUTO, scope, CTLFLAG_RWTUN,
87     &nfsrv_scope, NFSV4_OPAQUELIMIT, "Server scope");
88 static char nfsrv_owner_major[NFSV4_OPAQUELIMIT];
89 SYSCTL_STRING(_vfs_nfsd, OID_AUTO, owner_major, CTLFLAG_RWTUN,
90     &nfsrv_owner_major, NFSV4_OPAQUELIMIT, "Server owner major");
91 static uint64_t nfsrv_owner_minor;
92 SYSCTL_U64(_vfs_nfsd, OID_AUTO, owner_minor, CTLFLAG_RWTUN,
93     &nfsrv_owner_minor, 0, "Server owner minor");
94 /*
95  * Only enable this if all your exported file systems
96  * (or pNFS DSs for the pNFS case) support VOP_ALLOCATE.
97  */
98 static bool	nfsrv_doallocate = false;
99 SYSCTL_BOOL(_vfs_nfsd, OID_AUTO, enable_v42allocate, CTLFLAG_RW,
100     &nfsrv_doallocate, 0,
101     "Enable NFSv4.2 Allocate operation");
102 
103 /*
104  * This list defines the GSS mechanisms supported.
105  * (Don't ask me how you get these strings from the RFC stuff like
106  *  iso(1), org(3)... but someone did it, so I don't need to know.)
107  */
108 static struct nfsgss_mechlist nfsgss_mechlist[] = {
109 	{ 9, "\052\206\110\206\367\022\001\002\002", 11 },
110 	{ 0, "", 0 },
111 };
112 
113 /* local functions */
114 static void nfsrvd_symlinksub(struct nfsrv_descript *nd, struct nameidata *ndp,
115     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
116     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
117     int *diraft_retp, nfsattrbit_t *attrbitp,
118     NFSACL_T *aclp, NFSPROC_T *p, struct nfsexstuff *exp, char *pathcp,
119     int pathlen);
120 static void nfsrvd_mkdirsub(struct nfsrv_descript *nd, struct nameidata *ndp,
121     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
122     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
123     int *diraft_retp, nfsattrbit_t *attrbitp, NFSACL_T *aclp,
124     NFSPROC_T *p, struct nfsexstuff *exp);
125 
126 /*
127  * nfs access service (not a part of NFS V2)
128  */
129 int
130 nfsrvd_access(struct nfsrv_descript *nd, __unused int isdgram,
131     vnode_t vp, struct nfsexstuff *exp)
132 {
133 	u_int32_t *tl;
134 	int getret, error = 0;
135 	struct nfsvattr nva;
136 	u_int32_t testmode, nfsmode, supported = 0;
137 	accmode_t deletebit;
138 	struct thread *p = curthread;
139 
140 	if (nd->nd_repstat) {
141 		nfsrv_postopattr(nd, 1, &nva);
142 		goto out;
143 	}
144 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
145 	nfsmode = fxdr_unsigned(u_int32_t, *tl);
146 	if ((nd->nd_flag & ND_NFSV4) &&
147 	    (nfsmode & ~(NFSACCESS_READ | NFSACCESS_LOOKUP |
148 	     NFSACCESS_MODIFY | NFSACCESS_EXTEND | NFSACCESS_DELETE |
149 	     NFSACCESS_EXECUTE | NFSACCESS_XAREAD | NFSACCESS_XAWRITE |
150 	     NFSACCESS_XALIST))) {
151 		nd->nd_repstat = NFSERR_INVAL;
152 		vput(vp);
153 		goto out;
154 	}
155 	if (nfsmode & NFSACCESS_READ) {
156 		supported |= NFSACCESS_READ;
157 		if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
158 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
159 			nfsmode &= ~NFSACCESS_READ;
160 	}
161 	if (nfsmode & NFSACCESS_MODIFY) {
162 		supported |= NFSACCESS_MODIFY;
163 		if (nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp, p,
164 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
165 			nfsmode &= ~NFSACCESS_MODIFY;
166 	}
167 	if (nfsmode & NFSACCESS_EXTEND) {
168 		supported |= NFSACCESS_EXTEND;
169 		if (nfsvno_accchk(vp, VWRITE | VAPPEND, nd->nd_cred, exp, p,
170 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
171 			nfsmode &= ~NFSACCESS_EXTEND;
172 	}
173 	if (nfsmode & NFSACCESS_XAREAD) {
174 		supported |= NFSACCESS_XAREAD;
175 		if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
176 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
177 			nfsmode &= ~NFSACCESS_XAREAD;
178 	}
179 	if (nfsmode & NFSACCESS_XAWRITE) {
180 		supported |= NFSACCESS_XAWRITE;
181 		if (nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp, p,
182 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
183 			nfsmode &= ~NFSACCESS_XAWRITE;
184 	}
185 	if (nfsmode & NFSACCESS_XALIST) {
186 		supported |= NFSACCESS_XALIST;
187 		if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
188 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
189 			nfsmode &= ~NFSACCESS_XALIST;
190 	}
191 	if (nfsmode & NFSACCESS_DELETE) {
192 		supported |= NFSACCESS_DELETE;
193 		if (vp->v_type == VDIR)
194 			deletebit = VDELETE_CHILD;
195 		else
196 			deletebit = VDELETE;
197 		if (nfsvno_accchk(vp, deletebit, nd->nd_cred, exp, p,
198 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
199 			nfsmode &= ~NFSACCESS_DELETE;
200 	}
201 	if (vnode_vtype(vp) == VDIR)
202 		testmode = NFSACCESS_LOOKUP;
203 	else
204 		testmode = NFSACCESS_EXECUTE;
205 	if (nfsmode & testmode) {
206 		supported |= (nfsmode & testmode);
207 		if (nfsvno_accchk(vp, VEXEC, nd->nd_cred, exp, p,
208 		    NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
209 			nfsmode &= ~testmode;
210 	}
211 	nfsmode &= supported;
212 	if (nd->nd_flag & ND_NFSV3) {
213 		getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
214 		nfsrv_postopattr(nd, getret, &nva);
215 	}
216 	vput(vp);
217 	if (nd->nd_flag & ND_NFSV4) {
218 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
219 		*tl++ = txdr_unsigned(supported);
220 	} else
221 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
222 	*tl = txdr_unsigned(nfsmode);
223 
224 out:
225 	NFSEXITCODE2(0, nd);
226 	return (0);
227 nfsmout:
228 	vput(vp);
229 	NFSEXITCODE2(error, nd);
230 	return (error);
231 }
232 
233 /*
234  * nfs getattr service
235  */
236 int
237 nfsrvd_getattr(struct nfsrv_descript *nd, int isdgram,
238     vnode_t vp, __unused struct nfsexstuff *exp)
239 {
240 	struct nfsvattr nva;
241 	fhandle_t fh;
242 	int at_root = 0, error = 0, supports_nfsv4acls;
243 	struct nfsreferral *refp;
244 	nfsattrbit_t attrbits, tmpbits;
245 	struct mount *mp;
246 	struct vnode *tvp = NULL;
247 	struct vattr va;
248 	uint64_t mounted_on_fileno = 0;
249 	accmode_t accmode;
250 	struct thread *p = curthread;
251 
252 	if (nd->nd_repstat)
253 		goto out;
254 	if (nd->nd_flag & ND_NFSV4) {
255 		error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
256 		if (error) {
257 			vput(vp);
258 			goto out;
259 		}
260 
261 		/*
262 		 * Check for a referral.
263 		 */
264 		refp = nfsv4root_getreferral(vp, NULL, 0);
265 		if (refp != NULL) {
266 			(void) nfsrv_putreferralattr(nd, &attrbits, refp, 1,
267 			    &nd->nd_repstat);
268 			vput(vp);
269 			goto out;
270 		}
271 		if (nd->nd_repstat == 0) {
272 			accmode = 0;
273 			NFSSET_ATTRBIT(&tmpbits, &attrbits);
274 
275 			/*
276 			 * GETATTR with write-only attr time_access_set and time_modify_set
277 			 * should return NFS4ERR_INVAL.
278 			 */
279 			if (NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_TIMEACCESSSET) ||
280 					NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_TIMEMODIFYSET)){
281 				error = NFSERR_INVAL;
282 				vput(vp);
283 				goto out;
284 			}
285 			if (NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_ACL)) {
286 				NFSCLRBIT_ATTRBIT(&tmpbits, NFSATTRBIT_ACL);
287 				accmode |= VREAD_ACL;
288 			}
289 			if (NFSNONZERO_ATTRBIT(&tmpbits))
290 				accmode |= VREAD_ATTRIBUTES;
291 			if (accmode != 0)
292 				nd->nd_repstat = nfsvno_accchk(vp, accmode,
293 				    nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
294 				    NFSACCCHK_VPISLOCKED, NULL);
295 		}
296 	}
297 	if (!nd->nd_repstat)
298 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
299 	if (!nd->nd_repstat) {
300 		if (nd->nd_flag & ND_NFSV4) {
301 			if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_FILEHANDLE))
302 				nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
303 			if (!nd->nd_repstat)
304 				nd->nd_repstat = nfsrv_checkgetattr(nd, vp,
305 				    &nva, &attrbits, p);
306 			if (nd->nd_repstat == 0) {
307 				supports_nfsv4acls = nfs_supportsnfsv4acls(vp);
308 				mp = vp->v_mount;
309 				if (nfsrv_enable_crossmntpt != 0 &&
310 				    vp->v_type == VDIR &&
311 				    (vp->v_vflag & VV_ROOT) != 0 &&
312 				    vp != rootvnode) {
313 					tvp = mp->mnt_vnodecovered;
314 					VREF(tvp);
315 					at_root = 1;
316 				} else
317 					at_root = 0;
318 				vfs_ref(mp);
319 				NFSVOPUNLOCK(vp);
320 				if (at_root != 0) {
321 					if ((nd->nd_repstat =
322 					     NFSVOPLOCK(tvp, LK_SHARED)) == 0) {
323 						nd->nd_repstat = VOP_GETATTR(
324 						    tvp, &va, nd->nd_cred);
325 						vput(tvp);
326 					} else
327 						vrele(tvp);
328 					if (nd->nd_repstat == 0)
329 						mounted_on_fileno = (uint64_t)
330 						    va.va_fileid;
331 					else
332 						at_root = 0;
333 				}
334 				if (nd->nd_repstat == 0)
335 					nd->nd_repstat = vfs_busy(mp, 0);
336 				vfs_rel(mp);
337 				if (nd->nd_repstat == 0) {
338 					(void)nfsvno_fillattr(nd, mp, vp, &nva,
339 					    &fh, 0, &attrbits, nd->nd_cred, p,
340 					    isdgram, 1, supports_nfsv4acls,
341 					    at_root, mounted_on_fileno);
342 					vfs_unbusy(mp);
343 				}
344 				vrele(vp);
345 			} else
346 				vput(vp);
347 		} else {
348 			nfsrv_fillattr(nd, &nva);
349 			vput(vp);
350 		}
351 	} else {
352 		vput(vp);
353 	}
354 
355 out:
356 	NFSEXITCODE2(error, nd);
357 	return (error);
358 }
359 
360 /*
361  * nfs setattr service
362  */
363 int
364 nfsrvd_setattr(struct nfsrv_descript *nd, __unused int isdgram,
365     vnode_t vp, struct nfsexstuff *exp)
366 {
367 	struct nfsvattr nva, nva2;
368 	u_int32_t *tl;
369 	int preat_ret = 1, postat_ret = 1, gcheck = 0, error = 0;
370 	int gotproxystateid;
371 	struct timespec guard = { 0, 0 };
372 	nfsattrbit_t attrbits, retbits;
373 	nfsv4stateid_t stateid;
374 	NFSACL_T *aclp = NULL;
375 	struct thread *p = curthread;
376 
377 	if (nd->nd_repstat) {
378 		nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
379 		goto out;
380 	}
381 #ifdef NFS4_ACL_EXTATTR_NAME
382 	aclp = acl_alloc(M_WAITOK);
383 	aclp->acl_cnt = 0;
384 #endif
385 	gotproxystateid = 0;
386 	NFSVNO_ATTRINIT(&nva);
387 	if (nd->nd_flag & ND_NFSV4) {
388 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
389 		stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
390 		stateid.other[0] = *tl++;
391 		stateid.other[1] = *tl++;
392 		stateid.other[2] = *tl;
393 		if (stateid.other[0] == 0x55555555 &&
394 		    stateid.other[1] == 0x55555555 &&
395 		    stateid.other[2] == 0x55555555 &&
396 		    stateid.seqid == 0xffffffff)
397 			gotproxystateid = 1;
398 	}
399 	error = nfsrv_sattr(nd, vp, &nva, &attrbits, aclp, p);
400 	if (error)
401 		goto nfsmout;
402 
403 	/* For NFSv4, only va_uid is used from nva2. */
404 	NFSZERO_ATTRBIT(&retbits);
405 	NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNER);
406 	preat_ret = nfsvno_getattr(vp, &nva2, nd, p, 1, &retbits);
407 	if (!nd->nd_repstat)
408 		nd->nd_repstat = preat_ret;
409 
410 	NFSZERO_ATTRBIT(&retbits);
411 	if (nd->nd_flag & ND_NFSV3) {
412 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
413 		gcheck = fxdr_unsigned(int, *tl);
414 		if (gcheck) {
415 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
416 			fxdr_nfsv3time(tl, &guard);
417 		}
418 		if (!nd->nd_repstat && gcheck &&
419 		    (nva2.na_ctime.tv_sec != guard.tv_sec ||
420 		     nva2.na_ctime.tv_nsec != guard.tv_nsec))
421 			nd->nd_repstat = NFSERR_NOT_SYNC;
422 		if (nd->nd_repstat) {
423 			vput(vp);
424 #ifdef NFS4_ACL_EXTATTR_NAME
425 			acl_free(aclp);
426 #endif
427 			nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
428 			goto out;
429 		}
430 	} else if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4))
431 		nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
432 
433 	/*
434 	 * Now that we have all the fields, lets do it.
435 	 * If the size is being changed write access is required, otherwise
436 	 * just check for a read only file system.
437 	 */
438 	if (!nd->nd_repstat) {
439 		if (NFSVNO_NOTSETSIZE(&nva)) {
440 			if (NFSVNO_EXRDONLY(exp) ||
441 			    (vfs_flags(vp->v_mount) & MNT_RDONLY))
442 				nd->nd_repstat = EROFS;
443 		} else {
444 			if (vnode_vtype(vp) != VREG)
445 				nd->nd_repstat = EINVAL;
446 			else if (nva2.na_uid != nd->nd_cred->cr_uid ||
447 			    NFSVNO_EXSTRICTACCESS(exp))
448 				nd->nd_repstat = nfsvno_accchk(vp,
449 				    VWRITE, nd->nd_cred, exp, p,
450 				    NFSACCCHK_NOOVERRIDE,
451 				    NFSACCCHK_VPISLOCKED, NULL);
452 		}
453 	}
454 	/*
455 	 * Proxy operations from the MDS are allowed via the all 0s special
456 	 * stateid.
457 	 */
458 	if (nd->nd_repstat == 0 && (nd->nd_flag & ND_NFSV4) != 0 &&
459 	    gotproxystateid == 0)
460 		nd->nd_repstat = nfsrv_checksetattr(vp, nd, &stateid,
461 		    &nva, &attrbits, exp, p);
462 
463 	if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4)) {
464 	    /*
465 	     * For V4, try setting the attrbutes in sets, so that the
466 	     * reply bitmap will be correct for an error case.
467 	     */
468 	    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNER) ||
469 		NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNERGROUP)) {
470 		NFSVNO_ATTRINIT(&nva2);
471 		NFSVNO_SETATTRVAL(&nva2, uid, nva.na_uid);
472 		NFSVNO_SETATTRVAL(&nva2, gid, nva.na_gid);
473 		nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
474 		    exp);
475 		if (!nd->nd_repstat) {
476 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNER))
477 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNER);
478 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNERGROUP))
479 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNERGROUP);
480 		}
481 	    }
482 	    if (!nd->nd_repstat &&
483 		NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_SIZE)) {
484 		NFSVNO_ATTRINIT(&nva2);
485 		NFSVNO_SETATTRVAL(&nva2, size, nva.na_size);
486 		nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
487 		    exp);
488 		if (!nd->nd_repstat)
489 		    NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_SIZE);
490 	    }
491 	    if (!nd->nd_repstat &&
492 		(NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET) ||
493 		 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFYSET))) {
494 		NFSVNO_ATTRINIT(&nva2);
495 		NFSVNO_SETATTRVAL(&nva2, atime, nva.na_atime);
496 		NFSVNO_SETATTRVAL(&nva2, mtime, nva.na_mtime);
497 		if (nva.na_vaflags & VA_UTIMES_NULL) {
498 			nva2.na_vaflags |= VA_UTIMES_NULL;
499 			NFSVNO_SETACTIVE(&nva2, vaflags);
500 		}
501 		nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
502 		    exp);
503 		if (!nd->nd_repstat) {
504 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET))
505 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMEACCESSSET);
506 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFYSET))
507 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMEMODIFYSET);
508 		}
509 	    }
510 	    if (!nd->nd_repstat &&
511 		NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMECREATE)) {
512 		NFSVNO_ATTRINIT(&nva2);
513 		NFSVNO_SETATTRVAL(&nva2, btime, nva.na_btime);
514 		nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
515 		    exp);
516 		if (!nd->nd_repstat)
517 		    NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMECREATE);
518 	    }
519 	    if (!nd->nd_repstat &&
520 		(NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODE) ||
521 		 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODESETMASKED))) {
522 		NFSVNO_ATTRINIT(&nva2);
523 		NFSVNO_SETATTRVAL(&nva2, mode, nva.na_mode);
524 		nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
525 		    exp);
526 		if (!nd->nd_repstat) {
527 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODE))
528 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_MODE);
529 		    if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODESETMASKED))
530 			NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_MODESETMASKED);
531 		}
532 	    }
533 
534 #ifdef NFS4_ACL_EXTATTR_NAME
535 	    if (!nd->nd_repstat && aclp->acl_cnt > 0 &&
536 		NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_ACL)) {
537 		nd->nd_repstat = nfsrv_setacl(vp, aclp, nd->nd_cred, p);
538 		if (!nd->nd_repstat)
539 		    NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_ACL);
540 	    }
541 #endif
542 	} else if (!nd->nd_repstat) {
543 		nd->nd_repstat = nfsvno_setattr(vp, &nva, nd->nd_cred, p,
544 		    exp);
545 	}
546 	if (nd->nd_flag & (ND_NFSV2 | ND_NFSV3)) {
547 		postat_ret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
548 		if (!nd->nd_repstat)
549 			nd->nd_repstat = postat_ret;
550 	}
551 	vput(vp);
552 #ifdef NFS4_ACL_EXTATTR_NAME
553 	acl_free(aclp);
554 #endif
555 	if (nd->nd_flag & ND_NFSV3)
556 		nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
557 	else if (nd->nd_flag & ND_NFSV4)
558 		(void) nfsrv_putattrbit(nd, &retbits);
559 	else if (!nd->nd_repstat)
560 		nfsrv_fillattr(nd, &nva);
561 
562 out:
563 	NFSEXITCODE2(0, nd);
564 	return (0);
565 nfsmout:
566 	vput(vp);
567 #ifdef NFS4_ACL_EXTATTR_NAME
568 	acl_free(aclp);
569 #endif
570 	if (nd->nd_flag & ND_NFSV4) {
571 		/*
572 		 * For all nd_repstat, the V4 reply includes a bitmap,
573 		 * even NFSERR_BADXDR, which is what this will end up
574 		 * returning.
575 		 */
576 		(void) nfsrv_putattrbit(nd, &retbits);
577 	}
578 	NFSEXITCODE2(error, nd);
579 	return (error);
580 }
581 
582 /*
583  * nfs lookup rpc
584  * (Also performs lookup parent for v4)
585  */
586 int
587 nfsrvd_lookup(struct nfsrv_descript *nd, __unused int isdgram,
588     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
589 {
590 	struct nameidata named;
591 	vnode_t vp, dirp = NULL;
592 	int error = 0, dattr_ret = 1;
593 	struct nfsvattr nva, dattr;
594 	char *bufp;
595 	u_long *hashp;
596 	struct thread *p = curthread;
597 
598 	if (nd->nd_repstat) {
599 		nfsrv_postopattr(nd, dattr_ret, &dattr);
600 		goto out;
601 	}
602 
603 	/*
604 	 * For some reason, if dp is a symlink, the error
605 	 * returned is supposed to be NFSERR_SYMLINK and not NFSERR_NOTDIR.
606 	 */
607 	if (dp->v_type == VLNK && (nd->nd_flag & ND_NFSV4)) {
608 		nd->nd_repstat = NFSERR_SYMLINK;
609 		vrele(dp);
610 		goto out;
611 	}
612 
613 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
614 	    LOCKLEAF | SAVESTART);
615 	nfsvno_setpathbuf(&named, &bufp, &hashp);
616 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
617 	if (error) {
618 		vrele(dp);
619 		nfsvno_relpathbuf(&named);
620 		goto out;
621 	}
622 	if (!nd->nd_repstat) {
623 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, &dirp);
624 	} else {
625 		vrele(dp);
626 		nfsvno_relpathbuf(&named);
627 	}
628 	if (nd->nd_repstat) {
629 		if (dirp) {
630 			if (nd->nd_flag & ND_NFSV3)
631 				dattr_ret = nfsvno_getattr(dirp, &dattr, nd, p,
632 				    0, NULL);
633 			vrele(dirp);
634 		}
635 		if (nd->nd_flag & ND_NFSV3)
636 			nfsrv_postopattr(nd, dattr_ret, &dattr);
637 		goto out;
638 	}
639 	if (named.ni_startdir)
640 		vrele(named.ni_startdir);
641 	nfsvno_relpathbuf(&named);
642 	vp = named.ni_vp;
643 	if ((nd->nd_flag & ND_NFSV4) != 0 && !NFSVNO_EXPORTED(exp) &&
644 	    vp->v_type != VDIR && vp->v_type != VLNK)
645 		/*
646 		 * Only allow lookup of VDIR and VLNK for traversal of
647 		 * non-exported volumes during NFSv4 mounting.
648 		 */
649 		nd->nd_repstat = ENOENT;
650 	if (nd->nd_repstat == 0)
651 		nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
652 	if (!(nd->nd_flag & ND_NFSV4) && !nd->nd_repstat)
653 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
654 	if (vpp != NULL && nd->nd_repstat == 0)
655 		*vpp = vp;
656 	else
657 		vput(vp);
658 	if (dirp) {
659 		if (nd->nd_flag & ND_NFSV3)
660 			dattr_ret = nfsvno_getattr(dirp, &dattr, nd, p, 0,
661 			    NULL);
662 		vrele(dirp);
663 	}
664 	if (nd->nd_repstat) {
665 		if (nd->nd_flag & ND_NFSV3)
666 			nfsrv_postopattr(nd, dattr_ret, &dattr);
667 		goto out;
668 	}
669 	if (nd->nd_flag & ND_NFSV2) {
670 		(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
671 		nfsrv_fillattr(nd, &nva);
672 	} else if (nd->nd_flag & ND_NFSV3) {
673 		(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
674 		nfsrv_postopattr(nd, 0, &nva);
675 		nfsrv_postopattr(nd, dattr_ret, &dattr);
676 	}
677 
678 out:
679 	NFSEXITCODE2(error, nd);
680 	return (error);
681 }
682 
683 /*
684  * nfs readlink service
685  */
686 int
687 nfsrvd_readlink(struct nfsrv_descript *nd, __unused int isdgram,
688     vnode_t vp, __unused struct nfsexstuff *exp)
689 {
690 	u_int32_t *tl;
691 	struct mbuf *mp = NULL, *mpend = NULL;
692 	int getret = 1, len;
693 	struct nfsvattr nva;
694 	struct thread *p = curthread;
695 	uint16_t off;
696 
697 	if (nd->nd_repstat) {
698 		nfsrv_postopattr(nd, getret, &nva);
699 		goto out;
700 	}
701 	if (vnode_vtype(vp) != VLNK) {
702 		if (nd->nd_flag & ND_NFSV2)
703 			nd->nd_repstat = ENXIO;
704 		else
705 			nd->nd_repstat = EINVAL;
706 	}
707 	if (nd->nd_repstat == 0) {
708 		if ((nd->nd_flag & ND_EXTPG) != 0)
709 			nd->nd_repstat = nfsvno_readlink(vp, nd->nd_cred,
710 			    nd->nd_maxextsiz, p, &mp, &mpend, &len);
711 		else
712 			nd->nd_repstat = nfsvno_readlink(vp, nd->nd_cred,
713 			    0, p, &mp, &mpend, &len);
714 	}
715 	if (nd->nd_flag & ND_NFSV3)
716 		getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
717 	vput(vp);
718 	if (nd->nd_flag & ND_NFSV3)
719 		nfsrv_postopattr(nd, getret, &nva);
720 	if (nd->nd_repstat)
721 		goto out;
722 	NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
723 	*tl = txdr_unsigned(len);
724 	if (mp != NULL) {
725 		nd->nd_mb->m_next = mp;
726 		nd->nd_mb = mpend;
727 		if ((mpend->m_flags & M_EXTPG) != 0) {
728 			nd->nd_bextpg = mpend->m_epg_npgs - 1;
729 			nd->nd_bpos = (char *)(void *)
730 			    PHYS_TO_DMAP(mpend->m_epg_pa[nd->nd_bextpg]);
731 			off = (nd->nd_bextpg == 0) ? mpend->m_epg_1st_off : 0;
732 			nd->nd_bpos += off + mpend->m_epg_last_len;
733 			nd->nd_bextpgsiz = PAGE_SIZE - mpend->m_epg_last_len -
734 			    off;
735 		} else
736 			nd->nd_bpos = mtod(mpend, char *) + mpend->m_len;
737 	}
738 
739 out:
740 	NFSEXITCODE2(0, nd);
741 	return (0);
742 }
743 
744 /*
745  * nfs read service
746  */
747 int
748 nfsrvd_read(struct nfsrv_descript *nd, __unused int isdgram,
749     vnode_t vp, struct nfsexstuff *exp)
750 {
751 	u_int32_t *tl;
752 	int error = 0, cnt, getret = 1, gotproxystateid, reqlen, eof = 0;
753 	struct mbuf *m2, *m3;
754 	struct nfsvattr nva;
755 	off_t off = 0x0;
756 	struct nfsstate st, *stp = &st;
757 	struct nfslock lo, *lop = &lo;
758 	nfsv4stateid_t stateid;
759 	nfsquad_t clientid;
760 	struct thread *p = curthread;
761 	uint16_t poff;
762 
763 	if (nd->nd_repstat) {
764 		nfsrv_postopattr(nd, getret, &nva);
765 		goto out;
766 	}
767 	if (nd->nd_flag & ND_NFSV2) {
768 		NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
769 		off = (off_t)fxdr_unsigned(u_int32_t, *tl++);
770 		reqlen = fxdr_unsigned(int, *tl);
771 	} else if (nd->nd_flag & ND_NFSV3) {
772 		NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
773 		off = fxdr_hyper(tl);
774 		tl += 2;
775 		reqlen = fxdr_unsigned(int, *tl);
776 	} else {
777 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 3*NFSX_UNSIGNED);
778 		reqlen = fxdr_unsigned(int, *(tl + 6));
779 	}
780 	if (reqlen > NFS_SRVMAXDATA(nd)) {
781 		reqlen = NFS_SRVMAXDATA(nd);
782 	} else if (reqlen < 0) {
783 		error = EBADRPC;
784 		goto nfsmout;
785 	}
786 	gotproxystateid = 0;
787 	if (nd->nd_flag & ND_NFSV4) {
788 		stp->ls_flags = (NFSLCK_CHECK | NFSLCK_READACCESS);
789 		lop->lo_flags = NFSLCK_READ;
790 		stp->ls_ownerlen = 0;
791 		stp->ls_op = NULL;
792 		stp->ls_uid = nd->nd_cred->cr_uid;
793 		stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
794 		clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
795 		clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
796 		if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
797 			if ((nd->nd_flag & ND_NFSV41) != 0)
798 				clientid.qval = nd->nd_clientid.qval;
799 			else if (nd->nd_clientid.qval != clientid.qval)
800 				printf("EEK1 multiple clids\n");
801 		} else {
802 			if ((nd->nd_flag & ND_NFSV41) != 0)
803 				printf("EEK! no clientid from session\n");
804 			nd->nd_flag |= ND_IMPLIEDCLID;
805 			nd->nd_clientid.qval = clientid.qval;
806 		}
807 		stp->ls_stateid.other[2] = *tl++;
808 		/*
809 		 * Don't allow the client to use a special stateid for a DS op.
810 		 */
811 		if ((nd->nd_flag & ND_DSSERVER) != 0 &&
812 		    ((stp->ls_stateid.other[0] == 0x0 &&
813 		    stp->ls_stateid.other[1] == 0x0 &&
814 		    stp->ls_stateid.other[2] == 0x0) ||
815 		    (stp->ls_stateid.other[0] == 0xffffffff &&
816 		    stp->ls_stateid.other[1] == 0xffffffff &&
817 		    stp->ls_stateid.other[2] == 0xffffffff) ||
818 		    stp->ls_stateid.seqid != 0))
819 			nd->nd_repstat = NFSERR_BADSTATEID;
820 		/* However, allow the proxy stateid. */
821 		if (stp->ls_stateid.seqid == 0xffffffff &&
822 		    stp->ls_stateid.other[0] == 0x55555555 &&
823 		    stp->ls_stateid.other[1] == 0x55555555 &&
824 		    stp->ls_stateid.other[2] == 0x55555555)
825 			gotproxystateid = 1;
826 		off = fxdr_hyper(tl);
827 		lop->lo_first = off;
828 		tl += 2;
829 		lop->lo_end = off + reqlen;
830 		/*
831 		 * Paranoia, just in case it wraps around.
832 		 */
833 		if (lop->lo_end < off)
834 			lop->lo_end = NFS64BITSSET;
835 	}
836 	if (vnode_vtype(vp) != VREG) {
837 		if (nd->nd_flag & ND_NFSV3)
838 			nd->nd_repstat = EINVAL;
839 		else
840 			nd->nd_repstat = (vnode_vtype(vp) == VDIR) ? EISDIR :
841 			    EINVAL;
842 	}
843 	getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
844 	if (!nd->nd_repstat)
845 		nd->nd_repstat = getret;
846 	if (!nd->nd_repstat &&
847 	    (nva.na_uid != nd->nd_cred->cr_uid ||
848 	     NFSVNO_EXSTRICTACCESS(exp))) {
849 		nd->nd_repstat = nfsvno_accchk(vp, VREAD,
850 		    nd->nd_cred, exp, p,
851 		    NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED, NULL);
852 		if (nd->nd_repstat)
853 			nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
854 			    nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
855 			    NFSACCCHK_VPISLOCKED, NULL);
856 	}
857 	/*
858 	 * DS reads are marked by ND_DSSERVER or use the proxy special
859 	 * stateid.
860 	 */
861 	if (nd->nd_repstat == 0 && (nd->nd_flag & (ND_NFSV4 | ND_DSSERVER)) ==
862 	    ND_NFSV4 && gotproxystateid == 0)
863 		nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
864 		    &stateid, exp, nd, p);
865 	if (nd->nd_repstat) {
866 		vput(vp);
867 		if (nd->nd_flag & ND_NFSV3)
868 			nfsrv_postopattr(nd, getret, &nva);
869 		goto out;
870 	}
871 	if (off >= nva.na_size) {
872 		cnt = 0;
873 		eof = 1;
874 	} else if (reqlen == 0)
875 		cnt = 0;
876 	else if ((off + reqlen) >= nva.na_size) {
877 		cnt = nva.na_size - off;
878 		eof = 1;
879 	} else
880 		cnt = reqlen;
881 	m3 = NULL;
882 	if (cnt > 0) {
883 		/*
884 		 * If cnt > MCLBYTES and the reply will not be saved, use
885 		 * ext_pgs mbufs for TLS.
886 		 * For NFSv4.0, we do not know for sure if the reply will
887 		 * be saved, so do not use ext_pgs mbufs for NFSv4.0.
888 		 * Always use ext_pgs mbufs if ND_EXTPG is set.
889 		 */
890 		if ((nd->nd_flag & ND_EXTPG) != 0 || (cnt > MCLBYTES &&
891 		    (nd->nd_flag & (ND_TLS | ND_SAVEREPLY)) == ND_TLS &&
892 		    (nd->nd_flag & (ND_NFSV4 | ND_NFSV41)) != ND_NFSV4))
893 			nd->nd_repstat = nfsvno_read(vp, off, cnt, nd->nd_cred,
894 			    nd->nd_maxextsiz, p, &m3, &m2);
895 		else
896 			nd->nd_repstat = nfsvno_read(vp, off, cnt, nd->nd_cred,
897 			    0, p, &m3, &m2);
898 		if (!(nd->nd_flag & ND_NFSV4)) {
899 			getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
900 			if (!nd->nd_repstat)
901 				nd->nd_repstat = getret;
902 		}
903 		if (nd->nd_repstat) {
904 			vput(vp);
905 			if (m3)
906 				m_freem(m3);
907 			if (nd->nd_flag & ND_NFSV3)
908 				nfsrv_postopattr(nd, getret, &nva);
909 			goto out;
910 		}
911 	}
912 	vput(vp);
913 	if (nd->nd_flag & ND_NFSV2) {
914 		nfsrv_fillattr(nd, &nva);
915 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
916 	} else {
917 		if (nd->nd_flag & ND_NFSV3) {
918 			nfsrv_postopattr(nd, getret, &nva);
919 			NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
920 			*tl++ = txdr_unsigned(cnt);
921 		} else
922 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
923 		if (eof)
924 			*tl++ = newnfs_true;
925 		else
926 			*tl++ = newnfs_false;
927 	}
928 	*tl = txdr_unsigned(cnt);
929 	if (m3) {
930 		nd->nd_mb->m_next = m3;
931 		nd->nd_mb = m2;
932 		if ((m2->m_flags & M_EXTPG) != 0) {
933 			nd->nd_flag |= ND_EXTPG;
934 			nd->nd_bextpg = m2->m_epg_npgs - 1;
935 			nd->nd_bpos = (char *)(void *)
936 			    PHYS_TO_DMAP(m2->m_epg_pa[nd->nd_bextpg]);
937 			poff = (nd->nd_bextpg == 0) ? m2->m_epg_1st_off : 0;
938 			nd->nd_bpos += poff + m2->m_epg_last_len;
939 			nd->nd_bextpgsiz = PAGE_SIZE - m2->m_epg_last_len -
940 			    poff;
941 		} else
942 			nd->nd_bpos = mtod(m2, char *) + m2->m_len;
943 	}
944 
945 out:
946 	NFSEXITCODE2(0, nd);
947 	return (0);
948 nfsmout:
949 	vput(vp);
950 	NFSEXITCODE2(error, nd);
951 	return (error);
952 }
953 
954 /*
955  * nfs write service
956  */
957 int
958 nfsrvd_write(struct nfsrv_descript *nd, __unused int isdgram,
959     vnode_t vp, struct nfsexstuff *exp)
960 {
961 	u_int32_t *tl;
962 	struct nfsvattr nva, forat;
963 	int aftat_ret = 1, retlen, len, error = 0, forat_ret = 1;
964 	int gotproxystateid, stable = NFSWRITE_FILESYNC;
965 	off_t off;
966 	struct nfsstate st, *stp = &st;
967 	struct nfslock lo, *lop = &lo;
968 	nfsv4stateid_t stateid;
969 	nfsquad_t clientid;
970 	nfsattrbit_t attrbits;
971 	struct thread *p = curthread;
972 
973 	if (nd->nd_repstat) {
974 		nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
975 		goto out;
976 	}
977 	gotproxystateid = 0;
978 	if (nd->nd_flag & ND_NFSV2) {
979 		NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
980 		off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
981 		tl += 2;
982 		retlen = len = fxdr_unsigned(int32_t, *tl);
983 	} else if (nd->nd_flag & ND_NFSV3) {
984 		NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
985 		off = fxdr_hyper(tl);
986 		tl += 3;
987 		stable = fxdr_unsigned(int, *tl++);
988 		retlen = len = fxdr_unsigned(int32_t, *tl);
989 	} else {
990 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 4 * NFSX_UNSIGNED);
991 		stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
992 		lop->lo_flags = NFSLCK_WRITE;
993 		stp->ls_ownerlen = 0;
994 		stp->ls_op = NULL;
995 		stp->ls_uid = nd->nd_cred->cr_uid;
996 		stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
997 		clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
998 		clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
999 		if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
1000 			if ((nd->nd_flag & ND_NFSV41) != 0)
1001 				clientid.qval = nd->nd_clientid.qval;
1002 			else if (nd->nd_clientid.qval != clientid.qval)
1003 				printf("EEK2 multiple clids\n");
1004 		} else {
1005 			if ((nd->nd_flag & ND_NFSV41) != 0)
1006 				printf("EEK! no clientid from session\n");
1007 			nd->nd_flag |= ND_IMPLIEDCLID;
1008 			nd->nd_clientid.qval = clientid.qval;
1009 		}
1010 		stp->ls_stateid.other[2] = *tl++;
1011 		/*
1012 		 * Don't allow the client to use a special stateid for a DS op.
1013 		 */
1014 		if ((nd->nd_flag & ND_DSSERVER) != 0 &&
1015 		    ((stp->ls_stateid.other[0] == 0x0 &&
1016 		    stp->ls_stateid.other[1] == 0x0 &&
1017 		    stp->ls_stateid.other[2] == 0x0) ||
1018 		    (stp->ls_stateid.other[0] == 0xffffffff &&
1019 		    stp->ls_stateid.other[1] == 0xffffffff &&
1020 		    stp->ls_stateid.other[2] == 0xffffffff) ||
1021 		    stp->ls_stateid.seqid != 0))
1022 			nd->nd_repstat = NFSERR_BADSTATEID;
1023 		/* However, allow the proxy stateid. */
1024 		if (stp->ls_stateid.seqid == 0xffffffff &&
1025 		    stp->ls_stateid.other[0] == 0x55555555 &&
1026 		    stp->ls_stateid.other[1] == 0x55555555 &&
1027 		    stp->ls_stateid.other[2] == 0x55555555)
1028 			gotproxystateid = 1;
1029 		off = fxdr_hyper(tl);
1030 		lop->lo_first = off;
1031 		tl += 2;
1032 		stable = fxdr_unsigned(int, *tl++);
1033 		retlen = len = fxdr_unsigned(int32_t, *tl);
1034 		lop->lo_end = off + len;
1035 		/*
1036 		 * Paranoia, just in case it wraps around, which shouldn't
1037 		 * ever happen anyhow.
1038 		 */
1039 		if (lop->lo_end < lop->lo_first)
1040 			lop->lo_end = NFS64BITSSET;
1041 	}
1042 
1043 	if (retlen > nfs_srvmaxio || retlen < 0)
1044 		nd->nd_repstat = EIO;
1045 	if (vnode_vtype(vp) != VREG && !nd->nd_repstat) {
1046 		if (nd->nd_flag & ND_NFSV3)
1047 			nd->nd_repstat = EINVAL;
1048 		else
1049 			nd->nd_repstat = (vnode_vtype(vp) == VDIR) ? EISDIR :
1050 			    EINVAL;
1051 	}
1052 	NFSZERO_ATTRBIT(&attrbits);
1053 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
1054 	forat_ret = nfsvno_getattr(vp, &forat, nd, p, 1, &attrbits);
1055 	if (!nd->nd_repstat)
1056 		nd->nd_repstat = forat_ret;
1057 	if (!nd->nd_repstat &&
1058 	    (forat.na_uid != nd->nd_cred->cr_uid ||
1059 	     NFSVNO_EXSTRICTACCESS(exp)))
1060 		nd->nd_repstat = nfsvno_accchk(vp, VWRITE,
1061 		    nd->nd_cred, exp, p,
1062 		    NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED, NULL);
1063 	/*
1064 	 * DS reads are marked by ND_DSSERVER or use the proxy special
1065 	 * stateid.
1066 	 */
1067 	if (nd->nd_repstat == 0 && (nd->nd_flag & (ND_NFSV4 | ND_DSSERVER)) ==
1068 	    ND_NFSV4 && gotproxystateid == 0)
1069 		nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
1070 		    &stateid, exp, nd, p);
1071 	if (nd->nd_repstat) {
1072 		vput(vp);
1073 		if (nd->nd_flag & ND_NFSV3)
1074 			nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
1075 		goto out;
1076 	}
1077 
1078 	/*
1079 	 * For NFS Version 2, it is not obvious what a write of zero length
1080 	 * should do, but I might as well be consistent with Version 3,
1081 	 * which is to return ok so long as there are no permission problems.
1082 	 */
1083 	if (retlen > 0) {
1084 		nd->nd_repstat = nfsvno_write(vp, off, retlen, &stable,
1085 		    nd->nd_md, nd->nd_dpos, nd->nd_cred, p);
1086 		error = nfsm_advance(nd, NFSM_RNDUP(retlen), -1);
1087 		if (error)
1088 			goto nfsmout;
1089 	}
1090 	if (nd->nd_flag & ND_NFSV4)
1091 		aftat_ret = 0;
1092 	else
1093 		aftat_ret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
1094 	vput(vp);
1095 	if (!nd->nd_repstat)
1096 		nd->nd_repstat = aftat_ret;
1097 	if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
1098 		if (nd->nd_flag & ND_NFSV3)
1099 			nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
1100 		if (nd->nd_repstat)
1101 			goto out;
1102 		NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1103 		*tl++ = txdr_unsigned(retlen);
1104 		/*
1105 		 * If nfs_async is set, then pretend the write was FILESYNC.
1106 		 * Warning: Doing this violates RFC1813 and runs a risk
1107 		 * of data written by a client being lost when the server
1108 		 * crashes/reboots.
1109 		 */
1110 		if (stable == NFSWRITE_UNSTABLE && nfs_async == 0)
1111 			*tl++ = txdr_unsigned(stable);
1112 		else
1113 			*tl++ = txdr_unsigned(NFSWRITE_FILESYNC);
1114 		/*
1115 		 * Actually, there is no need to txdr these fields,
1116 		 * but it may make the values more human readable,
1117 		 * for debugging purposes.
1118 		 */
1119 		*tl++ = txdr_unsigned(nfsboottime.tv_sec);
1120 		*tl = txdr_unsigned(nfsboottime.tv_usec);
1121 	} else if (!nd->nd_repstat)
1122 		nfsrv_fillattr(nd, &nva);
1123 
1124 out:
1125 	NFSEXITCODE2(0, nd);
1126 	return (0);
1127 nfsmout:
1128 	vput(vp);
1129 	NFSEXITCODE2(error, nd);
1130 	return (error);
1131 }
1132 
1133 /*
1134  * nfs create service (creates regular files for V2 and V3. Spec. files for V2.)
1135  * now does a truncate to 0 length via. setattr if it already exists
1136  * The core creation routine has been extracted out into nfsrv_creatsub(),
1137  * so it can also be used by nfsrv_open() for V4.
1138  */
1139 int
1140 nfsrvd_create(struct nfsrv_descript *nd, __unused int isdgram,
1141     vnode_t dp, struct nfsexstuff *exp)
1142 {
1143 	struct nfsvattr nva, dirfor, diraft;
1144 	struct nfsv2_sattr *sp;
1145 	struct nameidata named;
1146 	u_int32_t *tl;
1147 	int error = 0, tsize, dirfor_ret = 1, diraft_ret = 1;
1148 	int how = NFSCREATE_UNCHECKED, exclusive_flag = 0;
1149 	NFSDEV_T rdev = 0;
1150 	vnode_t vp = NULL, dirp = NULL;
1151 	fhandle_t fh;
1152 	char *bufp;
1153 	u_long *hashp;
1154 	enum vtype vtyp;
1155 	int32_t cverf[2], tverf[2] = { 0, 0 };
1156 	struct thread *p = curthread;
1157 
1158 	if (nd->nd_repstat) {
1159 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1160 		goto out;
1161 	}
1162 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1163 	    LOCKPARENT | LOCKLEAF | SAVESTART | NOCACHE);
1164 	nfsvno_setpathbuf(&named, &bufp, &hashp);
1165 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1166 	if (error)
1167 		goto nfsmout;
1168 	if (!nd->nd_repstat) {
1169 		NFSVNO_ATTRINIT(&nva);
1170 		if (nd->nd_flag & ND_NFSV2) {
1171 			NFSM_DISSECT(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1172 			vtyp = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1173 			if (vtyp == VNON)
1174 				vtyp = VREG;
1175 			NFSVNO_SETATTRVAL(&nva, type, vtyp);
1176 			NFSVNO_SETATTRVAL(&nva, mode,
1177 			    nfstov_mode(sp->sa_mode));
1178 			switch (nva.na_type) {
1179 			case VREG:
1180 				tsize = fxdr_unsigned(int32_t, sp->sa_size);
1181 				if (tsize != -1)
1182 					NFSVNO_SETATTRVAL(&nva, size,
1183 					    (u_quad_t)tsize);
1184 				break;
1185 			case VCHR:
1186 			case VBLK:
1187 			case VFIFO:
1188 				rdev = fxdr_unsigned(NFSDEV_T, sp->sa_size);
1189 				break;
1190 			default:
1191 				break;
1192 			}
1193 		} else {
1194 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1195 			how = fxdr_unsigned(int, *tl);
1196 			switch (how) {
1197 			case NFSCREATE_GUARDED:
1198 			case NFSCREATE_UNCHECKED:
1199 				error = nfsrv_sattr(nd, NULL, &nva, NULL, NULL, p);
1200 				if (error)
1201 					goto nfsmout;
1202 				break;
1203 			case NFSCREATE_EXCLUSIVE:
1204 				NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
1205 				cverf[0] = *tl++;
1206 				cverf[1] = *tl;
1207 				exclusive_flag = 1;
1208 				break;
1209 			}
1210 			NFSVNO_SETATTRVAL(&nva, type, VREG);
1211 		}
1212 	}
1213 	if (nd->nd_repstat) {
1214 		nfsvno_relpathbuf(&named);
1215 		if (nd->nd_flag & ND_NFSV3) {
1216 			dirfor_ret = nfsvno_getattr(dp, &dirfor, nd, p, 1,
1217 			    NULL);
1218 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1219 			    &diraft);
1220 		}
1221 		vput(dp);
1222 		goto out;
1223 	}
1224 
1225 	nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, &dirp);
1226 	if (dirp) {
1227 		if (nd->nd_flag & ND_NFSV2) {
1228 			vrele(dirp);
1229 			dirp = NULL;
1230 		} else {
1231 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1232 			    NULL);
1233 		}
1234 	}
1235 	if (nd->nd_repstat) {
1236 		if (nd->nd_flag & ND_NFSV3)
1237 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1238 			    &diraft);
1239 		if (dirp)
1240 			vrele(dirp);
1241 		goto out;
1242 	}
1243 
1244 	if (!(nd->nd_flag & ND_NFSV2)) {
1245 		switch (how) {
1246 		case NFSCREATE_GUARDED:
1247 			if (named.ni_vp)
1248 				nd->nd_repstat = EEXIST;
1249 			break;
1250 		case NFSCREATE_UNCHECKED:
1251 			break;
1252 		case NFSCREATE_EXCLUSIVE:
1253 			if (named.ni_vp == NULL)
1254 				NFSVNO_SETATTRVAL(&nva, mode, 0);
1255 			break;
1256 		}
1257 	}
1258 
1259 	/*
1260 	 * Iff doesn't exist, create it
1261 	 * otherwise just truncate to 0 length
1262 	 *   should I set the mode too ?
1263 	 */
1264 	nd->nd_repstat = nfsvno_createsub(nd, &named, &vp, &nva,
1265 	    &exclusive_flag, cverf, rdev, exp);
1266 
1267 	if (!nd->nd_repstat) {
1268 		nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
1269 		if (!nd->nd_repstat)
1270 			nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1,
1271 			    NULL);
1272 		vput(vp);
1273 		if (!nd->nd_repstat) {
1274 			tverf[0] = nva.na_atime.tv_sec;
1275 			tverf[1] = nva.na_atime.tv_nsec;
1276 		}
1277 	}
1278 	if (nd->nd_flag & ND_NFSV2) {
1279 		if (!nd->nd_repstat) {
1280 			(void) nfsm_fhtom(nd, (u_int8_t *)&fh, 0, 0);
1281 			nfsrv_fillattr(nd, &nva);
1282 		}
1283 	} else {
1284 		if (exclusive_flag && !nd->nd_repstat && (cverf[0] != tverf[0]
1285 		    || cverf[1] != tverf[1]))
1286 			nd->nd_repstat = EEXIST;
1287 		diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1288 		vrele(dirp);
1289 		if (!nd->nd_repstat) {
1290 			(void) nfsm_fhtom(nd, (u_int8_t *)&fh, 0, 1);
1291 			nfsrv_postopattr(nd, 0, &nva);
1292 		}
1293 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1294 	}
1295 
1296 out:
1297 	NFSEXITCODE2(0, nd);
1298 	return (0);
1299 nfsmout:
1300 	vput(dp);
1301 	nfsvno_relpathbuf(&named);
1302 	NFSEXITCODE2(error, nd);
1303 	return (error);
1304 }
1305 
1306 /*
1307  * nfs v3 mknod service (and v4 create)
1308  */
1309 int
1310 nfsrvd_mknod(struct nfsrv_descript *nd, __unused int isdgram,
1311     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1312 {
1313 	struct nfsvattr nva, dirfor, diraft;
1314 	u_int32_t *tl;
1315 	struct nameidata named;
1316 	int error = 0, dirfor_ret = 1, diraft_ret = 1, pathlen;
1317 	u_int32_t major, minor;
1318 	enum vtype vtyp = VNON;
1319 	nfstype nfs4type = NFNON;
1320 	vnode_t vp, dirp = NULL;
1321 	nfsattrbit_t attrbits;
1322 	char *bufp = NULL, *pathcp = NULL;
1323 	u_long *hashp, cnflags;
1324 	NFSACL_T *aclp = NULL;
1325 	struct thread *p = curthread;
1326 
1327 	NFSVNO_ATTRINIT(&nva);
1328 	cnflags = (LOCKPARENT | SAVESTART);
1329 	if (nd->nd_repstat) {
1330 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1331 		goto out;
1332 	}
1333 #ifdef NFS4_ACL_EXTATTR_NAME
1334 	aclp = acl_alloc(M_WAITOK);
1335 	aclp->acl_cnt = 0;
1336 #endif
1337 
1338 	/*
1339 	 * For V4, the creation stuff is here, Yuck!
1340 	 */
1341 	if (nd->nd_flag & ND_NFSV4) {
1342 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1343 		vtyp = nfsv34tov_type(*tl);
1344 		nfs4type = fxdr_unsigned(nfstype, *tl);
1345 		switch (nfs4type) {
1346 		case NFLNK:
1347 			error = nfsvno_getsymlink(nd, &nva, p, &pathcp,
1348 			    &pathlen);
1349 			if (error)
1350 				goto nfsmout;
1351 			break;
1352 		case NFCHR:
1353 		case NFBLK:
1354 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1355 			major = fxdr_unsigned(u_int32_t, *tl++);
1356 			minor = fxdr_unsigned(u_int32_t, *tl);
1357 			nva.na_rdev = NFSMAKEDEV(major, minor);
1358 			break;
1359 		case NFSOCK:
1360 		case NFFIFO:
1361 			break;
1362 		case NFDIR:
1363 			cnflags = (LOCKPARENT | SAVENAME);
1364 			break;
1365 		default:
1366 			nd->nd_repstat = NFSERR_BADTYPE;
1367 			vrele(dp);
1368 #ifdef NFS4_ACL_EXTATTR_NAME
1369 			acl_free(aclp);
1370 #endif
1371 			goto out;
1372 		}
1373 	}
1374 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE, cnflags | NOCACHE);
1375 	nfsvno_setpathbuf(&named, &bufp, &hashp);
1376 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1377 	if (error)
1378 		goto nfsmout;
1379 	if (!nd->nd_repstat) {
1380 		if (nd->nd_flag & ND_NFSV3) {
1381 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1382 			vtyp = nfsv34tov_type(*tl);
1383 		}
1384 		error = nfsrv_sattr(nd, NULL, &nva, &attrbits, aclp, p);
1385 		if (error)
1386 			goto nfsmout;
1387 		nva.na_type = vtyp;
1388 		if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV3) &&
1389 		    (vtyp == VCHR || vtyp == VBLK)) {
1390 			NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1391 			major = fxdr_unsigned(u_int32_t, *tl++);
1392 			minor = fxdr_unsigned(u_int32_t, *tl);
1393 			nva.na_rdev = NFSMAKEDEV(major, minor);
1394 		}
1395 	}
1396 
1397 	dirfor_ret = nfsvno_getattr(dp, &dirfor, nd, p, 0, NULL);
1398 	if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4)) {
1399 		if (!dirfor_ret && NFSVNO_ISSETGID(&nva) &&
1400 		    dirfor.na_gid == nva.na_gid)
1401 			NFSVNO_UNSET(&nva, gid);
1402 		nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
1403 	}
1404 	if (nd->nd_repstat) {
1405 		vrele(dp);
1406 #ifdef NFS4_ACL_EXTATTR_NAME
1407 		acl_free(aclp);
1408 #endif
1409 		nfsvno_relpathbuf(&named);
1410 		if (pathcp)
1411 			free(pathcp, M_TEMP);
1412 		if (nd->nd_flag & ND_NFSV3)
1413 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1414 			    &diraft);
1415 		goto out;
1416 	}
1417 
1418 	/*
1419 	 * Yuck! For V4, mkdir and link are here and some V4 clients don't fill
1420 	 * in va_mode, so we'll have to set a default here.
1421 	 */
1422 	if (NFSVNO_NOTSETMODE(&nva)) {
1423 		if (vtyp == VLNK)
1424 			nva.na_mode = 0755;
1425 		else
1426 			nva.na_mode = 0400;
1427 	}
1428 
1429 	if (vtyp == VDIR)
1430 		named.ni_cnd.cn_flags |= WILLBEDIR;
1431 	nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, &dirp);
1432 	if (nd->nd_repstat) {
1433 		if (dirp) {
1434 			if (nd->nd_flag & ND_NFSV3)
1435 				dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd,
1436 				    p, 0, NULL);
1437 			vrele(dirp);
1438 		}
1439 #ifdef NFS4_ACL_EXTATTR_NAME
1440 		acl_free(aclp);
1441 #endif
1442 		if (nd->nd_flag & ND_NFSV3)
1443 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1444 			    &diraft);
1445 		goto out;
1446 	}
1447 	if (dirp)
1448 		dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1449 
1450 	if ((nd->nd_flag & ND_NFSV4) && (vtyp == VDIR || vtyp == VLNK)) {
1451 		if (vtyp == VDIR) {
1452 			nfsrvd_mkdirsub(nd, &named, &nva, fhp, vpp, dirp,
1453 			    &dirfor, &diraft, &diraft_ret, &attrbits, aclp, p,
1454 			    exp);
1455 #ifdef NFS4_ACL_EXTATTR_NAME
1456 			acl_free(aclp);
1457 #endif
1458 			goto out;
1459 		} else if (vtyp == VLNK) {
1460 			nfsrvd_symlinksub(nd, &named, &nva, fhp, vpp, dirp,
1461 			    &dirfor, &diraft, &diraft_ret, &attrbits,
1462 			    aclp, p, exp, pathcp, pathlen);
1463 #ifdef NFS4_ACL_EXTATTR_NAME
1464 			acl_free(aclp);
1465 #endif
1466 			free(pathcp, M_TEMP);
1467 			goto out;
1468 		}
1469 	}
1470 
1471 	nd->nd_repstat = nfsvno_mknod(&named, &nva, nd->nd_cred, p);
1472 	if (!nd->nd_repstat) {
1473 		vp = named.ni_vp;
1474 		nfsrv_fixattr(nd, vp, &nva, aclp, p, &attrbits, exp);
1475 		nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
1476 		if ((nd->nd_flag & ND_NFSV3) && !nd->nd_repstat)
1477 			nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1,
1478 			    NULL);
1479 		if (vpp != NULL && nd->nd_repstat == 0) {
1480 			NFSVOPUNLOCK(vp);
1481 			*vpp = vp;
1482 		} else
1483 			vput(vp);
1484 	}
1485 
1486 	diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1487 	vrele(dirp);
1488 	if (!nd->nd_repstat) {
1489 		if (nd->nd_flag & ND_NFSV3) {
1490 			(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 1);
1491 			nfsrv_postopattr(nd, 0, &nva);
1492 		} else {
1493 			NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1494 			*tl++ = newnfs_false;
1495 			txdr_hyper(dirfor.na_filerev, tl);
1496 			tl += 2;
1497 			txdr_hyper(diraft.na_filerev, tl);
1498 			(void) nfsrv_putattrbit(nd, &attrbits);
1499 		}
1500 	}
1501 	if (nd->nd_flag & ND_NFSV3)
1502 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1503 #ifdef NFS4_ACL_EXTATTR_NAME
1504 	acl_free(aclp);
1505 #endif
1506 
1507 out:
1508 	NFSEXITCODE2(0, nd);
1509 	return (0);
1510 nfsmout:
1511 	vrele(dp);
1512 #ifdef NFS4_ACL_EXTATTR_NAME
1513 	acl_free(aclp);
1514 #endif
1515 	if (bufp)
1516 		nfsvno_relpathbuf(&named);
1517 	if (pathcp)
1518 		free(pathcp, M_TEMP);
1519 
1520 	NFSEXITCODE2(error, nd);
1521 	return (error);
1522 }
1523 
1524 /*
1525  * nfs remove service
1526  */
1527 int
1528 nfsrvd_remove(struct nfsrv_descript *nd, __unused int isdgram,
1529     vnode_t dp, struct nfsexstuff *exp)
1530 {
1531 	struct nameidata named;
1532 	u_int32_t *tl;
1533 	int error = 0, dirfor_ret = 1, diraft_ret = 1;
1534 	vnode_t dirp = NULL;
1535 	struct nfsvattr dirfor, diraft;
1536 	char *bufp;
1537 	u_long *hashp;
1538 	struct thread *p = curthread;
1539 
1540 	if (nd->nd_repstat) {
1541 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1542 		goto out;
1543 	}
1544 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, DELETE,
1545 	    LOCKPARENT | LOCKLEAF);
1546 	nfsvno_setpathbuf(&named, &bufp, &hashp);
1547 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1548 	if (error) {
1549 		vput(dp);
1550 		nfsvno_relpathbuf(&named);
1551 		goto out;
1552 	}
1553 	if (!nd->nd_repstat) {
1554 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, &dirp);
1555 	} else {
1556 		vput(dp);
1557 		nfsvno_relpathbuf(&named);
1558 	}
1559 	if (dirp) {
1560 		if (!(nd->nd_flag & ND_NFSV2)) {
1561 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1562 			    NULL);
1563 		} else {
1564 			vrele(dirp);
1565 			dirp = NULL;
1566 		}
1567 	}
1568 	if (!nd->nd_repstat) {
1569 		if (nd->nd_flag & ND_NFSV4) {
1570 			if (vnode_vtype(named.ni_vp) == VDIR)
1571 				nd->nd_repstat = nfsvno_rmdirsub(&named, 1,
1572 				    nd->nd_cred, p, exp);
1573 			else
1574 				nd->nd_repstat = nfsvno_removesub(&named, 1,
1575 				    nd->nd_cred, p, exp);
1576 		} else if (nd->nd_procnum == NFSPROC_RMDIR) {
1577 			nd->nd_repstat = nfsvno_rmdirsub(&named, 0,
1578 			    nd->nd_cred, p, exp);
1579 		} else {
1580 			nd->nd_repstat = nfsvno_removesub(&named, 0,
1581 			    nd->nd_cred, p, exp);
1582 		}
1583 	}
1584 	if (!(nd->nd_flag & ND_NFSV2)) {
1585 		if (dirp) {
1586 			diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0,
1587 			    NULL);
1588 			vrele(dirp);
1589 		}
1590 		if (nd->nd_flag & ND_NFSV3) {
1591 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1592 			    &diraft);
1593 		} else if (!nd->nd_repstat) {
1594 			NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1595 			*tl++ = newnfs_false;
1596 			txdr_hyper(dirfor.na_filerev, tl);
1597 			tl += 2;
1598 			txdr_hyper(diraft.na_filerev, tl);
1599 		}
1600 	}
1601 
1602 out:
1603 	NFSEXITCODE2(error, nd);
1604 	return (error);
1605 }
1606 
1607 /*
1608  * nfs rename service
1609  */
1610 int
1611 nfsrvd_rename(struct nfsrv_descript *nd, int isdgram,
1612     vnode_t dp, vnode_t todp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
1613 {
1614 	u_int32_t *tl;
1615 	int error = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1616 	int tdirfor_ret = 1, tdiraft_ret = 1;
1617 	struct nameidata fromnd, tond;
1618 	vnode_t fdirp = NULL, tdirp = NULL, tdp = NULL;
1619 	struct nfsvattr fdirfor, fdiraft, tdirfor, tdiraft;
1620 	struct nfsexstuff tnes;
1621 	struct nfsrvfh tfh;
1622 	char *bufp, *tbufp = NULL;
1623 	u_long *hashp;
1624 	fhandle_t fh;
1625 	struct thread *p = curthread;
1626 
1627 	if (nd->nd_repstat) {
1628 		nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1629 		nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1630 		goto out;
1631 	}
1632 	if (!(nd->nd_flag & ND_NFSV2))
1633 		fdirfor_ret = nfsvno_getattr(dp, &fdirfor, nd, p, 1, NULL);
1634 	tond.ni_cnd.cn_nameiop = 0;
1635 	tond.ni_startdir = NULL;
1636 	NFSNAMEICNDSET(&fromnd.ni_cnd, nd->nd_cred, DELETE, WANTPARENT | SAVESTART);
1637 	nfsvno_setpathbuf(&fromnd, &bufp, &hashp);
1638 	error = nfsrv_parsename(nd, bufp, hashp, &fromnd.ni_pathlen);
1639 	if (error) {
1640 		vput(dp);
1641 		if (todp)
1642 			vrele(todp);
1643 		nfsvno_relpathbuf(&fromnd);
1644 		goto out;
1645 	}
1646 	/*
1647 	 * Unlock dp in this code section, so it is unlocked before
1648 	 * tdp gets locked. This avoids a potential LOR if tdp is the
1649 	 * parent directory of dp.
1650 	 */
1651 	if (nd->nd_flag & ND_NFSV4) {
1652 		tdp = todp;
1653 		tnes = *toexp;
1654 		if (dp != tdp) {
1655 			NFSVOPUNLOCK(dp);
1656 			/* Might lock tdp. */
1657 			tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 0,
1658 			    NULL);
1659 		} else {
1660 			tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 1,
1661 			    NULL);
1662 			NFSVOPUNLOCK(dp);
1663 		}
1664 	} else {
1665 		tfh.nfsrvfh_len = 0;
1666 		error = nfsrv_mtofh(nd, &tfh);
1667 		if (error == 0)
1668 			error = nfsvno_getfh(dp, &fh, p);
1669 		if (error) {
1670 			vput(dp);
1671 			/* todp is always NULL except NFSv4 */
1672 			nfsvno_relpathbuf(&fromnd);
1673 			goto out;
1674 		}
1675 
1676 		/* If this is the same file handle, just VREF() the vnode. */
1677 		if (tfh.nfsrvfh_len == NFSX_MYFH &&
1678 		    !NFSBCMP(tfh.nfsrvfh_data, &fh, NFSX_MYFH)) {
1679 			VREF(dp);
1680 			tdp = dp;
1681 			tnes = *exp;
1682 			tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 1,
1683 			    NULL);
1684 			NFSVOPUNLOCK(dp);
1685 		} else {
1686 			NFSVOPUNLOCK(dp);
1687 			nd->nd_cred->cr_uid = nd->nd_saveduid;
1688 			nfsd_fhtovp(nd, &tfh, LK_EXCLUSIVE, &tdp, &tnes, NULL,
1689 			    0, -1);	/* Locks tdp. */
1690 			if (tdp) {
1691 				tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd,
1692 				    p, 1, NULL);
1693 				NFSVOPUNLOCK(tdp);
1694 			}
1695 		}
1696 	}
1697 	NFSNAMEICNDSET(&tond.ni_cnd, nd->nd_cred, RENAME, LOCKPARENT | LOCKLEAF | NOCACHE | SAVESTART);
1698 	nfsvno_setpathbuf(&tond, &tbufp, &hashp);
1699 	if (!nd->nd_repstat) {
1700 		error = nfsrv_parsename(nd, tbufp, hashp, &tond.ni_pathlen);
1701 		if (error) {
1702 			if (tdp)
1703 				vrele(tdp);
1704 			vrele(dp);
1705 			nfsvno_relpathbuf(&fromnd);
1706 			nfsvno_relpathbuf(&tond);
1707 			goto out;
1708 		}
1709 	}
1710 	if (nd->nd_repstat) {
1711 		if (nd->nd_flag & ND_NFSV3) {
1712 			nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret,
1713 			    &fdiraft);
1714 			nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret,
1715 			    &tdiraft);
1716 		}
1717 		if (tdp)
1718 			vrele(tdp);
1719 		vrele(dp);
1720 		nfsvno_relpathbuf(&fromnd);
1721 		nfsvno_relpathbuf(&tond);
1722 		goto out;
1723 	}
1724 
1725 	/*
1726 	 * Done parsing, now down to business.
1727 	 */
1728 	nd->nd_repstat = nfsvno_namei(nd, &fromnd, dp, 0, exp, &fdirp);
1729 	if (nd->nd_repstat) {
1730 		if (nd->nd_flag & ND_NFSV3) {
1731 			nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret,
1732 			    &fdiraft);
1733 			nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret,
1734 			    &tdiraft);
1735 		}
1736 		if (fdirp)
1737 			vrele(fdirp);
1738 		if (tdp)
1739 			vrele(tdp);
1740 		nfsvno_relpathbuf(&tond);
1741 		goto out;
1742 	}
1743 	if (vnode_vtype(fromnd.ni_vp) == VDIR)
1744 		tond.ni_cnd.cn_flags |= WILLBEDIR;
1745 	nd->nd_repstat = nfsvno_namei(nd, &tond, tdp, 0, &tnes, &tdirp);
1746 	nd->nd_repstat = nfsvno_rename(&fromnd, &tond, nd->nd_repstat,
1747 	    nd->nd_flag, nd->nd_cred, p);
1748 	if (fdirp)
1749 		fdiraft_ret = nfsvno_getattr(fdirp, &fdiraft, nd, p, 0, NULL);
1750 	if (tdirp)
1751 		tdiraft_ret = nfsvno_getattr(tdirp, &tdiraft, nd, p, 0, NULL);
1752 	if (fdirp)
1753 		vrele(fdirp);
1754 	if (tdirp)
1755 		vrele(tdirp);
1756 	if (nd->nd_flag & ND_NFSV3) {
1757 		nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1758 		nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1759 	} else if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1760 		NFSM_BUILD(tl, u_int32_t *, 10 * NFSX_UNSIGNED);
1761 		*tl++ = newnfs_false;
1762 		txdr_hyper(fdirfor.na_filerev, tl);
1763 		tl += 2;
1764 		txdr_hyper(fdiraft.na_filerev, tl);
1765 		tl += 2;
1766 		*tl++ = newnfs_false;
1767 		txdr_hyper(tdirfor.na_filerev, tl);
1768 		tl += 2;
1769 		txdr_hyper(tdiraft.na_filerev, tl);
1770 	}
1771 
1772 out:
1773 	NFSEXITCODE2(error, nd);
1774 	return (error);
1775 }
1776 
1777 /*
1778  * nfs link service
1779  */
1780 int
1781 nfsrvd_link(struct nfsrv_descript *nd, int isdgram,
1782     vnode_t vp, vnode_t tovp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
1783 {
1784 	struct nameidata named;
1785 	u_int32_t *tl;
1786 	int error = 0, dirfor_ret = 1, diraft_ret = 1, getret = 1;
1787 	vnode_t dirp = NULL, dp = NULL;
1788 	struct nfsvattr dirfor, diraft, at;
1789 	struct nfsexstuff tnes;
1790 	struct nfsrvfh dfh;
1791 	char *bufp;
1792 	u_long *hashp;
1793 	struct thread *p = curthread;
1794 
1795 	if (nd->nd_repstat) {
1796 		nfsrv_postopattr(nd, getret, &at);
1797 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1798 		goto out;
1799 	}
1800 	NFSVOPUNLOCK(vp);
1801 	if (vnode_vtype(vp) == VDIR) {
1802 		if (nd->nd_flag & ND_NFSV4)
1803 			nd->nd_repstat = NFSERR_ISDIR;
1804 		else
1805 			nd->nd_repstat = NFSERR_INVAL;
1806 		if (tovp)
1807 			vrele(tovp);
1808 	}
1809 	if (!nd->nd_repstat) {
1810 		if (nd->nd_flag & ND_NFSV4) {
1811 			dp = tovp;
1812 			tnes = *toexp;
1813 		} else {
1814 			error = nfsrv_mtofh(nd, &dfh);
1815 			if (error) {
1816 				vrele(vp);
1817 				/* tovp is always NULL unless NFSv4 */
1818 				goto out;
1819 			}
1820 			nfsd_fhtovp(nd, &dfh, LK_EXCLUSIVE, &dp, &tnes, NULL,
1821 			    0, -1);
1822 			if (dp)
1823 				NFSVOPUNLOCK(dp);
1824 		}
1825 	}
1826 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1827 	    LOCKPARENT | SAVENAME | NOCACHE);
1828 	if (!nd->nd_repstat) {
1829 		nfsvno_setpathbuf(&named, &bufp, &hashp);
1830 		error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1831 		if (error) {
1832 			vrele(vp);
1833 			if (dp)
1834 				vrele(dp);
1835 			nfsvno_relpathbuf(&named);
1836 			goto out;
1837 		}
1838 		if (!nd->nd_repstat) {
1839 			nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, &tnes,
1840 			    &dirp);
1841 		} else {
1842 			if (dp)
1843 				vrele(dp);
1844 			nfsvno_relpathbuf(&named);
1845 		}
1846 	}
1847 	if (dirp) {
1848 		if (nd->nd_flag & ND_NFSV2) {
1849 			vrele(dirp);
1850 			dirp = NULL;
1851 		} else {
1852 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1853 			    NULL);
1854 		}
1855 	}
1856 	if (!nd->nd_repstat)
1857 		nd->nd_repstat = nfsvno_link(&named, vp, nd->nd_cred, p, exp);
1858 	if (nd->nd_flag & ND_NFSV3)
1859 		getret = nfsvno_getattr(vp, &at, nd, p, 0, NULL);
1860 	if (dirp) {
1861 		diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1862 		vrele(dirp);
1863 	}
1864 	vrele(vp);
1865 	if (nd->nd_flag & ND_NFSV3) {
1866 		nfsrv_postopattr(nd, getret, &at);
1867 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1868 	} else if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1869 		NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1870 		*tl++ = newnfs_false;
1871 		txdr_hyper(dirfor.na_filerev, tl);
1872 		tl += 2;
1873 		txdr_hyper(diraft.na_filerev, tl);
1874 	}
1875 
1876 out:
1877 	NFSEXITCODE2(error, nd);
1878 	return (error);
1879 }
1880 
1881 /*
1882  * nfs symbolic link service
1883  */
1884 int
1885 nfsrvd_symlink(struct nfsrv_descript *nd, __unused int isdgram,
1886     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1887 {
1888 	struct nfsvattr nva, dirfor, diraft;
1889 	struct nameidata named;
1890 	int error = 0, dirfor_ret = 1, diraft_ret = 1, pathlen;
1891 	vnode_t dirp = NULL;
1892 	char *bufp, *pathcp = NULL;
1893 	u_long *hashp;
1894 	struct thread *p = curthread;
1895 
1896 	if (nd->nd_repstat) {
1897 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1898 		goto out;
1899 	}
1900 	if (vpp)
1901 		*vpp = NULL;
1902 	NFSVNO_ATTRINIT(&nva);
1903 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1904 	    LOCKPARENT | SAVESTART | NOCACHE);
1905 	nfsvno_setpathbuf(&named, &bufp, &hashp);
1906 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1907 	if (!error && !nd->nd_repstat)
1908 		error = nfsvno_getsymlink(nd, &nva, p, &pathcp, &pathlen);
1909 	if (error) {
1910 		vrele(dp);
1911 		nfsvno_relpathbuf(&named);
1912 		goto out;
1913 	}
1914 	if (!nd->nd_repstat) {
1915 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, &dirp);
1916 	} else {
1917 		vrele(dp);
1918 		nfsvno_relpathbuf(&named);
1919 	}
1920 	if (dirp != NULL && !(nd->nd_flag & ND_NFSV3)) {
1921 		vrele(dirp);
1922 		dirp = NULL;
1923 	}
1924 
1925 	/*
1926 	 * And call nfsrvd_symlinksub() to do the common code. It will
1927 	 * return EBADRPC upon a parsing error, 0 otherwise.
1928 	 */
1929 	if (!nd->nd_repstat) {
1930 		if (dirp != NULL)
1931 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1932 			    NULL);
1933 		nfsrvd_symlinksub(nd, &named, &nva, fhp, vpp, dirp,
1934 		    &dirfor, &diraft, &diraft_ret, NULL, NULL, p, exp,
1935 		    pathcp, pathlen);
1936 	} else if (dirp != NULL) {
1937 		dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1938 		vrele(dirp);
1939 	}
1940 	if (pathcp)
1941 		free(pathcp, M_TEMP);
1942 
1943 	if (nd->nd_flag & ND_NFSV3) {
1944 		if (!nd->nd_repstat) {
1945 			(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 1);
1946 			nfsrv_postopattr(nd, 0, &nva);
1947 		}
1948 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1949 	}
1950 
1951 out:
1952 	NFSEXITCODE2(error, nd);
1953 	return (error);
1954 }
1955 
1956 /*
1957  * Common code for creating a symbolic link.
1958  */
1959 static void
1960 nfsrvd_symlinksub(struct nfsrv_descript *nd, struct nameidata *ndp,
1961     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
1962     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
1963     int *diraft_retp, nfsattrbit_t *attrbitp,
1964     NFSACL_T *aclp, NFSPROC_T *p, struct nfsexstuff *exp, char *pathcp,
1965     int pathlen)
1966 {
1967 	u_int32_t *tl;
1968 
1969 	nd->nd_repstat = nfsvno_symlink(ndp, nvap, pathcp, pathlen,
1970 	    !(nd->nd_flag & ND_NFSV2), nd->nd_saveduid, nd->nd_cred, p, exp);
1971 	if (!nd->nd_repstat && !(nd->nd_flag & ND_NFSV2)) {
1972 		nfsrv_fixattr(nd, ndp->ni_vp, nvap, aclp, p, attrbitp, exp);
1973 		if (nd->nd_flag & ND_NFSV3) {
1974 			nd->nd_repstat = nfsvno_getfh(ndp->ni_vp, fhp, p);
1975 			if (!nd->nd_repstat)
1976 				nd->nd_repstat = nfsvno_getattr(ndp->ni_vp,
1977 				    nvap, nd, p, 1, NULL);
1978 		}
1979 		if (vpp != NULL && nd->nd_repstat == 0) {
1980 			NFSVOPUNLOCK(ndp->ni_vp);
1981 			*vpp = ndp->ni_vp;
1982 		} else
1983 			vput(ndp->ni_vp);
1984 	}
1985 	if (dirp) {
1986 		*diraft_retp = nfsvno_getattr(dirp, diraftp, nd, p, 0, NULL);
1987 		vrele(dirp);
1988 	}
1989 	if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1990 		NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1991 		*tl++ = newnfs_false;
1992 		txdr_hyper(dirforp->na_filerev, tl);
1993 		tl += 2;
1994 		txdr_hyper(diraftp->na_filerev, tl);
1995 		(void) nfsrv_putattrbit(nd, attrbitp);
1996 	}
1997 
1998 	NFSEXITCODE2(0, nd);
1999 }
2000 
2001 /*
2002  * nfs mkdir service
2003  */
2004 int
2005 nfsrvd_mkdir(struct nfsrv_descript *nd, __unused int isdgram,
2006     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
2007 {
2008 	struct nfsvattr nva, dirfor, diraft;
2009 	struct nameidata named;
2010 	u_int32_t *tl;
2011 	int error = 0, dirfor_ret = 1, diraft_ret = 1;
2012 	vnode_t dirp = NULL;
2013 	char *bufp;
2014 	u_long *hashp;
2015 	struct thread *p = curthread;
2016 
2017 	if (nd->nd_repstat) {
2018 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
2019 		goto out;
2020 	}
2021 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
2022 	    LOCKPARENT | SAVENAME | NOCACHE);
2023 	nfsvno_setpathbuf(&named, &bufp, &hashp);
2024 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
2025 	if (error)
2026 		goto nfsmout;
2027 	if (!nd->nd_repstat) {
2028 		NFSVNO_ATTRINIT(&nva);
2029 		if (nd->nd_flag & ND_NFSV3) {
2030 			error = nfsrv_sattr(nd, NULL, &nva, NULL, NULL, p);
2031 			if (error)
2032 				goto nfsmout;
2033 		} else {
2034 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2035 			nva.na_mode = nfstov_mode(*tl++);
2036 		}
2037 	}
2038 	if (!nd->nd_repstat) {
2039 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, &dirp);
2040 	} else {
2041 		vrele(dp);
2042 		nfsvno_relpathbuf(&named);
2043 	}
2044 	if (dirp != NULL && !(nd->nd_flag & ND_NFSV3)) {
2045 		vrele(dirp);
2046 		dirp = NULL;
2047 	}
2048 	if (nd->nd_repstat) {
2049 		if (dirp != NULL) {
2050 			dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
2051 			    NULL);
2052 			vrele(dirp);
2053 		}
2054 		if (nd->nd_flag & ND_NFSV3)
2055 			nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
2056 			    &diraft);
2057 		goto out;
2058 	}
2059 	if (dirp != NULL)
2060 		dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
2061 
2062 	/*
2063 	 * Call nfsrvd_mkdirsub() for the code common to V4 as well.
2064 	 */
2065 	nfsrvd_mkdirsub(nd, &named, &nva, fhp, vpp, dirp, &dirfor, &diraft,
2066 	    &diraft_ret, NULL, NULL, p, exp);
2067 
2068 	if (nd->nd_flag & ND_NFSV3) {
2069 		if (!nd->nd_repstat) {
2070 			(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 1);
2071 			nfsrv_postopattr(nd, 0, &nva);
2072 		}
2073 		nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
2074 	} else if (!nd->nd_repstat) {
2075 		(void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
2076 		nfsrv_fillattr(nd, &nva);
2077 	}
2078 
2079 out:
2080 	NFSEXITCODE2(0, nd);
2081 	return (0);
2082 nfsmout:
2083 	vrele(dp);
2084 	nfsvno_relpathbuf(&named);
2085 	NFSEXITCODE2(error, nd);
2086 	return (error);
2087 }
2088 
2089 /*
2090  * Code common to mkdir for V2,3 and 4.
2091  */
2092 static void
2093 nfsrvd_mkdirsub(struct nfsrv_descript *nd, struct nameidata *ndp,
2094     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
2095     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
2096     int *diraft_retp, nfsattrbit_t *attrbitp, NFSACL_T *aclp,
2097     NFSPROC_T *p, struct nfsexstuff *exp)
2098 {
2099 	vnode_t vp;
2100 	u_int32_t *tl;
2101 
2102 	NFSVNO_SETATTRVAL(nvap, type, VDIR);
2103 	nd->nd_repstat = nfsvno_mkdir(ndp, nvap, nd->nd_saveduid,
2104 	    nd->nd_cred, p, exp);
2105 	if (!nd->nd_repstat) {
2106 		vp = ndp->ni_vp;
2107 		nfsrv_fixattr(nd, vp, nvap, aclp, p, attrbitp, exp);
2108 		nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
2109 		if (!(nd->nd_flag & ND_NFSV4) && !nd->nd_repstat)
2110 			nd->nd_repstat = nfsvno_getattr(vp, nvap, nd, p, 1,
2111 			    NULL);
2112 		if (vpp && !nd->nd_repstat) {
2113 			NFSVOPUNLOCK(vp);
2114 			*vpp = vp;
2115 		} else {
2116 			vput(vp);
2117 		}
2118 	}
2119 	if (dirp) {
2120 		*diraft_retp = nfsvno_getattr(dirp, diraftp, nd, p, 0, NULL);
2121 		vrele(dirp);
2122 	}
2123 	if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
2124 		NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2125 		*tl++ = newnfs_false;
2126 		txdr_hyper(dirforp->na_filerev, tl);
2127 		tl += 2;
2128 		txdr_hyper(diraftp->na_filerev, tl);
2129 		(void) nfsrv_putattrbit(nd, attrbitp);
2130 	}
2131 
2132 	NFSEXITCODE2(0, nd);
2133 }
2134 
2135 /*
2136  * nfs commit service
2137  */
2138 int
2139 nfsrvd_commit(struct nfsrv_descript *nd, __unused int isdgram,
2140     vnode_t vp, __unused struct nfsexstuff *exp)
2141 {
2142 	struct nfsvattr bfor, aft;
2143 	u_int32_t *tl;
2144 	int error = 0, for_ret = 1, aft_ret = 1, cnt;
2145 	u_int64_t off;
2146 	struct thread *p = curthread;
2147 
2148        if (nd->nd_repstat) {
2149 		nfsrv_wcc(nd, for_ret, &bfor, aft_ret, &aft);
2150 		goto out;
2151 	}
2152 
2153 	/* Return NFSERR_ISDIR in NFSv4 when commit on a directory. */
2154 	if (vp->v_type != VREG) {
2155 		if (nd->nd_flag & ND_NFSV3)
2156 			error = NFSERR_NOTSUPP;
2157 		else
2158 			error = (vp->v_type == VDIR) ? NFSERR_ISDIR : NFSERR_INVAL;
2159 		goto nfsmout;
2160 	}
2161 	NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
2162 
2163 	/*
2164 	 * XXX At this time VOP_FSYNC() does not accept offset and byte
2165 	 * count parameters, so these arguments are useless (someday maybe).
2166 	 */
2167 	off = fxdr_hyper(tl);
2168 	tl += 2;
2169 	cnt = fxdr_unsigned(int, *tl);
2170 	if (nd->nd_flag & ND_NFSV3)
2171 		for_ret = nfsvno_getattr(vp, &bfor, nd, p, 1, NULL);
2172 	nd->nd_repstat = nfsvno_fsync(vp, off, cnt, nd->nd_cred, p);
2173 	if (nd->nd_flag & ND_NFSV3) {
2174 		aft_ret = nfsvno_getattr(vp, &aft, nd, p, 1, NULL);
2175 		nfsrv_wcc(nd, for_ret, &bfor, aft_ret, &aft);
2176 	}
2177 	vput(vp);
2178 	if (!nd->nd_repstat) {
2179 		NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
2180 		*tl++ = txdr_unsigned(nfsboottime.tv_sec);
2181 		*tl = txdr_unsigned(nfsboottime.tv_usec);
2182 	}
2183 
2184 out:
2185 	NFSEXITCODE2(0, nd);
2186 	return (0);
2187 nfsmout:
2188 	vput(vp);
2189 	NFSEXITCODE2(error, nd);
2190 	return (error);
2191 }
2192 
2193 /*
2194  * nfs statfs service
2195  */
2196 int
2197 nfsrvd_statfs(struct nfsrv_descript *nd, __unused int isdgram,
2198     vnode_t vp, __unused struct nfsexstuff *exp)
2199 {
2200 	struct statfs *sf;
2201 	u_int32_t *tl;
2202 	int getret = 1;
2203 	struct nfsvattr at;
2204 	u_quad_t tval;
2205 	struct thread *p = curthread;
2206 
2207 	sf = NULL;
2208 	if (nd->nd_repstat) {
2209 		nfsrv_postopattr(nd, getret, &at);
2210 		goto out;
2211 	}
2212 	sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
2213 	nd->nd_repstat = nfsvno_statfs(vp, sf);
2214 	getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2215 	vput(vp);
2216 	if (nd->nd_flag & ND_NFSV3)
2217 		nfsrv_postopattr(nd, getret, &at);
2218 	if (nd->nd_repstat)
2219 		goto out;
2220 	if (nd->nd_flag & ND_NFSV2) {
2221 		NFSM_BUILD(tl, u_int32_t *, NFSX_V2STATFS);
2222 		*tl++ = txdr_unsigned(NFS_V2MAXDATA);
2223 		*tl++ = txdr_unsigned(sf->f_bsize);
2224 		*tl++ = txdr_unsigned(sf->f_blocks);
2225 		*tl++ = txdr_unsigned(sf->f_bfree);
2226 		*tl = txdr_unsigned(sf->f_bavail);
2227 	} else {
2228 		NFSM_BUILD(tl, u_int32_t *, NFSX_V3STATFS);
2229 		tval = (u_quad_t)sf->f_blocks;
2230 		tval *= (u_quad_t)sf->f_bsize;
2231 		txdr_hyper(tval, tl); tl += 2;
2232 		tval = (u_quad_t)sf->f_bfree;
2233 		tval *= (u_quad_t)sf->f_bsize;
2234 		txdr_hyper(tval, tl); tl += 2;
2235 		tval = (u_quad_t)sf->f_bavail;
2236 		tval *= (u_quad_t)sf->f_bsize;
2237 		txdr_hyper(tval, tl); tl += 2;
2238 		tval = (u_quad_t)sf->f_files;
2239 		txdr_hyper(tval, tl); tl += 2;
2240 		tval = (u_quad_t)sf->f_ffree;
2241 		txdr_hyper(tval, tl); tl += 2;
2242 		tval = (u_quad_t)sf->f_ffree;
2243 		txdr_hyper(tval, tl); tl += 2;
2244 		*tl = 0;
2245 	}
2246 
2247 out:
2248 	free(sf, M_STATFS);
2249 	NFSEXITCODE2(0, nd);
2250 	return (0);
2251 }
2252 
2253 /*
2254  * nfs fsinfo service
2255  */
2256 int
2257 nfsrvd_fsinfo(struct nfsrv_descript *nd, int isdgram,
2258     vnode_t vp, __unused struct nfsexstuff *exp)
2259 {
2260 	u_int32_t *tl;
2261 	struct nfsfsinfo fs;
2262 	int getret = 1;
2263 	struct nfsvattr at;
2264 	struct thread *p = curthread;
2265 
2266 	if (nd->nd_repstat) {
2267 		nfsrv_postopattr(nd, getret, &at);
2268 		goto out;
2269 	}
2270 	getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2271 	nfsvno_getfs(&fs, isdgram);
2272 	vput(vp);
2273 	nfsrv_postopattr(nd, getret, &at);
2274 	NFSM_BUILD(tl, u_int32_t *, NFSX_V3FSINFO);
2275 	*tl++ = txdr_unsigned(fs.fs_rtmax);
2276 	*tl++ = txdr_unsigned(fs.fs_rtpref);
2277 	*tl++ = txdr_unsigned(fs.fs_rtmult);
2278 	*tl++ = txdr_unsigned(fs.fs_wtmax);
2279 	*tl++ = txdr_unsigned(fs.fs_wtpref);
2280 	*tl++ = txdr_unsigned(fs.fs_wtmult);
2281 	*tl++ = txdr_unsigned(fs.fs_dtpref);
2282 	txdr_hyper(fs.fs_maxfilesize, tl);
2283 	tl += 2;
2284 	txdr_nfsv3time(&fs.fs_timedelta, tl);
2285 	tl += 2;
2286 	*tl = txdr_unsigned(fs.fs_properties);
2287 
2288 out:
2289 	NFSEXITCODE2(0, nd);
2290 	return (0);
2291 }
2292 
2293 /*
2294  * nfs pathconf service
2295  */
2296 int
2297 nfsrvd_pathconf(struct nfsrv_descript *nd, __unused int isdgram,
2298     vnode_t vp, __unused struct nfsexstuff *exp)
2299 {
2300 	struct nfsv3_pathconf *pc;
2301 	int getret = 1;
2302 	long linkmax, namemax, chownres, notrunc;
2303 	struct nfsvattr at;
2304 	struct thread *p = curthread;
2305 
2306 	if (nd->nd_repstat) {
2307 		nfsrv_postopattr(nd, getret, &at);
2308 		goto out;
2309 	}
2310 	nd->nd_repstat = nfsvno_pathconf(vp, _PC_LINK_MAX, &linkmax,
2311 	    nd->nd_cred, p);
2312 	if (!nd->nd_repstat)
2313 		nd->nd_repstat = nfsvno_pathconf(vp, _PC_NAME_MAX, &namemax,
2314 		    nd->nd_cred, p);
2315 	if (!nd->nd_repstat)
2316 		nd->nd_repstat=nfsvno_pathconf(vp, _PC_CHOWN_RESTRICTED,
2317 		    &chownres, nd->nd_cred, p);
2318 	if (!nd->nd_repstat)
2319 		nd->nd_repstat = nfsvno_pathconf(vp, _PC_NO_TRUNC, &notrunc,
2320 		    nd->nd_cred, p);
2321 	getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2322 	vput(vp);
2323 	nfsrv_postopattr(nd, getret, &at);
2324 	if (!nd->nd_repstat) {
2325 		NFSM_BUILD(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
2326 		pc->pc_linkmax = txdr_unsigned(linkmax);
2327 		pc->pc_namemax = txdr_unsigned(namemax);
2328 		pc->pc_notrunc = txdr_unsigned(notrunc);
2329 		pc->pc_chownrestricted = txdr_unsigned(chownres);
2330 
2331 		/*
2332 		 * These should probably be supported by VOP_PATHCONF(), but
2333 		 * until msdosfs is exportable (why would you want to?), the
2334 		 * Unix defaults should be ok.
2335 		 */
2336 		pc->pc_caseinsensitive = newnfs_false;
2337 		pc->pc_casepreserving = newnfs_true;
2338 	}
2339 
2340 out:
2341 	NFSEXITCODE2(0, nd);
2342 	return (0);
2343 }
2344 
2345 /*
2346  * nfsv4 lock service
2347  */
2348 int
2349 nfsrvd_lock(struct nfsrv_descript *nd, __unused int isdgram,
2350     vnode_t vp, struct nfsexstuff *exp)
2351 {
2352 	u_int32_t *tl;
2353 	int i;
2354 	struct nfsstate *stp = NULL;
2355 	struct nfslock *lop;
2356 	struct nfslockconflict cf;
2357 	int error = 0;
2358 	u_short flags = NFSLCK_LOCK, lflags;
2359 	u_int64_t offset, len;
2360 	nfsv4stateid_t stateid;
2361 	nfsquad_t clientid;
2362 	struct thread *p = curthread;
2363 
2364 	NFSM_DISSECT(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2365 	i = fxdr_unsigned(int, *tl++);
2366 	switch (i) {
2367 	case NFSV4LOCKT_READW:
2368 		flags |= NFSLCK_BLOCKING;
2369 	case NFSV4LOCKT_READ:
2370 		lflags = NFSLCK_READ;
2371 		break;
2372 	case NFSV4LOCKT_WRITEW:
2373 		flags |= NFSLCK_BLOCKING;
2374 	case NFSV4LOCKT_WRITE:
2375 		lflags = NFSLCK_WRITE;
2376 		break;
2377 	default:
2378 		nd->nd_repstat = NFSERR_BADXDR;
2379 		goto nfsmout;
2380 	}
2381 	if (*tl++ == newnfs_true)
2382 		flags |= NFSLCK_RECLAIM;
2383 	offset = fxdr_hyper(tl);
2384 	tl += 2;
2385 	len = fxdr_hyper(tl);
2386 	tl += 2;
2387 	if (*tl == newnfs_true)
2388 		flags |= NFSLCK_OPENTOLOCK;
2389 	if (flags & NFSLCK_OPENTOLOCK) {
2390 		NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED + NFSX_STATEID);
2391 		i = fxdr_unsigned(int, *(tl+4+(NFSX_STATEID / NFSX_UNSIGNED)));
2392 		if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2393 			nd->nd_repstat = NFSERR_BADXDR;
2394 			goto nfsmout;
2395 		}
2396 		stp = malloc(sizeof (struct nfsstate) + i,
2397 			M_NFSDSTATE, M_WAITOK);
2398 		stp->ls_ownerlen = i;
2399 		stp->ls_op = nd->nd_rp;
2400 		stp->ls_seq = fxdr_unsigned(int, *tl++);
2401 		stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2402 		NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2403 			NFSX_STATEIDOTHER);
2404 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2405 
2406 		/*
2407 		 * For the special stateid of other all 0s and seqid == 1, set
2408 		 * the stateid to the current stateid, if it is set.
2409 		 */
2410 		if ((nd->nd_flag & ND_NFSV41) != 0 &&
2411 		    stp->ls_stateid.seqid == 1 &&
2412 		    stp->ls_stateid.other[0] == 0 &&
2413 		    stp->ls_stateid.other[1] == 0 &&
2414 		    stp->ls_stateid.other[2] == 0) {
2415 			if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2416 				stp->ls_stateid = nd->nd_curstateid;
2417 				stp->ls_stateid.seqid = 0;
2418 			} else {
2419 				nd->nd_repstat = NFSERR_BADSTATEID;
2420 				goto nfsmout;
2421 			}
2422 		}
2423 
2424 		stp->ls_opentolockseq = fxdr_unsigned(int, *tl++);
2425 		clientid.lval[0] = *tl++;
2426 		clientid.lval[1] = *tl++;
2427 		if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2428 			if ((nd->nd_flag & ND_NFSV41) != 0)
2429 				clientid.qval = nd->nd_clientid.qval;
2430 			else if (nd->nd_clientid.qval != clientid.qval)
2431 				printf("EEK3 multiple clids\n");
2432 		} else {
2433 			if ((nd->nd_flag & ND_NFSV41) != 0)
2434 				printf("EEK! no clientid from session\n");
2435 			nd->nd_flag |= ND_IMPLIEDCLID;
2436 			nd->nd_clientid.qval = clientid.qval;
2437 		}
2438 		error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2439 		if (error)
2440 			goto nfsmout;
2441 	} else {
2442 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
2443 		stp = malloc(sizeof (struct nfsstate),
2444 			M_NFSDSTATE, M_WAITOK);
2445 		stp->ls_ownerlen = 0;
2446 		stp->ls_op = nd->nd_rp;
2447 		stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2448 		NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2449 			NFSX_STATEIDOTHER);
2450 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2451 
2452 		/*
2453 		 * For the special stateid of other all 0s and seqid == 1, set
2454 		 * the stateid to the current stateid, if it is set.
2455 		 */
2456 		if ((nd->nd_flag & ND_NFSV41) != 0 &&
2457 		    stp->ls_stateid.seqid == 1 &&
2458 		    stp->ls_stateid.other[0] == 0 &&
2459 		    stp->ls_stateid.other[1] == 0 &&
2460 		    stp->ls_stateid.other[2] == 0) {
2461 			if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2462 				stp->ls_stateid = nd->nd_curstateid;
2463 				stp->ls_stateid.seqid = 0;
2464 			} else {
2465 				nd->nd_repstat = NFSERR_BADSTATEID;
2466 				goto nfsmout;
2467 			}
2468 		}
2469 
2470 		stp->ls_seq = fxdr_unsigned(int, *tl);
2471 		clientid.lval[0] = stp->ls_stateid.other[0];
2472 		clientid.lval[1] = stp->ls_stateid.other[1];
2473 		if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2474 			if ((nd->nd_flag & ND_NFSV41) != 0)
2475 				clientid.qval = nd->nd_clientid.qval;
2476 			else if (nd->nd_clientid.qval != clientid.qval)
2477 				printf("EEK4 multiple clids\n");
2478 		} else {
2479 			if ((nd->nd_flag & ND_NFSV41) != 0)
2480 				printf("EEK! no clientid from session\n");
2481 			nd->nd_flag |= ND_IMPLIEDCLID;
2482 			nd->nd_clientid.qval = clientid.qval;
2483 		}
2484 	}
2485 	lop = malloc(sizeof (struct nfslock),
2486 		M_NFSDLOCK, M_WAITOK);
2487 	lop->lo_first = offset;
2488 	if (len == NFS64BITSSET) {
2489 		lop->lo_end = NFS64BITSSET;
2490 	} else {
2491 		lop->lo_end = offset + len;
2492 		if (lop->lo_end <= lop->lo_first)
2493 			nd->nd_repstat = NFSERR_INVAL;
2494 	}
2495 	lop->lo_flags = lflags;
2496 	stp->ls_flags = flags;
2497 	stp->ls_uid = nd->nd_cred->cr_uid;
2498 
2499 	/*
2500 	 * Do basic access checking.
2501 	 */
2502 	if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
2503 	    if (vnode_vtype(vp) == VDIR)
2504 		nd->nd_repstat = NFSERR_ISDIR;
2505 	    else
2506 		nd->nd_repstat = NFSERR_INVAL;
2507 	}
2508 	if (!nd->nd_repstat) {
2509 	    if (lflags & NFSLCK_WRITE) {
2510 		nd->nd_repstat = nfsvno_accchk(vp, VWRITE,
2511 		    nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2512 		    NFSACCCHK_VPISLOCKED, NULL);
2513 	    } else {
2514 		nd->nd_repstat = nfsvno_accchk(vp, VREAD,
2515 		    nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2516 		    NFSACCCHK_VPISLOCKED, NULL);
2517 		if (nd->nd_repstat)
2518 		    nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
2519 			nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2520 			NFSACCCHK_VPISLOCKED, NULL);
2521 	    }
2522 	}
2523 
2524 	/*
2525 	 * We call nfsrv_lockctrl() even if nd_repstat set, so that the
2526 	 * seqid# gets updated. nfsrv_lockctrl() will return the value
2527 	 * of nd_repstat, if it gets that far.
2528 	 */
2529 	nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, &cf, clientid,
2530 		&stateid, exp, nd, p);
2531 	if (lop)
2532 		free(lop, M_NFSDLOCK);
2533 	if (stp)
2534 		free(stp, M_NFSDSTATE);
2535 	if (!nd->nd_repstat) {
2536 		/* For NFSv4.1, set the Current StateID. */
2537 		if ((nd->nd_flag & ND_NFSV41) != 0) {
2538 			nd->nd_curstateid = stateid;
2539 			nd->nd_flag |= ND_CURSTATEID;
2540 		}
2541 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2542 		*tl++ = txdr_unsigned(stateid.seqid);
2543 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
2544 	} else if (nd->nd_repstat == NFSERR_DENIED) {
2545 		NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2546 		txdr_hyper(cf.cl_first, tl);
2547 		tl += 2;
2548 		if (cf.cl_end == NFS64BITSSET)
2549 			len = NFS64BITSSET;
2550 		else
2551 			len = cf.cl_end - cf.cl_first;
2552 		txdr_hyper(len, tl);
2553 		tl += 2;
2554 		if (cf.cl_flags == NFSLCK_WRITE)
2555 			*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
2556 		else
2557 			*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
2558 		*tl++ = stateid.other[0];
2559 		*tl = stateid.other[1];
2560 		(void) nfsm_strtom(nd, cf.cl_owner, cf.cl_ownerlen);
2561 	}
2562 	vput(vp);
2563 	NFSEXITCODE2(0, nd);
2564 	return (0);
2565 nfsmout:
2566 	vput(vp);
2567 	if (stp)
2568 		free(stp, M_NFSDSTATE);
2569 	NFSEXITCODE2(error, nd);
2570 	return (error);
2571 }
2572 
2573 /*
2574  * nfsv4 lock test service
2575  */
2576 int
2577 nfsrvd_lockt(struct nfsrv_descript *nd, __unused int isdgram,
2578     vnode_t vp, struct nfsexstuff *exp)
2579 {
2580 	u_int32_t *tl;
2581 	int i;
2582 	struct nfsstate *stp = NULL;
2583 	struct nfslock lo, *lop = &lo;
2584 	struct nfslockconflict cf;
2585 	int error = 0;
2586 	nfsv4stateid_t stateid;
2587 	nfsquad_t clientid;
2588 	u_int64_t len;
2589 	struct thread *p = curthread;
2590 
2591 	NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
2592 	i = fxdr_unsigned(int, *(tl + 7));
2593 	if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2594 		nd->nd_repstat = NFSERR_BADXDR;
2595 		goto nfsmout;
2596 	}
2597 	stp = malloc(sizeof (struct nfsstate) + i,
2598 	    M_NFSDSTATE, M_WAITOK);
2599 	stp->ls_ownerlen = i;
2600 	stp->ls_op = NULL;
2601 	stp->ls_flags = NFSLCK_TEST;
2602 	stp->ls_uid = nd->nd_cred->cr_uid;
2603 	i = fxdr_unsigned(int, *tl++);
2604 	switch (i) {
2605 	case NFSV4LOCKT_READW:
2606 		stp->ls_flags |= NFSLCK_BLOCKING;
2607 	case NFSV4LOCKT_READ:
2608 		lo.lo_flags = NFSLCK_READ;
2609 		break;
2610 	case NFSV4LOCKT_WRITEW:
2611 		stp->ls_flags |= NFSLCK_BLOCKING;
2612 	case NFSV4LOCKT_WRITE:
2613 		lo.lo_flags = NFSLCK_WRITE;
2614 		break;
2615 	default:
2616 		nd->nd_repstat = NFSERR_BADXDR;
2617 		goto nfsmout;
2618 	}
2619 	lo.lo_first = fxdr_hyper(tl);
2620 	tl += 2;
2621 	len = fxdr_hyper(tl);
2622 	if (len == NFS64BITSSET) {
2623 		lo.lo_end = NFS64BITSSET;
2624 	} else {
2625 		lo.lo_end = lo.lo_first + len;
2626 		if (lo.lo_end <= lo.lo_first)
2627 			nd->nd_repstat = NFSERR_INVAL;
2628 	}
2629 	tl += 2;
2630 	clientid.lval[0] = *tl++;
2631 	clientid.lval[1] = *tl;
2632 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2633 		if ((nd->nd_flag & ND_NFSV41) != 0)
2634 			clientid.qval = nd->nd_clientid.qval;
2635 		else if (nd->nd_clientid.qval != clientid.qval)
2636 			printf("EEK5 multiple clids\n");
2637 	} else {
2638 		if ((nd->nd_flag & ND_NFSV41) != 0)
2639 			printf("EEK! no clientid from session\n");
2640 		nd->nd_flag |= ND_IMPLIEDCLID;
2641 		nd->nd_clientid.qval = clientid.qval;
2642 	}
2643 	error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2644 	if (error)
2645 		goto nfsmout;
2646 	if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
2647 	    if (vnode_vtype(vp) == VDIR)
2648 		nd->nd_repstat = NFSERR_ISDIR;
2649 	    else
2650 		nd->nd_repstat = NFSERR_INVAL;
2651 	}
2652 	if (!nd->nd_repstat)
2653 	  nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, &cf, clientid,
2654 	    &stateid, exp, nd, p);
2655 	if (nd->nd_repstat) {
2656 	    if (nd->nd_repstat == NFSERR_DENIED) {
2657 		NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2658 		txdr_hyper(cf.cl_first, tl);
2659 		tl += 2;
2660 		if (cf.cl_end == NFS64BITSSET)
2661 			len = NFS64BITSSET;
2662 		else
2663 			len = cf.cl_end - cf.cl_first;
2664 		txdr_hyper(len, tl);
2665 		tl += 2;
2666 		if (cf.cl_flags == NFSLCK_WRITE)
2667 			*tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
2668 		else
2669 			*tl++ = txdr_unsigned(NFSV4LOCKT_READ);
2670 		*tl++ = stp->ls_stateid.other[0];
2671 		*tl = stp->ls_stateid.other[1];
2672 		(void) nfsm_strtom(nd, cf.cl_owner, cf.cl_ownerlen);
2673 	    }
2674 	}
2675 	vput(vp);
2676 	if (stp)
2677 		free(stp, M_NFSDSTATE);
2678 	NFSEXITCODE2(0, nd);
2679 	return (0);
2680 nfsmout:
2681 	vput(vp);
2682 	if (stp)
2683 		free(stp, M_NFSDSTATE);
2684 	NFSEXITCODE2(error, nd);
2685 	return (error);
2686 }
2687 
2688 /*
2689  * nfsv4 unlock service
2690  */
2691 int
2692 nfsrvd_locku(struct nfsrv_descript *nd, __unused int isdgram,
2693     vnode_t vp, struct nfsexstuff *exp)
2694 {
2695 	u_int32_t *tl;
2696 	int i;
2697 	struct nfsstate *stp;
2698 	struct nfslock *lop;
2699 	int error = 0;
2700 	nfsv4stateid_t stateid;
2701 	nfsquad_t clientid;
2702 	u_int64_t len;
2703 	struct thread *p = curthread;
2704 
2705 	NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED + NFSX_STATEID);
2706 	stp = malloc(sizeof (struct nfsstate),
2707 	    M_NFSDSTATE, M_WAITOK);
2708 	lop = malloc(sizeof (struct nfslock),
2709 	    M_NFSDLOCK, M_WAITOK);
2710 	stp->ls_flags = NFSLCK_UNLOCK;
2711 	lop->lo_flags = NFSLCK_UNLOCK;
2712 	stp->ls_op = nd->nd_rp;
2713 	i = fxdr_unsigned(int, *tl++);
2714 	switch (i) {
2715 	case NFSV4LOCKT_READW:
2716 		stp->ls_flags |= NFSLCK_BLOCKING;
2717 	case NFSV4LOCKT_READ:
2718 		break;
2719 	case NFSV4LOCKT_WRITEW:
2720 		stp->ls_flags |= NFSLCK_BLOCKING;
2721 	case NFSV4LOCKT_WRITE:
2722 		break;
2723 	default:
2724 		nd->nd_repstat = NFSERR_BADXDR;
2725 		free(stp, M_NFSDSTATE);
2726 		free(lop, M_NFSDLOCK);
2727 		goto nfsmout;
2728 	}
2729 	stp->ls_ownerlen = 0;
2730 	stp->ls_uid = nd->nd_cred->cr_uid;
2731 	stp->ls_seq = fxdr_unsigned(int, *tl++);
2732 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2733 	NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2734 	    NFSX_STATEIDOTHER);
2735 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2736 
2737 	/*
2738 	 * For the special stateid of other all 0s and seqid == 1, set the
2739 	 * stateid to the current stateid, if it is set.
2740 	 */
2741 	if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
2742 	    stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
2743 	    stp->ls_stateid.other[2] == 0) {
2744 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2745 			stp->ls_stateid = nd->nd_curstateid;
2746 			stp->ls_stateid.seqid = 0;
2747 		} else {
2748 			nd->nd_repstat = NFSERR_BADSTATEID;
2749 			free(stp, M_NFSDSTATE);
2750 			free(lop, M_NFSDLOCK);
2751 			goto nfsmout;
2752 		}
2753 	}
2754 
2755 	lop->lo_first = fxdr_hyper(tl);
2756 	tl += 2;
2757 	len = fxdr_hyper(tl);
2758 	if (len == NFS64BITSSET) {
2759 		lop->lo_end = NFS64BITSSET;
2760 	} else {
2761 		lop->lo_end = lop->lo_first + len;
2762 		if (lop->lo_end <= lop->lo_first)
2763 			nd->nd_repstat = NFSERR_INVAL;
2764 	}
2765 	clientid.lval[0] = stp->ls_stateid.other[0];
2766 	clientid.lval[1] = stp->ls_stateid.other[1];
2767 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2768 		if ((nd->nd_flag & ND_NFSV41) != 0)
2769 			clientid.qval = nd->nd_clientid.qval;
2770 		else if (nd->nd_clientid.qval != clientid.qval)
2771 			printf("EEK6 multiple clids\n");
2772 	} else {
2773 		if ((nd->nd_flag & ND_NFSV41) != 0)
2774 			printf("EEK! no clientid from session\n");
2775 		nd->nd_flag |= ND_IMPLIEDCLID;
2776 		nd->nd_clientid.qval = clientid.qval;
2777 	}
2778 	if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
2779 	    if (vnode_vtype(vp) == VDIR)
2780 		nd->nd_repstat = NFSERR_ISDIR;
2781 	    else
2782 		nd->nd_repstat = NFSERR_INVAL;
2783 	}
2784 	/*
2785 	 * Call nfsrv_lockctrl() even if nd_repstat is set, so that the
2786 	 * seqid# gets incremented. nfsrv_lockctrl() will return the
2787 	 * value of nd_repstat, if it gets that far.
2788 	 */
2789 	nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
2790 	    &stateid, exp, nd, p);
2791 	if (stp)
2792 		free(stp, M_NFSDSTATE);
2793 	if (lop)
2794 		free(lop, M_NFSDLOCK);
2795 	if (!nd->nd_repstat) {
2796 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2797 		*tl++ = txdr_unsigned(stateid.seqid);
2798 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
2799 	}
2800 nfsmout:
2801 	vput(vp);
2802 	NFSEXITCODE2(error, nd);
2803 	return (error);
2804 }
2805 
2806 /*
2807  * nfsv4 open service
2808  */
2809 int
2810 nfsrvd_open(struct nfsrv_descript *nd, __unused int isdgram,
2811     vnode_t dp, vnode_t *vpp, __unused fhandle_t *fhp, struct nfsexstuff *exp)
2812 {
2813 	u_int32_t *tl;
2814 	int i, retext;
2815 	struct nfsstate *stp = NULL;
2816 	int error = 0, create, claim, exclusive_flag = 0, override;
2817 	u_int32_t rflags = NFSV4OPEN_LOCKTYPEPOSIX, acemask;
2818 	int how = NFSCREATE_UNCHECKED;
2819 	int32_t cverf[2], tverf[2] = { 0, 0 };
2820 	vnode_t vp = NULL, dirp = NULL;
2821 	struct nfsvattr nva, dirfor, diraft;
2822 	struct nameidata named;
2823 	nfsv4stateid_t stateid, delegstateid;
2824 	nfsattrbit_t attrbits;
2825 	nfsquad_t clientid;
2826 	char *bufp = NULL;
2827 	u_long *hashp;
2828 	NFSACL_T *aclp = NULL;
2829 	struct thread *p = curthread;
2830 
2831 #ifdef NFS4_ACL_EXTATTR_NAME
2832 	aclp = acl_alloc(M_WAITOK);
2833 	aclp->acl_cnt = 0;
2834 #endif
2835 	NFSZERO_ATTRBIT(&attrbits);
2836 	named.ni_startdir = NULL;
2837 	named.ni_cnd.cn_nameiop = 0;
2838 	NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2839 	i = fxdr_unsigned(int, *(tl + 5));
2840 	if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2841 		nd->nd_repstat = NFSERR_BADXDR;
2842 		goto nfsmout;
2843 	}
2844 	stp = malloc(sizeof (struct nfsstate) + i,
2845 	    M_NFSDSTATE, M_WAITOK);
2846 	stp->ls_ownerlen = i;
2847 	stp->ls_op = nd->nd_rp;
2848 	stp->ls_flags = NFSLCK_OPEN;
2849 	stp->ls_uid = nd->nd_cred->cr_uid;
2850 	stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
2851 	i = fxdr_unsigned(int, *tl++);
2852 	retext = 0;
2853 	if ((i & (NFSV4OPEN_WANTDELEGMASK | NFSV4OPEN_WANTSIGNALDELEG |
2854 	    NFSV4OPEN_WANTPUSHDELEG)) != 0 && (nd->nd_flag & ND_NFSV41) != 0) {
2855 		retext = 1;
2856 		/* For now, ignore these. */
2857 		i &= ~(NFSV4OPEN_WANTPUSHDELEG | NFSV4OPEN_WANTSIGNALDELEG);
2858 		switch (i & NFSV4OPEN_WANTDELEGMASK) {
2859 		case NFSV4OPEN_WANTANYDELEG:
2860 			stp->ls_flags |= (NFSLCK_WANTRDELEG |
2861 			    NFSLCK_WANTWDELEG);
2862 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2863 			break;
2864 		case NFSV4OPEN_WANTREADDELEG:
2865 			stp->ls_flags |= NFSLCK_WANTRDELEG;
2866 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2867 			break;
2868 		case NFSV4OPEN_WANTWRITEDELEG:
2869 			stp->ls_flags |= NFSLCK_WANTWDELEG;
2870 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2871 			break;
2872 		case NFSV4OPEN_WANTNODELEG:
2873 			stp->ls_flags |= NFSLCK_WANTNODELEG;
2874 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2875 			break;
2876 		case NFSV4OPEN_WANTCANCEL:
2877 			printf("NFSv4: ignore Open WantCancel\n");
2878 			i &= ~NFSV4OPEN_WANTDELEGMASK;
2879 			break;
2880 		default:
2881 			/* nd_repstat will be set to NFSERR_INVAL below. */
2882 			break;
2883 		}
2884 	}
2885 	switch (i) {
2886 	case NFSV4OPEN_ACCESSREAD:
2887 		stp->ls_flags |= NFSLCK_READACCESS;
2888 		break;
2889 	case NFSV4OPEN_ACCESSWRITE:
2890 		stp->ls_flags |= NFSLCK_WRITEACCESS;
2891 		break;
2892 	case NFSV4OPEN_ACCESSBOTH:
2893 		stp->ls_flags |= (NFSLCK_READACCESS | NFSLCK_WRITEACCESS);
2894 		break;
2895 	default:
2896 		nd->nd_repstat = NFSERR_INVAL;
2897 	}
2898 	i = fxdr_unsigned(int, *tl++);
2899 	switch (i) {
2900 	case NFSV4OPEN_DENYNONE:
2901 		break;
2902 	case NFSV4OPEN_DENYREAD:
2903 		stp->ls_flags |= NFSLCK_READDENY;
2904 		break;
2905 	case NFSV4OPEN_DENYWRITE:
2906 		stp->ls_flags |= NFSLCK_WRITEDENY;
2907 		break;
2908 	case NFSV4OPEN_DENYBOTH:
2909 		stp->ls_flags |= (NFSLCK_READDENY | NFSLCK_WRITEDENY);
2910 		break;
2911 	default:
2912 		nd->nd_repstat = NFSERR_INVAL;
2913 	}
2914 	clientid.lval[0] = *tl++;
2915 	clientid.lval[1] = *tl;
2916 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2917 		if ((nd->nd_flag & ND_NFSV41) != 0)
2918 			clientid.qval = nd->nd_clientid.qval;
2919 		else if (nd->nd_clientid.qval != clientid.qval)
2920 			printf("EEK7 multiple clids\n");
2921 	} else {
2922 		if ((nd->nd_flag & ND_NFSV41) != 0)
2923 			printf("EEK! no clientid from session\n");
2924 		nd->nd_flag |= ND_IMPLIEDCLID;
2925 		nd->nd_clientid.qval = clientid.qval;
2926 	}
2927 	error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2928 	if (error)
2929 		goto nfsmout;
2930 	NFSVNO_ATTRINIT(&nva);
2931 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2932 	create = fxdr_unsigned(int, *tl);
2933 	if (!nd->nd_repstat)
2934 		nd->nd_repstat = nfsvno_getattr(dp, &dirfor, nd, p, 0, NULL);
2935 	if (create == NFSV4OPEN_CREATE) {
2936 		nva.na_type = VREG;
2937 		nva.na_mode = 0;
2938 		NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2939 		how = fxdr_unsigned(int, *tl);
2940 		switch (how) {
2941 		case NFSCREATE_UNCHECKED:
2942 		case NFSCREATE_GUARDED:
2943 			error = nfsv4_sattr(nd, NULL, &nva, &attrbits, aclp, p);
2944 			if (error)
2945 				goto nfsmout;
2946 			/*
2947 			 * If the na_gid being set is the same as that of
2948 			 * the directory it is going in, clear it, since
2949 			 * that is what will be set by default. This allows
2950 			 * a user that isn't in that group to do the create.
2951 			 */
2952 			if (!nd->nd_repstat && NFSVNO_ISSETGID(&nva) &&
2953 			    nva.na_gid == dirfor.na_gid)
2954 				NFSVNO_UNSET(&nva, gid);
2955 			if (!nd->nd_repstat)
2956 				nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
2957 			break;
2958 		case NFSCREATE_EXCLUSIVE:
2959 			NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
2960 			cverf[0] = *tl++;
2961 			cverf[1] = *tl;
2962 			break;
2963 		case NFSCREATE_EXCLUSIVE41:
2964 			NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
2965 			cverf[0] = *tl++;
2966 			cverf[1] = *tl;
2967 			error = nfsv4_sattr(nd, NULL, &nva, &attrbits, aclp, p);
2968 			if (error != 0)
2969 				goto nfsmout;
2970 			if (NFSISSET_ATTRBIT(&attrbits,
2971 			    NFSATTRBIT_TIMEACCESSSET))
2972 				nd->nd_repstat = NFSERR_INVAL;
2973 			/*
2974 			 * If the na_gid being set is the same as that of
2975 			 * the directory it is going in, clear it, since
2976 			 * that is what will be set by default. This allows
2977 			 * a user that isn't in that group to do the create.
2978 			 */
2979 			if (nd->nd_repstat == 0 && NFSVNO_ISSETGID(&nva) &&
2980 			    nva.na_gid == dirfor.na_gid)
2981 				NFSVNO_UNSET(&nva, gid);
2982 			if (nd->nd_repstat == 0)
2983 				nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
2984 			break;
2985 		default:
2986 			nd->nd_repstat = NFSERR_BADXDR;
2987 			goto nfsmout;
2988 		}
2989 	} else if (create != NFSV4OPEN_NOCREATE) {
2990 		nd->nd_repstat = NFSERR_BADXDR;
2991 		goto nfsmout;
2992 	}
2993 
2994 	/*
2995 	 * Now, handle the claim, which usually includes looking up a
2996 	 * name in the directory referenced by dp. The exception is
2997 	 * NFSV4OPEN_CLAIMPREVIOUS.
2998 	 */
2999 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3000 	claim = fxdr_unsigned(int, *tl);
3001 	if (claim == NFSV4OPEN_CLAIMDELEGATECUR || claim ==
3002 	    NFSV4OPEN_CLAIMDELEGATECURFH) {
3003 		NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
3004 		stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3005 		NFSBCOPY((caddr_t)tl,(caddr_t)stateid.other,NFSX_STATEIDOTHER);
3006 		stp->ls_flags |= NFSLCK_DELEGCUR;
3007 	} else if (claim == NFSV4OPEN_CLAIMDELEGATEPREV || claim ==
3008 	    NFSV4OPEN_CLAIMDELEGATEPREVFH) {
3009 		stp->ls_flags |= NFSLCK_DELEGPREV;
3010 	}
3011 	if (claim == NFSV4OPEN_CLAIMNULL || claim == NFSV4OPEN_CLAIMDELEGATECUR
3012 	    || claim == NFSV4OPEN_CLAIMDELEGATEPREV) {
3013 		if (!nd->nd_repstat && create == NFSV4OPEN_CREATE &&
3014 		    claim != NFSV4OPEN_CLAIMNULL)
3015 			nd->nd_repstat = NFSERR_INVAL;
3016 		if (nd->nd_repstat) {
3017 			nd->nd_repstat = nfsrv_opencheck(clientid,
3018 			    &stateid, stp, NULL, nd, p, nd->nd_repstat);
3019 			goto nfsmout;
3020 		}
3021 		if (create == NFSV4OPEN_CREATE)
3022 		    NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
3023 			LOCKPARENT | LOCKLEAF | SAVESTART | NOCACHE);
3024 		else
3025 		    NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
3026 			LOCKLEAF | SAVESTART);
3027 		nfsvno_setpathbuf(&named, &bufp, &hashp);
3028 		error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
3029 		if (error) {
3030 			vrele(dp);
3031 #ifdef NFS4_ACL_EXTATTR_NAME
3032 			acl_free(aclp);
3033 #endif
3034 			free(stp, M_NFSDSTATE);
3035 			nfsvno_relpathbuf(&named);
3036 			NFSEXITCODE2(error, nd);
3037 			return (error);
3038 		}
3039 		if (!nd->nd_repstat) {
3040 			nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp,
3041 			    &dirp);
3042 		} else {
3043 			vrele(dp);
3044 			nfsvno_relpathbuf(&named);
3045 		}
3046 		if (create == NFSV4OPEN_CREATE) {
3047 		    switch (how) {
3048 		    case NFSCREATE_UNCHECKED:
3049 			if (named.ni_vp) {
3050 				/*
3051 				 * Clear the setable attribute bits, except
3052 				 * for Size, if it is being truncated.
3053 				 */
3054 				NFSZERO_ATTRBIT(&attrbits);
3055 				if (NFSVNO_ISSETSIZE(&nva))
3056 					NFSSETBIT_ATTRBIT(&attrbits,
3057 					    NFSATTRBIT_SIZE);
3058 			}
3059 			break;
3060 		    case NFSCREATE_GUARDED:
3061 			if (named.ni_vp && !nd->nd_repstat)
3062 				nd->nd_repstat = EEXIST;
3063 			break;
3064 		    case NFSCREATE_EXCLUSIVE:
3065 			exclusive_flag = 1;
3066 			if (!named.ni_vp)
3067 				nva.na_mode = 0;
3068 			break;
3069 		    case NFSCREATE_EXCLUSIVE41:
3070 			exclusive_flag = 1;
3071 			break;
3072 		    }
3073 		}
3074 		nfsvno_open(nd, &named, clientid, &stateid, stp,
3075 		    &exclusive_flag, &nva, cverf, create, aclp, &attrbits,
3076 		    nd->nd_cred, exp, &vp);
3077 	} else if (claim == NFSV4OPEN_CLAIMPREVIOUS || claim ==
3078 	    NFSV4OPEN_CLAIMFH || claim == NFSV4OPEN_CLAIMDELEGATECURFH ||
3079 	    claim == NFSV4OPEN_CLAIMDELEGATEPREVFH) {
3080 		if (claim == NFSV4OPEN_CLAIMPREVIOUS) {
3081 			NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3082 			i = fxdr_unsigned(int, *tl);
3083 			switch (i) {
3084 			case NFSV4OPEN_DELEGATEREAD:
3085 				stp->ls_flags |= NFSLCK_DELEGREAD;
3086 				break;
3087 			case NFSV4OPEN_DELEGATEWRITE:
3088 				stp->ls_flags |= NFSLCK_DELEGWRITE;
3089 			case NFSV4OPEN_DELEGATENONE:
3090 				break;
3091 			default:
3092 				nd->nd_repstat = NFSERR_BADXDR;
3093 				goto nfsmout;
3094 			}
3095 			stp->ls_flags |= NFSLCK_RECLAIM;
3096 		} else {
3097 			if (nd->nd_repstat == 0 && create == NFSV4OPEN_CREATE)
3098 				nd->nd_repstat = NFSERR_INVAL;
3099 		}
3100 		vp = dp;
3101 		NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY);
3102 		if (!VN_IS_DOOMED(vp))
3103 			nd->nd_repstat = nfsrv_opencheck(clientid, &stateid,
3104 			    stp, vp, nd, p, nd->nd_repstat);
3105 		else
3106 			nd->nd_repstat = NFSERR_PERM;
3107 	} else {
3108 		nd->nd_repstat = NFSERR_BADXDR;
3109 		goto nfsmout;
3110 	}
3111 
3112 	/*
3113 	 * Do basic access checking.
3114 	 */
3115 	if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
3116 		/*
3117 		 * The IETF working group decided that this is the correct
3118 		 * error return for all non-regular files.
3119 		 */
3120 		nd->nd_repstat = (vp->v_type == VDIR) ? NFSERR_ISDIR : NFSERR_SYMLINK;
3121 	}
3122 
3123 	/*
3124 	 * If the Open is being done for a file that already exists, apply
3125 	 * normal permission checking including for the file owner, if
3126 	 * vfs.nfsd.v4openaccess is set.
3127 	 * Previously, the owner was always allowed to open the file to
3128 	 * be consistent with the NFS tradition of always allowing the
3129 	 * owner of the file to write to the file regardless of permissions.
3130 	 * It now appears that the Linux client expects the owner
3131 	 * permissions to be checked for opens that are not creating the
3132 	 * file.  I believe the correct approach is to use the Access
3133 	 * operation's results to be consistent with NFSv3, but that is
3134 	 * not what the current Linux client appears to be doing.
3135 	 * Since both the Linux and OpenSolaris NFSv4 servers do this check,
3136 	 * I have enabled it by default.  Since Linux does not apply this
3137 	 * check for claim_delegate_cur, this code does the same.
3138 	 * If this semantic change causes a problem, it can be disabled by
3139 	 * setting the sysctl vfs.nfsd.v4openaccess to 0 to re-enable the
3140 	 * previous semantics.
3141 	 */
3142 	if (nfsrv_openaccess && create == NFSV4OPEN_NOCREATE &&
3143 	    (stp->ls_flags & NFSLCK_DELEGCUR) == 0)
3144 		override = NFSACCCHK_NOOVERRIDE;
3145 	else
3146 		override = NFSACCCHK_ALLOWOWNER;
3147 	if (!nd->nd_repstat && (stp->ls_flags & NFSLCK_WRITEACCESS))
3148 	    nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred,
3149 	        exp, p, override, NFSACCCHK_VPISLOCKED, NULL);
3150 	if (!nd->nd_repstat && (stp->ls_flags & NFSLCK_READACCESS)) {
3151 	    nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred,
3152 	        exp, p, override, NFSACCCHK_VPISLOCKED, NULL);
3153 	    if (nd->nd_repstat)
3154 		nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
3155 		    nd->nd_cred, exp, p, override,
3156 		    NFSACCCHK_VPISLOCKED, NULL);
3157 	}
3158 
3159 	if (!nd->nd_repstat) {
3160 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
3161 		if (!nd->nd_repstat) {
3162 			tverf[0] = nva.na_atime.tv_sec;
3163 			tverf[1] = nva.na_atime.tv_nsec;
3164 		}
3165 	}
3166 	if (!nd->nd_repstat && exclusive_flag && (cverf[0] != tverf[0] ||
3167 	    cverf[1] != tverf[1]))
3168 		nd->nd_repstat = EEXIST;
3169 	/*
3170 	 * Do the open locking/delegation stuff.
3171 	 */
3172 	if (!nd->nd_repstat)
3173 	    nd->nd_repstat = nfsrv_openctrl(nd, vp, &stp, clientid, &stateid,
3174 		&delegstateid, &rflags, exp, p, nva.na_filerev);
3175 
3176 	/*
3177 	 * vp must be unlocked before the call to nfsvno_getattr(dirp,...)
3178 	 * below, to avoid a deadlock with the lookup in nfsvno_namei() above.
3179 	 * (ie: Leave the NFSVOPUNLOCK() about here.)
3180 	 */
3181 	if (vp)
3182 		NFSVOPUNLOCK(vp);
3183 	if (stp)
3184 		free(stp, M_NFSDSTATE);
3185 	if (!nd->nd_repstat && dirp)
3186 		nd->nd_repstat = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
3187 	if (!nd->nd_repstat) {
3188 		/* For NFSv4.1, set the Current StateID. */
3189 		if ((nd->nd_flag & ND_NFSV41) != 0) {
3190 			nd->nd_curstateid = stateid;
3191 			nd->nd_flag |= ND_CURSTATEID;
3192 		}
3193 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 6 * NFSX_UNSIGNED);
3194 		*tl++ = txdr_unsigned(stateid.seqid);
3195 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3196 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3197 		if (claim == NFSV4OPEN_CLAIMPREVIOUS) {
3198 			*tl++ = newnfs_true;
3199 			*tl++ = 0;
3200 			*tl++ = 0;
3201 			*tl++ = 0;
3202 			*tl++ = 0;
3203 		} else {
3204 			*tl++ = newnfs_false;	/* Since dirp is not locked */
3205 			txdr_hyper(dirfor.na_filerev, tl);
3206 			tl += 2;
3207 			txdr_hyper(diraft.na_filerev, tl);
3208 			tl += 2;
3209 		}
3210 		*tl = txdr_unsigned(rflags & NFSV4OPEN_RFLAGS);
3211 		(void) nfsrv_putattrbit(nd, &attrbits);
3212 		NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3213 		if (rflags & NFSV4OPEN_READDELEGATE)
3214 			*tl = txdr_unsigned(NFSV4OPEN_DELEGATEREAD);
3215 		else if (rflags & NFSV4OPEN_WRITEDELEGATE)
3216 			*tl = txdr_unsigned(NFSV4OPEN_DELEGATEWRITE);
3217 		else if (retext != 0) {
3218 			*tl = txdr_unsigned(NFSV4OPEN_DELEGATENONEEXT);
3219 			if ((rflags & NFSV4OPEN_WDNOTWANTED) != 0) {
3220 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3221 				*tl = txdr_unsigned(NFSV4OPEN_NOTWANTED);
3222 			} else if ((rflags & NFSV4OPEN_WDSUPPFTYPE) != 0) {
3223 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3224 				*tl = txdr_unsigned(NFSV4OPEN_NOTSUPPFTYPE);
3225 			} else if ((rflags & NFSV4OPEN_WDCONTENTION) != 0) {
3226 				NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3227 				*tl++ = txdr_unsigned(NFSV4OPEN_CONTENTION);
3228 				*tl = newnfs_false;
3229 			} else if ((rflags & NFSV4OPEN_WDRESOURCE) != 0) {
3230 				NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3231 				*tl++ = txdr_unsigned(NFSV4OPEN_RESOURCE);
3232 				*tl = newnfs_false;
3233 			} else {
3234 				NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3235 				*tl = txdr_unsigned(NFSV4OPEN_NOTWANTED);
3236 			}
3237 		} else
3238 			*tl = txdr_unsigned(NFSV4OPEN_DELEGATENONE);
3239 		if (rflags & (NFSV4OPEN_READDELEGATE|NFSV4OPEN_WRITEDELEGATE)) {
3240 			NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID+NFSX_UNSIGNED);
3241 			*tl++ = txdr_unsigned(delegstateid.seqid);
3242 			NFSBCOPY((caddr_t)delegstateid.other, (caddr_t)tl,
3243 			    NFSX_STATEIDOTHER);
3244 			tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3245 			if (rflags & NFSV4OPEN_RECALL)
3246 				*tl = newnfs_true;
3247 			else
3248 				*tl = newnfs_false;
3249 			if (rflags & NFSV4OPEN_WRITEDELEGATE) {
3250 				NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3251 				*tl++ = txdr_unsigned(NFSV4OPEN_LIMITSIZE);
3252 				txdr_hyper(nva.na_size, tl);
3253 			}
3254 			NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3255 			*tl++ = txdr_unsigned(NFSV4ACE_ALLOWEDTYPE);
3256 			*tl++ = txdr_unsigned(0x0);
3257 			acemask = NFSV4ACE_ALLFILESMASK;
3258 			if (nva.na_mode & S_IRUSR)
3259 			    acemask |= NFSV4ACE_READMASK;
3260 			if (nva.na_mode & S_IWUSR)
3261 			    acemask |= NFSV4ACE_WRITEMASK;
3262 			if (nva.na_mode & S_IXUSR)
3263 			    acemask |= NFSV4ACE_EXECUTEMASK;
3264 			*tl = txdr_unsigned(acemask);
3265 			(void) nfsm_strtom(nd, "OWNER@", 6);
3266 		}
3267 		*vpp = vp;
3268 	} else if (vp) {
3269 		vrele(vp);
3270 	}
3271 	if (dirp)
3272 		vrele(dirp);
3273 #ifdef NFS4_ACL_EXTATTR_NAME
3274 	acl_free(aclp);
3275 #endif
3276 	NFSEXITCODE2(0, nd);
3277 	return (0);
3278 nfsmout:
3279 	vrele(dp);
3280 #ifdef NFS4_ACL_EXTATTR_NAME
3281 	acl_free(aclp);
3282 #endif
3283 	if (stp)
3284 		free(stp, M_NFSDSTATE);
3285 	NFSEXITCODE2(error, nd);
3286 	return (error);
3287 }
3288 
3289 /*
3290  * nfsv4 close service
3291  */
3292 int
3293 nfsrvd_close(struct nfsrv_descript *nd, __unused int isdgram,
3294     vnode_t vp, __unused struct nfsexstuff *exp)
3295 {
3296 	u_int32_t *tl;
3297 	struct nfsstate st, *stp = &st;
3298 	int error = 0, writeacc;
3299 	nfsv4stateid_t stateid;
3300 	nfsquad_t clientid;
3301 	struct nfsvattr na;
3302 	struct thread *p = curthread;
3303 
3304 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
3305 	stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
3306 	stp->ls_ownerlen = 0;
3307 	stp->ls_op = nd->nd_rp;
3308 	stp->ls_uid = nd->nd_cred->cr_uid;
3309 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3310 	NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3311 	    NFSX_STATEIDOTHER);
3312 
3313 	/*
3314 	 * For the special stateid of other all 0s and seqid == 1, set the
3315 	 * stateid to the current stateid, if it is set.
3316 	 */
3317 	if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
3318 	    stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
3319 	    stp->ls_stateid.other[2] == 0) {
3320 		if ((nd->nd_flag & ND_CURSTATEID) != 0)
3321 			stp->ls_stateid = nd->nd_curstateid;
3322 		else {
3323 			nd->nd_repstat = NFSERR_BADSTATEID;
3324 			goto nfsmout;
3325 		}
3326 	}
3327 
3328 	stp->ls_flags = NFSLCK_CLOSE;
3329 	clientid.lval[0] = stp->ls_stateid.other[0];
3330 	clientid.lval[1] = stp->ls_stateid.other[1];
3331 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3332 		if ((nd->nd_flag & ND_NFSV41) != 0)
3333 			clientid.qval = nd->nd_clientid.qval;
3334 		else if (nd->nd_clientid.qval != clientid.qval)
3335 			printf("EEK8 multiple clids\n");
3336 	} else {
3337 		if ((nd->nd_flag & ND_NFSV41) != 0)
3338 			printf("EEK! no clientid from session\n");
3339 		nd->nd_flag |= ND_IMPLIEDCLID;
3340 		nd->nd_clientid.qval = clientid.qval;
3341 	}
3342 	nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid, nd, p,
3343 	    &writeacc);
3344 	/* For pNFS, update the attributes. */
3345 	if (writeacc != 0 || nfsrv_pnfsatime != 0)
3346 		nfsrv_updatemdsattr(vp, &na, p);
3347 	vput(vp);
3348 	if (!nd->nd_repstat) {
3349 		/*
3350 		 * If the stateid that has been closed is the current stateid,
3351 		 * unset it.
3352 		 */
3353 		if ((nd->nd_flag & ND_CURSTATEID) != 0 &&
3354 		    stateid.other[0] == nd->nd_curstateid.other[0] &&
3355 		    stateid.other[1] == nd->nd_curstateid.other[1] &&
3356 		    stateid.other[2] == nd->nd_curstateid.other[2])
3357 			nd->nd_flag &= ~ND_CURSTATEID;
3358 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3359 		*tl++ = txdr_unsigned(stateid.seqid);
3360 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3361 	}
3362 	NFSEXITCODE2(0, nd);
3363 	return (0);
3364 nfsmout:
3365 	vput(vp);
3366 	NFSEXITCODE2(error, nd);
3367 	return (error);
3368 }
3369 
3370 /*
3371  * nfsv4 delegpurge service
3372  */
3373 int
3374 nfsrvd_delegpurge(struct nfsrv_descript *nd, __unused int isdgram,
3375     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3376 {
3377 	u_int32_t *tl;
3378 	int error = 0;
3379 	nfsquad_t clientid;
3380 	struct thread *p = curthread;
3381 
3382 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
3383 		goto nfsmout;
3384 	NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3385 	clientid.lval[0] = *tl++;
3386 	clientid.lval[1] = *tl;
3387 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3388 		if ((nd->nd_flag & ND_NFSV41) != 0)
3389 			clientid.qval = nd->nd_clientid.qval;
3390 		else if (nd->nd_clientid.qval != clientid.qval)
3391 			printf("EEK9 multiple clids\n");
3392 	} else {
3393 		if ((nd->nd_flag & ND_NFSV41) != 0)
3394 			printf("EEK! no clientid from session\n");
3395 		nd->nd_flag |= ND_IMPLIEDCLID;
3396 		nd->nd_clientid.qval = clientid.qval;
3397 	}
3398 	nd->nd_repstat = nfsrv_delegupdate(nd, clientid, NULL, NULL,
3399 	    NFSV4OP_DELEGPURGE, nd->nd_cred, p, NULL);
3400 nfsmout:
3401 	NFSEXITCODE2(error, nd);
3402 	return (error);
3403 }
3404 
3405 /*
3406  * nfsv4 delegreturn service
3407  */
3408 int
3409 nfsrvd_delegreturn(struct nfsrv_descript *nd, __unused int isdgram,
3410     vnode_t vp, __unused struct nfsexstuff *exp)
3411 {
3412 	u_int32_t *tl;
3413 	int error = 0, writeacc;
3414 	nfsv4stateid_t stateid;
3415 	nfsquad_t clientid;
3416 	struct nfsvattr na;
3417 	struct thread *p = curthread;
3418 
3419 	NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
3420 	stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3421 	NFSBCOPY((caddr_t)tl, (caddr_t)stateid.other, NFSX_STATEIDOTHER);
3422 	clientid.lval[0] = stateid.other[0];
3423 	clientid.lval[1] = stateid.other[1];
3424 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3425 		if ((nd->nd_flag & ND_NFSV41) != 0)
3426 			clientid.qval = nd->nd_clientid.qval;
3427 		else if (nd->nd_clientid.qval != clientid.qval)
3428 			printf("EEK10 multiple clids\n");
3429 	} else {
3430 		if ((nd->nd_flag & ND_NFSV41) != 0)
3431 			printf("EEK! no clientid from session\n");
3432 		nd->nd_flag |= ND_IMPLIEDCLID;
3433 		nd->nd_clientid.qval = clientid.qval;
3434 	}
3435 	nd->nd_repstat = nfsrv_delegupdate(nd, clientid, &stateid, vp,
3436 	    NFSV4OP_DELEGRETURN, nd->nd_cred, p, &writeacc);
3437 	/* For pNFS, update the attributes. */
3438 	if (writeacc != 0 || nfsrv_pnfsatime != 0)
3439 		nfsrv_updatemdsattr(vp, &na, p);
3440 nfsmout:
3441 	vput(vp);
3442 	NFSEXITCODE2(error, nd);
3443 	return (error);
3444 }
3445 
3446 /*
3447  * nfsv4 get file handle service
3448  */
3449 int
3450 nfsrvd_getfh(struct nfsrv_descript *nd, __unused int isdgram,
3451     vnode_t vp, __unused struct nfsexstuff *exp)
3452 {
3453 	fhandle_t fh;
3454 	struct thread *p = curthread;
3455 
3456 	nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
3457 	vput(vp);
3458 	if (!nd->nd_repstat)
3459 		(void) nfsm_fhtom(nd, (u_int8_t *)&fh, 0, 0);
3460 	NFSEXITCODE2(0, nd);
3461 	return (0);
3462 }
3463 
3464 /*
3465  * nfsv4 open confirm service
3466  */
3467 int
3468 nfsrvd_openconfirm(struct nfsrv_descript *nd, __unused int isdgram,
3469     vnode_t vp, __unused struct nfsexstuff *exp)
3470 {
3471 	u_int32_t *tl;
3472 	struct nfsstate st, *stp = &st;
3473 	int error = 0;
3474 	nfsv4stateid_t stateid;
3475 	nfsquad_t clientid;
3476 	struct thread *p = curthread;
3477 
3478 	if ((nd->nd_flag & ND_NFSV41) != 0) {
3479 		nd->nd_repstat = NFSERR_NOTSUPP;
3480 		goto nfsmout;
3481 	}
3482 	NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
3483 	stp->ls_ownerlen = 0;
3484 	stp->ls_op = nd->nd_rp;
3485 	stp->ls_uid = nd->nd_cred->cr_uid;
3486 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3487 	NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3488 	    NFSX_STATEIDOTHER);
3489 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3490 	stp->ls_seq = fxdr_unsigned(u_int32_t, *tl);
3491 	stp->ls_flags = NFSLCK_CONFIRM;
3492 	clientid.lval[0] = stp->ls_stateid.other[0];
3493 	clientid.lval[1] = stp->ls_stateid.other[1];
3494 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3495 		if ((nd->nd_flag & ND_NFSV41) != 0)
3496 			clientid.qval = nd->nd_clientid.qval;
3497 		else if (nd->nd_clientid.qval != clientid.qval)
3498 			printf("EEK11 multiple clids\n");
3499 	} else {
3500 		if ((nd->nd_flag & ND_NFSV41) != 0)
3501 			printf("EEK! no clientid from session\n");
3502 		nd->nd_flag |= ND_IMPLIEDCLID;
3503 		nd->nd_clientid.qval = clientid.qval;
3504 	}
3505 	nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid, nd, p,
3506 	    NULL);
3507 	if (!nd->nd_repstat) {
3508 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3509 		*tl++ = txdr_unsigned(stateid.seqid);
3510 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3511 	}
3512 nfsmout:
3513 	vput(vp);
3514 	NFSEXITCODE2(error, nd);
3515 	return (error);
3516 }
3517 
3518 /*
3519  * nfsv4 open downgrade service
3520  */
3521 int
3522 nfsrvd_opendowngrade(struct nfsrv_descript *nd, __unused int isdgram,
3523     vnode_t vp, __unused struct nfsexstuff *exp)
3524 {
3525 	u_int32_t *tl;
3526 	int i;
3527 	struct nfsstate st, *stp = &st;
3528 	int error = 0;
3529 	nfsv4stateid_t stateid;
3530 	nfsquad_t clientid;
3531 	struct thread *p = curthread;
3532 
3533 	/* opendowngrade can only work on a file object.*/
3534 	if (vp->v_type != VREG) {
3535 		error = NFSERR_INVAL;
3536 		goto nfsmout;
3537 	}
3538 	NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 3 * NFSX_UNSIGNED);
3539 	stp->ls_ownerlen = 0;
3540 	stp->ls_op = nd->nd_rp;
3541 	stp->ls_uid = nd->nd_cred->cr_uid;
3542 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3543 	NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3544 	    NFSX_STATEIDOTHER);
3545 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3546 
3547 	/*
3548 	 * For the special stateid of other all 0s and seqid == 1, set the
3549 	 * stateid to the current stateid, if it is set.
3550 	 */
3551 	if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
3552 	    stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
3553 	    stp->ls_stateid.other[2] == 0) {
3554 		if ((nd->nd_flag & ND_CURSTATEID) != 0)
3555 			stp->ls_stateid = nd->nd_curstateid;
3556 		else {
3557 			nd->nd_repstat = NFSERR_BADSTATEID;
3558 			goto nfsmout;
3559 		}
3560 	}
3561 
3562 	stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
3563 	i = fxdr_unsigned(int, *tl++);
3564 	if ((nd->nd_flag & ND_NFSV41) != 0)
3565 		i &= ~NFSV4OPEN_WANTDELEGMASK;
3566 	switch (i) {
3567 	case NFSV4OPEN_ACCESSREAD:
3568 		stp->ls_flags = (NFSLCK_READACCESS | NFSLCK_DOWNGRADE);
3569 		break;
3570 	case NFSV4OPEN_ACCESSWRITE:
3571 		stp->ls_flags = (NFSLCK_WRITEACCESS | NFSLCK_DOWNGRADE);
3572 		break;
3573 	case NFSV4OPEN_ACCESSBOTH:
3574 		stp->ls_flags = (NFSLCK_READACCESS | NFSLCK_WRITEACCESS |
3575 		    NFSLCK_DOWNGRADE);
3576 		break;
3577 	default:
3578 		nd->nd_repstat = NFSERR_INVAL;
3579 	}
3580 	i = fxdr_unsigned(int, *tl);
3581 	switch (i) {
3582 	case NFSV4OPEN_DENYNONE:
3583 		break;
3584 	case NFSV4OPEN_DENYREAD:
3585 		stp->ls_flags |= NFSLCK_READDENY;
3586 		break;
3587 	case NFSV4OPEN_DENYWRITE:
3588 		stp->ls_flags |= NFSLCK_WRITEDENY;
3589 		break;
3590 	case NFSV4OPEN_DENYBOTH:
3591 		stp->ls_flags |= (NFSLCK_READDENY | NFSLCK_WRITEDENY);
3592 		break;
3593 	default:
3594 		nd->nd_repstat = NFSERR_INVAL;
3595 	}
3596 
3597 	clientid.lval[0] = stp->ls_stateid.other[0];
3598 	clientid.lval[1] = stp->ls_stateid.other[1];
3599 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3600 		if ((nd->nd_flag & ND_NFSV41) != 0)
3601 			clientid.qval = nd->nd_clientid.qval;
3602 		else if (nd->nd_clientid.qval != clientid.qval)
3603 			printf("EEK12 multiple clids\n");
3604 	} else {
3605 		if ((nd->nd_flag & ND_NFSV41) != 0)
3606 			printf("EEK! no clientid from session\n");
3607 		nd->nd_flag |= ND_IMPLIEDCLID;
3608 		nd->nd_clientid.qval = clientid.qval;
3609 	}
3610 	if (!nd->nd_repstat)
3611 		nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid,
3612 		    nd, p, NULL);
3613 	if (!nd->nd_repstat) {
3614 		/* For NFSv4.1, set the Current StateID. */
3615 		if ((nd->nd_flag & ND_NFSV41) != 0) {
3616 			nd->nd_curstateid = stateid;
3617 			nd->nd_flag |= ND_CURSTATEID;
3618 		}
3619 		NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3620 		*tl++ = txdr_unsigned(stateid.seqid);
3621 		NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3622 	}
3623 nfsmout:
3624 	vput(vp);
3625 	NFSEXITCODE2(error, nd);
3626 	return (error);
3627 }
3628 
3629 /*
3630  * nfsv4 renew lease service
3631  */
3632 int
3633 nfsrvd_renew(struct nfsrv_descript *nd, __unused int isdgram,
3634     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3635 {
3636 	u_int32_t *tl;
3637 	int error = 0;
3638 	nfsquad_t clientid;
3639 	struct thread *p = curthread;
3640 
3641 	if ((nd->nd_flag & ND_NFSV41) != 0) {
3642 		nd->nd_repstat = NFSERR_NOTSUPP;
3643 		goto nfsmout;
3644 	}
3645 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
3646 		goto nfsmout;
3647 	NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
3648 	clientid.lval[0] = *tl++;
3649 	clientid.lval[1] = *tl;
3650 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3651 		if ((nd->nd_flag & ND_NFSV41) != 0)
3652 			clientid.qval = nd->nd_clientid.qval;
3653 		else if (nd->nd_clientid.qval != clientid.qval)
3654 			printf("EEK13 multiple clids\n");
3655 	} else {
3656 		if ((nd->nd_flag & ND_NFSV41) != 0)
3657 			printf("EEK! no clientid from session\n");
3658 		nd->nd_flag |= ND_IMPLIEDCLID;
3659 		nd->nd_clientid.qval = clientid.qval;
3660 	}
3661 	nd->nd_repstat = nfsrv_getclient(clientid, (CLOPS_RENEWOP|CLOPS_RENEW),
3662 	    NULL, NULL, (nfsquad_t)((u_quad_t)0), 0, nd, p);
3663 nfsmout:
3664 	NFSEXITCODE2(error, nd);
3665 	return (error);
3666 }
3667 
3668 /*
3669  * nfsv4 security info service
3670  */
3671 int
3672 nfsrvd_secinfo(struct nfsrv_descript *nd, int isdgram,
3673     vnode_t dp, struct nfsexstuff *exp)
3674 {
3675 	u_int32_t *tl;
3676 	int len;
3677 	struct nameidata named;
3678 	vnode_t dirp = NULL, vp;
3679 	struct nfsrvfh fh;
3680 	struct nfsexstuff retnes;
3681 	u_int32_t *sizp;
3682 	int error = 0, i;
3683 	uint64_t savflag;
3684 	char *bufp;
3685 	u_long *hashp;
3686 	struct thread *p = curthread;
3687 
3688 	/*
3689 	 * All this just to get the export flags for the name.
3690 	 */
3691 	NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
3692 	    LOCKLEAF | SAVESTART);
3693 	nfsvno_setpathbuf(&named, &bufp, &hashp);
3694 	error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
3695 	if (error) {
3696 		vput(dp);
3697 		nfsvno_relpathbuf(&named);
3698 		goto out;
3699 	}
3700 	if (!nd->nd_repstat) {
3701 		nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, &dirp);
3702 	} else {
3703 		vput(dp);
3704 		nfsvno_relpathbuf(&named);
3705 	}
3706 	if (dirp)
3707 		vrele(dirp);
3708 	if (nd->nd_repstat)
3709 		goto out;
3710 	vrele(named.ni_startdir);
3711 	nfsvno_relpathbuf(&named);
3712 	fh.nfsrvfh_len = NFSX_MYFH;
3713 	vp = named.ni_vp;
3714 	nd->nd_repstat = nfsvno_getfh(vp, (fhandle_t *)fh.nfsrvfh_data, p);
3715 	vput(vp);
3716 	savflag = nd->nd_flag;
3717 	if (!nd->nd_repstat) {
3718 		/*
3719 		 * Pretend the next op is Secinfo, so that no wrongsec
3720 		 * test will be done.
3721 		 */
3722 		nfsd_fhtovp(nd, &fh, LK_SHARED, &vp, &retnes, NULL, 0,
3723 		    NFSV4OP_SECINFO);
3724 		if (vp)
3725 			vput(vp);
3726 	}
3727 	nd->nd_flag = savflag;
3728 	if (nd->nd_repstat)
3729 		goto out;
3730 
3731 	/*
3732 	 * Finally have the export flags for name, so we can create
3733 	 * the security info.
3734 	 */
3735 	len = 0;
3736 	NFSM_BUILD(sizp, u_int32_t *, NFSX_UNSIGNED);
3737 
3738 	/* If nes_numsecflavor == 0, all are allowed. */
3739 	if (retnes.nes_numsecflavor == 0) {
3740 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3741 		*tl++ = txdr_unsigned(RPCAUTH_UNIX);
3742 		*tl = txdr_unsigned(RPCAUTH_GSS);
3743 		nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3744 		    nfsgss_mechlist[KERBV_MECH].len);
3745 		NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
3746 		*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3747 		*tl++ = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3748 		*tl = txdr_unsigned(RPCAUTH_GSS);
3749 		nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3750 		    nfsgss_mechlist[KERBV_MECH].len);
3751 		NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
3752 		*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3753 		*tl++ = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3754 		*tl = txdr_unsigned(RPCAUTH_GSS);
3755 		nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3756 		    nfsgss_mechlist[KERBV_MECH].len);
3757 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3758 		*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3759 		*tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3760 		len = 4;
3761 	}
3762 	for (i = 0; i < retnes.nes_numsecflavor; i++) {
3763 		if (retnes.nes_secflavors[i] == AUTH_SYS) {
3764 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3765 			*tl = txdr_unsigned(RPCAUTH_UNIX);
3766 			len++;
3767 		} else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5) {
3768 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3769 			*tl++ = txdr_unsigned(RPCAUTH_GSS);
3770 			(void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3771 			    nfsgss_mechlist[KERBV_MECH].len);
3772 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3773 			*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3774 			*tl = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3775 			len++;
3776 		} else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5I) {
3777 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3778 			*tl++ = txdr_unsigned(RPCAUTH_GSS);
3779 			(void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3780 			    nfsgss_mechlist[KERBV_MECH].len);
3781 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3782 			*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3783 			*tl = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3784 			len++;
3785 		} else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5P) {
3786 			NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3787 			*tl++ = txdr_unsigned(RPCAUTH_GSS);
3788 			(void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3789 			    nfsgss_mechlist[KERBV_MECH].len);
3790 			NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3791 			*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3792 			*tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3793 			len++;
3794 		}
3795 	}
3796 	*sizp = txdr_unsigned(len);
3797 
3798 out:
3799 	NFSEXITCODE2(error, nd);
3800 	return (error);
3801 }
3802 
3803 /*
3804  * nfsv4 security info no name service
3805  */
3806 int
3807 nfsrvd_secinfononame(struct nfsrv_descript *nd, int isdgram,
3808     vnode_t dp, struct nfsexstuff *exp)
3809 {
3810 	uint32_t *tl, *sizp;
3811 	struct nameidata named;
3812 	vnode_t dirp = NULL, vp;
3813 	struct nfsrvfh fh;
3814 	struct nfsexstuff retnes;
3815 	int error = 0, fhstyle, i, len;
3816 	uint64_t savflag;
3817 	char *bufp;
3818 	u_long *hashp;
3819 	struct thread *p = curthread;
3820 
3821 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
3822 	fhstyle = fxdr_unsigned(int, *tl);
3823 	switch (fhstyle) {
3824 	case NFSSECINFONONAME_PARENT:
3825 		NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
3826 		    LOCKLEAF | SAVESTART);
3827 		nfsvno_setpathbuf(&named, &bufp, &hashp);
3828 		error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
3829 		if (error != 0) {
3830 			vput(dp);
3831 			nfsvno_relpathbuf(&named);
3832 			goto nfsmout;
3833 		}
3834 		if (nd->nd_repstat == 0)
3835 			nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, &dirp);
3836 		else
3837 			vput(dp);
3838 		if (dirp != NULL)
3839 			vrele(dirp);
3840 		vrele(named.ni_startdir);
3841 		nfsvno_relpathbuf(&named);
3842 		vp = named.ni_vp;
3843 		break;
3844 	case NFSSECINFONONAME_CURFH:
3845 		vp = dp;
3846 		break;
3847 	default:
3848 		nd->nd_repstat = NFSERR_INVAL;
3849 		vput(dp);
3850 	}
3851 	if (nd->nd_repstat != 0)
3852 		goto nfsmout;
3853 	fh.nfsrvfh_len = NFSX_MYFH;
3854 	nd->nd_repstat = nfsvno_getfh(vp, (fhandle_t *)fh.nfsrvfh_data, p);
3855 	vput(vp);
3856 	savflag = nd->nd_flag;
3857 	if (nd->nd_repstat == 0) {
3858 		/*
3859 		 * Pretend the next op is Secinfo, so that no wrongsec
3860 		 * test will be done.
3861 		 */
3862 		nfsd_fhtovp(nd, &fh, LK_SHARED, &vp, &retnes, NULL, 0,
3863 		    NFSV4OP_SECINFO);
3864 		if (vp != NULL)
3865 			vput(vp);
3866 	}
3867 	nd->nd_flag = savflag;
3868 	if (nd->nd_repstat != 0)
3869 		goto nfsmout;
3870 
3871 	/*
3872 	 * Finally have the export flags for fh/parent, so we can create
3873 	 * the security info.
3874 	 */
3875 	len = 0;
3876 	NFSM_BUILD(sizp, uint32_t *, NFSX_UNSIGNED);
3877 
3878 	/* If nes_numsecflavor == 0, all are allowed. */
3879 	if (retnes.nes_numsecflavor == 0) {
3880 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3881 		*tl++ = txdr_unsigned(RPCAUTH_UNIX);
3882 		*tl = txdr_unsigned(RPCAUTH_GSS);
3883 		nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3884 		    nfsgss_mechlist[KERBV_MECH].len);
3885 		NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
3886 		*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3887 		*tl++ = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3888 		*tl = txdr_unsigned(RPCAUTH_GSS);
3889 		nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3890 		    nfsgss_mechlist[KERBV_MECH].len);
3891 		NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
3892 		*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3893 		*tl++ = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3894 		*tl = txdr_unsigned(RPCAUTH_GSS);
3895 		nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3896 		    nfsgss_mechlist[KERBV_MECH].len);
3897 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3898 		*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3899 		*tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3900 		len = 4;
3901 	}
3902 	for (i = 0; i < retnes.nes_numsecflavor; i++) {
3903 		if (retnes.nes_secflavors[i] == AUTH_SYS) {
3904 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
3905 			*tl = txdr_unsigned(RPCAUTH_UNIX);
3906 			len++;
3907 		} else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5) {
3908 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
3909 			*tl = txdr_unsigned(RPCAUTH_GSS);
3910 			nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3911 			    nfsgss_mechlist[KERBV_MECH].len);
3912 			NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3913 			*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3914 			*tl = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3915 			len++;
3916 		} else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5I) {
3917 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
3918 			*tl = txdr_unsigned(RPCAUTH_GSS);
3919 			nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3920 			    nfsgss_mechlist[KERBV_MECH].len);
3921 			NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3922 			*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3923 			*tl = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3924 			len++;
3925 		} else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5P) {
3926 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
3927 			*tl = txdr_unsigned(RPCAUTH_GSS);
3928 			nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3929 			    nfsgss_mechlist[KERBV_MECH].len);
3930 			NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3931 			*tl++ = txdr_unsigned(GSS_KERBV_QOP);
3932 			*tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3933 			len++;
3934 		}
3935 	}
3936 	*sizp = txdr_unsigned(len);
3937 
3938 nfsmout:
3939 	NFSEXITCODE2(error, nd);
3940 	return (error);
3941 }
3942 
3943 /*
3944  * nfsv4 set client id service
3945  */
3946 int
3947 nfsrvd_setclientid(struct nfsrv_descript *nd, __unused int isdgram,
3948     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3949 {
3950 	u_int32_t *tl;
3951 	int i;
3952 	int error = 0, idlen;
3953 	struct nfsclient *clp = NULL;
3954 #ifdef INET
3955 	struct sockaddr_in *rin;
3956 #endif
3957 #ifdef INET6
3958 	struct sockaddr_in6 *rin6;
3959 #endif
3960 #if defined(INET) || defined(INET6)
3961 	u_char *ucp, *ucp2;
3962 #endif
3963 	u_char *verf, *addrbuf;
3964 	nfsquad_t clientid, confirm;
3965 	struct thread *p = curthread;
3966 
3967 	if ((nd->nd_flag & ND_NFSV41) != 0) {
3968 		nd->nd_repstat = NFSERR_NOTSUPP;
3969 		goto nfsmout;
3970 	}
3971 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
3972 		goto out;
3973 	NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF + NFSX_UNSIGNED);
3974 	verf = (u_char *)tl;
3975 	tl += (NFSX_VERF / NFSX_UNSIGNED);
3976 	i = fxdr_unsigned(int, *tl);
3977 	if (i > NFSV4_OPAQUELIMIT || i <= 0) {
3978 		nd->nd_repstat = NFSERR_BADXDR;
3979 		goto nfsmout;
3980 	}
3981 	idlen = i;
3982 	if (nd->nd_flag & ND_GSS)
3983 		i += nd->nd_princlen;
3984 	clp = malloc(sizeof(struct nfsclient) + i, M_NFSDCLIENT, M_WAITOK |
3985 	    M_ZERO);
3986 	clp->lc_stateid = malloc(sizeof(struct nfsstatehead) *
3987 	    nfsrv_statehashsize, M_NFSDCLIENT, M_WAITOK);
3988 	NFSINITSOCKMUTEX(&clp->lc_req.nr_mtx);
3989 	/* Allocated large enough for an AF_INET or AF_INET6 socket. */
3990 	clp->lc_req.nr_nam = malloc(sizeof(struct sockaddr_in6), M_SONAME,
3991 	    M_WAITOK | M_ZERO);
3992 	clp->lc_req.nr_cred = NULL;
3993 	NFSBCOPY(verf, clp->lc_verf, NFSX_VERF);
3994 	clp->lc_idlen = idlen;
3995 	error = nfsrv_mtostr(nd, clp->lc_id, idlen);
3996 	if (error)
3997 		goto nfsmout;
3998 	if (nd->nd_flag & ND_GSS) {
3999 		clp->lc_flags = LCL_GSS;
4000 		if (nd->nd_flag & ND_GSSINTEGRITY)
4001 			clp->lc_flags |= LCL_GSSINTEGRITY;
4002 		else if (nd->nd_flag & ND_GSSPRIVACY)
4003 			clp->lc_flags |= LCL_GSSPRIVACY;
4004 	} else {
4005 		clp->lc_flags = 0;
4006 	}
4007 	if ((nd->nd_flag & ND_GSS) && nd->nd_princlen > 0) {
4008 		clp->lc_flags |= LCL_NAME;
4009 		clp->lc_namelen = nd->nd_princlen;
4010 		clp->lc_name = &clp->lc_id[idlen];
4011 		NFSBCOPY(nd->nd_principal, clp->lc_name, clp->lc_namelen);
4012 	} else {
4013 		clp->lc_uid = nd->nd_cred->cr_uid;
4014 		clp->lc_gid = nd->nd_cred->cr_gid;
4015 	}
4016 
4017 	/* If the client is using TLS, do so for the callback connection. */
4018 	if (nd->nd_flag & ND_TLS)
4019 		clp->lc_flags |= LCL_TLSCB;
4020 
4021 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4022 	clp->lc_program = fxdr_unsigned(u_int32_t, *tl);
4023 	error = nfsrv_getclientipaddr(nd, clp);
4024 	if (error)
4025 		goto nfsmout;
4026 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4027 	clp->lc_callback = fxdr_unsigned(u_int32_t, *tl);
4028 
4029 	/*
4030 	 * nfsrv_setclient() does the actual work of adding it to the
4031 	 * client list. If there is no error, the structure has been
4032 	 * linked into the client list and clp should no longer be used
4033 	 * here. When an error is returned, it has not been linked in,
4034 	 * so it should be free'd.
4035 	 */
4036 	nd->nd_repstat = nfsrv_setclient(nd, &clp, &clientid, &confirm, p);
4037 	if (nd->nd_repstat == NFSERR_CLIDINUSE) {
4038 		/*
4039 		 * 8 is the maximum length of the port# string.
4040 		 */
4041 		addrbuf = malloc(INET6_ADDRSTRLEN + 8, M_TEMP, M_WAITOK);
4042 		switch (clp->lc_req.nr_nam->sa_family) {
4043 #ifdef INET
4044 		case AF_INET:
4045 			if (clp->lc_flags & LCL_TCPCALLBACK)
4046 				(void) nfsm_strtom(nd, "tcp", 3);
4047 			else
4048 				(void) nfsm_strtom(nd, "udp", 3);
4049 			rin = (struct sockaddr_in *)clp->lc_req.nr_nam;
4050 			ucp = (u_char *)&rin->sin_addr.s_addr;
4051 			ucp2 = (u_char *)&rin->sin_port;
4052 			sprintf(addrbuf, "%d.%d.%d.%d.%d.%d", ucp[0] & 0xff,
4053 			    ucp[1] & 0xff, ucp[2] & 0xff, ucp[3] & 0xff,
4054 			    ucp2[0] & 0xff, ucp2[1] & 0xff);
4055 			break;
4056 #endif
4057 #ifdef INET6
4058 		case AF_INET6:
4059 			if (clp->lc_flags & LCL_TCPCALLBACK)
4060 				(void) nfsm_strtom(nd, "tcp6", 4);
4061 			else
4062 				(void) nfsm_strtom(nd, "udp6", 4);
4063 			rin6 = (struct sockaddr_in6 *)clp->lc_req.nr_nam;
4064 			ucp = inet_ntop(AF_INET6, &rin6->sin6_addr, addrbuf,
4065 			    INET6_ADDRSTRLEN);
4066 			if (ucp != NULL)
4067 				i = strlen(ucp);
4068 			else
4069 				i = 0;
4070 			ucp2 = (u_char *)&rin6->sin6_port;
4071 			sprintf(&addrbuf[i], ".%d.%d", ucp2[0] & 0xff,
4072 			    ucp2[1] & 0xff);
4073 			break;
4074 #endif
4075 		}
4076 		(void) nfsm_strtom(nd, addrbuf, strlen(addrbuf));
4077 		free(addrbuf, M_TEMP);
4078 	}
4079 	if (clp) {
4080 		free(clp->lc_req.nr_nam, M_SONAME);
4081 		NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4082 		free(clp->lc_stateid, M_NFSDCLIENT);
4083 		free(clp, M_NFSDCLIENT);
4084 	}
4085 	if (!nd->nd_repstat) {
4086 		NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_HYPER);
4087 		*tl++ = clientid.lval[0];
4088 		*tl++ = clientid.lval[1];
4089 		*tl++ = confirm.lval[0];
4090 		*tl = confirm.lval[1];
4091 	}
4092 
4093 out:
4094 	NFSEXITCODE2(0, nd);
4095 	return (0);
4096 nfsmout:
4097 	if (clp) {
4098 		free(clp->lc_req.nr_nam, M_SONAME);
4099 		NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4100 		free(clp->lc_stateid, M_NFSDCLIENT);
4101 		free(clp, M_NFSDCLIENT);
4102 	}
4103 	NFSEXITCODE2(error, nd);
4104 	return (error);
4105 }
4106 
4107 /*
4108  * nfsv4 set client id confirm service
4109  */
4110 int
4111 nfsrvd_setclientidcfrm(struct nfsrv_descript *nd,
4112     __unused int isdgram, __unused vnode_t vp,
4113     __unused struct nfsexstuff *exp)
4114 {
4115 	u_int32_t *tl;
4116 	int error = 0;
4117 	nfsquad_t clientid, confirm;
4118 	struct thread *p = curthread;
4119 
4120 	if ((nd->nd_flag & ND_NFSV41) != 0) {
4121 		nd->nd_repstat = NFSERR_NOTSUPP;
4122 		goto nfsmout;
4123 	}
4124 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4125 		goto nfsmout;
4126 	NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_HYPER);
4127 	clientid.lval[0] = *tl++;
4128 	clientid.lval[1] = *tl++;
4129 	confirm.lval[0] = *tl++;
4130 	confirm.lval[1] = *tl;
4131 
4132 	/*
4133 	 * nfsrv_getclient() searches the client list for a match and
4134 	 * returns the appropriate NFSERR status.
4135 	 */
4136 	nd->nd_repstat = nfsrv_getclient(clientid, (CLOPS_CONFIRM|CLOPS_RENEW),
4137 	    NULL, NULL, confirm, 0, nd, p);
4138 nfsmout:
4139 	NFSEXITCODE2(error, nd);
4140 	return (error);
4141 }
4142 
4143 /*
4144  * nfsv4 verify service
4145  */
4146 int
4147 nfsrvd_verify(struct nfsrv_descript *nd, int isdgram,
4148     vnode_t vp, __unused struct nfsexstuff *exp)
4149 {
4150 	int error = 0, ret, fhsize = NFSX_MYFH;
4151 	struct nfsvattr nva;
4152 	struct statfs *sf;
4153 	struct nfsfsinfo fs;
4154 	fhandle_t fh;
4155 	struct thread *p = curthread;
4156 
4157 	sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
4158 	nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
4159 	if (!nd->nd_repstat)
4160 		nd->nd_repstat = nfsvno_statfs(vp, sf);
4161 	if (!nd->nd_repstat)
4162 		nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
4163 	if (!nd->nd_repstat) {
4164 		nfsvno_getfs(&fs, isdgram);
4165 		error = nfsv4_loadattr(nd, vp, &nva, NULL, &fh, fhsize, NULL,
4166 		    sf, NULL, &fs, NULL, 1, &ret, NULL, NULL, p, nd->nd_cred);
4167 		if (!error) {
4168 			if (nd->nd_procnum == NFSV4OP_NVERIFY) {
4169 				if (ret == 0)
4170 					nd->nd_repstat = NFSERR_SAME;
4171 				else if (ret != NFSERR_NOTSAME)
4172 					nd->nd_repstat = ret;
4173 			} else if (ret)
4174 				nd->nd_repstat = ret;
4175 		}
4176 	}
4177 	vput(vp);
4178 	free(sf, M_STATFS);
4179 	NFSEXITCODE2(error, nd);
4180 	return (error);
4181 }
4182 
4183 /*
4184  * nfs openattr rpc
4185  */
4186 int
4187 nfsrvd_openattr(struct nfsrv_descript *nd, __unused int isdgram,
4188     vnode_t dp, __unused vnode_t *vpp, __unused fhandle_t *fhp,
4189     __unused struct nfsexstuff *exp)
4190 {
4191 	u_int32_t *tl;
4192 	int error = 0, createdir __unused;
4193 
4194 	NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4195 	createdir = fxdr_unsigned(int, *tl);
4196 	nd->nd_repstat = NFSERR_NOTSUPP;
4197 nfsmout:
4198 	vrele(dp);
4199 	NFSEXITCODE2(error, nd);
4200 	return (error);
4201 }
4202 
4203 /*
4204  * nfsv4 release lock owner service
4205  */
4206 int
4207 nfsrvd_releaselckown(struct nfsrv_descript *nd, __unused int isdgram,
4208     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4209 {
4210 	u_int32_t *tl;
4211 	struct nfsstate *stp = NULL;
4212 	int error = 0, len;
4213 	nfsquad_t clientid;
4214 	struct thread *p = curthread;
4215 
4216 	if ((nd->nd_flag & ND_NFSV41) != 0) {
4217 		nd->nd_repstat = NFSERR_NOTSUPP;
4218 		goto nfsmout;
4219 	}
4220 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4221 		goto nfsmout;
4222 	NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
4223 	len = fxdr_unsigned(int, *(tl + 2));
4224 	if (len <= 0 || len > NFSV4_OPAQUELIMIT) {
4225 		nd->nd_repstat = NFSERR_BADXDR;
4226 		goto nfsmout;
4227 	}
4228 	stp = malloc(sizeof (struct nfsstate) + len,
4229 	    M_NFSDSTATE, M_WAITOK);
4230 	stp->ls_ownerlen = len;
4231 	stp->ls_op = NULL;
4232 	stp->ls_flags = NFSLCK_RELEASE;
4233 	stp->ls_uid = nd->nd_cred->cr_uid;
4234 	clientid.lval[0] = *tl++;
4235 	clientid.lval[1] = *tl;
4236 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
4237 		if ((nd->nd_flag & ND_NFSV41) != 0)
4238 			clientid.qval = nd->nd_clientid.qval;
4239 		else if (nd->nd_clientid.qval != clientid.qval)
4240 			printf("EEK14 multiple clids\n");
4241 	} else {
4242 		if ((nd->nd_flag & ND_NFSV41) != 0)
4243 			printf("EEK! no clientid from session\n");
4244 		nd->nd_flag |= ND_IMPLIEDCLID;
4245 		nd->nd_clientid.qval = clientid.qval;
4246 	}
4247 	error = nfsrv_mtostr(nd, stp->ls_owner, len);
4248 	if (error)
4249 		goto nfsmout;
4250 	nd->nd_repstat = nfsrv_releaselckown(stp, clientid, p);
4251 	free(stp, M_NFSDSTATE);
4252 
4253 	NFSEXITCODE2(0, nd);
4254 	return (0);
4255 nfsmout:
4256 	if (stp)
4257 		free(stp, M_NFSDSTATE);
4258 	NFSEXITCODE2(error, nd);
4259 	return (error);
4260 }
4261 
4262 /*
4263  * nfsv4 exchange_id service
4264  */
4265 int
4266 nfsrvd_exchangeid(struct nfsrv_descript *nd, __unused int isdgram,
4267     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4268 {
4269 	uint32_t *tl;
4270 	int error = 0, i, idlen;
4271 	struct nfsclient *clp = NULL;
4272 	nfsquad_t clientid, confirm;
4273 	uint8_t *verf;
4274 	uint32_t sp4type, v41flags;
4275 	struct timespec verstime;
4276 #ifdef INET
4277 	struct sockaddr_in *sin, *rin;
4278 #endif
4279 #ifdef INET6
4280 	struct sockaddr_in6 *sin6, *rin6;
4281 #endif
4282 	struct thread *p = curthread;
4283 	char *s;
4284 
4285 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4286 		goto nfsmout;
4287 	NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF + NFSX_UNSIGNED);
4288 	verf = (uint8_t *)tl;
4289 	tl += (NFSX_VERF / NFSX_UNSIGNED);
4290 	i = fxdr_unsigned(int, *tl);
4291 	if (i > NFSV4_OPAQUELIMIT || i <= 0) {
4292 		nd->nd_repstat = NFSERR_BADXDR;
4293 		goto nfsmout;
4294 	}
4295 	idlen = i;
4296 	if (nd->nd_flag & ND_GSS)
4297 		i += nd->nd_princlen;
4298 	clp = malloc(sizeof(struct nfsclient) + i, M_NFSDCLIENT, M_WAITOK |
4299 	    M_ZERO);
4300 	clp->lc_stateid = malloc(sizeof(struct nfsstatehead) *
4301 	    nfsrv_statehashsize, M_NFSDCLIENT, M_WAITOK);
4302 	NFSINITSOCKMUTEX(&clp->lc_req.nr_mtx);
4303 	/* Allocated large enough for an AF_INET or AF_INET6 socket. */
4304 	clp->lc_req.nr_nam = malloc(sizeof(struct sockaddr_in6), M_SONAME,
4305 	    M_WAITOK | M_ZERO);
4306 	switch (nd->nd_nam->sa_family) {
4307 #ifdef INET
4308 	case AF_INET:
4309 		rin = (struct sockaddr_in *)clp->lc_req.nr_nam;
4310 		sin = (struct sockaddr_in *)nd->nd_nam;
4311 		rin->sin_family = AF_INET;
4312 		rin->sin_len = sizeof(struct sockaddr_in);
4313 		rin->sin_port = 0;
4314 		rin->sin_addr.s_addr = sin->sin_addr.s_addr;
4315 		break;
4316 #endif
4317 #ifdef INET6
4318 	case AF_INET6:
4319 		rin6 = (struct sockaddr_in6 *)clp->lc_req.nr_nam;
4320 		sin6 = (struct sockaddr_in6 *)nd->nd_nam;
4321 		rin6->sin6_family = AF_INET6;
4322 		rin6->sin6_len = sizeof(struct sockaddr_in6);
4323 		rin6->sin6_port = 0;
4324 		rin6->sin6_addr = sin6->sin6_addr;
4325 		break;
4326 #endif
4327 	}
4328 	clp->lc_req.nr_cred = NULL;
4329 	NFSBCOPY(verf, clp->lc_verf, NFSX_VERF);
4330 	clp->lc_idlen = idlen;
4331 	error = nfsrv_mtostr(nd, clp->lc_id, idlen);
4332 	if (error != 0)
4333 		goto nfsmout;
4334 	if ((nd->nd_flag & ND_GSS) != 0) {
4335 		clp->lc_flags = LCL_GSS | LCL_NFSV41;
4336 		if ((nd->nd_flag & ND_GSSINTEGRITY) != 0)
4337 			clp->lc_flags |= LCL_GSSINTEGRITY;
4338 		else if ((nd->nd_flag & ND_GSSPRIVACY) != 0)
4339 			clp->lc_flags |= LCL_GSSPRIVACY;
4340 	} else
4341 		clp->lc_flags = LCL_NFSV41;
4342 	if ((nd->nd_flag & ND_NFSV42) != 0)
4343 		clp->lc_flags |= LCL_NFSV42;
4344 	if ((nd->nd_flag & ND_GSS) != 0 && nd->nd_princlen > 0) {
4345 		clp->lc_flags |= LCL_NAME;
4346 		clp->lc_namelen = nd->nd_princlen;
4347 		clp->lc_name = &clp->lc_id[idlen];
4348 		NFSBCOPY(nd->nd_principal, clp->lc_name, clp->lc_namelen);
4349 	} else {
4350 		clp->lc_uid = nd->nd_cred->cr_uid;
4351 		clp->lc_gid = nd->nd_cred->cr_gid;
4352 	}
4353 	NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
4354 	v41flags = fxdr_unsigned(uint32_t, *tl++);
4355 	if ((v41flags & ~(NFSV4EXCH_SUPPMOVEDREFER | NFSV4EXCH_SUPPMOVEDMIGR |
4356 	    NFSV4EXCH_BINDPRINCSTATEID | NFSV4EXCH_MASKPNFS |
4357 	    NFSV4EXCH_UPDCONFIRMEDRECA)) != 0) {
4358 		nd->nd_repstat = NFSERR_INVAL;
4359 		goto nfsmout;
4360 	}
4361 	if ((v41flags & NFSV4EXCH_UPDCONFIRMEDRECA) != 0)
4362 		confirm.lval[1] = 1;
4363 	else
4364 		confirm.lval[1] = 0;
4365 	if (nfsrv_devidcnt == 0)
4366 		v41flags = NFSV4EXCH_USENONPNFS | NFSV4EXCH_USEPNFSDS;
4367  	else
4368  		v41flags = NFSV4EXCH_USEPNFSMDS;
4369 	sp4type = fxdr_unsigned(uint32_t, *tl);
4370 	if (sp4type != NFSV4EXCH_SP4NONE) {
4371 		nd->nd_repstat = NFSERR_NOTSUPP;
4372 		goto nfsmout;
4373 	}
4374 
4375 	/*
4376 	 * nfsrv_setclient() does the actual work of adding it to the
4377 	 * client list. If there is no error, the structure has been
4378 	 * linked into the client list and clp should no longer be used
4379 	 * here. When an error is returned, it has not been linked in,
4380 	 * so it should be free'd.
4381 	 */
4382 	nd->nd_repstat = nfsrv_setclient(nd, &clp, &clientid, &confirm, p);
4383 	if (clp != NULL) {
4384 		free(clp->lc_req.nr_nam, M_SONAME);
4385 		NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4386 		free(clp->lc_stateid, M_NFSDCLIENT);
4387 		free(clp, M_NFSDCLIENT);
4388 	}
4389 	if (nd->nd_repstat == 0) {
4390 		if (confirm.lval[1] != 0)
4391 			v41flags |= NFSV4EXCH_CONFIRMEDR;
4392 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + 3 * NFSX_UNSIGNED);
4393 		*tl++ = clientid.lval[0];			/* ClientID */
4394 		*tl++ = clientid.lval[1];
4395 		*tl++ = txdr_unsigned(confirm.lval[0]);		/* SequenceID */
4396 		*tl++ = txdr_unsigned(v41flags);		/* Exch flags */
4397 		*tl++ = txdr_unsigned(NFSV4EXCH_SP4NONE);	/* No SSV */
4398 		txdr_hyper(nfsrv_owner_minor, tl);	/* Owner Minor */
4399 		if (nfsrv_owner_major[0] != 0)
4400 			s = nfsrv_owner_major;
4401 		else
4402 			s = nd->nd_cred->cr_prison->pr_hostuuid;
4403 		nfsm_strtom(nd, s, strlen(s));		/* Owner Major */
4404 		if (nfsrv_scope[0] != 0)
4405 			s = nfsrv_scope;
4406 		else
4407 			s = nd->nd_cred->cr_prison->pr_hostuuid;
4408 		nfsm_strtom(nd, s, strlen(s)	);		/* Scope */
4409 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4410 		*tl = txdr_unsigned(1);
4411 		(void)nfsm_strtom(nd, "freebsd.org", strlen("freebsd.org"));
4412 		(void)nfsm_strtom(nd, version, strlen(version));
4413 		NFSM_BUILD(tl, uint32_t *, NFSX_V4TIME);
4414 		verstime.tv_sec = 1293840000;		/* Jan 1, 2011 */
4415 		verstime.tv_nsec = 0;
4416 		txdr_nfsv4time(&verstime, tl);
4417 	}
4418 	NFSEXITCODE2(0, nd);
4419 	return (0);
4420 nfsmout:
4421 	if (clp != NULL) {
4422 		free(clp->lc_req.nr_nam, M_SONAME);
4423 		NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4424 		free(clp->lc_stateid, M_NFSDCLIENT);
4425 		free(clp, M_NFSDCLIENT);
4426 	}
4427 	NFSEXITCODE2(error, nd);
4428 	return (error);
4429 }
4430 
4431 /*
4432  * nfsv4 create session service
4433  */
4434 int
4435 nfsrvd_createsession(struct nfsrv_descript *nd, __unused int isdgram,
4436     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4437 {
4438 	uint32_t *tl;
4439 	int error = 0;
4440 	nfsquad_t clientid, confirm;
4441 	struct nfsdsession *sep = NULL;
4442 	uint32_t rdmacnt;
4443 	struct thread *p = curthread;
4444 	static bool do_printf = true;
4445 
4446 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4447 		goto nfsmout;
4448 	sep = (struct nfsdsession *)malloc(sizeof(struct nfsdsession),
4449 	    M_NFSDSESSION, M_WAITOK | M_ZERO);
4450 	sep->sess_refcnt = 1;
4451 	mtx_init(&sep->sess_cbsess.nfsess_mtx, "nfscbsession", NULL, MTX_DEF);
4452 	NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + 2 * NFSX_UNSIGNED);
4453 	clientid.lval[0] = *tl++;
4454 	clientid.lval[1] = *tl++;
4455 	confirm.lval[0] = fxdr_unsigned(uint32_t, *tl++);
4456 	sep->sess_crflags = fxdr_unsigned(uint32_t, *tl);
4457 	/* Persistent sessions and RDMA are not supported. */
4458 	sep->sess_crflags &= NFSV4CRSESS_CONNBACKCHAN;
4459 
4460 	/* Fore channel attributes. */
4461 	NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
4462 	tl++;					/* Header pad always 0. */
4463 	sep->sess_maxreq = fxdr_unsigned(uint32_t, *tl++);
4464 	if (sep->sess_maxreq > sb_max_adj - NFS_MAXXDR) {
4465 		sep->sess_maxreq = sb_max_adj - NFS_MAXXDR;
4466 		if (do_printf)
4467 			printf("Consider increasing kern.ipc.maxsockbuf\n");
4468 		do_printf = false;
4469 	}
4470 	sep->sess_maxresp = fxdr_unsigned(uint32_t, *tl++);
4471 	if (sep->sess_maxresp > sb_max_adj - NFS_MAXXDR) {
4472 		sep->sess_maxresp = sb_max_adj - NFS_MAXXDR;
4473 		if (do_printf)
4474 			printf("Consider increasing kern.ipc.maxsockbuf\n");
4475 		do_printf = false;
4476 	}
4477 	sep->sess_maxrespcached = fxdr_unsigned(uint32_t, *tl++);
4478 	sep->sess_maxops = fxdr_unsigned(uint32_t, *tl++);
4479 	sep->sess_maxslots = fxdr_unsigned(uint32_t, *tl++);
4480 	if (sep->sess_maxslots > NFSV4_SLOTS)
4481 		sep->sess_maxslots = NFSV4_SLOTS;
4482 	rdmacnt = fxdr_unsigned(uint32_t, *tl);
4483 	if (rdmacnt > 1) {
4484 		nd->nd_repstat = NFSERR_BADXDR;
4485 		goto nfsmout;
4486 	} else if (rdmacnt == 1)
4487 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4488 
4489 	/* Back channel attributes. */
4490 	NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
4491 	tl++;					/* Header pad always 0. */
4492 	sep->sess_cbmaxreq = fxdr_unsigned(uint32_t, *tl++);
4493 	sep->sess_cbmaxresp = fxdr_unsigned(uint32_t, *tl++);
4494 	sep->sess_cbmaxrespcached = fxdr_unsigned(uint32_t, *tl++);
4495 	sep->sess_cbmaxops = fxdr_unsigned(uint32_t, *tl++);
4496 	sep->sess_cbsess.nfsess_foreslots = fxdr_unsigned(uint32_t, *tl++);
4497 	rdmacnt = fxdr_unsigned(uint32_t, *tl);
4498 	if (rdmacnt > 1) {
4499 		nd->nd_repstat = NFSERR_BADXDR;
4500 		goto nfsmout;
4501 	} else if (rdmacnt == 1)
4502 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4503 
4504 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4505 	sep->sess_cbprogram = fxdr_unsigned(uint32_t, *tl);
4506 
4507 	/*
4508 	 * nfsrv_getclient() searches the client list for a match and
4509 	 * returns the appropriate NFSERR status.
4510 	 */
4511 	nd->nd_repstat = nfsrv_getclient(clientid, CLOPS_CONFIRM | CLOPS_RENEW,
4512 	    NULL, sep, confirm, sep->sess_cbprogram, nd, p);
4513 	if (nd->nd_repstat == 0) {
4514 		NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
4515 		NFSBCOPY(sep->sess_sessionid, tl, NFSX_V4SESSIONID);
4516 		NFSM_BUILD(tl, uint32_t *, 18 * NFSX_UNSIGNED);
4517 		*tl++ = txdr_unsigned(confirm.lval[0]);	/* sequenceid */
4518 		*tl++ = txdr_unsigned(sep->sess_crflags);
4519 
4520 		/* Fore channel attributes. */
4521 		*tl++ = 0;
4522 		*tl++ = txdr_unsigned(sep->sess_maxreq);
4523 		*tl++ = txdr_unsigned(sep->sess_maxresp);
4524 		*tl++ = txdr_unsigned(sep->sess_maxrespcached);
4525 		*tl++ = txdr_unsigned(sep->sess_maxops);
4526 		*tl++ = txdr_unsigned(sep->sess_maxslots);
4527 		*tl++ = txdr_unsigned(1);
4528 		*tl++ = txdr_unsigned(0);			/* No RDMA. */
4529 
4530 		/* Back channel attributes. */
4531 		*tl++ = 0;
4532 		*tl++ = txdr_unsigned(sep->sess_cbmaxreq);
4533 		*tl++ = txdr_unsigned(sep->sess_cbmaxresp);
4534 		*tl++ = txdr_unsigned(sep->sess_cbmaxrespcached);
4535 		*tl++ = txdr_unsigned(sep->sess_cbmaxops);
4536 		*tl++ = txdr_unsigned(sep->sess_cbsess.nfsess_foreslots);
4537 		*tl++ = txdr_unsigned(1);
4538 		*tl = txdr_unsigned(0);			/* No RDMA. */
4539 	}
4540 nfsmout:
4541 	if (nd->nd_repstat != 0 && sep != NULL)
4542 		free(sep, M_NFSDSESSION);
4543 	NFSEXITCODE2(error, nd);
4544 	return (error);
4545 }
4546 
4547 /*
4548  * nfsv4 sequence service
4549  */
4550 int
4551 nfsrvd_sequence(struct nfsrv_descript *nd, __unused int isdgram,
4552     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4553 {
4554 	uint32_t *tl;
4555 	uint32_t highest_slotid, sequenceid, sflags, target_highest_slotid;
4556 	int cache_this, error = 0;
4557 	struct thread *p = curthread;
4558 
4559 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4560 		goto nfsmout;
4561 	NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID);
4562 	NFSBCOPY(tl, nd->nd_sessionid, NFSX_V4SESSIONID);
4563 	NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED);
4564 	sequenceid = fxdr_unsigned(uint32_t, *tl++);
4565 	nd->nd_slotid = fxdr_unsigned(uint32_t, *tl++);
4566 	highest_slotid = fxdr_unsigned(uint32_t, *tl++);
4567 	if (*tl == newnfs_true)
4568 		cache_this = 1;
4569 	else
4570 		cache_this = 0;
4571 	nd->nd_repstat = nfsrv_checksequence(nd, sequenceid, &highest_slotid,
4572 	    &target_highest_slotid, cache_this, &sflags, p);
4573 	if (nd->nd_repstat != NFSERR_BADSLOT)
4574 		nd->nd_flag |= ND_HASSEQUENCE;
4575 	if (nd->nd_repstat == 0) {
4576 		NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
4577 		NFSBCOPY(nd->nd_sessionid, tl, NFSX_V4SESSIONID);
4578 		NFSM_BUILD(tl, uint32_t *, 5 * NFSX_UNSIGNED);
4579 		*tl++ = txdr_unsigned(sequenceid);
4580 		*tl++ = txdr_unsigned(nd->nd_slotid);
4581 		*tl++ = txdr_unsigned(highest_slotid);
4582 		*tl++ = txdr_unsigned(target_highest_slotid);
4583 		*tl = txdr_unsigned(sflags);
4584 	}
4585 nfsmout:
4586 	NFSEXITCODE2(error, nd);
4587 	return (error);
4588 }
4589 
4590 /*
4591  * nfsv4 reclaim complete service
4592  */
4593 int
4594 nfsrvd_reclaimcomplete(struct nfsrv_descript *nd, __unused int isdgram,
4595     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4596 {
4597 	uint32_t *tl;
4598 	int error = 0, onefs;
4599 
4600 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4601 	/*
4602 	 * I believe that a ReclaimComplete with rca_one_fs == TRUE is only
4603 	 * to be used after a file system has been transferred to a different
4604 	 * file server.  However, RFC5661 is somewhat vague w.r.t. this and
4605 	 * the ESXi 6.7 client does both a ReclaimComplete with rca_one_fs
4606 	 * == TRUE and one with ReclaimComplete with rca_one_fs == FALSE.
4607 	 * Therefore, just ignore the rca_one_fs == TRUE operation and return
4608 	 * NFS_OK without doing anything.
4609 	 */
4610 	onefs = 0;
4611 	if (*tl == newnfs_true)
4612 		onefs = 1;
4613 	nd->nd_repstat = nfsrv_checkreclaimcomplete(nd, onefs);
4614 nfsmout:
4615 	NFSEXITCODE2(error, nd);
4616 	return (error);
4617 }
4618 
4619 /*
4620  * nfsv4 destroy clientid service
4621  */
4622 int
4623 nfsrvd_destroyclientid(struct nfsrv_descript *nd, __unused int isdgram,
4624     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4625 {
4626 	uint32_t *tl;
4627 	nfsquad_t clientid;
4628 	int error = 0;
4629 	struct thread *p = curthread;
4630 
4631 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4632 		goto nfsmout;
4633 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
4634 	clientid.lval[0] = *tl++;
4635 	clientid.lval[1] = *tl;
4636 	nd->nd_repstat = nfsrv_destroyclient(clientid, p);
4637 nfsmout:
4638 	NFSEXITCODE2(error, nd);
4639 	return (error);
4640 }
4641 
4642 /*
4643  * nfsv4 bind connection to session service
4644  */
4645 int
4646 nfsrvd_bindconnsess(struct nfsrv_descript *nd, __unused int isdgram,
4647     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4648 {
4649 	uint32_t *tl;
4650 	uint8_t sessid[NFSX_V4SESSIONID];
4651 	int error = 0, foreaft;
4652 
4653 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4654 		goto nfsmout;
4655 	NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID + 2 * NFSX_UNSIGNED);
4656 	NFSBCOPY(tl, sessid, NFSX_V4SESSIONID);
4657 	tl += (NFSX_V4SESSIONID / NFSX_UNSIGNED);
4658 	foreaft = fxdr_unsigned(int, *tl++);
4659 	if (*tl == newnfs_true) {
4660 		/* RDMA is not supported. */
4661 		nd->nd_repstat = NFSERR_NOTSUPP;
4662 		goto nfsmout;
4663 	}
4664 
4665 	nd->nd_repstat = nfsrv_bindconnsess(nd, sessid, &foreaft);
4666 	if (nd->nd_repstat == 0) {
4667 		NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID + 2 *
4668 		    NFSX_UNSIGNED);
4669 		NFSBCOPY(sessid, tl, NFSX_V4SESSIONID);
4670 		tl += (NFSX_V4SESSIONID / NFSX_UNSIGNED);
4671 		*tl++ = txdr_unsigned(foreaft);
4672 		*tl = newnfs_false;
4673 	}
4674 nfsmout:
4675 	NFSEXITCODE2(error, nd);
4676 	return (error);
4677 }
4678 
4679 /*
4680  * nfsv4 destroy session service
4681  */
4682 int
4683 nfsrvd_destroysession(struct nfsrv_descript *nd, __unused int isdgram,
4684     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4685 {
4686 	uint8_t *cp, sessid[NFSX_V4SESSIONID];
4687 	int error = 0;
4688 
4689 	if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4690 		goto nfsmout;
4691 	NFSM_DISSECT(cp, uint8_t *, NFSX_V4SESSIONID);
4692 	NFSBCOPY(cp, sessid, NFSX_V4SESSIONID);
4693 	nd->nd_repstat = nfsrv_destroysession(nd, sessid);
4694 nfsmout:
4695 	NFSEXITCODE2(error, nd);
4696 	return (error);
4697 }
4698 
4699 /*
4700  * nfsv4 free stateid service
4701  */
4702 int
4703 nfsrvd_freestateid(struct nfsrv_descript *nd, __unused int isdgram,
4704     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4705 {
4706 	uint32_t *tl;
4707 	nfsv4stateid_t stateid;
4708 	int error = 0;
4709 	struct thread *p = curthread;
4710 
4711 	NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
4712 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4713 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4714 
4715 	/*
4716 	 * For the special stateid of other all 0s and seqid == 1, set the
4717 	 * stateid to the current stateid, if it is set.
4718 	 */
4719 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4720 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
4721 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4722 			stateid = nd->nd_curstateid;
4723 			stateid.seqid = 0;
4724 		} else {
4725 			nd->nd_repstat = NFSERR_BADSTATEID;
4726 			goto nfsmout;
4727 		}
4728 	}
4729 
4730 	nd->nd_repstat = nfsrv_freestateid(nd, &stateid, p);
4731 
4732 	/* If the current stateid has been free'd, unset it. */
4733 	if (nd->nd_repstat == 0 && (nd->nd_flag & ND_CURSTATEID) != 0 &&
4734 	    stateid.other[0] == nd->nd_curstateid.other[0] &&
4735 	    stateid.other[1] == nd->nd_curstateid.other[1] &&
4736 	    stateid.other[2] == nd->nd_curstateid.other[2])
4737 		nd->nd_flag &= ~ND_CURSTATEID;
4738 nfsmout:
4739 	NFSEXITCODE2(error, nd);
4740 	return (error);
4741 }
4742 
4743 /*
4744  * nfsv4 layoutget service
4745  */
4746 int
4747 nfsrvd_layoutget(struct nfsrv_descript *nd, __unused int isdgram,
4748     vnode_t vp, struct nfsexstuff *exp)
4749 {
4750 	uint32_t *tl;
4751 	nfsv4stateid_t stateid;
4752 	int error = 0, layoutlen, layouttype, iomode, maxcnt, retonclose;
4753 	uint64_t offset, len, minlen;
4754 	char *layp;
4755 	struct thread *p = curthread;
4756 
4757 	NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED + 3 * NFSX_HYPER +
4758 	    NFSX_STATEID);
4759 	tl++;		/* Signal layout available. Ignore for now. */
4760 	layouttype = fxdr_unsigned(int, *tl++);
4761 	iomode = fxdr_unsigned(int, *tl++);
4762 	offset = fxdr_hyper(tl); tl += 2;
4763 	len = fxdr_hyper(tl); tl += 2;
4764 	minlen = fxdr_hyper(tl); tl += 2;
4765 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4766 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4767 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4768 	maxcnt = fxdr_unsigned(int, *tl);
4769 	NFSD_DEBUG(4, "layoutget ltyp=%d iom=%d off=%ju len=%ju mlen=%ju\n",
4770 	    layouttype, iomode, (uintmax_t)offset, (uintmax_t)len,
4771 	    (uintmax_t)minlen);
4772 	if (len < minlen ||
4773 	    (minlen != UINT64_MAX && offset + minlen < offset) ||
4774 	    (len != UINT64_MAX && offset + len < offset)) {
4775 		nd->nd_repstat = NFSERR_INVAL;
4776 		goto nfsmout;
4777 	}
4778 
4779 	/*
4780 	 * For the special stateid of other all 0s and seqid == 1, set the
4781 	 * stateid to the current stateid, if it is set.
4782 	 */
4783 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4784 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
4785 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4786 			stateid = nd->nd_curstateid;
4787 			stateid.seqid = 0;
4788 		} else {
4789 			nd->nd_repstat = NFSERR_BADSTATEID;
4790 			goto nfsmout;
4791 		}
4792 	}
4793 
4794 	layp = NULL;
4795 	if (layouttype == NFSLAYOUT_NFSV4_1_FILES && nfsrv_maxpnfsmirror == 1)
4796 		layp = malloc(NFSX_V4FILELAYOUT, M_TEMP, M_WAITOK);
4797 	else if (layouttype == NFSLAYOUT_FLEXFILE)
4798 		layp = malloc(NFSX_V4FLEXLAYOUT(nfsrv_maxpnfsmirror), M_TEMP,
4799 		    M_WAITOK);
4800 	else
4801 		nd->nd_repstat = NFSERR_UNKNLAYOUTTYPE;
4802 	if (layp != NULL)
4803 		nd->nd_repstat = nfsrv_layoutget(nd, vp, exp, layouttype,
4804 		    &iomode, &offset, &len, minlen, &stateid, maxcnt,
4805 		    &retonclose, &layoutlen, layp, nd->nd_cred, p);
4806 	NFSD_DEBUG(4, "nfsrv_layoutget stat=%u layoutlen=%d\n", nd->nd_repstat,
4807 	    layoutlen);
4808 	if (nd->nd_repstat == 0) {
4809 		/* For NFSv4.1, set the Current StateID. */
4810 		if ((nd->nd_flag & ND_NFSV41) != 0) {
4811 			nd->nd_curstateid = stateid;
4812 			nd->nd_flag |= ND_CURSTATEID;
4813 		}
4814 		NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + NFSX_STATEID +
4815 		    2 * NFSX_HYPER);
4816 		*tl++ = txdr_unsigned(retonclose);
4817 		*tl++ = txdr_unsigned(stateid.seqid);
4818 		NFSBCOPY(stateid.other, tl, NFSX_STATEIDOTHER);
4819 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4820 		*tl++ = txdr_unsigned(1);	/* Only returns one layout. */
4821 		txdr_hyper(offset, tl); tl += 2;
4822 		txdr_hyper(len, tl); tl += 2;
4823 		*tl++ = txdr_unsigned(iomode);
4824 		*tl = txdr_unsigned(layouttype);
4825 		nfsm_strtom(nd, layp, layoutlen);
4826 	} else if (nd->nd_repstat == NFSERR_LAYOUTTRYLATER) {
4827 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4828 		*tl = newnfs_false;
4829 	}
4830 	free(layp, M_TEMP);
4831 nfsmout:
4832 	vput(vp);
4833 	NFSEXITCODE2(error, nd);
4834 	return (error);
4835 }
4836 
4837 /*
4838  * nfsv4 layoutcommit service
4839  */
4840 int
4841 nfsrvd_layoutcommit(struct nfsrv_descript *nd, __unused int isdgram,
4842     vnode_t vp, struct nfsexstuff *exp)
4843 {
4844 	uint32_t *tl;
4845 	nfsv4stateid_t stateid;
4846 	int error = 0, hasnewoff, hasnewmtime, layouttype, maxcnt, reclaim;
4847 	int hasnewsize;
4848 	uint64_t offset, len, newoff = 0, newsize;
4849 	struct timespec newmtime;
4850 	char *layp;
4851 	struct thread *p = curthread;
4852 
4853 	layp = NULL;
4854 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED + 2 * NFSX_HYPER +
4855 	    NFSX_STATEID);
4856 	offset = fxdr_hyper(tl); tl += 2;
4857 	len = fxdr_hyper(tl); tl += 2;
4858 	reclaim = fxdr_unsigned(int, *tl++);
4859 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4860 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4861 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4862 	/*
4863 	 * For the special stateid of other all 0s and seqid == 1, set the
4864 	 * stateid to the current stateid, if it is set.
4865 	 */
4866 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4867 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
4868 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4869 			stateid = nd->nd_curstateid;
4870 			stateid.seqid = 0;
4871 		} else {
4872 			nd->nd_repstat = NFSERR_BADSTATEID;
4873 			goto nfsmout;
4874 		}
4875 	}
4876 
4877 	hasnewoff = fxdr_unsigned(int, *tl);
4878 	if (hasnewoff != 0) {
4879 		NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
4880 		newoff = fxdr_hyper(tl); tl += 2;
4881 	} else
4882 		NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4883 	hasnewmtime = fxdr_unsigned(int, *tl);
4884 	if (hasnewmtime != 0) {
4885 		NFSM_DISSECT(tl, uint32_t *, NFSX_V4TIME + 2 * NFSX_UNSIGNED);
4886 		fxdr_nfsv4time(tl, &newmtime);
4887 		tl += (NFSX_V4TIME / NFSX_UNSIGNED);
4888 	} else
4889 		NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
4890 	layouttype = fxdr_unsigned(int, *tl++);
4891 	maxcnt = fxdr_unsigned(int, *tl);
4892 	if (maxcnt > 0) {
4893 		layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK);
4894 		error = nfsrv_mtostr(nd, layp, maxcnt);
4895 		if (error != 0)
4896 			goto nfsmout;
4897 	}
4898 	nd->nd_repstat = nfsrv_layoutcommit(nd, vp, layouttype, hasnewoff,
4899 	    newoff, offset, len, hasnewmtime, &newmtime, reclaim, &stateid,
4900 	    maxcnt, layp, &hasnewsize, &newsize, nd->nd_cred, p);
4901 	NFSD_DEBUG(4, "nfsrv_layoutcommit stat=%u\n", nd->nd_repstat);
4902 	if (nd->nd_repstat == 0) {
4903 		if (hasnewsize != 0) {
4904 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED + NFSX_HYPER);
4905 			*tl++ = newnfs_true;
4906 			txdr_hyper(newsize, tl);
4907 		} else {
4908 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4909 			*tl = newnfs_false;
4910 		}
4911 	}
4912 nfsmout:
4913 	free(layp, M_TEMP);
4914 	vput(vp);
4915 	NFSEXITCODE2(error, nd);
4916 	return (error);
4917 }
4918 
4919 /*
4920  * nfsv4 layoutreturn service
4921  */
4922 int
4923 nfsrvd_layoutreturn(struct nfsrv_descript *nd, __unused int isdgram,
4924     vnode_t vp, struct nfsexstuff *exp)
4925 {
4926 	uint32_t *tl, *layp;
4927 	nfsv4stateid_t stateid;
4928 	int error = 0, fnd, kind, layouttype, iomode, maxcnt, reclaim;
4929 	uint64_t offset, len;
4930 	struct thread *p = curthread;
4931 
4932 	layp = NULL;
4933 	NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED);
4934 	reclaim = *tl++;
4935 	layouttype = fxdr_unsigned(int, *tl++);
4936 	iomode = fxdr_unsigned(int, *tl++);
4937 	kind = fxdr_unsigned(int, *tl);
4938 	NFSD_DEBUG(4, "layoutreturn recl=%d ltyp=%d iom=%d kind=%d\n", reclaim,
4939 	    layouttype, iomode, kind);
4940 	if (kind == NFSV4LAYOUTRET_FILE) {
4941 		NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
4942 		    NFSX_UNSIGNED);
4943 		offset = fxdr_hyper(tl); tl += 2;
4944 		len = fxdr_hyper(tl); tl += 2;
4945 		stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4946 		NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4947 		tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4948 
4949 		/*
4950 		 * For the special stateid of other all 0s and seqid == 1, set
4951 		 * the stateid to the current stateid, if it is set.
4952 		 */
4953 		if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4954 		    stateid.other[1] == 0 && stateid.other[2] == 0) {
4955 			if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4956 				stateid = nd->nd_curstateid;
4957 				stateid.seqid = 0;
4958 			} else {
4959 				nd->nd_repstat = NFSERR_BADSTATEID;
4960 				goto nfsmout;
4961 			}
4962 		}
4963 
4964 		maxcnt = fxdr_unsigned(int, *tl);
4965 		/*
4966 		 * There is no fixed upper bound defined in the RFCs,
4967 		 * but 128Kbytes should be more than sufficient.
4968 		 */
4969 		if (maxcnt < 0 || maxcnt > 131072)
4970 			maxcnt = 0;
4971 		if (maxcnt > 0) {
4972 			layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK);
4973 			error = nfsrv_mtostr(nd, (char *)layp, maxcnt);
4974 			if (error != 0)
4975 				goto nfsmout;
4976 		}
4977 	} else {
4978 		if (reclaim == newnfs_true) {
4979 			nd->nd_repstat = NFSERR_INVAL;
4980 			goto nfsmout;
4981 		}
4982 		offset = len = 0;
4983 		maxcnt = 0;
4984 	}
4985 	nd->nd_repstat = nfsrv_layoutreturn(nd, vp, layouttype, iomode,
4986 	    offset, len, reclaim, kind, &stateid, maxcnt, layp, &fnd,
4987 	    nd->nd_cred, p);
4988 	NFSD_DEBUG(4, "nfsrv_layoutreturn stat=%u fnd=%d\n", nd->nd_repstat,
4989 	    fnd);
4990 	if (nd->nd_repstat == 0) {
4991 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4992 		if (fnd != 0) {
4993 			*tl = newnfs_true;
4994 			NFSM_BUILD(tl, uint32_t *, NFSX_STATEID);
4995 			*tl++ = txdr_unsigned(stateid.seqid);
4996 			NFSBCOPY(stateid.other, tl, NFSX_STATEIDOTHER);
4997 		} else
4998 			*tl = newnfs_false;
4999 	}
5000 nfsmout:
5001 	free(layp, M_TEMP);
5002 	vput(vp);
5003 	NFSEXITCODE2(error, nd);
5004 	return (error);
5005 }
5006 
5007 /*
5008  * nfsv4 layout error service
5009  */
5010 int
5011 nfsrvd_layouterror(struct nfsrv_descript *nd, __unused int isdgram,
5012     vnode_t vp, struct nfsexstuff *exp)
5013 {
5014 	uint32_t *tl;
5015 	nfsv4stateid_t stateid;
5016 	int cnt, error = 0, i, stat;
5017 	int opnum __unused;
5018 	char devid[NFSX_V4DEVICEID];
5019 	uint64_t offset, len;
5020 
5021 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
5022 	    NFSX_UNSIGNED);
5023 	offset = fxdr_hyper(tl); tl += 2;
5024 	len = fxdr_hyper(tl); tl += 2;
5025 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5026 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
5027 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
5028 	cnt = fxdr_unsigned(int, *tl);
5029 	NFSD_DEBUG(4, "layouterror off=%ju len=%ju cnt=%d\n", (uintmax_t)offset,
5030 	    (uintmax_t)len, cnt);
5031 	/*
5032 	 * For the special stateid of other all 0s and seqid == 1, set
5033 	 * the stateid to the current stateid, if it is set.
5034 	 */
5035 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
5036 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
5037 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
5038 			stateid = nd->nd_curstateid;
5039 			stateid.seqid = 0;
5040 		} else {
5041 			nd->nd_repstat = NFSERR_BADSTATEID;
5042 			goto nfsmout;
5043 		}
5044 	}
5045 
5046 	/*
5047 	 * Ignore offset, len and stateid for now.
5048 	 */
5049 	for (i = 0; i < cnt; i++) {
5050 		NFSM_DISSECT(tl, uint32_t *, NFSX_V4DEVICEID + 2 *
5051 		    NFSX_UNSIGNED);
5052 		NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
5053 		tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
5054 		stat = fxdr_unsigned(int, *tl++);
5055 		opnum = fxdr_unsigned(int, *tl);
5056 		NFSD_DEBUG(4, "nfsrvd_layouterr op=%d stat=%d\n", opnum, stat);
5057 		/*
5058 		 * Except for NFSERR_ACCES, NFSERR_STALE and NFSERR_NOSPC
5059 		 * errors, disable the mirror.
5060 		 */
5061 		if (stat != NFSERR_ACCES && stat != NFSERR_STALE &&
5062 		    stat != NFSERR_NOSPC)
5063 			nfsrv_delds(devid, curthread);
5064 
5065 		/* For NFSERR_NOSPC, mark all deviceids and layouts. */
5066 		if (stat == NFSERR_NOSPC)
5067 			nfsrv_marknospc(devid, true);
5068 	}
5069 nfsmout:
5070 	vput(vp);
5071 	NFSEXITCODE2(error, nd);
5072 	return (error);
5073 }
5074 
5075 /*
5076  * nfsv4 layout stats service
5077  */
5078 int
5079 nfsrvd_layoutstats(struct nfsrv_descript *nd, __unused int isdgram,
5080     vnode_t vp, struct nfsexstuff *exp)
5081 {
5082 	uint32_t *tl;
5083 	nfsv4stateid_t stateid;
5084 	int cnt, error = 0;
5085 	int layouttype __unused;
5086 	char devid[NFSX_V4DEVICEID] __unused;
5087 	uint64_t offset __unused, len __unused, readcount __unused;
5088 	uint64_t readbytes __unused, writecount __unused, writebytes __unused;
5089 
5090 	NFSM_DISSECT(tl, uint32_t *, 6 * NFSX_HYPER + NFSX_STATEID +
5091 	    NFSX_V4DEVICEID + 2 * NFSX_UNSIGNED);
5092 	offset = fxdr_hyper(tl); tl += 2;
5093 	len = fxdr_hyper(tl); tl += 2;
5094 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5095 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
5096 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
5097 	readcount = fxdr_hyper(tl); tl += 2;
5098 	readbytes = fxdr_hyper(tl); tl += 2;
5099 	writecount = fxdr_hyper(tl); tl += 2;
5100 	writebytes = fxdr_hyper(tl); tl += 2;
5101 	NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
5102 	tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
5103 	layouttype = fxdr_unsigned(int, *tl++);
5104 	cnt = fxdr_unsigned(int, *tl);
5105 	error = nfsm_advance(nd, NFSM_RNDUP(cnt), -1);
5106 	if (error != 0)
5107 		goto nfsmout;
5108 	NFSD_DEBUG(4, "layoutstats cnt=%d\n", cnt);
5109 	/*
5110 	 * For the special stateid of other all 0s and seqid == 1, set
5111 	 * the stateid to the current stateid, if it is set.
5112 	 */
5113 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
5114 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
5115 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
5116 			stateid = nd->nd_curstateid;
5117 			stateid.seqid = 0;
5118 		} else {
5119 			nd->nd_repstat = NFSERR_BADSTATEID;
5120 			goto nfsmout;
5121 		}
5122 	}
5123 
5124 	/*
5125 	 * No use for the stats for now.
5126 	 */
5127 nfsmout:
5128 	vput(vp);
5129 	NFSEXITCODE2(error, nd);
5130 	return (error);
5131 }
5132 
5133 /*
5134  * nfsv4 io_advise service
5135  */
5136 int
5137 nfsrvd_ioadvise(struct nfsrv_descript *nd, __unused int isdgram,
5138     vnode_t vp, struct nfsexstuff *exp)
5139 {
5140 	uint32_t *tl;
5141 	nfsv4stateid_t stateid;
5142 	nfsattrbit_t hints;
5143 	int error = 0, ret;
5144 	off_t offset, len;
5145 
5146 	NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
5147 	stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5148 	NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
5149 	tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
5150 	offset = fxdr_hyper(tl); tl += 2;
5151 	len = fxdr_hyper(tl);
5152 	error = nfsrv_getattrbits(nd, &hints, NULL, NULL);
5153 	if (error != 0)
5154 		goto nfsmout;
5155 	/*
5156 	 * For the special stateid of other all 0s and seqid == 1, set
5157 	 * the stateid to the current stateid, if it is set.
5158 	 */
5159 	if (stateid.seqid == 1 && stateid.other[0] == 0 &&
5160 	    stateid.other[1] == 0 && stateid.other[2] == 0) {
5161 		if ((nd->nd_flag & ND_CURSTATEID) != 0) {
5162 			stateid = nd->nd_curstateid;
5163 			stateid.seqid = 0;
5164 		} else {
5165 			nd->nd_repstat = NFSERR_BADSTATEID;
5166 			goto nfsmout;
5167 		}
5168 	}
5169 
5170 	if (offset < 0) {
5171 		nd->nd_repstat = NFSERR_INVAL;
5172 		goto nfsmout;
5173 	}
5174 	if (len < 0)
5175 		len = 0;
5176 	if (vp->v_type != VREG) {
5177 		if (vp->v_type == VDIR)
5178 			nd->nd_repstat = NFSERR_ISDIR;
5179 		else
5180 			nd->nd_repstat = NFSERR_WRONGTYPE;
5181 		goto nfsmout;
5182 	}
5183 
5184 	/*
5185 	 * For now, we can only handle WILLNEED and DONTNEED and don't use
5186 	 * the stateid.
5187 	 */
5188 	if ((NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED) &&
5189 	    !NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED)) ||
5190 	    (NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED) &&
5191 	    !NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED))) {
5192 		NFSVOPUNLOCK(vp);
5193 		if (NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED)) {
5194 			ret = VOP_ADVISE(vp, offset, len, POSIX_FADV_WILLNEED);
5195 			NFSZERO_ATTRBIT(&hints);
5196 			if (ret == 0)
5197 				NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED);
5198 			else
5199 				NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
5200 		} else {
5201 			ret = VOP_ADVISE(vp, offset, len, POSIX_FADV_DONTNEED);
5202 			NFSZERO_ATTRBIT(&hints);
5203 			if (ret == 0)
5204 				NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED);
5205 			else
5206 				NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
5207 		}
5208 		vrele(vp);
5209 	} else {
5210 		NFSZERO_ATTRBIT(&hints);
5211 		NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
5212 		vput(vp);
5213 	}
5214 	nfsrv_putattrbit(nd, &hints);
5215 	NFSEXITCODE2(error, nd);
5216 	return (error);
5217 nfsmout:
5218 	vput(vp);
5219 	NFSEXITCODE2(error, nd);
5220 	return (error);
5221 }
5222 
5223 /*
5224  * nfsv4 getdeviceinfo service
5225  */
5226 int
5227 nfsrvd_getdevinfo(struct nfsrv_descript *nd, __unused int isdgram,
5228     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5229 {
5230 	uint32_t *tl, maxcnt, notify[NFSV4_NOTIFYBITMAP];
5231 	int cnt, devaddrlen, error = 0, i, layouttype;
5232 	char devid[NFSX_V4DEVICEID], *devaddr;
5233 	time_t dev_time;
5234 
5235 	NFSM_DISSECT(tl, uint32_t *, 3 * NFSX_UNSIGNED + NFSX_V4DEVICEID);
5236 	NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
5237 	tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
5238 	layouttype = fxdr_unsigned(int, *tl++);
5239 	maxcnt = fxdr_unsigned(uint32_t, *tl++);
5240 	cnt = fxdr_unsigned(int, *tl);
5241 	NFSD_DEBUG(4, "getdevinfo ltyp=%d maxcnt=%u bitcnt=%d\n", layouttype,
5242 	    maxcnt, cnt);
5243 	if (cnt > NFSV4_NOTIFYBITMAP || cnt < 0) {
5244 		nd->nd_repstat = NFSERR_INVAL;
5245 		goto nfsmout;
5246 	}
5247 	if (cnt > 0) {
5248 		NFSM_DISSECT(tl, uint32_t *, cnt * NFSX_UNSIGNED);
5249 		for (i = 0; i < cnt; i++)
5250 			notify[i] = fxdr_unsigned(uint32_t, *tl++);
5251 	}
5252 	for (i = cnt; i < NFSV4_NOTIFYBITMAP; i++)
5253 		notify[i] = 0;
5254 
5255 	/*
5256 	 * Check that the device id is not stale.  Device ids are recreated
5257 	 * each time the nfsd threads are restarted.
5258 	 */
5259 	NFSBCOPY(devid, &dev_time, sizeof(dev_time));
5260 	if (dev_time != nfsdev_time) {
5261 		nd->nd_repstat = NFSERR_NOENT;
5262 		goto nfsmout;
5263 	}
5264 
5265 	/* Look for the device id. */
5266 	nd->nd_repstat = nfsrv_getdevinfo(devid, layouttype, &maxcnt,
5267 	    notify, &devaddrlen, &devaddr);
5268 	NFSD_DEBUG(4, "nfsrv_getdevinfo stat=%u\n", nd->nd_repstat);
5269 	if (nd->nd_repstat == 0) {
5270 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5271 		*tl = txdr_unsigned(layouttype);
5272 		nfsm_strtom(nd, devaddr, devaddrlen);
5273 		cnt = 0;
5274 		for (i = 0; i < NFSV4_NOTIFYBITMAP; i++) {
5275 			if (notify[i] != 0)
5276 				cnt = i + 1;
5277 		}
5278 		NFSM_BUILD(tl, uint32_t *, (cnt + 1) * NFSX_UNSIGNED);
5279 		*tl++ = txdr_unsigned(cnt);
5280 		for (i = 0; i < cnt; i++)
5281 			*tl++ = txdr_unsigned(notify[i]);
5282 	} else if (nd->nd_repstat == NFSERR_TOOSMALL) {
5283 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5284 		*tl = txdr_unsigned(maxcnt);
5285 	}
5286 nfsmout:
5287 	NFSEXITCODE2(error, nd);
5288 	return (error);
5289 }
5290 
5291 /*
5292  * nfsv4 test stateid service
5293  */
5294 int
5295 nfsrvd_teststateid(struct nfsrv_descript *nd, __unused int isdgram,
5296     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5297 {
5298 	uint32_t *tl;
5299 	nfsv4stateid_t *stateidp = NULL, *tstateidp;
5300 	int cnt, error = 0, i, ret;
5301 	struct thread *p = curthread;
5302 
5303 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5304 	cnt = fxdr_unsigned(int, *tl);
5305 	if (cnt <= 0 || cnt > 1024) {
5306 		nd->nd_repstat = NFSERR_BADXDR;
5307 		goto nfsmout;
5308 	}
5309 	stateidp = mallocarray(cnt, sizeof(nfsv4stateid_t), M_TEMP, M_WAITOK);
5310 	tstateidp = stateidp;
5311 	for (i = 0; i < cnt; i++) {
5312 		NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
5313 		tstateidp->seqid = fxdr_unsigned(uint32_t, *tl++);
5314 		NFSBCOPY(tl, tstateidp->other, NFSX_STATEIDOTHER);
5315 		tstateidp++;
5316 	}
5317 	NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5318 	*tl = txdr_unsigned(cnt);
5319 	tstateidp = stateidp;
5320 	for (i = 0; i < cnt; i++) {
5321 		ret = nfsrv_teststateid(nd, tstateidp, p);
5322 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5323 		*tl = txdr_unsigned(ret);
5324 		tstateidp++;
5325 	}
5326 nfsmout:
5327 	free(stateidp, M_TEMP);
5328 	NFSEXITCODE2(error, nd);
5329 	return (error);
5330 }
5331 
5332 /*
5333  * nfs allocate service
5334  */
5335 int
5336 nfsrvd_allocate(struct nfsrv_descript *nd, __unused int isdgram,
5337     vnode_t vp, struct nfsexstuff *exp)
5338 {
5339 	uint32_t *tl;
5340 	struct nfsvattr forat;
5341 	int error = 0, forat_ret = 1, gotproxystateid;
5342 	off_t off, len;
5343 	struct nfsstate st, *stp = &st;
5344 	struct nfslock lo, *lop = &lo;
5345 	nfsv4stateid_t stateid;
5346 	nfsquad_t clientid;
5347 	nfsattrbit_t attrbits;
5348 
5349 	if (!nfsrv_doallocate) {
5350 		/*
5351 		 * If any exported file system, such as a ZFS one, cannot
5352 		 * do VOP_ALLOCATE(), this operation cannot be supported
5353 		 * for NFSv4.2.  This cannot be done 'per filesystem', but
5354 		 * must be for the entire nfsd NFSv4.2 service.
5355 		 */
5356 		nd->nd_repstat = NFSERR_NOTSUPP;
5357 		goto nfsmout;
5358 	}
5359 	gotproxystateid = 0;
5360 	NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
5361 	stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5362 	lop->lo_flags = NFSLCK_WRITE;
5363 	stp->ls_ownerlen = 0;
5364 	stp->ls_op = NULL;
5365 	stp->ls_uid = nd->nd_cred->cr_uid;
5366 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
5367 	clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
5368 	clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
5369 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
5370 		if ((nd->nd_flag & ND_NFSV41) != 0)
5371 			clientid.qval = nd->nd_clientid.qval;
5372 		else if (nd->nd_clientid.qval != clientid.qval)
5373 			printf("EEK2 multiple clids\n");
5374 	} else {
5375 		if ((nd->nd_flag & ND_NFSV41) != 0)
5376 			printf("EEK! no clientid from session\n");
5377 		nd->nd_flag |= ND_IMPLIEDCLID;
5378 		nd->nd_clientid.qval = clientid.qval;
5379 	}
5380 	stp->ls_stateid.other[2] = *tl++;
5381 	/*
5382 	 * Don't allow this to be done for a DS.
5383 	 */
5384 	if ((nd->nd_flag & ND_DSSERVER) != 0)
5385 		nd->nd_repstat = NFSERR_NOTSUPP;
5386 	/* However, allow the proxy stateid. */
5387 	if (stp->ls_stateid.seqid == 0xffffffff &&
5388 	    stp->ls_stateid.other[0] == 0x55555555 &&
5389 	    stp->ls_stateid.other[1] == 0x55555555 &&
5390 	    stp->ls_stateid.other[2] == 0x55555555)
5391 		gotproxystateid = 1;
5392 	off = fxdr_hyper(tl); tl += 2;
5393 	lop->lo_first = off;
5394 	len = fxdr_hyper(tl);
5395 	lop->lo_end = lop->lo_first + len;
5396 	/*
5397 	 * Sanity check the offset and length.
5398 	 * off and len are off_t (signed int64_t) whereas
5399 	 * lo_first and lo_end are uint64_t and, as such,
5400 	 * if off >= 0 && len > 0, lo_end cannot overflow
5401 	 * unless off_t is changed to something other than
5402 	 * int64_t.  Check lo_end < lo_first in case that
5403 	 * is someday the case.
5404 	 */
5405 	if (nd->nd_repstat == 0 && (len <= 0 || off < 0 || lop->lo_end >
5406 	    OFF_MAX || lop->lo_end < lop->lo_first))
5407 		nd->nd_repstat = NFSERR_INVAL;
5408 
5409 	if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5410 		nd->nd_repstat = NFSERR_WRONGTYPE;
5411 	NFSZERO_ATTRBIT(&attrbits);
5412 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5413 	forat_ret = nfsvno_getattr(vp, &forat, nd, curthread, 1, &attrbits);
5414 	if (nd->nd_repstat == 0)
5415 		nd->nd_repstat = forat_ret;
5416 	if (nd->nd_repstat == 0 && (forat.na_uid != nd->nd_cred->cr_uid ||
5417 	     NFSVNO_EXSTRICTACCESS(exp)))
5418 		nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp,
5419 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5420 		    NULL);
5421 	if (nd->nd_repstat == 0 && gotproxystateid == 0)
5422 		nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
5423 		    &stateid, exp, nd, curthread);
5424 
5425 	NFSD_DEBUG(4, "nfsrvd_allocate: off=%jd len=%jd stat=%d\n",
5426 	    (intmax_t)off, (intmax_t)len, nd->nd_repstat);
5427 	if (nd->nd_repstat == 0)
5428 		nd->nd_repstat = nfsvno_allocate(vp, off, len, nd->nd_cred,
5429 		    curthread);
5430 	NFSD_DEBUG(4, "nfsrvd_allocate: aft nfsvno_allocate=%d\n",
5431 	    nd->nd_repstat);
5432 	vput(vp);
5433 	NFSEXITCODE2(0, nd);
5434 	return (0);
5435 nfsmout:
5436 	vput(vp);
5437 	NFSEXITCODE2(error, nd);
5438 	return (error);
5439 }
5440 
5441 /*
5442  * nfs deallocate service
5443  */
5444 int
5445 nfsrvd_deallocate(struct nfsrv_descript *nd, __unused int isdgram,
5446     vnode_t vp, struct nfsexstuff *exp)
5447 {
5448 	uint32_t *tl;
5449 	struct nfsvattr forat;
5450 	int error = 0, forat_ret = 1, gotproxystateid;
5451 	off_t off, len;
5452 	struct nfsstate st, *stp = &st;
5453 	struct nfslock lo, *lop = &lo;
5454 	nfsv4stateid_t stateid;
5455 	nfsquad_t clientid;
5456 	nfsattrbit_t attrbits;
5457 
5458 	gotproxystateid = 0;
5459 	NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
5460 	stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5461 	lop->lo_flags = NFSLCK_WRITE;
5462 	stp->ls_ownerlen = 0;
5463 	stp->ls_op = NULL;
5464 	stp->ls_uid = nd->nd_cred->cr_uid;
5465 	stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
5466 	clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
5467 	clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
5468 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
5469 		if ((nd->nd_flag & ND_NFSV41) != 0)
5470 			clientid.qval = nd->nd_clientid.qval;
5471 		else if (nd->nd_clientid.qval != clientid.qval)
5472 			printf("EEK2 multiple clids\n");
5473 	} else {
5474 		if ((nd->nd_flag & ND_NFSV41) != 0)
5475 			printf("EEK! no clientid from session\n");
5476 		nd->nd_flag |= ND_IMPLIEDCLID;
5477 		nd->nd_clientid.qval = clientid.qval;
5478 	}
5479 	stp->ls_stateid.other[2] = *tl++;
5480 	/*
5481 	 * Don't allow this to be done for a DS.
5482 	 */
5483 	if ((nd->nd_flag & ND_DSSERVER) != 0)
5484 		nd->nd_repstat = NFSERR_NOTSUPP;
5485 	/* However, allow the proxy stateid. */
5486 	if (stp->ls_stateid.seqid == 0xffffffff &&
5487 	    stp->ls_stateid.other[0] == 0x55555555 &&
5488 	    stp->ls_stateid.other[1] == 0x55555555 &&
5489 	    stp->ls_stateid.other[2] == 0x55555555)
5490 		gotproxystateid = 1;
5491 	off = fxdr_hyper(tl); tl += 2;
5492 	lop->lo_first = off;
5493 	len = fxdr_hyper(tl);
5494 	if (len < 0)
5495 		len = OFF_MAX;
5496 	NFSD_DEBUG(4, "dealloc: off=%jd len=%jd\n", (intmax_t)off,
5497 	    (intmax_t)len);
5498 	lop->lo_end = lop->lo_first + len;
5499 	/*
5500 	 * Sanity check the offset and length.
5501 	 * off and len are off_t (signed int64_t) whereas
5502 	 * lo_first and lo_end are uint64_t and, as such,
5503 	 * if off >= 0 && len > 0, lo_end cannot overflow
5504 	 * unless off_t is changed to something other than
5505 	 * int64_t.  Check lo_end < lo_first in case that
5506 	 * is someday the case.
5507 	 * The error to return is not specified by RFC 7862 so I
5508 	 * made this compatible with the Linux knfsd.
5509 	 */
5510 	if (nd->nd_repstat == 0) {
5511 		if (off < 0 || lop->lo_end > NFSRV_MAXFILESIZE)
5512 			nd->nd_repstat = NFSERR_FBIG;
5513 		else if (len == 0 || lop->lo_end < lop->lo_first)
5514 			nd->nd_repstat = NFSERR_INVAL;
5515 	}
5516 
5517 	if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5518 		nd->nd_repstat = NFSERR_WRONGTYPE;
5519 	NFSZERO_ATTRBIT(&attrbits);
5520 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5521 	forat_ret = nfsvno_getattr(vp, &forat, nd, curthread, 1, &attrbits);
5522 	if (nd->nd_repstat == 0)
5523 		nd->nd_repstat = forat_ret;
5524 	if (nd->nd_repstat == 0 && (forat.na_uid != nd->nd_cred->cr_uid ||
5525 	     NFSVNO_EXSTRICTACCESS(exp)))
5526 		nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp,
5527 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5528 		    NULL);
5529 	if (nd->nd_repstat == 0 && gotproxystateid == 0)
5530 		nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
5531 		    &stateid, exp, nd, curthread);
5532 
5533 	if (nd->nd_repstat == 0)
5534 		nd->nd_repstat = nfsvno_deallocate(vp, off, len, nd->nd_cred,
5535 		    curthread);
5536 	vput(vp);
5537 	NFSD_DEBUG(4, "eo deallocate=%d\n", nd->nd_repstat);
5538 	NFSEXITCODE2(0, nd);
5539 	return (0);
5540 nfsmout:
5541 	vput(vp);
5542 	NFSEXITCODE2(error, nd);
5543 	return (error);
5544 }
5545 
5546 /*
5547  * nfs copy service
5548  */
5549 int
5550 nfsrvd_copy_file_range(struct nfsrv_descript *nd, __unused int isdgram,
5551     vnode_t vp, vnode_t tovp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
5552 {
5553 	uint32_t *tl;
5554 	struct nfsvattr at;
5555 	int cnt, error = 0, ret;
5556 	off_t inoff, outoff;
5557 	uint64_t len;
5558 	size_t xfer;
5559 	struct nfsstate inst, outst, *instp = &inst, *outstp = &outst;
5560 	struct nfslock inlo, outlo, *inlop = &inlo, *outlop = &outlo;
5561 	nfsquad_t clientid;
5562 	nfsv4stateid_t stateid;
5563 	nfsattrbit_t attrbits;
5564 	void *rl_rcookie, *rl_wcookie;
5565 
5566 	rl_rcookie = rl_wcookie = NULL;
5567 	if (nfsrv_devidcnt > 0) {
5568 		/*
5569 		 * For a pNFS server, reply NFSERR_NOTSUPP so that the client
5570 		 * will do the copy via I/O on the DS(s).
5571 		 */
5572 		nd->nd_repstat = NFSERR_NOTSUPP;
5573 		goto nfsmout;
5574 	}
5575 	if (vp == tovp) {
5576 		/* Copying a byte range within the same file is not allowed. */
5577 		nd->nd_repstat = NFSERR_INVAL;
5578 		goto nfsmout;
5579 	}
5580 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_STATEID + 3 * NFSX_HYPER +
5581 	    3 * NFSX_UNSIGNED);
5582 	instp->ls_flags = (NFSLCK_CHECK | NFSLCK_READACCESS);
5583 	inlop->lo_flags = NFSLCK_READ;
5584 	instp->ls_ownerlen = 0;
5585 	instp->ls_op = NULL;
5586 	instp->ls_uid = nd->nd_cred->cr_uid;
5587 	instp->ls_stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5588 	clientid.lval[0] = instp->ls_stateid.other[0] = *tl++;
5589 	clientid.lval[1] = instp->ls_stateid.other[1] = *tl++;
5590 	if ((nd->nd_flag & ND_IMPLIEDCLID) != 0)
5591 		clientid.qval = nd->nd_clientid.qval;
5592 	instp->ls_stateid.other[2] = *tl++;
5593 	outstp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5594 	outlop->lo_flags = NFSLCK_WRITE;
5595 	outstp->ls_ownerlen = 0;
5596 	outstp->ls_op = NULL;
5597 	outstp->ls_uid = nd->nd_cred->cr_uid;
5598 	outstp->ls_stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5599 	outstp->ls_stateid.other[0] = *tl++;
5600 	outstp->ls_stateid.other[1] = *tl++;
5601 	outstp->ls_stateid.other[2] = *tl++;
5602 	inoff = fxdr_hyper(tl); tl += 2;
5603 	inlop->lo_first = inoff;
5604 	outoff = fxdr_hyper(tl); tl += 2;
5605 	outlop->lo_first = outoff;
5606 	len = fxdr_hyper(tl); tl += 2;
5607 	if (len == 0) {
5608 		/* len == 0 means to EOF. */
5609 		inlop->lo_end = OFF_MAX;
5610 		outlop->lo_end = OFF_MAX;
5611 	} else {
5612 		inlop->lo_end = inlop->lo_first + len;
5613 		outlop->lo_end = outlop->lo_first + len;
5614 	}
5615 
5616 	/*
5617 	 * At this time only consecutive, synchronous copy is supported,
5618 	 * so ca_consecutive and ca_synchronous can be ignored.
5619 	 */
5620 	tl += 2;
5621 
5622 	cnt = fxdr_unsigned(int, *tl);
5623 	if ((nd->nd_flag & ND_DSSERVER) != 0 || cnt != 0)
5624 		nd->nd_repstat = NFSERR_NOTSUPP;
5625 	if (nd->nd_repstat == 0 && (inoff > OFF_MAX || outoff > OFF_MAX ||
5626 	    inlop->lo_end > OFF_MAX || outlop->lo_end > OFF_MAX ||
5627 	    inlop->lo_end < inlop->lo_first || outlop->lo_end <
5628 	    outlop->lo_first))
5629 		nd->nd_repstat = NFSERR_INVAL;
5630 
5631 	if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5632 		nd->nd_repstat = NFSERR_WRONGTYPE;
5633 
5634 	/* Check permissions for the input file. */
5635 	NFSZERO_ATTRBIT(&attrbits);
5636 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5637 	ret = nfsvno_getattr(vp, &at, nd, curthread, 1, &attrbits);
5638 	if (nd->nd_repstat == 0)
5639 		nd->nd_repstat = ret;
5640 	if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5641 	     NFSVNO_EXSTRICTACCESS(exp)))
5642 		nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred, exp,
5643 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5644 		    NULL);
5645 	if (nd->nd_repstat == 0)
5646 		nd->nd_repstat = nfsrv_lockctrl(vp, &instp, &inlop, NULL,
5647 		    clientid, &stateid, exp, nd, curthread);
5648 	NFSVOPUNLOCK(vp);
5649 	if (nd->nd_repstat != 0)
5650 		goto out;
5651 
5652 	error = NFSVOPLOCK(tovp, LK_SHARED);
5653 	if (error != 0)
5654 		goto out;
5655 	if (vnode_vtype(tovp) != VREG)
5656 		nd->nd_repstat = NFSERR_WRONGTYPE;
5657 
5658 	/* For the output file, we only need the Owner attribute. */
5659 	ret = nfsvno_getattr(tovp, &at, nd, curthread, 1, &attrbits);
5660 	if (nd->nd_repstat == 0)
5661 		nd->nd_repstat = ret;
5662 	if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5663 	     NFSVNO_EXSTRICTACCESS(exp)))
5664 		nd->nd_repstat = nfsvno_accchk(tovp, VWRITE, nd->nd_cred, toexp,
5665 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5666 		    NULL);
5667 	if (nd->nd_repstat == 0)
5668 		nd->nd_repstat = nfsrv_lockctrl(tovp, &outstp, &outlop, NULL,
5669 		    clientid, &stateid, toexp, nd, curthread);
5670 	NFSVOPUNLOCK(tovp);
5671 
5672 	/* Range lock the byte ranges for both invp and outvp. */
5673 	if (nd->nd_repstat == 0) {
5674 		for (;;) {
5675 			if (len == 0) {
5676 				rl_wcookie = vn_rangelock_wlock(tovp, outoff,
5677 				    OFF_MAX);
5678 				rl_rcookie = vn_rangelock_tryrlock(vp, inoff,
5679 				    OFF_MAX);
5680 			} else {
5681 				rl_wcookie = vn_rangelock_wlock(tovp, outoff,
5682 				    outoff + len);
5683 				rl_rcookie = vn_rangelock_tryrlock(vp, inoff,
5684 				    inoff + len);
5685 			}
5686 			if (rl_rcookie != NULL)
5687 				break;
5688 			vn_rangelock_unlock(tovp, rl_wcookie);
5689 			if (len == 0)
5690 				rl_rcookie = vn_rangelock_rlock(vp, inoff,
5691 				    OFF_MAX);
5692 			else
5693 				rl_rcookie = vn_rangelock_rlock(vp, inoff,
5694 				    inoff + len);
5695 			vn_rangelock_unlock(vp, rl_rcookie);
5696 		}
5697 
5698 		error = NFSVOPLOCK(vp, LK_SHARED);
5699 		if (error == 0) {
5700 			ret = nfsvno_getattr(vp, &at, nd, curthread, 1, NULL);
5701 			if (ret == 0) {
5702 				/*
5703 				 * Since invp is range locked, na_size should
5704 				 * not change.
5705 				 */
5706 				if (len == 0 && at.na_size > inoff) {
5707 					/*
5708 					 * If len == 0, set it based on invp's
5709 					 * size. If offset is past EOF, just
5710 					 * leave len == 0.
5711 					 */
5712 					len = at.na_size - inoff;
5713 				} else if (nfsrv_linux42server == 0 &&
5714 				    inoff + len > at.na_size) {
5715 					/*
5716 					 * RFC-7862 says that NFSERR_INVAL must
5717 					 * be returned when inoff + len exceeds
5718 					 * the file size, however the NFSv4.2
5719 					 * Linux client likes to do this, so
5720 					 * only check if nfsrv_linux42server
5721 					 * is not set.
5722 					 */
5723 					nd->nd_repstat = NFSERR_INVAL;
5724 				}
5725 			}
5726 			NFSVOPUNLOCK(vp);
5727 			if (ret != 0 && nd->nd_repstat == 0)
5728 				nd->nd_repstat = ret;
5729 		} else if (nd->nd_repstat == 0)
5730 			nd->nd_repstat = error;
5731 	}
5732 
5733 	xfer = len;
5734 	if (nd->nd_repstat == 0) {
5735 		nd->nd_repstat = vn_copy_file_range(vp, &inoff, tovp, &outoff,
5736 		    &xfer, COPY_FILE_RANGE_TIMEO1SEC, nd->nd_cred, nd->nd_cred,
5737 		    NULL);
5738 		if (nd->nd_repstat == 0)
5739 			len = xfer;
5740 	}
5741 
5742 	/* Unlock the ranges. */
5743 	if (rl_rcookie != NULL)
5744 		vn_rangelock_unlock(vp, rl_rcookie);
5745 	if (rl_wcookie != NULL)
5746 		vn_rangelock_unlock(tovp, rl_wcookie);
5747 
5748 	if (nd->nd_repstat == 0) {
5749 		NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + NFSX_HYPER +
5750 		    NFSX_VERF);
5751 		*tl++ = txdr_unsigned(0);	/* No callback ids. */
5752 		txdr_hyper(len, tl); tl += 2;
5753 		*tl++ = txdr_unsigned(NFSWRITE_UNSTABLE);
5754 		*tl++ = txdr_unsigned(nfsboottime.tv_sec);
5755 		*tl++ = txdr_unsigned(nfsboottime.tv_usec);
5756 		*tl++ = newnfs_true;
5757 		*tl = newnfs_true;
5758 	}
5759 out:
5760 	vrele(vp);
5761 	vrele(tovp);
5762 	NFSEXITCODE2(error, nd);
5763 	return (error);
5764 nfsmout:
5765 	vput(vp);
5766 	vrele(tovp);
5767 	NFSEXITCODE2(error, nd);
5768 	return (error);
5769 }
5770 
5771 /*
5772  * nfs seek service
5773  */
5774 int
5775 nfsrvd_seek(struct nfsrv_descript *nd, __unused int isdgram,
5776     vnode_t vp, struct nfsexstuff *exp)
5777 {
5778 	uint32_t *tl;
5779 	struct nfsvattr at;
5780 	int content, error = 0;
5781 	off_t off;
5782 	u_long cmd;
5783 	nfsattrbit_t attrbits;
5784 	bool eof;
5785 
5786 	NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + NFSX_HYPER + NFSX_UNSIGNED);
5787 	/* Ignore the stateid for now. */
5788 	tl += (NFSX_STATEID / NFSX_UNSIGNED);
5789 	off = fxdr_hyper(tl); tl += 2;
5790 	content = fxdr_unsigned(int, *tl);
5791 	if (content == NFSV4CONTENT_DATA)
5792 		cmd = FIOSEEKDATA;
5793 	else if (content == NFSV4CONTENT_HOLE)
5794 		cmd = FIOSEEKHOLE;
5795 	else
5796 		nd->nd_repstat = NFSERR_BADXDR;
5797 	if (nd->nd_repstat == 0 && vnode_vtype(vp) == VDIR)
5798 		nd->nd_repstat = NFSERR_ISDIR;
5799 	if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5800 		nd->nd_repstat = NFSERR_WRONGTYPE;
5801 	if (nd->nd_repstat == 0 && off < 0)
5802 		nd->nd_repstat = NFSERR_NXIO;
5803 	if (nd->nd_repstat == 0) {
5804 		/* Check permissions for the input file. */
5805 		NFSZERO_ATTRBIT(&attrbits);
5806 		NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5807 		nd->nd_repstat = nfsvno_getattr(vp, &at, nd, curthread, 1,
5808 		    &attrbits);
5809 	}
5810 	if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5811 	     NFSVNO_EXSTRICTACCESS(exp)))
5812 		nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred, exp,
5813 		    curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5814 		    NULL);
5815 	if (nd->nd_repstat != 0)
5816 		goto nfsmout;
5817 
5818 	/* nfsvno_seek() unlocks and vrele()s the vp. */
5819 	nd->nd_repstat = nfsvno_seek(nd, vp, cmd, &off, content, &eof,
5820 	    nd->nd_cred, curthread);
5821 	if (nd->nd_repstat == 0 && eof && content == NFSV4CONTENT_DATA &&
5822 	    nfsrv_linux42server != 0)
5823 		nd->nd_repstat = NFSERR_NXIO;
5824 	if (nd->nd_repstat == 0) {
5825 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED + NFSX_HYPER);
5826 		if (eof)
5827 			*tl++ = newnfs_true;
5828 		else
5829 			*tl++ = newnfs_false;
5830 		txdr_hyper(off, tl);
5831 	}
5832 	NFSEXITCODE2(error, nd);
5833 	return (error);
5834 nfsmout:
5835 	vput(vp);
5836 	NFSEXITCODE2(error, nd);
5837 	return (error);
5838 }
5839 
5840 /*
5841  * nfs get extended attribute service
5842  */
5843 int
5844 nfsrvd_getxattr(struct nfsrv_descript *nd, __unused int isdgram,
5845     vnode_t vp, __unused struct nfsexstuff *exp)
5846 {
5847 	uint32_t *tl;
5848 	struct mbuf *mp = NULL, *mpend = NULL;
5849 	int error, len;
5850 	char *name;
5851 	struct thread *p = curthread;
5852 	uint16_t off;
5853 
5854 	error = 0;
5855 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5856 	len = fxdr_unsigned(int, *tl);
5857 	if (len <= 0) {
5858 		nd->nd_repstat = NFSERR_BADXDR;
5859 		goto nfsmout;
5860 	}
5861 	if (len > EXTATTR_MAXNAMELEN) {
5862 		nd->nd_repstat = NFSERR_NOXATTR;
5863 		goto nfsmout;
5864 	}
5865 	name = malloc(len + 1, M_TEMP, M_WAITOK);
5866 	nd->nd_repstat = nfsrv_mtostr(nd, name, len);
5867 	if (nd->nd_repstat == 0)
5868 		nd->nd_repstat = nfsvno_getxattr(vp, name,
5869 		    nd->nd_maxresp, nd->nd_cred, nd->nd_flag,
5870 		    nd->nd_maxextsiz, p, &mp, &mpend, &len);
5871 	if (nd->nd_repstat == ENOATTR)
5872 		nd->nd_repstat = NFSERR_NOXATTR;
5873 	else if (nd->nd_repstat == EOPNOTSUPP)
5874 		nd->nd_repstat = NFSERR_NOTSUPP;
5875 	if (nd->nd_repstat == 0) {
5876 		NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5877 		*tl = txdr_unsigned(len);
5878 		if (len > 0) {
5879 			nd->nd_mb->m_next = mp;
5880 			nd->nd_mb = mpend;
5881 			if ((mpend->m_flags & M_EXTPG) != 0) {
5882 				nd->nd_flag |= ND_EXTPG;
5883 				nd->nd_bextpg = mpend->m_epg_npgs - 1;
5884 				nd->nd_bpos = (char *)(void *)
5885 				   PHYS_TO_DMAP(mpend->m_epg_pa[nd->nd_bextpg]);
5886 				off = (nd->nd_bextpg == 0) ?
5887 				    mpend->m_epg_1st_off : 0;
5888 				nd->nd_bpos += off + mpend->m_epg_last_len;
5889 				nd->nd_bextpgsiz = PAGE_SIZE -
5890 				    mpend->m_epg_last_len - off;
5891 			} else
5892 				nd->nd_bpos = mtod(mpend, char *) +
5893 				    mpend->m_len;
5894 		}
5895 	}
5896 	free(name, M_TEMP);
5897 
5898 nfsmout:
5899 	if (nd->nd_repstat == 0)
5900 		nd->nd_repstat = error;
5901 	vput(vp);
5902 	NFSEXITCODE2(0, nd);
5903 	return (0);
5904 }
5905 
5906 /*
5907  * nfs set extended attribute service
5908  */
5909 int
5910 nfsrvd_setxattr(struct nfsrv_descript *nd, __unused int isdgram,
5911     vnode_t vp, __unused struct nfsexstuff *exp)
5912 {
5913 	uint32_t *tl;
5914 	struct nfsvattr ova, nva;
5915 	nfsattrbit_t attrbits;
5916 	int error, len, opt;
5917 	char *name;
5918 	size_t siz;
5919 	struct thread *p = curthread;
5920 
5921 	error = 0;
5922 	name = NULL;
5923 	NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
5924 	opt = fxdr_unsigned(int, *tl++);
5925 	len = fxdr_unsigned(int, *tl);
5926 	if (len <= 0) {
5927 		nd->nd_repstat = NFSERR_BADXDR;
5928 		goto nfsmout;
5929 	}
5930 	if (len > EXTATTR_MAXNAMELEN) {
5931 		nd->nd_repstat = NFSERR_NOXATTR;
5932 		goto nfsmout;
5933 	}
5934 	name = malloc(len + 1, M_TEMP, M_WAITOK);
5935 	error = nfsrv_mtostr(nd, name, len);
5936 	if (error != 0)
5937 		goto nfsmout;
5938 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5939 	len = fxdr_unsigned(int, *tl);
5940 	if (len < 0 || len > IOSIZE_MAX) {
5941 		nd->nd_repstat = NFSERR_XATTR2BIG;
5942 		goto nfsmout;
5943 	}
5944 	switch (opt) {
5945 	case NFSV4SXATTR_CREATE:
5946 		error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
5947 		    &siz, nd->nd_cred, p);
5948 		if (error != ENOATTR)
5949 			nd->nd_repstat = NFSERR_EXIST;
5950 		error = 0;
5951 		break;
5952 	case NFSV4SXATTR_REPLACE:
5953 		error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
5954 		    &siz, nd->nd_cred, p);
5955 		if (error != 0)
5956 			nd->nd_repstat = NFSERR_NOXATTR;
5957 		break;
5958 	case NFSV4SXATTR_EITHER:
5959 		break;
5960 	default:
5961 		nd->nd_repstat = NFSERR_BADXDR;
5962 	}
5963 	if (nd->nd_repstat != 0)
5964 		goto nfsmout;
5965 
5966 	/* Now, do the Set Extended attribute, with Change before and after. */
5967 	NFSZERO_ATTRBIT(&attrbits);
5968 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
5969 	nd->nd_repstat = nfsvno_getattr(vp, &ova, nd, p, 1, &attrbits);
5970 	if (nd->nd_repstat == 0) {
5971 		nd->nd_repstat = nfsvno_setxattr(vp, name, len, nd->nd_md,
5972 		    nd->nd_dpos, nd->nd_cred, p);
5973 		if (nd->nd_repstat == ENXIO)
5974 			nd->nd_repstat = NFSERR_XATTR2BIG;
5975 	}
5976 	if (nd->nd_repstat == 0 && len > 0)
5977 		nd->nd_repstat = nfsm_advance(nd, NFSM_RNDUP(len), -1);
5978 	if (nd->nd_repstat == 0)
5979 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
5980 	if (nd->nd_repstat == 0) {
5981 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_UNSIGNED);
5982 		*tl++ = newnfs_true;
5983 		txdr_hyper(ova.na_filerev, tl); tl += 2;
5984 		txdr_hyper(nva.na_filerev, tl);
5985 	}
5986 
5987 nfsmout:
5988 	free(name, M_TEMP);
5989 	if (nd->nd_repstat == 0)
5990 		nd->nd_repstat = error;
5991 	vput(vp);
5992 	NFSEXITCODE2(0, nd);
5993 	return (0);
5994 }
5995 
5996 /*
5997  * nfs remove extended attribute service
5998  */
5999 int
6000 nfsrvd_rmxattr(struct nfsrv_descript *nd, __unused int isdgram,
6001     vnode_t vp, __unused struct nfsexstuff *exp)
6002 {
6003 	uint32_t *tl;
6004 	struct nfsvattr ova, nva;
6005 	nfsattrbit_t attrbits;
6006 	int error, len;
6007 	char *name;
6008 	struct thread *p = curthread;
6009 
6010 	error = 0;
6011 	name = NULL;
6012 	NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
6013 	len = fxdr_unsigned(int, *tl);
6014 	if (len <= 0) {
6015 		nd->nd_repstat = NFSERR_BADXDR;
6016 		goto nfsmout;
6017 	}
6018 	if (len > EXTATTR_MAXNAMELEN) {
6019 		nd->nd_repstat = NFSERR_NOXATTR;
6020 		goto nfsmout;
6021 	}
6022 	name = malloc(len + 1, M_TEMP, M_WAITOK);
6023 	error = nfsrv_mtostr(nd, name, len);
6024 	if (error != 0)
6025 		goto nfsmout;
6026 
6027 	if ((nd->nd_flag & ND_IMPLIEDCLID) == 0) {
6028 		printf("EEK! nfsrvd_rmxattr: no implied clientid\n");
6029 		error = NFSERR_NOXATTR;
6030 		goto nfsmout;
6031 	}
6032 	/*
6033 	 * Now, do the Remove Extended attribute, with Change before and
6034 	 * after.
6035 	*/
6036 	NFSZERO_ATTRBIT(&attrbits);
6037 	NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
6038 	nd->nd_repstat = nfsvno_getattr(vp, &ova, nd, p, 1, &attrbits);
6039 	if (nd->nd_repstat == 0) {
6040 		nd->nd_repstat = nfsvno_rmxattr(nd, vp, name, nd->nd_cred, p);
6041 		if (nd->nd_repstat == ENOATTR)
6042 			nd->nd_repstat = NFSERR_NOXATTR;
6043 	}
6044 	if (nd->nd_repstat == 0)
6045 		nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
6046 	if (nd->nd_repstat == 0) {
6047 		NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_UNSIGNED);
6048 		*tl++ = newnfs_true;
6049 		txdr_hyper(ova.na_filerev, tl); tl += 2;
6050 		txdr_hyper(nva.na_filerev, tl);
6051 	}
6052 
6053 nfsmout:
6054 	free(name, M_TEMP);
6055 	if (nd->nd_repstat == 0)
6056 		nd->nd_repstat = error;
6057 	vput(vp);
6058 	NFSEXITCODE2(0, nd);
6059 	return (0);
6060 }
6061 
6062 /*
6063  * nfs list extended attribute service
6064  */
6065 int
6066 nfsrvd_listxattr(struct nfsrv_descript *nd, __unused int isdgram,
6067     vnode_t vp, __unused struct nfsexstuff *exp)
6068 {
6069 	uint32_t cnt, *tl, len, len2, i, pos, retlen;
6070 	int error;
6071 	uint64_t cookie, cookie2;
6072 	u_char *buf;
6073 	bool eof;
6074 	struct thread *p = curthread;
6075 
6076 	error = 0;
6077 	buf = NULL;
6078 	NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
6079 	/*
6080 	 * The cookie doesn't need to be in net byte order, but FreeBSD
6081 	 * does so to make it more readable in packet traces.
6082 	 */
6083 	cookie = fxdr_hyper(tl); tl += 2;
6084 	len = fxdr_unsigned(uint32_t, *tl);
6085 	if (len == 0 || cookie >= IOSIZE_MAX) {
6086 		nd->nd_repstat = NFSERR_BADXDR;
6087 		goto nfsmout;
6088 	}
6089 	if (len > nd->nd_maxresp - NFS_MAXXDR)
6090 		len = nd->nd_maxresp - NFS_MAXXDR;
6091 	len2 = len;
6092 	nd->nd_repstat = nfsvno_listxattr(vp, cookie, nd->nd_cred, p, &buf,
6093 	    &len, &eof);
6094 	if (nd->nd_repstat == EOPNOTSUPP)
6095 		nd->nd_repstat = NFSERR_NOTSUPP;
6096 	if (nd->nd_repstat == 0) {
6097 		cookie2 = cookie + len;
6098 		if (cookie2 < cookie)
6099 			nd->nd_repstat = NFSERR_BADXDR;
6100 	}
6101 	retlen = NFSX_HYPER + 2 * NFSX_UNSIGNED;
6102 	if (nd->nd_repstat == 0 && len2 < retlen)
6103 		nd->nd_repstat = NFSERR_TOOSMALL;
6104 	if (nd->nd_repstat == 0) {
6105 		/* Now copy the entries out. */
6106 		if (len == 0) {
6107 			/* The cookie was at eof. */
6108 			NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + 2 *
6109 			    NFSX_UNSIGNED);
6110 			txdr_hyper(cookie2, tl); tl += 2;
6111 			*tl++ = txdr_unsigned(0);
6112 			*tl = newnfs_true;
6113 			goto nfsmout;
6114 		}
6115 
6116 		/* Sanity check the cookie. */
6117 		for (pos = 0; pos < len; pos += (i + 1)) {
6118 			if (pos == cookie)
6119 				break;
6120 			i = buf[pos];
6121 		}
6122 		if (pos != cookie) {
6123 			nd->nd_repstat = NFSERR_INVAL;
6124 			goto nfsmout;
6125 		}
6126 
6127 		/* Loop around copying the entrie(s) out. */
6128 		cnt = 0;
6129 		len -= cookie;
6130 		i = buf[pos];
6131 		while (i < len && len2 >= retlen + NFSM_RNDUP(i) +
6132 		    NFSX_UNSIGNED) {
6133 			if (cnt == 0) {
6134 				NFSM_BUILD(tl, uint32_t *, NFSX_HYPER +
6135 				    NFSX_UNSIGNED);
6136 				txdr_hyper(cookie2, tl); tl += 2;
6137 			}
6138 			retlen += nfsm_strtom(nd, &buf[pos + 1], i);
6139 			len -= (i + 1);
6140 			pos += (i + 1);
6141 			i = buf[pos];
6142 			cnt++;
6143 		}
6144 		/*
6145 		 * eof is set true/false by nfsvno_listxattr(), but if we
6146 		 * can't copy all entries returned by nfsvno_listxattr(),
6147 		 * we are not at eof.
6148 		 */
6149 		if (len > 0)
6150 			eof = false;
6151 		if (cnt > 0) {
6152 			/* *tl is set above. */
6153 			*tl = txdr_unsigned(cnt);
6154 			NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
6155 			if (eof)
6156 				*tl = newnfs_true;
6157 			else
6158 				*tl = newnfs_false;
6159 		} else
6160 			nd->nd_repstat = NFSERR_TOOSMALL;
6161 	}
6162 
6163 nfsmout:
6164 	free(buf, M_TEMP);
6165 	if (nd->nd_repstat == 0)
6166 		nd->nd_repstat = error;
6167 	vput(vp);
6168 	NFSEXITCODE2(0, nd);
6169 	return (0);
6170 }
6171 
6172 /*
6173  * nfsv4 service not supported
6174  */
6175 int
6176 nfsrvd_notsupp(struct nfsrv_descript *nd, __unused int isdgram,
6177     __unused vnode_t vp, __unused struct nfsexstuff *exp)
6178 {
6179 
6180 	nd->nd_repstat = NFSERR_NOTSUPP;
6181 	NFSEXITCODE2(0, nd);
6182 	return (0);
6183 }
6184